VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp@ 67954

Last change on this file since 67954 was 66847, checked in by vboxsync, 7 years ago

Support/posix: use the alternative approach
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 26.1 KB
Line 
1/* $Id: SUPR3HardenedMain-posix.cpp 66847 2017-05-09 11:55:28Z vboxsync $ */
2/** @file
3 * VirtualBox Support Library - Hardened main(), posix bits.
4 */
5
6/*
7 * Copyright (C) 2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#include <VBox/err.h>
32#include <VBox/dis.h>
33#include <VBox/sup.h>
34
35#include <iprt/path.h>
36#include <iprt/string.h>
37#include <iprt/x86.h>
38
39#include <dlfcn.h>
40#include <sys/mman.h>
41#ifdef RT_OS_DARWIN
42# include <errno.h>
43# include <fcntl.h>
44# include <sys/stat.h> /* fstat() */
45# include <unistd.h> /* readlink() */
46# include <stdlib.h>
47#elif defined(RT_OS_SOLARIS)
48# include <link.h>
49#endif
50#include <stdio.h>
51#include <stdint.h>
52
53#include "SUPLibInternal.h"
54
55
56/*********************************************************************************************************************************
57* Defined Constants And Macros *
58*********************************************************************************************************************************/
59
60/** For OS X. */
61#ifndef MAP_ANONYMOUS
62# define MAP_ANONYMOUS MAP_ANON
63#endif
64
65/**
66 * Memory for code patching.
67 */
68#define DLOPEN_PATCH_MEMORY_SIZE _4K
69
70
71/*********************************************************************************************************************************
72* Structures and Typedefs *
73*********************************************************************************************************************************/
74/**
75 * Callback (SUPHARDENEDPOSIXHOOK::pfnResolv) for triggering lazy GOT resolver.
76 *
77 * This generally just calls the API in a harmless manner and triggers the lazy
78 * resolving of the symbol, ensuring a proper address in the GOT/PLT entry.
79 *
80 * On Solaris dlsym() will return the value in the GOT/PLT entry. We don't wish
81 * to patch the lazy loader trampoline function, but rather the real function!
82 */
83typedef DECLCALLBACK(void) FNSUPHARDENEDSYMRESOLVE(void);
84/** Pointer to FNSUPHARDENEDSYMRESOLVE. */
85typedef FNSUPHARDENEDSYMRESOLVE *PFNSUPHARDENEDSYMRESOLVE;
86
87/**
88 * A hook descriptor.
89 */
90typedef struct SUPHARDENEDPOSIXHOOK
91{
92 /** The symbol to hook. */
93 const char *pszSymbol;
94 /** The intercepting wrapper doing additional checks. */
95 PFNRT pfnHook;
96 /** Where to store the pointer to the code into patch memory
97 * which resumes the original call. */
98 PFNRT *ppfnRealResume;
99 /** Pointer to the resolver method used on Solaris. */
100 PFNSUPHARDENEDSYMRESOLVE pfnResolve;
101} SUPHARDENEDPOSIXHOOK;
102/** Pointer to a hook descriptor. */
103typedef SUPHARDENEDPOSIXHOOK *PSUPHARDENEDPOSIXHOOK;
104/** Pointer to a const hook descriptor. */
105typedef const SUPHARDENEDPOSIXHOOK *PCSUPHARDENEDPOSIXHOOK;
106
107/** dlopen() declaration. */
108typedef void *FNDLOPEN(const char *pszFilename, int fFlags);
109/** Pointer to dlopen. */
110typedef FNDLOPEN *PFNDLOPEN;
111
112#ifdef SUP_HARDENED_WITH_DLMOPEN
113/** dlmopen() declaration */
114typedef void *FNDLMOPEN(Lmid_t idLm, const char *pszFilename, int fFlags);
115/** Pointer to dlmopen. */
116typedef FNDLMOPEN *PFNDLMOPEN;
117#endif
118
119
120/*********************************************************************************************************************************
121* Internal Functions *
122*********************************************************************************************************************************/
123static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlopenResolve;
124#ifdef SUP_HARDENED_WITH_DLMOPEN
125static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlmopenResolve;
126#endif
127
128/* SUPR3HardenedMainA-posix.asm: */
129DECLASM(void) supR3HardenedPosixMonitor_Dlopen(const char *pszFilename, int fFlags);
130#ifdef SUP_HARDENED_WITH_DLMOPEN
131DECLASM(void) supR3HardenedPosixMonitor_Dlmopen(Lmid_t idLm, const char *pszFilename, int fFlags);
132#endif
133
134
135/*********************************************************************************************************************************
136* Global Variables *
137*********************************************************************************************************************************/
138RT_C_DECLS_BEGIN
139/** Resume patch for dlopen(), jumped to form assembly stub. */
140DECLHIDDEN(PFNDLOPEN) g_pfnDlopenReal = NULL;
141#ifdef SUP_HARDENED_WITH_DLMOPEN
142/** Resume patch for dlmopen(), jumped to form assembly stub. */
143DECLHIDDEN(PFNDLMOPEN) g_pfnDlmopenReal = NULL;
144#endif
145RT_C_DECLS_END
146
147/** Memory allocated for the patches. */
148static uint8_t *g_pbExecMemory = NULL;
149/** Offset into the patch memory which is not used. */
150static uint32_t g_offExecMemory = 0;
151
152/**
153 * Array of hooks to install.
154 */
155static SUPHARDENEDPOSIXHOOK const g_aHooks[] =
156{
157 /* pszSymbol, pfnHook, ppfnRealResume, pfnResolve */
158 { "dlopen", (PFNRT)supR3HardenedPosixMonitor_Dlopen, (PFNRT *)&g_pfnDlopenReal, supR3HardenedPosixMonitorDlopenResolve },
159#ifdef SUP_HARDENED_WITH_DLMOPEN
160 { "dlmopen", (PFNRT)supR3HardenedPosixMonitor_Dlmopen, (PFNRT *)&g_pfnDlmopenReal, supR3HardenedPosixMonitorDlmopenResolve }
161#endif
162};
163
164
165
166/**
167 * Verifies the given library for proper access rights for further loading
168 * into the process.
169 *
170 * @returns Flag whether the access rights of the library look sane and loading
171 * it is not considered a security risk. Returns true if the library
172 * looks sane, false otherwise.
173 * @param pszFilename The library to load, this can be an absolute or relative path
174 * or just the filename of the library when the default paths should
175 * be searched. NULL is allowed too to indicate opening the main
176 * binary.
177 */
178DECLASM(bool) supR3HardenedPosixMonitor_VerifyLibrary(const char *pszFilename)
179{
180 /*
181 * Giving NULL as the filename indicates opening the main program which is fine
182 * We are already loaded and executing after all.
183 *
184 * Filenames without any path component (whether absolute or relative) are allowed
185 * unconditionally too as the loader will only search the default paths configured by root.
186 */
187 bool fAllow = true;
188
189 if ( pszFilename
190 && strchr(pszFilename, '/') != NULL)
191 {
192#if defined(RT_OS_DARWIN) || defined(RT_OS_LINUX)
193 int rc = supR3HardenedVerifyFileFollowSymlinks(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
194 NULL /* pErrInfo */);
195#else
196 int rc = supR3HardenedVerifyFile(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
197 NULL /* pErrInfo */);
198#endif
199
200 if (RT_FAILURE(rc))
201 fAllow = false;
202 }
203
204 return fAllow;
205}
206
207
208/**
209 * Returns the start address of the given symbol if found or NULL otherwise.
210 *
211 * @returns Start address of the symbol or NULL if not found.
212 * @param pszSymbol The symbol name.
213 * @param pfnResolve The resolver to call before trying to query the start address.
214 */
215static void *supR3HardenedMainPosixGetStartBySymbol(const char *pszSymbol, PFNSUPHARDENEDSYMRESOLVE pfnResolve)
216{
217#ifndef RT_OS_SOLARIS
218 return dlsym(RTLD_DEFAULT, pszSymbol);
219 RT_NOREF(pfnResolve);
220
221#else /* RT_OS_SOLARIS */
222 /*
223 * Solaris is tricky as dlsym doesn't return the actual start address of
224 * the symbol but the start of the trampoline in the PLT of the caller.
225 *
226 * Disassemble the first jmp instruction to get at the entry in the global
227 * offset table where the actual address is stored.
228 *
229 * To counter lazy symbol resolving, we first have to call the API before
230 * trying to resolve and disassemble it.
231 */
232 pfnResolve();
233
234 uint8_t *pbSym = (uint8_t *)dlsym(RTLD_DEFAULT, pszSymbol);
235
236# ifdef RT_ARCH_AMD64
237 DISSTATE Dis;
238 uint32_t cbInstr = 1;
239 int rc = DISInstr(pbSym, DISCPUMODE_64BIT, &Dis, &cbInstr);
240 if ( RT_FAILURE(rc)
241 || Dis.pCurInstr->uOpcode != OP_JMP
242 || !(Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */))
243 return NULL;
244
245 /* Extract start address. */
246 pbSym = (pbSym + cbInstr + Dis.Param1.uDisp.i32);
247 pbSym = (uint8_t *)*((uintptr_t *)pbSym);
248# else
249# error "Unsupported architecture"
250# endif
251
252 return pbSym;
253#endif /* RT_OS_SOLARIS */
254}
255
256
257/**
258 * Allocates executable patch memory with the given constraints.
259 *
260 * @returns VBox status code.
261 * @param cb Size of the patch memory in bytes.
262 * @param pvHint Where to try allocating nearby.
263 * @param fRipRelAddr Flag whether the executable memory must be within
264 * 2GB before or after the hint as it will contain
265 * instructions using RIP relative addressing
266 */
267static uint8_t *supR3HardenedMainPosixExecMemAlloc(size_t cb, void *pvHint, bool fRipRelAddr)
268{
269 AssertReturn(cb < _1K, NULL);
270
271 /* Lazy allocation of exectuable memory. */
272 if (!g_pbExecMemory)
273 {
274 g_pbExecMemory = (uint8_t *)mmap(pvHint, DLOPEN_PATCH_MEMORY_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
275 MAP_SHARED | MAP_ANONYMOUS, -1, 0);
276 g_offExecMemory = 0;
277 if (g_pbExecMemory == MAP_FAILED)
278 return NULL;
279
280 memset(g_pbExecMemory, 0xcc, DLOPEN_PATCH_MEMORY_SIZE);
281 }
282
283 if (g_offExecMemory + cb >= DLOPEN_PATCH_MEMORY_SIZE)
284 return NULL;
285
286 uint8_t *pb = &g_pbExecMemory[g_offExecMemory];
287
288 if (fRipRelAddr)
289 {
290 /* Check that we allocated within 2GB of the hint. */
291 uintptr_t uPtrHint = (uintptr_t)pvHint;
292 uintptr_t uPtrPatchMem = (uintptr_t)pb;
293 uintptr_t cbDistance = uPtrHint < uPtrPatchMem
294 ? uPtrPatchMem - uPtrHint
295 : uPtrHint - uPtrPatchMem;
296
297 if (cbDistance >= _2G - _4K)
298 return NULL;
299 }
300
301 g_offExecMemory = RT_ALIGN_32(g_offExecMemory + cb, 16);
302 return pb;
303}
304
305
306/**
307 * Hooks the given method to execute the given one first.
308 *
309 * @returns VBox status code.
310 * @param pszSymbol The symbol to hook.
311 * @param pfnHook The hook to install.
312 * @param ppfnReal Where to store the pointer to entry point of the real method
313 * (somewhere in patch memory).
314 * @param pfnResolve The resolver to call before trying to query the start address.
315 */
316static int supR3HardenedMainPosixHookOne(const char *pszSymbol, PFNRT pfnHook, PFNRT *ppfnReal,
317 PFNSUPHARDENEDSYMRESOLVE pfnResolve)
318{
319 void *pfnTarget = supR3HardenedMainPosixGetStartBySymbol(pszSymbol, pfnResolve);
320 if (!pfnTarget)
321 return VERR_NOT_FOUND;
322
323 /*
324 * Make the target memory writeable to be able to insert the patch.
325 * Unprotect two pages in case the code crosses a page boundary.
326 */
327 void *pvTargetBase = (void *)(((uintptr_t)pfnTarget) & ~(uintptr_t)(_4K - 1));
328 int rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_WRITE | PROT_READ | PROT_EXEC);
329 if (rcPsx == -1)
330 return VERR_SUPLIB_TEXT_NOT_WRITEABLE;
331
332 uint8_t * const pbTarget = (uint8_t *)(uintptr_t)pfnTarget;
333
334 DISSTATE Dis;
335 uint32_t cbInstr;
336 uint32_t offJmpBack = 0;
337 uint32_t cbPatchMem = 0;
338
339#ifdef RT_ARCH_AMD64
340 /*
341 * Patch 64-bit hosts.
342 */
343 uint32_t cRipRelMovs = 0;
344 uint32_t cRelCalls = 0;
345
346 /* Just use the disassembler to skip 12 bytes or more, we might need to
347 rewrite mov instructions using RIP relative addressing. */
348 while (offJmpBack < 12)
349 {
350 cbInstr = 1;
351 int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_64BIT, &Dis, &cbInstr);
352 if ( RT_FAILURE(rc)
353 || ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
354 && Dis.pCurInstr->uOpcode != OP_CALL)
355 || ( Dis.ModRM.Bits.Mod == 0
356 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
357 && Dis.pCurInstr->uOpcode != OP_MOV))
358 return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
359
360 if (Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */)
361 cRipRelMovs++;
362 if ( Dis.pCurInstr->uOpcode == OP_CALL
363 && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
364 cRelCalls++;
365
366 offJmpBack += cbInstr;
367 cbPatchMem += cbInstr;
368 }
369
370 /*
371 * Each relative call requires extra bytes as it is converted to a pushq imm32
372 * + mov [RSP+4], imm32 + a jmp qword [$+8 wrt RIP] to avoid clobbering registers.
373 */
374 cbPatchMem += cRelCalls * RT_ALIGN_32(13 + 6 + 8, 8);
375 cbPatchMem += 14; /* jmp qword [$+8 wrt RIP] + 8 byte address to jump to. */
376 cbPatchMem = RT_ALIGN_32(cbPatchMem, 8);
377
378 /* Allocate suitable executable memory available. */
379 bool fConvRipRelMovs = false;
380 uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, cRipRelMovs > 0);
381 if (!pbPatchMem)
382 {
383 /*
384 * Try to allocate memory again without the RIP relative mov addressing constraint
385 * Makes it a bit more difficult for us later on but there is no way around it.
386 * We need to increase the patch memory because we create two instructions for one
387 * (7 bytes for the RIP relative mov vs. 13 bytes for the two instructions replacing it ->
388 * need to allocate 6 bytes more per RIP relative mov).
389 */
390 fConvRipRelMovs = true;
391 if (cRipRelMovs > 0)
392 pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem + cRipRelMovs * 6,
393 pbTarget, false /*fRipRelAddr*/);
394
395 if (!pbPatchMem)
396 return VERR_NO_MEMORY;
397 }
398
399 /* Assemble the code for resuming the call.*/
400 *ppfnReal = (PFNRT)(uintptr_t)pbPatchMem;
401
402 /* Go through the instructions to patch and fixup any rip relative mov instructions. */
403 uint32_t offInsn = 0;
404 while (offInsn < offJmpBack)
405 {
406 cbInstr = 1;
407 int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_64BIT, &Dis, &cbInstr);
408 if ( RT_FAILURE(rc)
409 || ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
410 && Dis.pCurInstr->uOpcode != OP_CALL))
411 return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
412
413 if ( Dis.ModRM.Bits.Mod == 0
414 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
415 && Dis.pCurInstr->uOpcode == OP_MOV)
416 {
417 /* Deduce destination register and write out new instruction. */
418 if (RT_UNLIKELY(!( (Dis.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN64))
419 && (Dis.Param2.fUse & DISUSE_RIPDISPLACEMENT32))))
420 return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
421
422 uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param2.uDisp.i32;
423
424 if (fConvRipRelMovs)
425 {
426 /*
427 * Create two instructions, first one moves the address as a constant to the destination register
428 * and the second one loads the data from the memory into the destination register.
429 */
430
431 *pbPatchMem++ = 0x48;
432 *pbPatchMem++ = 0xb8 + Dis.Param1.Base.idxGenReg;
433 *(uintptr_t *)pbPatchMem = uAddr;
434 pbPatchMem += sizeof(uintptr_t);
435
436 *pbPatchMem++ = 0x48;
437 *pbPatchMem++ = 0x8b;
438 *pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) | Dis.Param1.Base.idxGenReg;
439 }
440 else
441 {
442 intptr_t iDispNew = uAddr - (uintptr_t)&pbPatchMem[3 + sizeof(int32_t)];
443 Assert(iDispNew == (int32_t)iDispNew);
444
445 /* Assemble the mov to register instruction with the updated rip relative displacement. */
446 *pbPatchMem++ = 0x48;
447 *pbPatchMem++ = 0x8b;
448 *pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) | 5;
449 *(int32_t *)pbPatchMem = (int32_t)iDispNew;
450 pbPatchMem += sizeof(int32_t);
451 }
452 }
453 else if ( Dis.pCurInstr->uOpcode == OP_CALL
454 && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
455 {
456 /* Convert to absolute jump. */
457 uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param1.uValue;
458
459 /* Skip the push instructions till the return address is known. */
460 uint8_t *pbPatchMemPush = pbPatchMem;
461 pbPatchMem += 13;
462
463 *pbPatchMem++ = 0xff; /* jmp qword [$+8 wrt RIP] */
464 *pbPatchMem++ = 0x25;
465 *(uint32_t *)pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
466 pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
467 *(uint64_t *)pbPatchMem = uAddr;
468 pbPatchMem += sizeof(uint64_t);
469
470 /* Push the return address onto stack. Difficult on amd64 without clobbering registers... */
471 uintptr_t uAddrReturn = (uintptr_t)pbPatchMem;
472 *pbPatchMemPush++ = 0x68; /* push imm32 sign-extended as 64-bit*/
473 *(uint32_t *)pbPatchMemPush = RT_LO_U32(uAddrReturn);
474 pbPatchMemPush += sizeof(uint32_t);
475 *pbPatchMemPush++ = 0xc7;
476 *pbPatchMemPush++ = 0x44;
477 *pbPatchMemPush++ = 0x24;
478 *pbPatchMemPush++ = 0x04; /* movl [RSP+4], imm32 */
479 *(uint32_t *)pbPatchMemPush = RT_HI_U32(uAddrReturn);
480 }
481 else
482 {
483 memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
484 pbPatchMem += cbInstr;
485 }
486
487 offInsn += cbInstr;
488 }
489
490 *pbPatchMem++ = 0xff; /* jmp qword [$+8 wrt RIP] */
491 *pbPatchMem++ = 0x25;
492 *(uint32_t *)pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
493 pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
494 *(uint64_t *)pbPatchMem = (uintptr_t)&pbTarget[offJmpBack];
495
496 /* Assemble the patch. */
497 Assert(offJmpBack >= 12);
498 pbTarget[0] = 0x48; /* mov rax, qword */
499 pbTarget[1] = 0xb8;
500 *(uintptr_t *)&pbTarget[2] = (uintptr_t)pfnHook;
501 pbTarget[10] = 0xff; /* jmp rax */
502 pbTarget[11] = 0xe0;
503
504#else /* !RT_ARCH_AMD64 */
505 /*
506 * Patch 32-bit hosts.
507 */
508 /* Just use the disassembler to skip 5 bytes or more. */
509 while (offJmpBack < 5)
510 {
511 cbInstr = 1;
512 int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr);
513 if ( RT_FAILURE(rc)
514 || ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
515 && Dis.pCurInstr->uOpcode != OP_CALL))
516 return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
517
518 if ( Dis.pCurInstr->uOpcode == OP_CALL
519 && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
520 cbPatchMem += 10; /* push imm32 + jmp rel32 */
521 else
522 cbPatchMem += cbInstr;
523
524 offJmpBack += cbInstr;
525 }
526
527 /* Allocate suitable exectuable memory available. */
528 uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, false /* fRipRelAddr */);
529 if (!pbPatchMem)
530 return VERR_NO_MEMORY;
531
532 /* Assemble the code for resuming the call.*/
533 *ppfnReal = (PFNRT)pbPatchMem;
534
535 /* Go through the instructions to patch and fixup any relative call instructions. */
536 uint32_t offInsn = 0;
537 while (offInsn < offJmpBack)
538 {
539 cbInstr = 1;
540 int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_32BIT, &Dis, &cbInstr);
541 if ( RT_FAILURE(rc)
542 || ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
543 && Dis.pCurInstr->uOpcode != OP_CALL))
544 return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
545
546 if ( Dis.pCurInstr->uOpcode == OP_CALL
547 && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
548 {
549 /*
550 * Don't use a call instruction directly but push the original return address
551 * onto the stack and use a relative jump to the call target.
552 * The reason here is that on Linux the called method saves the return
553 * address from the stack which will be different from the original because
554 * the code is executed from our patch memory.
555 *
556 * Luckily the call instruction is 5 bytes long which means it is always the
557 * last instruction to patch and we don't need to return from the call
558 * to patch memory anyway but can use this method to resume the original call.
559 */
560 AssertReturn(offInsn + cbInstr >= offJmpBack, VERR_SUPLIB_UNEXPECTED_INSTRUCTION); /* Must be last instruction! */
561
562 /* push return address */
563 uint32_t const uAddrReturn = (uintptr_t)&pbTarget[offInsn + cbInstr]; /* The return address to push to the stack. */
564
565 *pbPatchMem++ = 0x68; /* push dword */
566 *(uint32_t *)pbPatchMem = uAddrReturn;
567 pbPatchMem += sizeof(uint32_t);
568
569 /* jmp rel32 to the call target */
570 uintptr_t const uAddr = uAddrReturn + (int32_t)Dis.Param1.uValue;
571 int32_t const i32DispNew = uAddr - (uintptr_t)&pbPatchMem[5];
572
573 *pbPatchMem++ = 0xe9; /* jmp rel32 */
574 *(int32_t *)pbPatchMem = i32DispNew;
575 pbPatchMem += sizeof(int32_t);
576 }
577 else
578 {
579 memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
580 pbPatchMem += cbInstr;
581 }
582
583 offInsn += cbInstr;
584 }
585
586 *pbPatchMem++ = 0xe9; /* jmp rel32 */
587 *(uint32_t *)pbPatchMem = (uintptr_t)&pbTarget[offJmpBack] - ((uintptr_t)pbPatchMem + 4);
588
589 /* Assemble the patch. */
590 Assert(offJmpBack >= 5);
591 pbTarget[0] = 0xe9;
592 *(uint32_t *)&pbTarget[1] = (uintptr_t)pfnHook - (uintptr_t)&pbTarget[1+4];
593#endif /* !RT_ARCH_AMD64 */
594
595 /*
596 * Re-seal target (ASSUMING that the shared object either has page aligned
597 * section or that the patch target is far enough from the writable parts).
598 */
599 rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_READ | PROT_EXEC);
600 if (rcPsx == -1)
601 return VERR_SUPLIB_TEXT_NOT_SEALED;
602
603 return VINF_SUCCESS;
604}
605
606
607/**
608 * @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlopen}
609 */
610static DECLCALLBACK(void) supR3HardenedPosixMonitorDlopenResolve(void)
611{
612 /* Make harmless dlopen call. */
613 void *pv = dlopen(NULL, RTLD_LAZY);
614 if (pv)
615 dlclose(pv);
616}
617
618
619#ifdef SUP_HARDENED_WITH_DLMOPEN
620/**
621 * @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlmopen}
622 */
623static DECLCALLBACK(void) supR3HardenedPosixMonitorDlmopenResolve(void)
624{
625 /* Make harmless dlmopen call. */
626 void *pv = dlmopen(LM_ID_BASE, NULL, RTLD_LAZY);
627 if (pv)
628 dlclose(pv);
629}
630#endif
631
632
633/**
634 * Hardening initialization for POSIX compatible hosts.
635 *
636 * @returns nothing.
637 *
638 * @note Doesn't return on error.
639 */
640DECLHIDDEN(void) supR3HardenedPosixInit(void)
641{
642 for (unsigned i = 0; i < RT_ELEMENTS(g_aHooks); i++)
643 {
644 PCSUPHARDENEDPOSIXHOOK pHook = &g_aHooks[i];
645 int rc = supR3HardenedMainPosixHookOne(pHook->pszSymbol, pHook->pfnHook, pHook->ppfnRealResume, pHook->pfnResolve);
646 if (RT_FAILURE(rc))
647 supR3HardenedFatalMsg("supR3HardenedPosixInit", kSupInitOp_Integrity, rc,
648 "Failed to hook the %s interface", pHook->pszSymbol);
649 }
650}
651
652
653
654/*
655 * assert.cpp
656 *
657 * ASSUMES working DECLHIDDEN or there will be symbol confusion!
658 */
659
660RTDATADECL(char) g_szRTAssertMsg1[1024];
661RTDATADECL(char) g_szRTAssertMsg2[4096];
662RTDATADECL(const char * volatile) g_pszRTAssertExpr;
663RTDATADECL(const char * volatile) g_pszRTAssertFile;
664RTDATADECL(uint32_t volatile) g_u32RTAssertLine;
665RTDATADECL(const char * volatile) g_pszRTAssertFunction;
666
667RTDECL(bool) RTAssertMayPanic(void)
668{
669 return true;
670}
671
672
673RTDECL(void) RTAssertMsg1(const char *pszExpr, unsigned uLine, const char *pszFile, const char *pszFunction)
674{
675 /*
676 * Fill in the globals.
677 */
678 g_pszRTAssertExpr = pszExpr;
679 g_pszRTAssertFile = pszFile;
680 g_pszRTAssertFunction = pszFunction;
681 g_u32RTAssertLine = uLine;
682 snprintf(g_szRTAssertMsg1, sizeof(g_szRTAssertMsg1),
683 "\n!!Assertion Failed!!\n"
684 "Expression: %s\n"
685 "Location : %s(%d) %s\n",
686 pszExpr, pszFile, uLine, pszFunction);
687}
688
689
690RTDECL(void) RTAssertMsg2V(const char *pszFormat, va_list va)
691{
692 vsnprintf(g_szRTAssertMsg2, sizeof(g_szRTAssertMsg2), pszFormat, va);
693 if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN)
694 supR3HardenedFatalMsg(g_pszRTAssertExpr, kSupInitOp_Misc, VERR_INTERNAL_ERROR,
695 "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
696 else
697 supR3HardenedError(VERR_INTERNAL_ERROR, false/*fFatal*/, "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
698}
699
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use