courgette/rel32_finder_win32_x86.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "courgette/rel32_finder_win32_x86.h"
   6
   7 namespace courgette {
   8
   9 Rel32FinderWin32X86::Rel32FinderWin32X86(
  10     RVA relocs_start_rva, RVA relocs_end_rva, RVA image_end_rva)
  11     : relocs_start_rva_(relocs_start_rva),
  12       relocs_end_rva_(relocs_end_rva),
  13       image_end_rva_(image_end_rva) {
  14 }
  15
  16 Rel32FinderWin32X86::~Rel32FinderWin32X86() {
  17 }
  18
  19 void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) {
  20   dest->swap(rel32_locations_);
  21 }
  22
  23 #if COURGETTE_HISTOGRAM_TARGETS
  24 void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) {
  25   dest->swap(rel32_target_rvas_);
  26 }
  27 #endif
  28
  29 Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(
  30     RVA relocs_start_rva, RVA relocs_end_rva, RVA image_end_rva)
  31     : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva, image_end_rva) {
  32 }
  33
  34 Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() {
  35 }
  36
  37 void Rel32FinderWin32X86_Basic::Find(
  38     const uint8* start_pointer,
  39     const uint8* end_pointer,
  40     RVA start_rva,
  41     RVA end_rva,
  42     const std::vector<RVA>& abs32_locations) {
  43   // Quick way to convert from Pointer to RVA within a single Section is to
  44   // subtract 'pointer_to_rva'.
  45   const uint8* const adjust_pointer_to_rva = start_pointer - start_rva;
  46
  47   std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
  48
  49   // Find the rel32 relocations.
  50   const uint8* p = start_pointer;
  51   while (p < end_pointer) {
  52     RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
  53     if (current_rva == relocs_start_rva_) {
  54       if (relocs_start_rva_ < relocs_end_rva_) {
  55         p += relocs_end_rva_ - relocs_start_rva_;
  56         continue;
  57       }
  58     }
  59
  60     //while (abs32_pos != abs32_locations.end() && *abs32_pos < current_rva)
  61     //  ++abs32_pos;
  62
  63     // Heuristic discovery of rel32 locations in instruction stream: are the
  64     // next few bytes the start of an instruction containing a rel32
  65     // addressing mode?
  66     const uint8* rel32 = NULL;
  67
  68     if (p + 5 <= end_pointer) {
  69       if (*p == 0xE8 || *p == 0xE9) {  // jmp rel32 and call rel32
  70         rel32 = p + 1;
  71       }
  72     }
  73     if (p + 6 <= end_pointer) {
  74       if (*p == 0x0F  &&  (*(p+1) & 0xF0) == 0x80) {  // Jcc long form
  75         if (p[1] != 0x8A && p[1] != 0x8B)  // JPE/JPO unlikely
  76           rel32 = p + 2;
  77       }
  78     }
  79     if (rel32) {
  80       RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
  81
  82       // Is there an abs32 reloc overlapping the candidate?
  83       while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3)
  84         ++abs32_pos;
  85       // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
  86       // region that could overlap rel32_rva.
  87       if (abs32_pos != abs32_locations.end()) {
  88         if (*abs32_pos < rel32_rva + 4) {
  89           // Beginning of abs32 reloc is before end of rel32 reloc so they
  90           // overlap.  Skip four bytes past the abs32 reloc.
  91           p += (*abs32_pos + 4) - current_rva;
  92           continue;
  93         }
  94       }
  95
  96       RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
  97       // To be valid, rel32 target must be within image, and within this
  98       // section.
  99       if (IsValidRVA(target_rva) &&
 100           start_rva <= target_rva && target_rva < end_rva) {
 101         rel32_locations_.push_back(rel32_rva);
 102 #if COURGETTE_HISTOGRAM_TARGETS
 103         ++rel32_target_rvas_[target_rva];
 104 #endif
 105         p = rel32 + 4;
 106         continue;
 107       }
 108     }
 109     p += 1;
 110   }
 111 }
 112
 113 }  // namespace courgette