From 492aac484b5c65e5df21a7d1b1cf781063efef50 Mon Sep 17 00:00:00 2001 From: Matthew Wozniak Date: Sun, 3 Nov 2024 00:20:45 -0400 Subject: purge CR from this project --- hook.c | 216 ++++++++++++++++++++++++++++++++--------------------------------- 1 file changed, 108 insertions(+), 108 deletions(-) (limited to 'hook.c') diff --git a/hook.c b/hook.c index fe8c555..f42e1d0 100644 --- a/hook.c +++ b/hook.c @@ -1,108 +1,108 @@ -// SPDX-License-Identifier: ISC -// SPDX-FileCopyrightText: 2024 Michael Smith -// SPDX-FileCopyrightText: 2022 Willian Henrique -// SPDX-FileCopyrightText: 2024 Matthew Wozniak - -#include - -#include "3p/sst/x86.h" - -#include "intdef.h" -#include "log.h" -#include "os.h" - -#ifdef _WIN32 -// try to avoid pulling in all of Windows.h for this... (redundant dllimport -// avoids warnings in hook.test.c where Windows.h is included via test.h) -__declspec(dllimport) int __stdcall FlushInstructionCache( - void *, const void *, usize); -#endif - -// Warning: half-arsed hacky implementation (because that's all we really need) -// Almost certainly breaks in some weird cases. Oh well! Most of the time, -// vtable hooking is more reliable, this is only for, uh, emergencies. - -__attribute__((aligned(4096))) static uchar trampolines[4096]; -static uchar *nexttrampoline = trampolines; - -bool hook_init(void) { - return os_mprot(trampolines, sizeof(trampolines), PAGE_EXECUTE_READWRITE); -} - -static inline void iflush(void *p, int len) { -#if defined(_WIN32) - // -1 is the current process, and it's a constant in the WDK, so it's - // assumed we can safely avoid the useless GetCurrentProcess call - FlushInstructionCache((void *)-1, p, len); -#elif defined(__GNUC__) - __builtin___clear_cache((char *)p, (char *)p + len); -#else - warn("no way to clear instruction cache!"); -#endif -} - -void *hook_inline(void *func_, void *target) { - uchar *func = func_; - // dumb hack: if we hit some thunk that immediately jumps elsewhere (which - // seems common for win32 API functions), hook the underlying thing instead. - while (*func == X86_JMPIW) func += *(i32 *)(func + 1) + 5; - if (!os_mprot(func, 5, PAGE_EXECUTE_READWRITE)) return 0; - int len = 0; - for (;;) { - // FIXME: these cases may result in somewhat dodgy error messaging. They - // shouldn't happen anyway though. Maybe if we're confident we just - // compile 'em out of release builds some day, but that sounds a little - // scary. For now preferring confusing messages over crashes, I guess. - if (func[len] == X86_CALL) { - warn("can't trampoline call instructions\n"); - return 0; - } - int ilen = x86_len(func + len); - if (ilen == -1) { - warn("unknown or invalid instruction\n"); - return 0; - } - len += ilen; - if (len >= 5) break; - if (func[len] == X86_JMPIW) { - warn("can't trampoline jmp instructions\n"); - return 0; - } - } - // for simplicity, just bump alloc the trampoline. no need to free anyway - if (nexttrampoline - trampolines > (int)sizeof(trampolines) - len - 6) { - warn("out of trampoline space\n"); - return 0; - } - uchar *trampoline = nexttrampoline; - nexttrampoline += len + 6; // NOT thread-safe. we don't need that anyway! - *trampoline++ = len; // stick length in front for quicker unhooking - memcpy(trampoline, func, len); - trampoline[len] = X86_JMPIW; - u32 diff = func - (trampoline + 5); // goto the continuation - memcpy(trampoline + len + 1, &diff, 4); - diff = (uchar *)target - (func + 5); // goto the hook target - func[0] = X86_JMPIW; - memcpy(func + 1, &diff, 4); - iflush(func, 5); - return trampoline; -} - -void unhook_inline(void *orig) { - uchar *p = orig; - int len = p[-1]; - int off = *(i32 *)(p + len + 1); - uchar *q = p + off + 5; - memcpy(q, p, 5); // XXX: not atomic atm! (does any of it even need to be?) - iflush(q, 5); -} - -void *hook_dllapi(const char *module, const char *name, void *target) { - void *func = os_dlsym(os_dlopen(module), name); - debug("%s = %p", name, func); - if (!func) warn("couldn't find function %s in %s", name, module); - else return hook_inline(func, target); - return NULL; -} - -// vi: sw=4 ts=4 noet tw=80 cc=80 +// SPDX-License-Identifier: ISC +// SPDX-FileCopyrightText: 2024 Michael Smith +// SPDX-FileCopyrightText: 2022 Willian Henrique +// SPDX-FileCopyrightText: 2024 Matthew Wozniak + +#include + +#include "3p/sst/x86.h" + +#include "intdef.h" +#include "log.h" +#include "os.h" + +#ifdef _WIN32 +// try to avoid pulling in all of Windows.h for this... (redundant dllimport +// avoids warnings in hook.test.c where Windows.h is included via test.h) +__declspec(dllimport) int __stdcall FlushInstructionCache( + void *, const void *, usize); +#endif + +// Warning: half-arsed hacky implementation (because that's all we really need) +// Almost certainly breaks in some weird cases. Oh well! Most of the time, +// vtable hooking is more reliable, this is only for, uh, emergencies. + +__attribute__((aligned(4096))) static uchar trampolines[4096]; +static uchar *nexttrampoline = trampolines; + +bool hook_init(void) { + return os_mprot(trampolines, sizeof(trampolines), PAGE_EXECUTE_READWRITE); +} + +static inline void iflush(void *p, int len) { +#if defined(_WIN32) + // -1 is the current process, and it's a constant in the WDK, so it's + // assumed we can safely avoid the useless GetCurrentProcess call + FlushInstructionCache((void *)-1, p, len); +#elif defined(__GNUC__) + __builtin___clear_cache((char *)p, (char *)p + len); +#else + warn("no way to clear instruction cache!"); +#endif +} + +void *hook_inline(void *func_, void *target) { + uchar *func = func_; + // dumb hack: if we hit some thunk that immediately jumps elsewhere (which + // seems common for win32 API functions), hook the underlying thing instead. + while (*func == X86_JMPIW) func += *(i32 *)(func + 1) + 5; + if (!os_mprot(func, 5, PAGE_EXECUTE_READWRITE)) return 0; + int len = 0; + for (;;) { + // FIXME: these cases may result in somewhat dodgy error messaging. They + // shouldn't happen anyway though. Maybe if we're confident we just + // compile 'em out of release builds some day, but that sounds a little + // scary. For now preferring confusing messages over crashes, I guess. + if (func[len] == X86_CALL) { + warn("can't trampoline call instructions\n"); + return 0; + } + int ilen = x86_len(func + len); + if (ilen == -1) { + warn("unknown or invalid instruction\n"); + return 0; + } + len += ilen; + if (len >= 5) break; + if (func[len] == X86_JMPIW) { + warn("can't trampoline jmp instructions\n"); + return 0; + } + } + // for simplicity, just bump alloc the trampoline. no need to free anyway + if (nexttrampoline - trampolines > (int)sizeof(trampolines) - len - 6) { + warn("out of trampoline space\n"); + return 0; + } + uchar *trampoline = nexttrampoline; + nexttrampoline += len + 6; // NOT thread-safe. we don't need that anyway! + *trampoline++ = len; // stick length in front for quicker unhooking + memcpy(trampoline, func, len); + trampoline[len] = X86_JMPIW; + u32 diff = func - (trampoline + 5); // goto the continuation + memcpy(trampoline + len + 1, &diff, 4); + diff = (uchar *)target - (func + 5); // goto the hook target + func[0] = X86_JMPIW; + memcpy(func + 1, &diff, 4); + iflush(func, 5); + return trampoline; +} + +void unhook_inline(void *orig) { + uchar *p = orig; + int len = p[-1]; + int off = *(i32 *)(p + len + 1); + uchar *q = p + off + 5; + memcpy(q, p, 5); // XXX: not atomic atm! (does any of it even need to be?) + iflush(q, 5); +} + +void *hook_dllapi(const char *module, const char *name, void *target) { + void *func = os_dlsym(os_dlopen(module), name); + debug("%s = %p", name, func); + if (!func) warn("couldn't find function %s in %s", name, module); + else return hook_inline(func, target); + return NULL; +} + +// vi: sw=4 ts=4 noet tw=80 cc=80 -- cgit v1.2.3-54-g00ecf