1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/zucchini/rel32_finder.h"
#include <algorithm>
namespace zucchini {
/******** Abs32GapFinder ********/
Abs32GapFinder::Abs32GapFinder(ConstBufferView image,
ConstBufferView region,
const std::vector<offset_t>& abs32_locations,
size_t abs32_width)
: base_(image.begin()),
region_end_(region.end()),
abs32_end_(abs32_locations.end()),
abs32_width_(abs32_width) {
DCHECK_GT(abs32_width, size_t(0));
DCHECK_GE(region.begin(), image.begin());
DCHECK_LE(region.end(), image.end());
const offset_t begin_offset = region.begin() - image.begin();
// Find the first |abs32_current_| with |*abs32_current_ >= begin_offset|.
abs32_current_ = std::lower_bound(abs32_locations.begin(),
abs32_locations.end(), begin_offset);
// Find lower boundary, accounting for possibility that |abs32_current_[-1]|
// may straddle across |region.begin()|.
current_lo_ = region.begin();
if (abs32_current_ > abs32_locations.begin()) {
current_lo_ = std::max(current_lo_,
image.begin() + abs32_current_[-1] + abs32_width_);
}
}
Abs32GapFinder::~Abs32GapFinder() = default;
base::Optional<ConstBufferView> Abs32GapFinder::GetNext() {
// Iterate over |[abs32_current_, abs32_end_)| and emit segments.
while (abs32_current_ != abs32_end_ &&
base_ + *abs32_current_ < region_end_) {
ConstBufferView::const_iterator hi = base_ + *abs32_current_;
ConstBufferView gap = ConstBufferView::FromRange(current_lo_, hi);
current_lo_ = hi + abs32_width_;
++abs32_current_;
if (!gap.empty())
return gap;
}
// Emit final segment.
if (current_lo_ < region_end_) {
ConstBufferView gap = ConstBufferView::FromRange(current_lo_, region_end_);
current_lo_ = region_end_;
return gap;
}
return base::nullopt;
}
/******** Rel32Finder ********/
Rel32Finder::Rel32Finder() = default;
Rel32Finder::Rel32Finder(ConstBufferView region)
: region_(region), next_cursor_(region_.begin()) {}
Rel32Finder::~Rel32Finder() = default;
/******** Rel32FinderX86 ********/
ConstBufferView Rel32FinderX86::Scan(ConstBufferView region) {
ConstBufferView::const_iterator cursor = region.begin();
while (cursor < region.end()) {
// Heuristic rel32 detection by looking for opcodes that use them.
if (cursor + 5 <= region.end()) {
if (cursor[0] == 0xE8 || cursor[0] == 0xE9) { // JMP rel32; CALL rel32
rel32_ = {cursor + 1, false};
return ConstBufferView::FromRange(cursor, rel32_.location + 4);
}
}
if (cursor + 6 <= region.end()) {
if (cursor[0] == 0x0F && (cursor[1] & 0xF0) == 0x80) { // Jcc long form
rel32_ = {cursor + 2, false};
return ConstBufferView::FromRange(cursor, rel32_.location + 4);
}
}
++cursor;
}
return {region.end(), 0};
}
/******** Rel32FinderX64 ********/
ConstBufferView Rel32FinderX64::Scan(ConstBufferView region) {
ConstBufferView::const_iterator cursor = region.begin();
while (cursor < region.end()) {
// Heuristic rel32 detection by looking for opcodes that use them.
if (cursor + 5 <= region.end()) {
if (cursor[0] == 0xE8 || cursor[0] == 0xE9) { // JMP rel32; CALL rel32
rel32_ = {cursor + 1, false};
return ConstBufferView::FromRange(cursor, rel32_.location + 4);
}
}
if (cursor + 6 <= region.end()) {
if (cursor[0] == 0x0F && (cursor[1] & 0xF0) == 0x80) { // Jcc long form
rel32_ = {cursor + 2, false};
return ConstBufferView::FromRange(cursor, rel32_.location + 4);
} else if ((cursor[0] == 0xFF &&
(cursor[1] == 0x15 || cursor[1] == 0x25)) ||
((cursor[0] == 0x89 || cursor[0] == 0x8B ||
cursor[0] == 0x8D) &&
(cursor[1] & 0xC7) == 0x05)) {
// 6-byte instructions:
// [2-byte opcode] [disp32]:
// Opcode
// FF 15: CALL QWORD PTR [rip+disp32]
// FF 25: JMP QWORD PTR [rip+disp32]
//
// [1-byte opcode] [ModR/M] [disp32]:
// Opcode
// 89: MOV DWORD PTR [rip+disp32],reg
// 8B: MOV reg,DWORD PTR [rip+disp32]
// 8D: LEA reg,[rip+disp32]
// ModR/M : MMRRRMMM
// MM = 00 & MMM = 101 => rip+disp32
// RRR: selects reg operand from [eax|ecx|...|edi]
rel32_ = {cursor + 2, true};
return ConstBufferView::FromRange(cursor, rel32_.location + 4);
}
}
++cursor;
}
return {region.end(), 0};
}
} // namespace zucchini
|
