SUPR3HardenedMain-posix.cpp@ 94439

Last change on this file since 94439 was 94439, checked in by vboxsync, 3 years ago
Support: Disable dlopen() patching for ASAN builds for now as our patcher can't deal with the encountered instructions yet
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 26.3 KB

Line
1	/* $Id: SUPR3HardenedMain-posix.cpp 94439 2022-04-01 14:02:04Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Hardened main(), posix bits.
4	*/
5
6	/*
7	* Copyright (C) 2017-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <VBox/err.h>
32	#include <VBox/dis.h>
33	#include <VBox/sup.h>
34
35	#include <iprt/path.h>
36	#include <iprt/string.h>
37	#include <iprt/x86.h>
38
39	#include <dlfcn.h>
40	#include <sys/mman.h>
41	#if defined(RT_OS_SOLARIS)
42	# include <link.h>
43	#endif
44	#include <stdio.h>
45	#include <stdint.h>
46
47	#include "SUPLibInternal.h"
48
49
50	/*********************************************************************************************************************************
51	* Defined Constants And Macros *
52	*********************************************************************************************************************************/
53
54	/**
55	* Memory for code patching.
56	*/
57	#define DLOPEN_PATCH_MEMORY_SIZE _4K
58
59
60	/*********************************************************************************************************************************
61	* Structures and Typedefs *
62	*********************************************************************************************************************************/
63	#ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
64	/**
65	* Callback (SUPHARDENEDPOSIXHOOK::pfnResolv) for triggering lazy GOT resolver.
66	*
67	* This generally just calls the API in a harmless manner and triggers the lazy
68	* resolving of the symbol, ensuring a proper address in the GOT/PLT entry.
69	*
70	* On Solaris dlsym() will return the value in the GOT/PLT entry. We don't wish
71	* to patch the lazy loader trampoline function, but rather the real function!
72	*/
73	typedef DECLCALLBACKTYPE(void, FNSUPHARDENEDSYMRESOLVE,(void));
74	/** Pointer to FNSUPHARDENEDSYMRESOLVE. */
75	typedef FNSUPHARDENEDSYMRESOLVE *PFNSUPHARDENEDSYMRESOLVE;
76
77	/**
78	* A hook descriptor.
79	*/
80	typedef struct SUPHARDENEDPOSIXHOOK
81	{
82	/** The symbol to hook. */
83	const char *pszSymbol;
84	/** The intercepting wrapper doing additional checks. */
85	PFNRT pfnHook;
86	/** Where to store the pointer to the code into patch memory
87	* which resumes the original call.
88	* @note uintptr_t instead of PFNRT is for Clang 11. */
89	uintptr_t *ppfnRealResume;
90	/** Pointer to the resolver method used on Solaris. */
91	PFNSUPHARDENEDSYMRESOLVE pfnResolve;
92	} SUPHARDENEDPOSIXHOOK;
93	/** Pointer to a hook descriptor. */
94	typedef SUPHARDENEDPOSIXHOOK *PSUPHARDENEDPOSIXHOOK;
95	/** Pointer to a const hook descriptor. */
96	typedef const SUPHARDENEDPOSIXHOOK *PCSUPHARDENEDPOSIXHOOK;
97
98	/** dlopen() declaration. */
99	typedef void FNDLOPEN(const char pszFilename, int fFlags);
100	/** Pointer to dlopen. */
101	typedef FNDLOPEN *PFNDLOPEN;
102
103	#ifdef SUP_HARDENED_WITH_DLMOPEN
104	/** dlmopen() declaration */
105	typedef void FNDLMOPEN(Lmid_t idLm, const char pszFilename, int fFlags);
106	/** Pointer to dlmopen. */
107	typedef FNDLMOPEN *PFNDLMOPEN;
108	#endif
109
110	#endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
111
112
113	/*********************************************************************************************************************************
114	* Internal Functions *
115	*********************************************************************************************************************************/
116	#ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
117	static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlopenResolve;
118	#ifdef SUP_HARDENED_WITH_DLMOPEN
119	static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlmopenResolve;
120	#endif
121
122	/* SUPR3HardenedMainA-posix.asm: */
123	DECLASM(void) supR3HardenedPosixMonitor_Dlopen(const char *pszFilename, int fFlags);
124	#ifdef SUP_HARDENED_WITH_DLMOPEN
125	DECLASM(void) supR3HardenedPosixMonitor_Dlmopen(Lmid_t idLm, const char *pszFilename, int fFlags);
126	#endif
127	#endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
128
129
130	/*********************************************************************************************************************************
131	* Global Variables *
132	*********************************************************************************************************************************/
133	#ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
134
135	RT_C_DECLS_BEGIN
136	/** Resume patch for dlopen(), jumped to form assembly stub. */
137	DECL_HIDDEN_DATA(PFNDLOPEN) g_pfnDlopenReal = NULL;
138	#ifdef SUP_HARDENED_WITH_DLMOPEN
139	/** Resume patch for dlmopen(), jumped to form assembly stub. */
140	DECL_HIDDEN_DATA(PFNDLMOPEN) g_pfnDlmopenReal = NULL;
141	#endif
142	RT_C_DECLS_END
143
144	/** Memory allocated for the patches. */
145	static uint8_t *g_pbExecMemory = NULL;
146	/** Offset into the patch memory which is not used. */
147	static uint32_t g_offExecMemory = 0;
148
149	/**
150	* Array of hooks to install.
151	*/
152	static SUPHARDENEDPOSIXHOOK const g_aHooks[] =
153	{
154	/* pszSymbol, pfnHook, ppfnRealResume, pfnResolve */
155	{ "dlopen", (PFNRT)supR3HardenedPosixMonitor_Dlopen, (uintptr_t *)&g_pfnDlopenReal, supR3HardenedPosixMonitorDlopenResolve },
156	#ifdef SUP_HARDENED_WITH_DLMOPEN
157	{ "dlmopen", (PFNRT)supR3HardenedPosixMonitor_Dlmopen, (uintptr_t *)&g_pfnDlmopenReal, supR3HardenedPosixMonitorDlmopenResolve }
158	#endif
159	};
160
161
162
163	/**
164	* Verifies the given library for proper access rights for further loading
165	* into the process.
166	*
167	* @returns Flag whether the access rights of the library look sane and loading
168	* it is not considered a security risk. Returns true if the library
169	* looks sane, false otherwise.
170	* @param pszFilename The library to load, this can be an absolute or relative path
171	* or just the filename of the library when the default paths should
172	* be searched. NULL is allowed too to indicate opening the main
173	* binary.
174	*/
175	DECLASM(bool) supR3HardenedPosixMonitor_VerifyLibrary(const char *pszFilename)
176	{
177	/*
178	* Giving NULL as the filename indicates opening the main program which is fine
179	* We are already loaded and executing after all.
180	*
181	* Filenames without any path component (whether absolute or relative) are allowed
182	* unconditionally too as the loader will only search the default paths configured by root.
183	*/
184	bool fAllow = true;
185
186	if ( pszFilename
187	&& strchr(pszFilename, '/') != NULL)
188	{
189	#if defined(RT_OS_LINUX)
190	int rc = supR3HardenedVerifyFileFollowSymlinks(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
191	NULL /* pErrInfo */);
192	#else
193	int rc = supR3HardenedVerifyFile(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
194	NULL /* pErrInfo */);
195	#endif
196
197	if (RT_FAILURE(rc))
198	fAllow = false;
199	}
200
201	return fAllow;
202	}
203
204
205	/**
206	* Returns the start address of the given symbol if found or NULL otherwise.
207	*
208	* @returns Start address of the symbol or NULL if not found.
209	* @param pszSymbol The symbol name.
210	* @param pfnResolve The resolver to call before trying to query the start address.
211	*/
212	static void supR3HardenedMainPosixGetStartBySymbol(const char pszSymbol, PFNSUPHARDENEDSYMRESOLVE pfnResolve)
213	{
214	#ifndef RT_OS_SOLARIS
215	RT_NOREF(pfnResolve);
216	return dlsym(RTLD_DEFAULT, pszSymbol);
217
218	#else /* RT_OS_SOLARIS */
219	/*
220	* Solaris is tricky as dlsym doesn't return the actual start address of
221	* the symbol but the start of the trampoline in the PLT of the caller.
222	*
223	* Disassemble the first jmp instruction to get at the entry in the global
224	* offset table where the actual address is stored.
225	*
226	* To counter lazy symbol resolving, we first have to call the API before
227	* trying to resolve and disassemble it.
228	*/
229	pfnResolve();
230
231	uint8_t pbSym = (uint8_t )dlsym(RTLD_DEFAULT, pszSymbol);
232
233	# ifdef RT_ARCH_AMD64
234	DISSTATE Dis;
235	uint32_t cbInstr = 1;
236	int rc = DISInstr(pbSym, DISCPUMODE_64BIT, &Dis, &cbInstr);
237	if ( RT_FAILURE(rc)
238	\|\| Dis.pCurInstr->uOpcode != OP_JMP
239	\|\| !(Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */))
240	return NULL;
241
242	/* Extract start address. */
243	pbSym = (pbSym + cbInstr + Dis.Param1.uDisp.i32);
244	pbSym = (uint8_t )((uintptr_t *)pbSym);
245	# else
246	# error "Unsupported architecture"
247	# endif
248
249	return pbSym;
250	#endif /* RT_OS_SOLARIS */
251	}
252
253
254	/**
255	* Allocates executable patch memory with the given constraints.
256	*
257	* @returns VBox status code.
258	* @param cb Size of the patch memory in bytes.
259	* @param pvHint Where to try allocating nearby.
260	* @param fRipRelAddr Flag whether the executable memory must be within
261	* 2GB before or after the hint as it will contain
262	* instructions using RIP relative addressing
263	*/
264	static uint8_t supR3HardenedMainPosixExecMemAlloc(size_t cb, void pvHint, bool fRipRelAddr)
265	{
266	AssertReturn(cb < _1K, NULL);
267
268	/* Lazy allocation of exectuable memory. */
269	if (!g_pbExecMemory)
270	{
271	g_pbExecMemory = (uint8_t *)mmap(pvHint, DLOPEN_PATCH_MEMORY_SIZE, PROT_READ \| PROT_WRITE \| PROT_EXEC,
272	MAP_SHARED \| MAP_ANONYMOUS, -1, 0);
273	g_offExecMemory = 0;
274	if (g_pbExecMemory == MAP_FAILED)
275	return NULL;
276
277	memset(g_pbExecMemory, 0xcc, DLOPEN_PATCH_MEMORY_SIZE);
278	}
279
280	if (g_offExecMemory + cb >= DLOPEN_PATCH_MEMORY_SIZE)
281	return NULL;
282
283	uint8_t *pb = &g_pbExecMemory[g_offExecMemory];
284
285	if (fRipRelAddr)
286	{
287	/* Check that we allocated within 2GB of the hint. */
288	uintptr_t uPtrHint = (uintptr_t)pvHint;
289	uintptr_t uPtrPatchMem = (uintptr_t)pb;
290	uintptr_t cbDistance = uPtrHint < uPtrPatchMem
291	? uPtrPatchMem - uPtrHint
292	: uPtrHint - uPtrPatchMem;
293
294	if (cbDistance >= _2G - _4K)
295	return NULL;
296	}
297
298	g_offExecMemory = RT_ALIGN_32(g_offExecMemory + cb, 16);
299	return pb;
300	}
301
302
303	/**
304	* Hooks the given method to execute the given one first.
305	*
306	* @returns VBox status code.
307	* @param pszSymbol The symbol to hook.
308	* @param pfnHook The hook to install.
309	* @param ppfnReal Where to store the pointer to entry point of the real method
310	* (somewhere in patch memory).
311	* @param pfnResolve The resolver to call before trying to query the start address.
312	*/
313	static int supR3HardenedMainPosixHookOne(const char pszSymbol, PFNRT pfnHook, uintptr_t /PFNRT/ ppfnReal,
314	PFNSUPHARDENEDSYMRESOLVE pfnResolve)
315	{
316	void *pfnTarget = supR3HardenedMainPosixGetStartBySymbol(pszSymbol, pfnResolve);
317	if (!pfnTarget)
318	return VERR_NOT_FOUND;
319
320	/*
321	* Make the target memory writeable to be able to insert the patch.
322	* Unprotect two pages in case the code crosses a page boundary.
323	*/
324	void pvTargetBase = (void )(((uintptr_t)pfnTarget) & ~(uintptr_t)(_4K - 1));
325	int rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_WRITE \| PROT_READ \| PROT_EXEC);
326	if (rcPsx == -1)
327	return VERR_SUPLIB_TEXT_NOT_WRITEABLE;
328
329	uint8_t * const pbTarget = (uint8_t *)(uintptr_t)pfnTarget;
330
331	DISSTATE Dis;
332	uint32_t cbInstr;
333	uint32_t offJmpBack = 0;
334	uint32_t cbPatchMem = 0;
335
336	#ifdef RT_ARCH_AMD64
337	/*
338	* Patch 64-bit hosts.
339	*/
340	uint32_t cRipRelMovs = 0;
341	uint32_t cRelCalls = 0;
342
343	/* Just use the disassembler to skip 12 bytes or more, we might need to
344	rewrite mov instructions using RIP relative addressing. */
345	while (offJmpBack < 12)
346	{
347	cbInstr = 1;
348	int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_64BIT, &Dis, &cbInstr);
349	if ( RT_FAILURE(rc)
350	\|\| ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
351	&& Dis.pCurInstr->uOpcode != OP_CALL)
352	\|\| ( Dis.ModRM.Bits.Mod == 0
353	&& Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
354	&& Dis.pCurInstr->uOpcode != OP_MOV))
355	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
356
357	if (Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */)
358	cRipRelMovs++;
359	if ( Dis.pCurInstr->uOpcode == OP_CALL
360	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
361	cRelCalls++;
362
363	offJmpBack += cbInstr;
364	cbPatchMem += cbInstr;
365	}
366
367	/*
368	* Each relative call requires extra bytes as it is converted to a pushq imm32
369	* + mov [RSP+4], imm32 + a jmp qword [$+8 wrt RIP] to avoid clobbering registers.
370	*/
371	cbPatchMem += cRelCalls * RT_ALIGN_32(13 + 6 + 8, 8);
372	cbPatchMem += 14; /* jmp qword [$+8 wrt RIP] + 8 byte address to jump to. */
373	cbPatchMem = RT_ALIGN_32(cbPatchMem, 8);
374
375	/* Allocate suitable executable memory available. */
376	bool fConvRipRelMovs = false;
377	uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, cRipRelMovs > 0);
378	if (!pbPatchMem)
379	{
380	/*
381	* Try to allocate memory again without the RIP relative mov addressing constraint
382	* Makes it a bit more difficult for us later on but there is no way around it.
383	* We need to increase the patch memory because we create two instructions for one
384	* (7 bytes for the RIP relative mov vs. 13 bytes for the two instructions replacing it ->
385	* need to allocate 6 bytes more per RIP relative mov).
386	*/
387	fConvRipRelMovs = true;
388	if (cRipRelMovs > 0)
389	pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem + cRipRelMovs * 6,
390	pbTarget, false /fRipRelAddr/);
391
392	if (!pbPatchMem)
393	return VERR_NO_MEMORY;
394	}
395
396	/* Assemble the code for resuming the call.*/
397	*ppfnReal = (uintptr_t)pbPatchMem;
398
399	/* Go through the instructions to patch and fixup any rip relative mov instructions. */
400	uint32_t offInsn = 0;
401	while (offInsn < offJmpBack)
402	{
403	cbInstr = 1;
404	int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_64BIT, &Dis, &cbInstr);
405	if ( RT_FAILURE(rc)
406	\|\| ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
407	&& Dis.pCurInstr->uOpcode != OP_CALL))
408	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
409
410	if ( Dis.ModRM.Bits.Mod == 0
411	&& Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
412	&& Dis.pCurInstr->uOpcode == OP_MOV)
413	{
414	/* Deduce destination register and write out new instruction. */
415	if (RT_UNLIKELY(!( (Dis.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
416	&& (Dis.Param2.fUse & DISUSE_RIPDISPLACEMENT32))))
417	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
418
419	uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param2.uDisp.i32;
420
421	if (fConvRipRelMovs)
422	{
423	/*
424	* Create two instructions, first one moves the address as a constant to the destination register
425	* and the second one loads the data from the memory into the destination register.
426	*/
427
428	*pbPatchMem++ = 0x48;
429	*pbPatchMem++ = 0xb8 + Dis.Param1.Base.idxGenReg;
430	(uintptr_t )pbPatchMem = uAddr;
431	pbPatchMem += sizeof(uintptr_t);
432
433	*pbPatchMem++ = 0x48;
434	*pbPatchMem++ = 0x8b;
435	*pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) \| Dis.Param1.Base.idxGenReg;
436	}
437	else
438	{
439	intptr_t iDispNew = uAddr - (uintptr_t)&pbPatchMem[3 + sizeof(int32_t)];
440	Assert(iDispNew == (int32_t)iDispNew);
441
442	/* Assemble the mov to register instruction with the updated rip relative displacement. */
443	*pbPatchMem++ = 0x48;
444	*pbPatchMem++ = 0x8b;
445	*pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) \| 5;
446	(int32_t )pbPatchMem = (int32_t)iDispNew;
447	pbPatchMem += sizeof(int32_t);
448	}
449	}
450	else if ( Dis.pCurInstr->uOpcode == OP_CALL
451	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
452	{
453	/* Convert to absolute jump. */
454	uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param1.uValue;
455
456	/* Skip the push instructions till the return address is known. */
457	uint8_t *pbPatchMemPush = pbPatchMem;
458	pbPatchMem += 13;
459
460	pbPatchMem++ = 0xff; / jmp qword [$+8 wrt RIP] */
461	*pbPatchMem++ = 0x25;
462	(uint32_t )pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
463	pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
464	(uint64_t )pbPatchMem = uAddr;
465	pbPatchMem += sizeof(uint64_t);
466
467	/* Push the return address onto stack. Difficult on amd64 without clobbering registers... */
468	uintptr_t uAddrReturn = (uintptr_t)pbPatchMem;
469	pbPatchMemPush++ = 0x68; / push imm32 sign-extended as 64-bit*/
470	(uint32_t )pbPatchMemPush = RT_LO_U32(uAddrReturn);
471	pbPatchMemPush += sizeof(uint32_t);
472	*pbPatchMemPush++ = 0xc7;
473	*pbPatchMemPush++ = 0x44;
474	*pbPatchMemPush++ = 0x24;
475	pbPatchMemPush++ = 0x04; / movl [RSP+4], imm32 */
476	(uint32_t )pbPatchMemPush = RT_HI_U32(uAddrReturn);
477	}
478	else
479	{
480	memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
481	pbPatchMem += cbInstr;
482	}
483
484	offInsn += cbInstr;
485	}
486
487	pbPatchMem++ = 0xff; / jmp qword [$+8 wrt RIP] */
488	*pbPatchMem++ = 0x25;
489	(uint32_t )pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
490	pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
491	(uint64_t )pbPatchMem = (uintptr_t)&pbTarget[offJmpBack];
492
493	/* Assemble the patch. */
494	Assert(offJmpBack >= 12);
495	pbTarget[0] = 0x48; /* mov rax, qword */
496	pbTarget[1] = 0xb8;
497	(uintptr_t )&pbTarget[2] = (uintptr_t)pfnHook;
498	pbTarget[10] = 0xff; /* jmp rax */
499	pbTarget[11] = 0xe0;
500
501	#else /* !RT_ARCH_AMD64 */
502	/*
503	* Patch 32-bit hosts.
504	*/
505	/* Just use the disassembler to skip 5 bytes or more. */
506	while (offJmpBack < 5)
507	{
508	cbInstr = 1;
509	int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr);
510	if ( RT_FAILURE(rc)
511	\|\| ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
512	&& Dis.pCurInstr->uOpcode != OP_CALL))
513	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
514
515	if ( Dis.pCurInstr->uOpcode == OP_CALL
516	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
517	cbPatchMem += 10; /* push imm32 + jmp rel32 */
518	else
519	cbPatchMem += cbInstr;
520
521	offJmpBack += cbInstr;
522	}
523
524	/* Allocate suitable exectuable memory available. */
525	uint8_t pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, false / fRipRelAddr */);
526	if (!pbPatchMem)
527	return VERR_NO_MEMORY;
528
529	/* Assemble the code for resuming the call.*/
530	*ppfnReal = (uintptr_t)pbPatchMem;
531
532	/* Go through the instructions to patch and fixup any relative call instructions. */
533	uint32_t offInsn = 0;
534	while (offInsn < offJmpBack)
535	{
536	cbInstr = 1;
537	int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_32BIT, &Dis, &cbInstr);
538	if ( RT_FAILURE(rc)
539	\|\| ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
540	&& Dis.pCurInstr->uOpcode != OP_CALL))
541	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
542
543	if ( Dis.pCurInstr->uOpcode == OP_CALL
544	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
545	{
546	/*
547	* Don't use a call instruction directly but push the original return address
548	* onto the stack and use a relative jump to the call target.
549	* The reason here is that on Linux the called method saves the return
550	* address from the stack which will be different from the original because
551	* the code is executed from our patch memory.
552	*
553	* Luckily the call instruction is 5 bytes long which means it is always the
554	* last instruction to patch and we don't need to return from the call
555	* to patch memory anyway but can use this method to resume the original call.
556	*/
557	AssertReturn(offInsn + cbInstr >= offJmpBack, VERR_SUPLIB_UNEXPECTED_INSTRUCTION); /* Must be last instruction! */
558
559	/* push return address */
560	uint32_t const uAddrReturn = (uintptr_t)&pbTarget[offInsn + cbInstr]; /* The return address to push to the stack. */
561
562	pbPatchMem++ = 0x68; / push dword */
563	(uint32_t )pbPatchMem = uAddrReturn;
564	pbPatchMem += sizeof(uint32_t);
565
566	/* jmp rel32 to the call target */
567	uintptr_t const uAddr = uAddrReturn + (int32_t)Dis.Param1.uValue;
568	int32_t const i32DispNew = uAddr - (uintptr_t)&pbPatchMem[5];
569
570	pbPatchMem++ = 0xe9; / jmp rel32 */
571	(int32_t )pbPatchMem = i32DispNew;
572	pbPatchMem += sizeof(int32_t);
573	}
574	else
575	{
576	memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
577	pbPatchMem += cbInstr;
578	}
579
580	offInsn += cbInstr;
581	}
582
583	pbPatchMem++ = 0xe9; / jmp rel32 */
584	(uint32_t )pbPatchMem = (uintptr_t)&pbTarget[offJmpBack] - ((uintptr_t)pbPatchMem + 4);
585
586	/* Assemble the patch. */
587	Assert(offJmpBack >= 5);
588	pbTarget[0] = 0xe9;
589	(uint32_t )&pbTarget[1] = (uintptr_t)pfnHook - (uintptr_t)&pbTarget[1+4];
590	#endif /* !RT_ARCH_AMD64 */
591
592	/*
593	* Re-seal target (ASSUMING that the shared object either has page aligned
594	* section or that the patch target is far enough from the writable parts).
595	*/
596	rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_READ \| PROT_EXEC);
597	if (rcPsx == -1)
598	return VERR_SUPLIB_TEXT_NOT_SEALED;
599
600	return VINF_SUCCESS;
601	}
602
603
604	/**
605	* @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlopen}
606	*/
607	static DECLCALLBACK(void) supR3HardenedPosixMonitorDlopenResolve(void)
608	{
609	/* Make harmless dlopen call. */
610	void *pv = dlopen(NULL, RTLD_LAZY);
611	if (pv)
612	dlclose(pv);
613	}
614
615
616	#ifdef SUP_HARDENED_WITH_DLMOPEN
617	/**
618	* @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlmopen}
619	*/
620	static DECLCALLBACK(void) supR3HardenedPosixMonitorDlmopenResolve(void)
621	{
622	/* Make harmless dlmopen call. */
623	void *pv = dlmopen(LM_ID_BASE, NULL, RTLD_LAZY);
624	if (pv)
625	dlclose(pv);
626	}
627	#endif
628
629	#endif /* SUP_HARDENED_WITHOUT_DLOPEN_PATCHING */
630
631
632	/**
633	* Hardening initialization for POSIX compatible hosts.
634	*
635	* @returns nothing.
636	*
637	* @note Doesn't return on error.
638	*/
639	DECLHIDDEN(void) supR3HardenedPosixInit(void)
640	{
641	#ifndef SUP_HARDENED_WITHOUT_DLOPEN_PATCHING
642	for (unsigned i = 0; i < RT_ELEMENTS(g_aHooks); i++)
643	{
644	PCSUPHARDENEDPOSIXHOOK pHook = &g_aHooks[i];
645	int rc = supR3HardenedMainPosixHookOne(pHook->pszSymbol, pHook->pfnHook, pHook->ppfnRealResume, pHook->pfnResolve);
646	if (RT_FAILURE(rc))
647	supR3HardenedFatalMsg("supR3HardenedPosixInit", kSupInitOp_Integrity, rc,
648	"Failed to hook the %s interface", pHook->pszSymbol);
649	}
650	#endif
651	}
652
653
654
655	/*
656	* assert.cpp
657	*
658	* ASSUMES working DECLHIDDEN or there will be symbol confusion!
659	*/
660
661	RTDATADECL(char) g_szRTAssertMsg1[1024];
662	RTDATADECL(char) g_szRTAssertMsg2[4096];
663	RTDATADECL(const char * volatile) g_pszRTAssertExpr;
664	RTDATADECL(const char * volatile) g_pszRTAssertFile;
665	RTDATADECL(uint32_t volatile) g_u32RTAssertLine;
666	RTDATADECL(const char * volatile) g_pszRTAssertFunction;
667
668	RTDECL(bool) RTAssertMayPanic(void)
669	{
670	return true;
671	}
672
673
674	RTDECL(void) RTAssertMsg1(const char pszExpr, unsigned uLine, const char pszFile, const char *pszFunction)
675	{
676	/*
677	* Fill in the globals.
678	*/
679	g_pszRTAssertExpr = pszExpr;
680	g_pszRTAssertFile = pszFile;
681	g_pszRTAssertFunction = pszFunction;
682	g_u32RTAssertLine = uLine;
683	snprintf(g_szRTAssertMsg1, sizeof(g_szRTAssertMsg1),
684	"\n!!Assertion Failed!!\n"
685	"Expression: %s\n"
686	"Location : %s(%u) %s\n",
687	pszExpr, pszFile, uLine, pszFunction);
688	}
689
690
691	RTDECL(void) RTAssertMsg2V(const char *pszFormat, va_list va)
692	{
693	vsnprintf(g_szRTAssertMsg2, sizeof(g_szRTAssertMsg2), pszFormat, va);
694	if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN)
695	supR3HardenedFatalMsg(g_pszRTAssertExpr, kSupInitOp_Misc, VERR_INTERNAL_ERROR,
696	"%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
697	else
698	supR3HardenedError(VERR_INTERNAL_ERROR, false/fFatal/, "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
699	}
700

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp@ 94439

Download in other formats: