1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
// SPDX-License-Identifier: ISC
// SPDX-FileCopyrightText: 2024 Michael Smith <mikesmiffy128@gmail.com>
// SPDX-FileCopyrightText: 2022 Willian Henrique <wsimanbrazil@yahoo.com.br>
// SPDX-FileCopyrightText: 2024 Matthew Wozniak <me@woz.blue>
#include <string.h>
#include "3p/sst/x86.h"
#include "intdef.h"
#include "log.h"
#include "os.h"
#ifdef _WIN32
// try to avoid pulling in all of Windows.h for this... (redundant dllimport
// avoids warnings in hook.test.c where Windows.h is included via test.h)
__declspec(dllimport) int __stdcall FlushInstructionCache(
void *, const void *, usize);
#endif
// Warning: half-arsed hacky implementation (because that's all we really need)
// Almost certainly breaks in some weird cases. Oh well! Most of the time,
// vtable hooking is more reliable, this is only for, uh, emergencies.
__attribute__((aligned(4096))) static uchar trampolines[4096];
static uchar *nexttrampoline = trampolines;
bool hook_init(void) {
return os_mprot(trampolines, sizeof(trampolines), PAGE_EXECUTE_READWRITE);
}
static inline void iflush(void *p, int len) {
#if defined(_WIN32)
// -1 is the current process, and it's a constant in the WDK, so it's
// assumed we can safely avoid the useless GetCurrentProcess call
FlushInstructionCache((void *)-1, p, len);
#elif defined(__GNUC__)
__builtin___clear_cache((char *)p, (char *)p + len);
#else
warn("no way to clear instruction cache!");
#endif
}
void *hook_inline(void *func_, void *target) {
uchar *func = func_;
// dumb hack: if we hit some thunk that immediately jumps elsewhere (which
// seems common for win32 API functions), hook the underlying thing instead.
while (*func == X86_JMPIW) func += *(i32 *)(func + 1) + 5;
if (!os_mprot(func, 5, PAGE_EXECUTE_READWRITE)) return 0;
int len = 0;
for (;;) {
// FIXME: these cases may result in somewhat dodgy error messaging. They
// shouldn't happen anyway though. Maybe if we're confident we just
// compile 'em out of release builds some day, but that sounds a little
// scary. For now preferring confusing messages over crashes, I guess.
if (func[len] == X86_CALL) {
warn("can't trampoline call instructions\n");
return 0;
}
int ilen = x86_len(func + len);
if (ilen == -1) {
warn("unknown or invalid instruction\n");
return 0;
}
len += ilen;
if (len >= 5) break;
if (func[len] == X86_JMPIW) {
warn("can't trampoline jmp instructions\n");
return 0;
}
}
// for simplicity, just bump alloc the trampoline. no need to free anyway
if (nexttrampoline - trampolines > (int)sizeof(trampolines) - len - 6) {
warn("out of trampoline space\n");
return 0;
}
uchar *trampoline = nexttrampoline;
nexttrampoline += len + 6; // NOT thread-safe. we don't need that anyway!
*trampoline++ = len; // stick length in front for quicker unhooking
memcpy(trampoline, func, len);
trampoline[len] = X86_JMPIW;
u32 diff = func - (trampoline + 5); // goto the continuation
memcpy(trampoline + len + 1, &diff, 4);
diff = (uchar *)target - (func + 5); // goto the hook target
func[0] = X86_JMPIW;
memcpy(func + 1, &diff, 4);
iflush(func, 5);
return trampoline;
}
void unhook_inline(void *orig) {
uchar *p = orig;
int len = p[-1];
int off = *(i32 *)(p + len + 1);
uchar *q = p + off + 5;
memcpy(q, p, 5); // XXX: not atomic atm! (does any of it even need to be?)
iflush(q, 5);
}
void *hook_dllapi(const char *module, const char *name, void *target) {
void *func = os_dlsym(os_dlopen(module), name);
debug("%s = %p", name, func);
if (!func) warn("couldn't find function %s in %s", name, module);
else return hook_inline(func, target);
return NULL;
}
// vi: sw=4 ts=4 noet tw=80 cc=80
|
