courgette/disassembler_elf_32_x86.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "courgette/disassembler_elf_32_x86.h"
   6
   7 #include <algorithm>
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/basictypes.h"
  12 #include "base/logging.h"
  13
  14 #include "courgette/assembly_program.h"
  15 #include "courgette/courgette.h"
  16 #include "courgette/encoded_program.h"
  17
  18 namespace courgette {
  19
  20 DisassemblerElf32X86::DisassemblerElf32X86(const void* start, size_t length)
  21   : DisassemblerElf32(start, length) {
  22 }
  23
  24 // Convert an ELF relocation struction into an RVA
  25 CheckBool DisassemblerElf32X86::RelToRVA(Elf32_Rel rel, RVA* result) const {
  26
  27   // The rightmost byte of r_info is the type...
  28   elf32_rel_386_type_values type =
  29       (elf32_rel_386_type_values)(unsigned char)rel.r_info;
  30
  31   // The other 3 bytes of r_info are the symbol
  32   uint32 symbol =  rel.r_info >> 8;
  33
  34   switch(type)
  35   {
  36     case R_386_NONE:
  37     case R_386_32:
  38     case R_386_PC32:
  39     case R_386_GOT32:
  40     case R_386_PLT32:
  41     case R_386_COPY:
  42     case R_386_GLOB_DAT:
  43     case R_386_JMP_SLOT:
  44       return false;
  45
  46     case R_386_RELATIVE:
  47       if (symbol != 0)
  48         return false;
  49
  50       // This is a basic ABS32 relocation address
  51       *result = rel.r_offset;
  52       return true;
  53
  54     case R_386_GOTOFF:
  55     case R_386_GOTPC:
  56     case R_386_TLS_TPOFF:
  57       return false;
  58   }
  59
  60   return false;
  61 }
  62
  63 CheckBool DisassemblerElf32X86::ParseRelocationSection(
  64     const Elf32_Shdr *section_header,
  65       AssemblyProgram* program) {
  66   // We can reproduce the R_386_RELATIVE entries in one of the relocation
  67   // table based on other information in the patch, given these
  68   // conditions....
  69   //
  70   // All R_386_RELATIVE entries are:
  71   //   1) In the same relocation table
  72   //   2) Are consecutive
  73   //   3) Are sorted in memory address order
  74   //
  75   // Happily, this is normally the case, but it's not required by spec
  76   // so we check, and just don't do it if we don't match up.
  77
  78   // The expectation is that one relocation section will contain
  79   // all of our R_386_RELATIVE entries in the expected order followed
  80   // by assorted other entries we can't use special handling for.
  81
  82   bool match = true;
  83
  84   // Walk all the bytes in the section, matching relocation table or not
  85   size_t file_offset = section_header->sh_offset;
  86   size_t section_end = section_header->sh_offset + section_header->sh_size;
  87
  88   Elf32_Rel *section_relocs_iter =
  89       (Elf32_Rel *)OffsetToPointer(section_header->sh_offset);
  90
  91   uint32 section_relocs_count = section_header->sh_size /
  92                                 section_header->sh_entsize;
  93
  94   if (abs32_locations_.empty())
  95     match = false;
  96
  97   if (abs32_locations_.size() > section_relocs_count)
  98     match = false;
  99
 100   std::vector<RVA>::iterator reloc_iter = abs32_locations_.begin();
 101
 102   while (match && (reloc_iter !=  abs32_locations_.end())) {
 103     if (section_relocs_iter->r_info != R_386_RELATIVE ||
 104         section_relocs_iter->r_offset != *reloc_iter)
 105       match = false;
 106     section_relocs_iter++;
 107     reloc_iter++;
 108   }
 109
 110   if (match) {
 111     // Skip over relocation tables
 112     if (!program->EmitElfRelocationInstruction())
 113       return false;
 114     file_offset += sizeof(Elf32_Rel) * abs32_locations_.size();
 115   }
 116
 117   return ParseSimpleRegion(file_offset, section_end, program);
 118 }
 119
 120 CheckBool DisassemblerElf32X86::ParseRel32RelocsFromSection(
 121     const Elf32_Shdr* section_header) {
 122
 123   uint32 start_file_offset = section_header->sh_offset;
 124   uint32 end_file_offset = start_file_offset + section_header->sh_size;
 125
 126   const uint8* start_pointer = OffsetToPointer(start_file_offset);
 127   const uint8* end_pointer = OffsetToPointer(end_file_offset);
 128
 129   // Quick way to convert from Pointer to RVA within a single Section is to
 130   // subtract 'pointer_to_rva'.
 131   const uint8* const adjust_pointer_to_rva = start_pointer -
 132                                              section_header->sh_addr;
 133
 134   // Find the rel32 relocations.
 135   const uint8* p = start_pointer;
 136   while (p < end_pointer) {
 137     //RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
 138
 139     // Heuristic discovery of rel32 locations in instruction stream: are the
 140     // next few bytes the start of an instruction containing a rel32
 141     // addressing mode?
 142     const uint8* rel32 = NULL;
 143
 144     if (p + 5 <= end_pointer) {
 145       if (*p == 0xE8 || *p == 0xE9) {  // jmp rel32 and call rel32
 146         rel32 = p + 1;
 147       }
 148     }
 149     if (p + 6 <= end_pointer) {
 150       if (*p == 0x0F  &&  (*(p+1) & 0xF0) == 0x80) {  // Jcc long form
 151         if (p[1] != 0x8A && p[1] != 0x8B)  // JPE/JPO unlikely
 152           rel32 = p + 2;
 153       }
 154     }
 155     if (rel32) {
 156       RVA rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
 157       TypedRVAX86* rel32_rva = new TypedRVAX86(rva);
 158
 159       if (!rel32_rva->ComputeRelativeTarget(rel32)) {
 160         return false;
 161       }
 162
 163       RVA target_rva = rel32_rva->rva() + rel32_rva->relative_target();
 164       // To be valid, rel32 target must be within image, and within this
 165       // section.
 166       if (IsValidRVA(target_rva)) {
 167         rel32_locations_.push_back(rel32_rva);
 168 #if COURGETTE_HISTOGRAM_TARGETS
 169         ++rel32_target_rvas_[target_rva];
 170 #endif
 171         p = rel32 + 4;
 172         continue;
 173       } else {
 174         delete rel32_rva;
 175       }
 176     }
 177     p += 1;
 178   }
 179
 180   return true;
 181 }
 182
 183 }  // namespace courgette