[66605] | 1 | /* $Id: SUPR3HardenedMain-posix.cpp 101541 2023-10-22 02:55:27Z vboxsync $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * VirtualBox Support Library - Hardened main(), posix bits.
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | /*
|
---|
[98103] | 7 | * Copyright (C) 2017-2023 Oracle and/or its affiliates.
|
---|
[66605] | 8 | *
|
---|
[96407] | 9 | * This file is part of VirtualBox base platform packages, as
|
---|
| 10 | * available from https://www.virtualbox.org.
|
---|
[66605] | 11 | *
|
---|
[96407] | 12 | * This program is free software; you can redistribute it and/or
|
---|
| 13 | * modify it under the terms of the GNU General Public License
|
---|
| 14 | * as published by the Free Software Foundation, in version 3 of the
|
---|
| 15 | * License.
|
---|
| 16 | *
|
---|
| 17 | * This program is distributed in the hope that it will be useful, but
|
---|
| 18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
| 20 | * General Public License for more details.
|
---|
| 21 | *
|
---|
| 22 | * You should have received a copy of the GNU General Public License
|
---|
| 23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
| 24 | *
|
---|
[66605] | 25 | * The contents of this file may alternatively be used under the terms
|
---|
| 26 | * of the Common Development and Distribution License Version 1.0
|
---|
[96407] | 27 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
---|
| 28 | * in the VirtualBox distribution, in which case the provisions of the
|
---|
[66605] | 29 | * CDDL are applicable instead of those of the GPL.
|
---|
| 30 | *
|
---|
| 31 | * You may elect to license modified versions of this file under the
|
---|
| 32 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
[96407] | 33 | *
|
---|
| 34 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
---|
[66605] | 35 | */
|
---|
| 36 |
|
---|
| 37 |
|
---|
| 38 | /*********************************************************************************************************************************
|
---|
| 39 | * Header Files *
|
---|
| 40 | *********************************************************************************************************************************/
|
---|
| 41 | #include <VBox/err.h>
|
---|
| 42 | #include <VBox/dis.h>
|
---|
| 43 | #include <VBox/sup.h>
|
---|
| 44 |
|
---|
| 45 | #include <iprt/path.h>
|
---|
| 46 | #include <iprt/string.h>
|
---|
| 47 | #include <iprt/x86.h>
|
---|
| 48 |
|
---|
| 49 | #include <dlfcn.h>
|
---|
| 50 | #include <sys/mman.h>
|
---|
[87030] | 51 | #if defined(RT_OS_SOLARIS)
|
---|
[66605] | 52 | # include <link.h>
|
---|
| 53 | #endif
|
---|
| 54 | #include <stdio.h>
|
---|
| 55 | #include <stdint.h>
|
---|
| 56 |
|
---|
| 57 | #include "SUPLibInternal.h"
|
---|
| 58 |
|
---|
| 59 |
|
---|
| 60 | /*********************************************************************************************************************************
|
---|
| 61 | * Defined Constants And Macros *
|
---|
| 62 | *********************************************************************************************************************************/
|
---|
| 63 |
|
---|
| 64 | /**
|
---|
| 65 | * Memory for code patching.
|
---|
| 66 | */
|
---|
| 67 | #define DLOPEN_PATCH_MEMORY_SIZE _4K
|
---|
| 68 |
|
---|
| 69 |
|
---|
| 70 | /*********************************************************************************************************************************
|
---|
| 71 | * Structures and Typedefs *
|
---|
| 72 | *********************************************************************************************************************************/
|
---|
[94439] | 73 | #ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
|
---|
[66605] | 74 | /**
|
---|
| 75 | * Callback (SUPHARDENEDPOSIXHOOK::pfnResolv) for triggering lazy GOT resolver.
|
---|
| 76 | *
|
---|
| 77 | * This generally just calls the API in a harmless manner and triggers the lazy
|
---|
| 78 | * resolving of the symbol, ensuring a proper address in the GOT/PLT entry.
|
---|
| 79 | *
|
---|
| 80 | * On Solaris dlsym() will return the value in the GOT/PLT entry. We don't wish
|
---|
| 81 | * to patch the lazy loader trampoline function, but rather the real function!
|
---|
| 82 | */
|
---|
[85121] | 83 | typedef DECLCALLBACKTYPE(void, FNSUPHARDENEDSYMRESOLVE,(void));
|
---|
[66605] | 84 | /** Pointer to FNSUPHARDENEDSYMRESOLVE. */
|
---|
| 85 | typedef FNSUPHARDENEDSYMRESOLVE *PFNSUPHARDENEDSYMRESOLVE;
|
---|
| 86 |
|
---|
| 87 | /**
|
---|
| 88 | * A hook descriptor.
|
---|
| 89 | */
|
---|
| 90 | typedef struct SUPHARDENEDPOSIXHOOK
|
---|
| 91 | {
|
---|
| 92 | /** The symbol to hook. */
|
---|
| 93 | const char *pszSymbol;
|
---|
| 94 | /** The intercepting wrapper doing additional checks. */
|
---|
| 95 | PFNRT pfnHook;
|
---|
| 96 | /** Where to store the pointer to the code into patch memory
|
---|
[86224] | 97 | * which resumes the original call.
|
---|
| 98 | * @note uintptr_t instead of PFNRT is for Clang 11. */
|
---|
| 99 | uintptr_t *ppfnRealResume;
|
---|
[66605] | 100 | /** Pointer to the resolver method used on Solaris. */
|
---|
| 101 | PFNSUPHARDENEDSYMRESOLVE pfnResolve;
|
---|
| 102 | } SUPHARDENEDPOSIXHOOK;
|
---|
| 103 | /** Pointer to a hook descriptor. */
|
---|
| 104 | typedef SUPHARDENEDPOSIXHOOK *PSUPHARDENEDPOSIXHOOK;
|
---|
| 105 | /** Pointer to a const hook descriptor. */
|
---|
| 106 | typedef const SUPHARDENEDPOSIXHOOK *PCSUPHARDENEDPOSIXHOOK;
|
---|
| 107 |
|
---|
| 108 | /** dlopen() declaration. */
|
---|
| 109 | typedef void *FNDLOPEN(const char *pszFilename, int fFlags);
|
---|
| 110 | /** Pointer to dlopen. */
|
---|
| 111 | typedef FNDLOPEN *PFNDLOPEN;
|
---|
| 112 |
|
---|
| 113 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
| 114 | /** dlmopen() declaration */
|
---|
| 115 | typedef void *FNDLMOPEN(Lmid_t idLm, const char *pszFilename, int fFlags);
|
---|
| 116 | /** Pointer to dlmopen. */
|
---|
| 117 | typedef FNDLMOPEN *PFNDLMOPEN;
|
---|
| 118 | #endif
|
---|
| 119 |
|
---|
[94439] | 120 | #endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
|
---|
[66605] | 121 |
|
---|
[94439] | 122 |
|
---|
[66605] | 123 | /*********************************************************************************************************************************
|
---|
| 124 | * Internal Functions *
|
---|
| 125 | *********************************************************************************************************************************/
|
---|
[94439] | 126 | #ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
|
---|
[66605] | 127 | static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlopenResolve;
|
---|
| 128 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
| 129 | static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlmopenResolve;
|
---|
| 130 | #endif
|
---|
| 131 |
|
---|
| 132 | /* SUPR3HardenedMainA-posix.asm: */
|
---|
| 133 | DECLASM(void) supR3HardenedPosixMonitor_Dlopen(const char *pszFilename, int fFlags);
|
---|
| 134 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
| 135 | DECLASM(void) supR3HardenedPosixMonitor_Dlmopen(Lmid_t idLm, const char *pszFilename, int fFlags);
|
---|
| 136 | #endif
|
---|
[94439] | 137 | #endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
|
---|
[66605] | 138 |
|
---|
| 139 |
|
---|
| 140 | /*********************************************************************************************************************************
|
---|
| 141 | * Global Variables *
|
---|
| 142 | *********************************************************************************************************************************/
|
---|
[94439] | 143 | #ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
|
---|
| 144 |
|
---|
[66605] | 145 | RT_C_DECLS_BEGIN
|
---|
| 146 | /** Resume patch for dlopen(), jumped to form assembly stub. */
|
---|
[85124] | 147 | DECL_HIDDEN_DATA(PFNDLOPEN) g_pfnDlopenReal = NULL;
|
---|
[66605] | 148 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
| 149 | /** Resume patch for dlmopen(), jumped to form assembly stub. */
|
---|
[85124] | 150 | DECL_HIDDEN_DATA(PFNDLMOPEN) g_pfnDlmopenReal = NULL;
|
---|
[66605] | 151 | #endif
|
---|
| 152 | RT_C_DECLS_END
|
---|
| 153 |
|
---|
| 154 | /** Memory allocated for the patches. */
|
---|
| 155 | static uint8_t *g_pbExecMemory = NULL;
|
---|
| 156 | /** Offset into the patch memory which is not used. */
|
---|
| 157 | static uint32_t g_offExecMemory = 0;
|
---|
| 158 |
|
---|
| 159 | /**
|
---|
| 160 | * Array of hooks to install.
|
---|
| 161 | */
|
---|
| 162 | static SUPHARDENEDPOSIXHOOK const g_aHooks[] =
|
---|
| 163 | {
|
---|
[86224] | 164 | /* pszSymbol, pfnHook, ppfnRealResume, pfnResolve */
|
---|
| 165 | { "dlopen", (PFNRT)supR3HardenedPosixMonitor_Dlopen, (uintptr_t *)&g_pfnDlopenReal, supR3HardenedPosixMonitorDlopenResolve },
|
---|
[66605] | 166 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
[86224] | 167 | { "dlmopen", (PFNRT)supR3HardenedPosixMonitor_Dlmopen, (uintptr_t *)&g_pfnDlmopenReal, supR3HardenedPosixMonitorDlmopenResolve }
|
---|
[66605] | 168 | #endif
|
---|
| 169 | };
|
---|
| 170 |
|
---|
| 171 |
|
---|
| 172 |
|
---|
| 173 | /**
|
---|
| 174 | * Verifies the given library for proper access rights for further loading
|
---|
| 175 | * into the process.
|
---|
| 176 | *
|
---|
| 177 | * @returns Flag whether the access rights of the library look sane and loading
|
---|
| 178 | * it is not considered a security risk. Returns true if the library
|
---|
| 179 | * looks sane, false otherwise.
|
---|
| 180 | * @param pszFilename The library to load, this can be an absolute or relative path
|
---|
| 181 | * or just the filename of the library when the default paths should
|
---|
| 182 | * be searched. NULL is allowed too to indicate opening the main
|
---|
| 183 | * binary.
|
---|
| 184 | */
|
---|
| 185 | DECLASM(bool) supR3HardenedPosixMonitor_VerifyLibrary(const char *pszFilename)
|
---|
| 186 | {
|
---|
| 187 | /*
|
---|
| 188 | * Giving NULL as the filename indicates opening the main program which is fine
|
---|
| 189 | * We are already loaded and executing after all.
|
---|
| 190 | *
|
---|
| 191 | * Filenames without any path component (whether absolute or relative) are allowed
|
---|
| 192 | * unconditionally too as the loader will only search the default paths configured by root.
|
---|
| 193 | */
|
---|
| 194 | bool fAllow = true;
|
---|
| 195 |
|
---|
| 196 | if ( pszFilename
|
---|
| 197 | && strchr(pszFilename, '/') != NULL)
|
---|
| 198 | {
|
---|
[87030] | 199 | #if defined(RT_OS_LINUX)
|
---|
[66605] | 200 | int rc = supR3HardenedVerifyFileFollowSymlinks(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
|
---|
| 201 | NULL /* pErrInfo */);
|
---|
| 202 | #else
|
---|
| 203 | int rc = supR3HardenedVerifyFile(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
|
---|
| 204 | NULL /* pErrInfo */);
|
---|
| 205 | #endif
|
---|
| 206 |
|
---|
| 207 | if (RT_FAILURE(rc))
|
---|
| 208 | fAllow = false;
|
---|
| 209 | }
|
---|
| 210 |
|
---|
| 211 | return fAllow;
|
---|
| 212 | }
|
---|
| 213 |
|
---|
| 214 |
|
---|
| 215 | /**
|
---|
| 216 | * Returns the start address of the given symbol if found or NULL otherwise.
|
---|
| 217 | *
|
---|
| 218 | * @returns Start address of the symbol or NULL if not found.
|
---|
| 219 | * @param pszSymbol The symbol name.
|
---|
| 220 | * @param pfnResolve The resolver to call before trying to query the start address.
|
---|
| 221 | */
|
---|
| 222 | static void *supR3HardenedMainPosixGetStartBySymbol(const char *pszSymbol, PFNSUPHARDENEDSYMRESOLVE pfnResolve)
|
---|
| 223 | {
|
---|
| 224 | #ifndef RT_OS_SOLARIS
|
---|
[72838] | 225 | RT_NOREF(pfnResolve);
|
---|
[66605] | 226 | return dlsym(RTLD_DEFAULT, pszSymbol);
|
---|
| 227 |
|
---|
| 228 | #else /* RT_OS_SOLARIS */
|
---|
| 229 | /*
|
---|
| 230 | * Solaris is tricky as dlsym doesn't return the actual start address of
|
---|
| 231 | * the symbol but the start of the trampoline in the PLT of the caller.
|
---|
| 232 | *
|
---|
| 233 | * Disassemble the first jmp instruction to get at the entry in the global
|
---|
| 234 | * offset table where the actual address is stored.
|
---|
| 235 | *
|
---|
| 236 | * To counter lazy symbol resolving, we first have to call the API before
|
---|
| 237 | * trying to resolve and disassemble it.
|
---|
| 238 | */
|
---|
| 239 | pfnResolve();
|
---|
| 240 |
|
---|
| 241 | uint8_t *pbSym = (uint8_t *)dlsym(RTLD_DEFAULT, pszSymbol);
|
---|
| 242 |
|
---|
| 243 | # ifdef RT_ARCH_AMD64
|
---|
| 244 | DISSTATE Dis;
|
---|
| 245 | uint32_t cbInstr = 1;
|
---|
| 246 | int rc = DISInstr(pbSym, DISCPUMODE_64BIT, &Dis, &cbInstr);
|
---|
| 247 | if ( RT_FAILURE(rc)
|
---|
| 248 | || Dis.pCurInstr->uOpcode != OP_JMP
|
---|
[101541] | 249 | || !(Dis.x86.ModRM.Bits.Mod == 0 && Dis.x86.ModRM.Bits.Rm == 5 /* wrt RIP */))
|
---|
[66605] | 250 | return NULL;
|
---|
| 251 |
|
---|
| 252 | /* Extract start address. */
|
---|
[101541] | 253 | pbSym = (pbSym + cbInstr + Dis.Param1.x86.uDisp.i32);
|
---|
[66605] | 254 | pbSym = (uint8_t *)*((uintptr_t *)pbSym);
|
---|
| 255 | # else
|
---|
| 256 | # error "Unsupported architecture"
|
---|
| 257 | # endif
|
---|
| 258 |
|
---|
| 259 | return pbSym;
|
---|
| 260 | #endif /* RT_OS_SOLARIS */
|
---|
| 261 | }
|
---|
| 262 |
|
---|
| 263 |
|
---|
| 264 | /**
|
---|
| 265 | * Allocates executable patch memory with the given constraints.
|
---|
| 266 | *
|
---|
| 267 | * @returns VBox status code.
|
---|
| 268 | * @param cb Size of the patch memory in bytes.
|
---|
| 269 | * @param pvHint Where to try allocating nearby.
|
---|
| 270 | * @param fRipRelAddr Flag whether the executable memory must be within
|
---|
| 271 | * 2GB before or after the hint as it will contain
|
---|
| 272 | * instructions using RIP relative addressing
|
---|
| 273 | */
|
---|
| 274 | static uint8_t *supR3HardenedMainPosixExecMemAlloc(size_t cb, void *pvHint, bool fRipRelAddr)
|
---|
| 275 | {
|
---|
| 276 | AssertReturn(cb < _1K, NULL);
|
---|
| 277 |
|
---|
| 278 | /* Lazy allocation of exectuable memory. */
|
---|
| 279 | if (!g_pbExecMemory)
|
---|
| 280 | {
|
---|
| 281 | g_pbExecMemory = (uint8_t *)mmap(pvHint, DLOPEN_PATCH_MEMORY_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
|
---|
| 282 | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
|
---|
| 283 | g_offExecMemory = 0;
|
---|
| 284 | if (g_pbExecMemory == MAP_FAILED)
|
---|
| 285 | return NULL;
|
---|
| 286 |
|
---|
| 287 | memset(g_pbExecMemory, 0xcc, DLOPEN_PATCH_MEMORY_SIZE);
|
---|
| 288 | }
|
---|
| 289 |
|
---|
| 290 | if (g_offExecMemory + cb >= DLOPEN_PATCH_MEMORY_SIZE)
|
---|
| 291 | return NULL;
|
---|
| 292 |
|
---|
| 293 | uint8_t *pb = &g_pbExecMemory[g_offExecMemory];
|
---|
| 294 |
|
---|
| 295 | if (fRipRelAddr)
|
---|
| 296 | {
|
---|
| 297 | /* Check that we allocated within 2GB of the hint. */
|
---|
| 298 | uintptr_t uPtrHint = (uintptr_t)pvHint;
|
---|
| 299 | uintptr_t uPtrPatchMem = (uintptr_t)pb;
|
---|
| 300 | uintptr_t cbDistance = uPtrHint < uPtrPatchMem
|
---|
| 301 | ? uPtrPatchMem - uPtrHint
|
---|
| 302 | : uPtrHint - uPtrPatchMem;
|
---|
| 303 |
|
---|
| 304 | if (cbDistance >= _2G - _4K)
|
---|
| 305 | return NULL;
|
---|
| 306 | }
|
---|
| 307 |
|
---|
| 308 | g_offExecMemory = RT_ALIGN_32(g_offExecMemory + cb, 16);
|
---|
| 309 | return pb;
|
---|
| 310 | }
|
---|
| 311 |
|
---|
| 312 |
|
---|
| 313 | /**
|
---|
| 314 | * Hooks the given method to execute the given one first.
|
---|
| 315 | *
|
---|
| 316 | * @returns VBox status code.
|
---|
| 317 | * @param pszSymbol The symbol to hook.
|
---|
| 318 | * @param pfnHook The hook to install.
|
---|
| 319 | * @param ppfnReal Where to store the pointer to entry point of the real method
|
---|
| 320 | * (somewhere in patch memory).
|
---|
| 321 | * @param pfnResolve The resolver to call before trying to query the start address.
|
---|
| 322 | */
|
---|
[86224] | 323 | static int supR3HardenedMainPosixHookOne(const char *pszSymbol, PFNRT pfnHook, uintptr_t /*PFNRT*/ *ppfnReal,
|
---|
[66605] | 324 | PFNSUPHARDENEDSYMRESOLVE pfnResolve)
|
---|
| 325 | {
|
---|
| 326 | void *pfnTarget = supR3HardenedMainPosixGetStartBySymbol(pszSymbol, pfnResolve);
|
---|
| 327 | if (!pfnTarget)
|
---|
| 328 | return VERR_NOT_FOUND;
|
---|
| 329 |
|
---|
| 330 | /*
|
---|
| 331 | * Make the target memory writeable to be able to insert the patch.
|
---|
| 332 | * Unprotect two pages in case the code crosses a page boundary.
|
---|
| 333 | */
|
---|
| 334 | void *pvTargetBase = (void *)(((uintptr_t)pfnTarget) & ~(uintptr_t)(_4K - 1));
|
---|
| 335 | int rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_WRITE | PROT_READ | PROT_EXEC);
|
---|
| 336 | if (rcPsx == -1)
|
---|
| 337 | return VERR_SUPLIB_TEXT_NOT_WRITEABLE;
|
---|
| 338 |
|
---|
| 339 | uint8_t * const pbTarget = (uint8_t *)(uintptr_t)pfnTarget;
|
---|
| 340 |
|
---|
| 341 | DISSTATE Dis;
|
---|
| 342 | uint32_t cbInstr;
|
---|
| 343 | uint32_t offJmpBack = 0;
|
---|
| 344 | uint32_t cbPatchMem = 0;
|
---|
| 345 |
|
---|
| 346 | #ifdef RT_ARCH_AMD64
|
---|
| 347 | /*
|
---|
| 348 | * Patch 64-bit hosts.
|
---|
| 349 | */
|
---|
| 350 | uint32_t cRipRelMovs = 0;
|
---|
[66794] | 351 | uint32_t cRelCalls = 0;
|
---|
[66605] | 352 |
|
---|
| 353 | /* Just use the disassembler to skip 12 bytes or more, we might need to
|
---|
| 354 | rewrite mov instructions using RIP relative addressing. */
|
---|
| 355 | while (offJmpBack < 12)
|
---|
| 356 | {
|
---|
| 357 | cbInstr = 1;
|
---|
| 358 | int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_64BIT, &Dis, &cbInstr);
|
---|
| 359 | if ( RT_FAILURE(rc)
|
---|
[66794] | 360 | || ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
|
---|
| 361 | && Dis.pCurInstr->uOpcode != OP_CALL)
|
---|
[101541] | 362 | || ( Dis.x86.ModRM.Bits.Mod == 0
|
---|
| 363 | && Dis.x86.ModRM.Bits.Rm == 5 /* wrt RIP */
|
---|
[66605] | 364 | && Dis.pCurInstr->uOpcode != OP_MOV))
|
---|
| 365 | return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
|
---|
| 366 |
|
---|
[101541] | 367 | if (Dis.x86.ModRM.Bits.Mod == 0 && Dis.x86.ModRM.Bits.Rm == 5 /* wrt RIP */)
|
---|
[66605] | 368 | cRipRelMovs++;
|
---|
[66794] | 369 | if ( Dis.pCurInstr->uOpcode == OP_CALL
|
---|
| 370 | && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
|
---|
| 371 | cRelCalls++;
|
---|
[66605] | 372 |
|
---|
| 373 | offJmpBack += cbInstr;
|
---|
| 374 | cbPatchMem += cbInstr;
|
---|
| 375 | }
|
---|
| 376 |
|
---|
[66794] | 377 | /*
|
---|
[66847] | 378 | * Each relative call requires extra bytes as it is converted to a pushq imm32
|
---|
| 379 | * + mov [RSP+4], imm32 + a jmp qword [$+8 wrt RIP] to avoid clobbering registers.
|
---|
[66841] | 380 | */
|
---|
[66847] | 381 | cbPatchMem += cRelCalls * RT_ALIGN_32(13 + 6 + 8, 8);
|
---|
[66605] | 382 | cbPatchMem += 14; /* jmp qword [$+8 wrt RIP] + 8 byte address to jump to. */
|
---|
| 383 | cbPatchMem = RT_ALIGN_32(cbPatchMem, 8);
|
---|
| 384 |
|
---|
[66794] | 385 | /* Allocate suitable executable memory available. */
|
---|
[66605] | 386 | bool fConvRipRelMovs = false;
|
---|
| 387 | uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, cRipRelMovs > 0);
|
---|
| 388 | if (!pbPatchMem)
|
---|
| 389 | {
|
---|
| 390 | /*
|
---|
| 391 | * Try to allocate memory again without the RIP relative mov addressing constraint
|
---|
| 392 | * Makes it a bit more difficult for us later on but there is no way around it.
|
---|
| 393 | * We need to increase the patch memory because we create two instructions for one
|
---|
| 394 | * (7 bytes for the RIP relative mov vs. 13 bytes for the two instructions replacing it ->
|
---|
| 395 | * need to allocate 6 bytes more per RIP relative mov).
|
---|
| 396 | */
|
---|
| 397 | fConvRipRelMovs = true;
|
---|
| 398 | if (cRipRelMovs > 0)
|
---|
| 399 | pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem + cRipRelMovs * 6,
|
---|
| 400 | pbTarget, false /*fRipRelAddr*/);
|
---|
| 401 |
|
---|
| 402 | if (!pbPatchMem)
|
---|
| 403 | return VERR_NO_MEMORY;
|
---|
| 404 | }
|
---|
| 405 |
|
---|
| 406 | /* Assemble the code for resuming the call.*/
|
---|
[86224] | 407 | *ppfnReal = (uintptr_t)pbPatchMem;
|
---|
[66605] | 408 |
|
---|
| 409 | /* Go through the instructions to patch and fixup any rip relative mov instructions. */
|
---|
| 410 | uint32_t offInsn = 0;
|
---|
| 411 | while (offInsn < offJmpBack)
|
---|
| 412 | {
|
---|
| 413 | cbInstr = 1;
|
---|
| 414 | int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_64BIT, &Dis, &cbInstr);
|
---|
| 415 | if ( RT_FAILURE(rc)
|
---|
[66794] | 416 | || ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
|
---|
| 417 | && Dis.pCurInstr->uOpcode != OP_CALL))
|
---|
[66605] | 418 | return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
|
---|
| 419 |
|
---|
[101541] | 420 | if ( Dis.x86.ModRM.Bits.Mod == 0
|
---|
| 421 | && Dis.x86.ModRM.Bits.Rm == 5 /* wrt RIP */
|
---|
[66605] | 422 | && Dis.pCurInstr->uOpcode == OP_MOV)
|
---|
| 423 | {
|
---|
| 424 | /* Deduce destination register and write out new instruction. */
|
---|
| 425 | if (RT_UNLIKELY(!( (Dis.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN64))
|
---|
| 426 | && (Dis.Param2.fUse & DISUSE_RIPDISPLACEMENT32))))
|
---|
| 427 | return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
|
---|
| 428 |
|
---|
[101541] | 429 | uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param2.x86.uDisp.i32;
|
---|
[66605] | 430 |
|
---|
| 431 | if (fConvRipRelMovs)
|
---|
| 432 | {
|
---|
| 433 | /*
|
---|
| 434 | * Create two instructions, first one moves the address as a constant to the destination register
|
---|
| 435 | * and the second one loads the data from the memory into the destination register.
|
---|
| 436 | */
|
---|
| 437 |
|
---|
| 438 | *pbPatchMem++ = 0x48;
|
---|
[101541] | 439 | *pbPatchMem++ = 0xb8 + Dis.Param1.x86.Base.idxGenReg;
|
---|
[66605] | 440 | *(uintptr_t *)pbPatchMem = uAddr;
|
---|
| 441 | pbPatchMem += sizeof(uintptr_t);
|
---|
| 442 |
|
---|
| 443 | *pbPatchMem++ = 0x48;
|
---|
| 444 | *pbPatchMem++ = 0x8b;
|
---|
[101541] | 445 | *pbPatchMem++ = (Dis.Param1.x86.Base.idxGenReg << X86_MODRM_REG_SHIFT) | Dis.Param1.x86.Base.idxGenReg;
|
---|
[66605] | 446 | }
|
---|
| 447 | else
|
---|
| 448 | {
|
---|
| 449 | intptr_t iDispNew = uAddr - (uintptr_t)&pbPatchMem[3 + sizeof(int32_t)];
|
---|
| 450 | Assert(iDispNew == (int32_t)iDispNew);
|
---|
| 451 |
|
---|
| 452 | /* Assemble the mov to register instruction with the updated rip relative displacement. */
|
---|
| 453 | *pbPatchMem++ = 0x48;
|
---|
| 454 | *pbPatchMem++ = 0x8b;
|
---|
[101541] | 455 | *pbPatchMem++ = (Dis.Param1.x86.Base.idxGenReg << X86_MODRM_REG_SHIFT) | 5;
|
---|
[66605] | 456 | *(int32_t *)pbPatchMem = (int32_t)iDispNew;
|
---|
| 457 | pbPatchMem += sizeof(int32_t);
|
---|
| 458 | }
|
---|
| 459 | }
|
---|
[66794] | 460 | else if ( Dis.pCurInstr->uOpcode == OP_CALL
|
---|
| 461 | && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
|
---|
| 462 | {
|
---|
[66841] | 463 | /* Convert to absolute jump. */
|
---|
[66794] | 464 | uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param1.uValue;
|
---|
| 465 |
|
---|
[66845] | 466 | /* Skip the push instructions till the return address is known. */
|
---|
[66841] | 467 | uint8_t *pbPatchMemPush = pbPatchMem;
|
---|
[66847] | 468 | pbPatchMem += 13;
|
---|
[66841] | 469 |
|
---|
| 470 | *pbPatchMem++ = 0xff; /* jmp qword [$+8 wrt RIP] */
|
---|
| 471 | *pbPatchMem++ = 0x25;
|
---|
| 472 | *(uint32_t *)pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
|
---|
| 473 | pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
|
---|
[66794] | 474 | *(uint64_t *)pbPatchMem = uAddr;
|
---|
[66841] | 475 | pbPatchMem += sizeof(uint64_t);
|
---|
[66794] | 476 |
|
---|
[66845] | 477 | /* Push the return address onto stack. Difficult on amd64 without clobbering registers... */
|
---|
[66846] | 478 | uintptr_t uAddrReturn = (uintptr_t)pbPatchMem;
|
---|
[66847] | 479 | *pbPatchMemPush++ = 0x68; /* push imm32 sign-extended as 64-bit*/
|
---|
| 480 | *(uint32_t *)pbPatchMemPush = RT_LO_U32(uAddrReturn);
|
---|
| 481 | pbPatchMemPush += sizeof(uint32_t);
|
---|
| 482 | *pbPatchMemPush++ = 0xc7;
|
---|
| 483 | *pbPatchMemPush++ = 0x44;
|
---|
| 484 | *pbPatchMemPush++ = 0x24;
|
---|
| 485 | *pbPatchMemPush++ = 0x04; /* movl [RSP+4], imm32 */
|
---|
| 486 | *(uint32_t *)pbPatchMemPush = RT_HI_U32(uAddrReturn);
|
---|
[66794] | 487 | }
|
---|
[66605] | 488 | else
|
---|
| 489 | {
|
---|
| 490 | memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
|
---|
| 491 | pbPatchMem += cbInstr;
|
---|
| 492 | }
|
---|
| 493 |
|
---|
| 494 | offInsn += cbInstr;
|
---|
| 495 | }
|
---|
| 496 |
|
---|
| 497 | *pbPatchMem++ = 0xff; /* jmp qword [$+8 wrt RIP] */
|
---|
| 498 | *pbPatchMem++ = 0x25;
|
---|
| 499 | *(uint32_t *)pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
|
---|
| 500 | pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
|
---|
| 501 | *(uint64_t *)pbPatchMem = (uintptr_t)&pbTarget[offJmpBack];
|
---|
| 502 |
|
---|
| 503 | /* Assemble the patch. */
|
---|
| 504 | Assert(offJmpBack >= 12);
|
---|
| 505 | pbTarget[0] = 0x48; /* mov rax, qword */
|
---|
| 506 | pbTarget[1] = 0xb8;
|
---|
| 507 | *(uintptr_t *)&pbTarget[2] = (uintptr_t)pfnHook;
|
---|
| 508 | pbTarget[10] = 0xff; /* jmp rax */
|
---|
| 509 | pbTarget[11] = 0xe0;
|
---|
| 510 |
|
---|
| 511 | #else /* !RT_ARCH_AMD64 */
|
---|
| 512 | /*
|
---|
| 513 | * Patch 32-bit hosts.
|
---|
| 514 | */
|
---|
| 515 | /* Just use the disassembler to skip 5 bytes or more. */
|
---|
| 516 | while (offJmpBack < 5)
|
---|
| 517 | {
|
---|
| 518 | cbInstr = 1;
|
---|
| 519 | int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr);
|
---|
| 520 | if ( RT_FAILURE(rc)
|
---|
| 521 | || ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
|
---|
| 522 | && Dis.pCurInstr->uOpcode != OP_CALL))
|
---|
| 523 | return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
|
---|
| 524 |
|
---|
| 525 | if ( Dis.pCurInstr->uOpcode == OP_CALL
|
---|
| 526 | && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
|
---|
| 527 | cbPatchMem += 10; /* push imm32 + jmp rel32 */
|
---|
| 528 | else
|
---|
| 529 | cbPatchMem += cbInstr;
|
---|
| 530 |
|
---|
| 531 | offJmpBack += cbInstr;
|
---|
| 532 | }
|
---|
| 533 |
|
---|
| 534 | /* Allocate suitable exectuable memory available. */
|
---|
| 535 | uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, false /* fRipRelAddr */);
|
---|
| 536 | if (!pbPatchMem)
|
---|
| 537 | return VERR_NO_MEMORY;
|
---|
| 538 |
|
---|
| 539 | /* Assemble the code for resuming the call.*/
|
---|
[86224] | 540 | *ppfnReal = (uintptr_t)pbPatchMem;
|
---|
[66605] | 541 |
|
---|
| 542 | /* Go through the instructions to patch and fixup any relative call instructions. */
|
---|
| 543 | uint32_t offInsn = 0;
|
---|
| 544 | while (offInsn < offJmpBack)
|
---|
| 545 | {
|
---|
| 546 | cbInstr = 1;
|
---|
| 547 | int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_32BIT, &Dis, &cbInstr);
|
---|
| 548 | if ( RT_FAILURE(rc)
|
---|
| 549 | || ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
|
---|
| 550 | && Dis.pCurInstr->uOpcode != OP_CALL))
|
---|
| 551 | return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
|
---|
| 552 |
|
---|
| 553 | if ( Dis.pCurInstr->uOpcode == OP_CALL
|
---|
| 554 | && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
|
---|
| 555 | {
|
---|
| 556 | /*
|
---|
| 557 | * Don't use a call instruction directly but push the original return address
|
---|
| 558 | * onto the stack and use a relative jump to the call target.
|
---|
| 559 | * The reason here is that on Linux the called method saves the return
|
---|
| 560 | * address from the stack which will be different from the original because
|
---|
| 561 | * the code is executed from our patch memory.
|
---|
| 562 | *
|
---|
| 563 | * Luckily the call instruction is 5 bytes long which means it is always the
|
---|
| 564 | * last instruction to patch and we don't need to return from the call
|
---|
| 565 | * to patch memory anyway but can use this method to resume the original call.
|
---|
| 566 | */
|
---|
| 567 | AssertReturn(offInsn + cbInstr >= offJmpBack, VERR_SUPLIB_UNEXPECTED_INSTRUCTION); /* Must be last instruction! */
|
---|
| 568 |
|
---|
| 569 | /* push return address */
|
---|
| 570 | uint32_t const uAddrReturn = (uintptr_t)&pbTarget[offInsn + cbInstr]; /* The return address to push to the stack. */
|
---|
| 571 |
|
---|
| 572 | *pbPatchMem++ = 0x68; /* push dword */
|
---|
| 573 | *(uint32_t *)pbPatchMem = uAddrReturn;
|
---|
| 574 | pbPatchMem += sizeof(uint32_t);
|
---|
| 575 |
|
---|
| 576 | /* jmp rel32 to the call target */
|
---|
| 577 | uintptr_t const uAddr = uAddrReturn + (int32_t)Dis.Param1.uValue;
|
---|
| 578 | int32_t const i32DispNew = uAddr - (uintptr_t)&pbPatchMem[5];
|
---|
| 579 |
|
---|
| 580 | *pbPatchMem++ = 0xe9; /* jmp rel32 */
|
---|
| 581 | *(int32_t *)pbPatchMem = i32DispNew;
|
---|
| 582 | pbPatchMem += sizeof(int32_t);
|
---|
| 583 | }
|
---|
| 584 | else
|
---|
| 585 | {
|
---|
| 586 | memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
|
---|
| 587 | pbPatchMem += cbInstr;
|
---|
| 588 | }
|
---|
| 589 |
|
---|
| 590 | offInsn += cbInstr;
|
---|
| 591 | }
|
---|
| 592 |
|
---|
| 593 | *pbPatchMem++ = 0xe9; /* jmp rel32 */
|
---|
| 594 | *(uint32_t *)pbPatchMem = (uintptr_t)&pbTarget[offJmpBack] - ((uintptr_t)pbPatchMem + 4);
|
---|
| 595 |
|
---|
| 596 | /* Assemble the patch. */
|
---|
| 597 | Assert(offJmpBack >= 5);
|
---|
| 598 | pbTarget[0] = 0xe9;
|
---|
| 599 | *(uint32_t *)&pbTarget[1] = (uintptr_t)pfnHook - (uintptr_t)&pbTarget[1+4];
|
---|
| 600 | #endif /* !RT_ARCH_AMD64 */
|
---|
| 601 |
|
---|
| 602 | /*
|
---|
| 603 | * Re-seal target (ASSUMING that the shared object either has page aligned
|
---|
| 604 | * section or that the patch target is far enough from the writable parts).
|
---|
| 605 | */
|
---|
| 606 | rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_READ | PROT_EXEC);
|
---|
| 607 | if (rcPsx == -1)
|
---|
| 608 | return VERR_SUPLIB_TEXT_NOT_SEALED;
|
---|
| 609 |
|
---|
| 610 | return VINF_SUCCESS;
|
---|
| 611 | }
|
---|
| 612 |
|
---|
| 613 |
|
---|
| 614 | /**
|
---|
| 615 | * @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlopen}
|
---|
| 616 | */
|
---|
| 617 | static DECLCALLBACK(void) supR3HardenedPosixMonitorDlopenResolve(void)
|
---|
| 618 | {
|
---|
| 619 | /* Make harmless dlopen call. */
|
---|
| 620 | void *pv = dlopen(NULL, RTLD_LAZY);
|
---|
| 621 | if (pv)
|
---|
| 622 | dlclose(pv);
|
---|
| 623 | }
|
---|
| 624 |
|
---|
| 625 |
|
---|
| 626 | #ifdef SUP_HARDENED_WITH_DLMOPEN
|
---|
| 627 | /**
|
---|
| 628 | * @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlmopen}
|
---|
| 629 | */
|
---|
| 630 | static DECLCALLBACK(void) supR3HardenedPosixMonitorDlmopenResolve(void)
|
---|
| 631 | {
|
---|
| 632 | /* Make harmless dlmopen call. */
|
---|
| 633 | void *pv = dlmopen(LM_ID_BASE, NULL, RTLD_LAZY);
|
---|
| 634 | if (pv)
|
---|
| 635 | dlclose(pv);
|
---|
| 636 | }
|
---|
| 637 | #endif
|
---|
| 638 |
|
---|
[94439] | 639 | #endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
|
---|
[66605] | 640 |
|
---|
[94439] | 641 |
|
---|
[66605] | 642 | /**
|
---|
| 643 | * Hardening initialization for POSIX compatible hosts.
|
---|
| 644 | *
|
---|
| 645 | * @note Doesn't return on error.
|
---|
| 646 | */
|
---|
| 647 | DECLHIDDEN(void) supR3HardenedPosixInit(void)
|
---|
| 648 | {
|
---|
[94439] | 649 | #ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
|
---|
[66605] | 650 | for (unsigned i = 0; i < RT_ELEMENTS(g_aHooks); i++)
|
---|
| 651 | {
|
---|
| 652 | PCSUPHARDENEDPOSIXHOOK pHook = &g_aHooks[i];
|
---|
[87030] | 653 | int rc = supR3HardenedMainPosixHookOne(pHook->pszSymbol, pHook->pfnHook, pHook->ppfnRealResume, pHook->pfnResolve);
|
---|
| 654 | if (RT_FAILURE(rc))
|
---|
[66605] | 655 | supR3HardenedFatalMsg("supR3HardenedPosixInit", kSupInitOp_Integrity, rc,
|
---|
| 656 | "Failed to hook the %s interface", pHook->pszSymbol);
|
---|
| 657 | }
|
---|
[94439] | 658 | #endif
|
---|
[66605] | 659 | }
|
---|
| 660 |
|
---|
| 661 |
|
---|
| 662 |
|
---|
| 663 | /*
|
---|
| 664 | * assert.cpp
|
---|
| 665 | *
|
---|
| 666 | * ASSUMES working DECLHIDDEN or there will be symbol confusion!
|
---|
| 667 | */
|
---|
| 668 |
|
---|
| 669 | RTDATADECL(char) g_szRTAssertMsg1[1024];
|
---|
| 670 | RTDATADECL(char) g_szRTAssertMsg2[4096];
|
---|
| 671 | RTDATADECL(const char * volatile) g_pszRTAssertExpr;
|
---|
| 672 | RTDATADECL(const char * volatile) g_pszRTAssertFile;
|
---|
| 673 | RTDATADECL(uint32_t volatile) g_u32RTAssertLine;
|
---|
| 674 | RTDATADECL(const char * volatile) g_pszRTAssertFunction;
|
---|
| 675 |
|
---|
| 676 | RTDECL(bool) RTAssertMayPanic(void)
|
---|
| 677 | {
|
---|
| 678 | return true;
|
---|
| 679 | }
|
---|
| 680 |
|
---|
| 681 |
|
---|
| 682 | RTDECL(void) RTAssertMsg1(const char *pszExpr, unsigned uLine, const char *pszFile, const char *pszFunction)
|
---|
| 683 | {
|
---|
| 684 | /*
|
---|
| 685 | * Fill in the globals.
|
---|
| 686 | */
|
---|
| 687 | g_pszRTAssertExpr = pszExpr;
|
---|
| 688 | g_pszRTAssertFile = pszFile;
|
---|
| 689 | g_pszRTAssertFunction = pszFunction;
|
---|
| 690 | g_u32RTAssertLine = uLine;
|
---|
| 691 | snprintf(g_szRTAssertMsg1, sizeof(g_szRTAssertMsg1),
|
---|
| 692 | "\n!!Assertion Failed!!\n"
|
---|
| 693 | "Expression: %s\n"
|
---|
[72839] | 694 | "Location : %s(%u) %s\n",
|
---|
[66605] | 695 | pszExpr, pszFile, uLine, pszFunction);
|
---|
| 696 | }
|
---|
| 697 |
|
---|
| 698 |
|
---|
| 699 | RTDECL(void) RTAssertMsg2V(const char *pszFormat, va_list va)
|
---|
| 700 | {
|
---|
| 701 | vsnprintf(g_szRTAssertMsg2, sizeof(g_szRTAssertMsg2), pszFormat, va);
|
---|
| 702 | if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN)
|
---|
| 703 | supR3HardenedFatalMsg(g_pszRTAssertExpr, kSupInitOp_Misc, VERR_INTERNAL_ERROR,
|
---|
| 704 | "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
|
---|
| 705 | else
|
---|
| 706 | supR3HardenedError(VERR_INTERNAL_ERROR, false/*fFatal*/, "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
|
---|
| 707 | }
|
---|
| 708 |
|
---|