SUPR3HardenedMain-posix.cpp@ 92651

Last change on this file since 92651 was 87030, checked in by vboxsync, 4 years ago
Forward port r141521, r141567, r141568, r141588, r141589, r141590, r141592, r141593, r141594, r141595 and r141652 from 6.1 (Fixes for BigSur with SIP disabled, bugref:9836)
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 25.9 KB

Line
1	/* $Id: SUPR3HardenedMain-posix.cpp 87030 2020-12-02 10:46:49Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Hardened main(), posix bits.
4	*/
5
6	/*
7	* Copyright (C) 2017-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <VBox/err.h>
32	#include <VBox/dis.h>
33	#include <VBox/sup.h>
34
35	#include <iprt/path.h>
36	#include <iprt/string.h>
37	#include <iprt/x86.h>
38
39	#include <dlfcn.h>
40	#include <sys/mman.h>
41	#if defined(RT_OS_SOLARIS)
42	# include <link.h>
43	#endif
44	#include <stdio.h>
45	#include <stdint.h>
46
47	#include "SUPLibInternal.h"
48
49
50	/*********************************************************************************************************************************
51	* Defined Constants And Macros *
52	*********************************************************************************************************************************/
53
54	/**
55	* Memory for code patching.
56	*/
57	#define DLOPEN_PATCH_MEMORY_SIZE _4K
58
59
60	/*********************************************************************************************************************************
61	* Structures and Typedefs *
62	*********************************************************************************************************************************/
63	/**
64	* Callback (SUPHARDENEDPOSIXHOOK::pfnResolv) for triggering lazy GOT resolver.
65	*
66	* This generally just calls the API in a harmless manner and triggers the lazy
67	* resolving of the symbol, ensuring a proper address in the GOT/PLT entry.
68	*
69	* On Solaris dlsym() will return the value in the GOT/PLT entry. We don't wish
70	* to patch the lazy loader trampoline function, but rather the real function!
71	*/
72	typedef DECLCALLBACKTYPE(void, FNSUPHARDENEDSYMRESOLVE,(void));
73	/** Pointer to FNSUPHARDENEDSYMRESOLVE. */
74	typedef FNSUPHARDENEDSYMRESOLVE *PFNSUPHARDENEDSYMRESOLVE;
75
76	/**
77	* A hook descriptor.
78	*/
79	typedef struct SUPHARDENEDPOSIXHOOK
80	{
81	/** The symbol to hook. */
82	const char *pszSymbol;
83	/** The intercepting wrapper doing additional checks. */
84	PFNRT pfnHook;
85	/** Where to store the pointer to the code into patch memory
86	* which resumes the original call.
87	* @note uintptr_t instead of PFNRT is for Clang 11. */
88	uintptr_t *ppfnRealResume;
89	/** Pointer to the resolver method used on Solaris. */
90	PFNSUPHARDENEDSYMRESOLVE pfnResolve;
91	} SUPHARDENEDPOSIXHOOK;
92	/** Pointer to a hook descriptor. */
93	typedef SUPHARDENEDPOSIXHOOK *PSUPHARDENEDPOSIXHOOK;
94	/** Pointer to a const hook descriptor. */
95	typedef const SUPHARDENEDPOSIXHOOK *PCSUPHARDENEDPOSIXHOOK;
96
97	/** dlopen() declaration. */
98	typedef void FNDLOPEN(const char pszFilename, int fFlags);
99	/** Pointer to dlopen. */
100	typedef FNDLOPEN *PFNDLOPEN;
101
102	#ifdef SUP_HARDENED_WITH_DLMOPEN
103	/** dlmopen() declaration */
104	typedef void FNDLMOPEN(Lmid_t idLm, const char pszFilename, int fFlags);
105	/** Pointer to dlmopen. */
106	typedef FNDLMOPEN *PFNDLMOPEN;
107	#endif
108
109
110	/*********************************************************************************************************************************
111	* Internal Functions *
112	*********************************************************************************************************************************/
113	static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlopenResolve;
114	#ifdef SUP_HARDENED_WITH_DLMOPEN
115	static FNSUPHARDENEDSYMRESOLVE supR3HardenedPosixMonitorDlmopenResolve;
116	#endif
117
118	/* SUPR3HardenedMainA-posix.asm: */
119	DECLASM(void) supR3HardenedPosixMonitor_Dlopen(const char *pszFilename, int fFlags);
120	#ifdef SUP_HARDENED_WITH_DLMOPEN
121	DECLASM(void) supR3HardenedPosixMonitor_Dlmopen(Lmid_t idLm, const char *pszFilename, int fFlags);
122	#endif
123
124
125	/*********************************************************************************************************************************
126	* Global Variables *
127	*********************************************************************************************************************************/
128	RT_C_DECLS_BEGIN
129	/** Resume patch for dlopen(), jumped to form assembly stub. */
130	DECL_HIDDEN_DATA(PFNDLOPEN) g_pfnDlopenReal = NULL;
131	#ifdef SUP_HARDENED_WITH_DLMOPEN
132	/** Resume patch for dlmopen(), jumped to form assembly stub. */
133	DECL_HIDDEN_DATA(PFNDLMOPEN) g_pfnDlmopenReal = NULL;
134	#endif
135	RT_C_DECLS_END
136
137	/** Memory allocated for the patches. */
138	static uint8_t *g_pbExecMemory = NULL;
139	/** Offset into the patch memory which is not used. */
140	static uint32_t g_offExecMemory = 0;
141
142	/**
143	* Array of hooks to install.
144	*/
145	static SUPHARDENEDPOSIXHOOK const g_aHooks[] =
146	{
147	/* pszSymbol, pfnHook, ppfnRealResume, pfnResolve */
148	{ "dlopen", (PFNRT)supR3HardenedPosixMonitor_Dlopen, (uintptr_t *)&g_pfnDlopenReal, supR3HardenedPosixMonitorDlopenResolve },
149	#ifdef SUP_HARDENED_WITH_DLMOPEN
150	{ "dlmopen", (PFNRT)supR3HardenedPosixMonitor_Dlmopen, (uintptr_t *)&g_pfnDlmopenReal, supR3HardenedPosixMonitorDlmopenResolve }
151	#endif
152	};
153
154
155
156	/**
157	* Verifies the given library for proper access rights for further loading
158	* into the process.
159	*
160	* @returns Flag whether the access rights of the library look sane and loading
161	* it is not considered a security risk. Returns true if the library
162	* looks sane, false otherwise.
163	* @param pszFilename The library to load, this can be an absolute or relative path
164	* or just the filename of the library when the default paths should
165	* be searched. NULL is allowed too to indicate opening the main
166	* binary.
167	*/
168	DECLASM(bool) supR3HardenedPosixMonitor_VerifyLibrary(const char *pszFilename)
169	{
170	/*
171	* Giving NULL as the filename indicates opening the main program which is fine
172	* We are already loaded and executing after all.
173	*
174	* Filenames without any path component (whether absolute or relative) are allowed
175	* unconditionally too as the loader will only search the default paths configured by root.
176	*/
177	bool fAllow = true;
178
179	if ( pszFilename
180	&& strchr(pszFilename, '/') != NULL)
181	{
182	#if defined(RT_OS_LINUX)
183	int rc = supR3HardenedVerifyFileFollowSymlinks(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
184	NULL /* pErrInfo */);
185	#else
186	int rc = supR3HardenedVerifyFile(pszFilename, RTHCUINTPTR_MAX, true /* fMaybe3rdParty */,
187	NULL /* pErrInfo */);
188	#endif
189
190	if (RT_FAILURE(rc))
191	fAllow = false;
192	}
193
194	return fAllow;
195	}
196
197
198	/**
199	* Returns the start address of the given symbol if found or NULL otherwise.
200	*
201	* @returns Start address of the symbol or NULL if not found.
202	* @param pszSymbol The symbol name.
203	* @param pfnResolve The resolver to call before trying to query the start address.
204	*/
205	static void supR3HardenedMainPosixGetStartBySymbol(const char pszSymbol, PFNSUPHARDENEDSYMRESOLVE pfnResolve)
206	{
207	#ifndef RT_OS_SOLARIS
208	RT_NOREF(pfnResolve);
209	return dlsym(RTLD_DEFAULT, pszSymbol);
210
211	#else /* RT_OS_SOLARIS */
212	/*
213	* Solaris is tricky as dlsym doesn't return the actual start address of
214	* the symbol but the start of the trampoline in the PLT of the caller.
215	*
216	* Disassemble the first jmp instruction to get at the entry in the global
217	* offset table where the actual address is stored.
218	*
219	* To counter lazy symbol resolving, we first have to call the API before
220	* trying to resolve and disassemble it.
221	*/
222	pfnResolve();
223
224	uint8_t pbSym = (uint8_t )dlsym(RTLD_DEFAULT, pszSymbol);
225
226	# ifdef RT_ARCH_AMD64
227	DISSTATE Dis;
228	uint32_t cbInstr = 1;
229	int rc = DISInstr(pbSym, DISCPUMODE_64BIT, &Dis, &cbInstr);
230	if ( RT_FAILURE(rc)
231	\|\| Dis.pCurInstr->uOpcode != OP_JMP
232	\|\| !(Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */))
233	return NULL;
234
235	/* Extract start address. */
236	pbSym = (pbSym + cbInstr + Dis.Param1.uDisp.i32);
237	pbSym = (uint8_t )((uintptr_t *)pbSym);
238	# else
239	# error "Unsupported architecture"
240	# endif
241
242	return pbSym;
243	#endif /* RT_OS_SOLARIS */
244	}
245
246
247	/**
248	* Allocates executable patch memory with the given constraints.
249	*
250	* @returns VBox status code.
251	* @param cb Size of the patch memory in bytes.
252	* @param pvHint Where to try allocating nearby.
253	* @param fRipRelAddr Flag whether the executable memory must be within
254	* 2GB before or after the hint as it will contain
255	* instructions using RIP relative addressing
256	*/
257	static uint8_t supR3HardenedMainPosixExecMemAlloc(size_t cb, void pvHint, bool fRipRelAddr)
258	{
259	AssertReturn(cb < _1K, NULL);
260
261	/* Lazy allocation of exectuable memory. */
262	if (!g_pbExecMemory)
263	{
264	g_pbExecMemory = (uint8_t *)mmap(pvHint, DLOPEN_PATCH_MEMORY_SIZE, PROT_READ \| PROT_WRITE \| PROT_EXEC,
265	MAP_SHARED \| MAP_ANONYMOUS, -1, 0);
266	g_offExecMemory = 0;
267	if (g_pbExecMemory == MAP_FAILED)
268	return NULL;
269
270	memset(g_pbExecMemory, 0xcc, DLOPEN_PATCH_MEMORY_SIZE);
271	}
272
273	if (g_offExecMemory + cb >= DLOPEN_PATCH_MEMORY_SIZE)
274	return NULL;
275
276	uint8_t *pb = &g_pbExecMemory[g_offExecMemory];
277
278	if (fRipRelAddr)
279	{
280	/* Check that we allocated within 2GB of the hint. */
281	uintptr_t uPtrHint = (uintptr_t)pvHint;
282	uintptr_t uPtrPatchMem = (uintptr_t)pb;
283	uintptr_t cbDistance = uPtrHint < uPtrPatchMem
284	? uPtrPatchMem - uPtrHint
285	: uPtrHint - uPtrPatchMem;
286
287	if (cbDistance >= _2G - _4K)
288	return NULL;
289	}
290
291	g_offExecMemory = RT_ALIGN_32(g_offExecMemory + cb, 16);
292	return pb;
293	}
294
295
296	/**
297	* Hooks the given method to execute the given one first.
298	*
299	* @returns VBox status code.
300	* @param pszSymbol The symbol to hook.
301	* @param pfnHook The hook to install.
302	* @param ppfnReal Where to store the pointer to entry point of the real method
303	* (somewhere in patch memory).
304	* @param pfnResolve The resolver to call before trying to query the start address.
305	*/
306	static int supR3HardenedMainPosixHookOne(const char pszSymbol, PFNRT pfnHook, uintptr_t /PFNRT/ ppfnReal,
307	PFNSUPHARDENEDSYMRESOLVE pfnResolve)
308	{
309	void *pfnTarget = supR3HardenedMainPosixGetStartBySymbol(pszSymbol, pfnResolve);
310	if (!pfnTarget)
311	return VERR_NOT_FOUND;
312
313	/*
314	* Make the target memory writeable to be able to insert the patch.
315	* Unprotect two pages in case the code crosses a page boundary.
316	*/
317	void pvTargetBase = (void )(((uintptr_t)pfnTarget) & ~(uintptr_t)(_4K - 1));
318	int rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_WRITE \| PROT_READ \| PROT_EXEC);
319	if (rcPsx == -1)
320	return VERR_SUPLIB_TEXT_NOT_WRITEABLE;
321
322	uint8_t * const pbTarget = (uint8_t *)(uintptr_t)pfnTarget;
323
324	DISSTATE Dis;
325	uint32_t cbInstr;
326	uint32_t offJmpBack = 0;
327	uint32_t cbPatchMem = 0;
328
329	#ifdef RT_ARCH_AMD64
330	/*
331	* Patch 64-bit hosts.
332	*/
333	uint32_t cRipRelMovs = 0;
334	uint32_t cRelCalls = 0;
335
336	/* Just use the disassembler to skip 12 bytes or more, we might need to
337	rewrite mov instructions using RIP relative addressing. */
338	while (offJmpBack < 12)
339	{
340	cbInstr = 1;
341	int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_64BIT, &Dis, &cbInstr);
342	if ( RT_FAILURE(rc)
343	\|\| ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
344	&& Dis.pCurInstr->uOpcode != OP_CALL)
345	\|\| ( Dis.ModRM.Bits.Mod == 0
346	&& Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
347	&& Dis.pCurInstr->uOpcode != OP_MOV))
348	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
349
350	if (Dis.ModRM.Bits.Mod == 0 && Dis.ModRM.Bits.Rm == 5 /* wrt RIP */)
351	cRipRelMovs++;
352	if ( Dis.pCurInstr->uOpcode == OP_CALL
353	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
354	cRelCalls++;
355
356	offJmpBack += cbInstr;
357	cbPatchMem += cbInstr;
358	}
359
360	/*
361	* Each relative call requires extra bytes as it is converted to a pushq imm32
362	* + mov [RSP+4], imm32 + a jmp qword [$+8 wrt RIP] to avoid clobbering registers.
363	*/
364	cbPatchMem += cRelCalls * RT_ALIGN_32(13 + 6 + 8, 8);
365	cbPatchMem += 14; /* jmp qword [$+8 wrt RIP] + 8 byte address to jump to. */
366	cbPatchMem = RT_ALIGN_32(cbPatchMem, 8);
367
368	/* Allocate suitable executable memory available. */
369	bool fConvRipRelMovs = false;
370	uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, cRipRelMovs > 0);
371	if (!pbPatchMem)
372	{
373	/*
374	* Try to allocate memory again without the RIP relative mov addressing constraint
375	* Makes it a bit more difficult for us later on but there is no way around it.
376	* We need to increase the patch memory because we create two instructions for one
377	* (7 bytes for the RIP relative mov vs. 13 bytes for the two instructions replacing it ->
378	* need to allocate 6 bytes more per RIP relative mov).
379	*/
380	fConvRipRelMovs = true;
381	if (cRipRelMovs > 0)
382	pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem + cRipRelMovs * 6,
383	pbTarget, false /fRipRelAddr/);
384
385	if (!pbPatchMem)
386	return VERR_NO_MEMORY;
387	}
388
389	/* Assemble the code for resuming the call.*/
390	*ppfnReal = (uintptr_t)pbPatchMem;
391
392	/* Go through the instructions to patch and fixup any rip relative mov instructions. */
393	uint32_t offInsn = 0;
394	while (offInsn < offJmpBack)
395	{
396	cbInstr = 1;
397	int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_64BIT, &Dis, &cbInstr);
398	if ( RT_FAILURE(rc)
399	\|\| ( Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW
400	&& Dis.pCurInstr->uOpcode != OP_CALL))
401	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
402
403	if ( Dis.ModRM.Bits.Mod == 0
404	&& Dis.ModRM.Bits.Rm == 5 /* wrt RIP */
405	&& Dis.pCurInstr->uOpcode == OP_MOV)
406	{
407	/* Deduce destination register and write out new instruction. */
408	if (RT_UNLIKELY(!( (Dis.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
409	&& (Dis.Param2.fUse & DISUSE_RIPDISPLACEMENT32))))
410	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
411
412	uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param2.uDisp.i32;
413
414	if (fConvRipRelMovs)
415	{
416	/*
417	* Create two instructions, first one moves the address as a constant to the destination register
418	* and the second one loads the data from the memory into the destination register.
419	*/
420
421	*pbPatchMem++ = 0x48;
422	*pbPatchMem++ = 0xb8 + Dis.Param1.Base.idxGenReg;
423	(uintptr_t )pbPatchMem = uAddr;
424	pbPatchMem += sizeof(uintptr_t);
425
426	*pbPatchMem++ = 0x48;
427	*pbPatchMem++ = 0x8b;
428	*pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) \| Dis.Param1.Base.idxGenReg;
429	}
430	else
431	{
432	intptr_t iDispNew = uAddr - (uintptr_t)&pbPatchMem[3 + sizeof(int32_t)];
433	Assert(iDispNew == (int32_t)iDispNew);
434
435	/* Assemble the mov to register instruction with the updated rip relative displacement. */
436	*pbPatchMem++ = 0x48;
437	*pbPatchMem++ = 0x8b;
438	*pbPatchMem++ = (Dis.Param1.Base.idxGenReg << X86_MODRM_REG_SHIFT) \| 5;
439	(int32_t )pbPatchMem = (int32_t)iDispNew;
440	pbPatchMem += sizeof(int32_t);
441	}
442	}
443	else if ( Dis.pCurInstr->uOpcode == OP_CALL
444	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
445	{
446	/* Convert to absolute jump. */
447	uintptr_t uAddr = (uintptr_t)&pbTarget[offInsn + cbInstr] + (intptr_t)Dis.Param1.uValue;
448
449	/* Skip the push instructions till the return address is known. */
450	uint8_t *pbPatchMemPush = pbPatchMem;
451	pbPatchMem += 13;
452
453	pbPatchMem++ = 0xff; / jmp qword [$+8 wrt RIP] */
454	*pbPatchMem++ = 0x25;
455	(uint32_t )pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
456	pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
457	(uint64_t )pbPatchMem = uAddr;
458	pbPatchMem += sizeof(uint64_t);
459
460	/* Push the return address onto stack. Difficult on amd64 without clobbering registers... */
461	uintptr_t uAddrReturn = (uintptr_t)pbPatchMem;
462	pbPatchMemPush++ = 0x68; / push imm32 sign-extended as 64-bit*/
463	(uint32_t )pbPatchMemPush = RT_LO_U32(uAddrReturn);
464	pbPatchMemPush += sizeof(uint32_t);
465	*pbPatchMemPush++ = 0xc7;
466	*pbPatchMemPush++ = 0x44;
467	*pbPatchMemPush++ = 0x24;
468	pbPatchMemPush++ = 0x04; / movl [RSP+4], imm32 */
469	(uint32_t )pbPatchMemPush = RT_HI_U32(uAddrReturn);
470	}
471	else
472	{
473	memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
474	pbPatchMem += cbInstr;
475	}
476
477	offInsn += cbInstr;
478	}
479
480	pbPatchMem++ = 0xff; / jmp qword [$+8 wrt RIP] */
481	*pbPatchMem++ = 0x25;
482	(uint32_t )pbPatchMem = (uint32_t)(RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *) - (pbPatchMem + 4));
483	pbPatchMem = RT_ALIGN_PT(pbPatchMem + 4, 8, uint8_t *);
484	(uint64_t )pbPatchMem = (uintptr_t)&pbTarget[offJmpBack];
485
486	/* Assemble the patch. */
487	Assert(offJmpBack >= 12);
488	pbTarget[0] = 0x48; /* mov rax, qword */
489	pbTarget[1] = 0xb8;
490	(uintptr_t )&pbTarget[2] = (uintptr_t)pfnHook;
491	pbTarget[10] = 0xff; /* jmp rax */
492	pbTarget[11] = 0xe0;
493
494	#else /* !RT_ARCH_AMD64 */
495	/*
496	* Patch 32-bit hosts.
497	*/
498	/* Just use the disassembler to skip 5 bytes or more. */
499	while (offJmpBack < 5)
500	{
501	cbInstr = 1;
502	int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr);
503	if ( RT_FAILURE(rc)
504	\|\| ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
505	&& Dis.pCurInstr->uOpcode != OP_CALL))
506	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
507
508	if ( Dis.pCurInstr->uOpcode == OP_CALL
509	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
510	cbPatchMem += 10; /* push imm32 + jmp rel32 */
511	else
512	cbPatchMem += cbInstr;
513
514	offJmpBack += cbInstr;
515	}
516
517	/* Allocate suitable exectuable memory available. */
518	uint8_t pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, false / fRipRelAddr */);
519	if (!pbPatchMem)
520	return VERR_NO_MEMORY;
521
522	/* Assemble the code for resuming the call.*/
523	*ppfnReal = (uintptr_t)pbPatchMem;
524
525	/* Go through the instructions to patch and fixup any relative call instructions. */
526	uint32_t offInsn = 0;
527	while (offInsn < offJmpBack)
528	{
529	cbInstr = 1;
530	int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_32BIT, &Dis, &cbInstr);
531	if ( RT_FAILURE(rc)
532	\|\| ( (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
533	&& Dis.pCurInstr->uOpcode != OP_CALL))
534	return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
535
536	if ( Dis.pCurInstr->uOpcode == OP_CALL
537	&& (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
538	{
539	/*
540	* Don't use a call instruction directly but push the original return address
541	* onto the stack and use a relative jump to the call target.
542	* The reason here is that on Linux the called method saves the return
543	* address from the stack which will be different from the original because
544	* the code is executed from our patch memory.
545	*
546	* Luckily the call instruction is 5 bytes long which means it is always the
547	* last instruction to patch and we don't need to return from the call
548	* to patch memory anyway but can use this method to resume the original call.
549	*/
550	AssertReturn(offInsn + cbInstr >= offJmpBack, VERR_SUPLIB_UNEXPECTED_INSTRUCTION); /* Must be last instruction! */
551
552	/* push return address */
553	uint32_t const uAddrReturn = (uintptr_t)&pbTarget[offInsn + cbInstr]; /* The return address to push to the stack. */
554
555	pbPatchMem++ = 0x68; / push dword */
556	(uint32_t )pbPatchMem = uAddrReturn;
557	pbPatchMem += sizeof(uint32_t);
558
559	/* jmp rel32 to the call target */
560	uintptr_t const uAddr = uAddrReturn + (int32_t)Dis.Param1.uValue;
561	int32_t const i32DispNew = uAddr - (uintptr_t)&pbPatchMem[5];
562
563	pbPatchMem++ = 0xe9; / jmp rel32 */
564	(int32_t )pbPatchMem = i32DispNew;
565	pbPatchMem += sizeof(int32_t);
566	}
567	else
568	{
569	memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
570	pbPatchMem += cbInstr;
571	}
572
573	offInsn += cbInstr;
574	}
575
576	pbPatchMem++ = 0xe9; / jmp rel32 */
577	(uint32_t )pbPatchMem = (uintptr_t)&pbTarget[offJmpBack] - ((uintptr_t)pbPatchMem + 4);
578
579	/* Assemble the patch. */
580	Assert(offJmpBack >= 5);
581	pbTarget[0] = 0xe9;
582	(uint32_t )&pbTarget[1] = (uintptr_t)pfnHook - (uintptr_t)&pbTarget[1+4];
583	#endif /* !RT_ARCH_AMD64 */
584
585	/*
586	* Re-seal target (ASSUMING that the shared object either has page aligned
587	* section or that the patch target is far enough from the writable parts).
588	*/
589	rcPsx = mprotect(pvTargetBase, 2 * _4K, PROT_READ \| PROT_EXEC);
590	if (rcPsx == -1)
591	return VERR_SUPLIB_TEXT_NOT_SEALED;
592
593	return VINF_SUCCESS;
594	}
595
596
597	/**
598	* @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlopen}
599	*/
600	static DECLCALLBACK(void) supR3HardenedPosixMonitorDlopenResolve(void)
601	{
602	/* Make harmless dlopen call. */
603	void *pv = dlopen(NULL, RTLD_LAZY);
604	if (pv)
605	dlclose(pv);
606	}
607
608
609	#ifdef SUP_HARDENED_WITH_DLMOPEN
610	/**
611	* @callback_method_impl{FNSUPHARDENEDSYMRESOLVE, dlmopen}
612	*/
613	static DECLCALLBACK(void) supR3HardenedPosixMonitorDlmopenResolve(void)
614	{
615	/* Make harmless dlmopen call. */
616	void *pv = dlmopen(LM_ID_BASE, NULL, RTLD_LAZY);
617	if (pv)
618	dlclose(pv);
619	}
620	#endif
621
622
623	/**
624	* Hardening initialization for POSIX compatible hosts.
625	*
626	* @returns nothing.
627	*
628	* @note Doesn't return on error.
629	*/
630	DECLHIDDEN(void) supR3HardenedPosixInit(void)
631	{
632	for (unsigned i = 0; i < RT_ELEMENTS(g_aHooks); i++)
633	{
634	PCSUPHARDENEDPOSIXHOOK pHook = &g_aHooks[i];
635	int rc = supR3HardenedMainPosixHookOne(pHook->pszSymbol, pHook->pfnHook, pHook->ppfnRealResume, pHook->pfnResolve);
636	if (RT_FAILURE(rc))
637	supR3HardenedFatalMsg("supR3HardenedPosixInit", kSupInitOp_Integrity, rc,
638	"Failed to hook the %s interface", pHook->pszSymbol);
639	}
640	}
641
642
643
644	/*
645	* assert.cpp
646	*
647	* ASSUMES working DECLHIDDEN or there will be symbol confusion!
648	*/
649
650	RTDATADECL(char) g_szRTAssertMsg1[1024];
651	RTDATADECL(char) g_szRTAssertMsg2[4096];
652	RTDATADECL(const char * volatile) g_pszRTAssertExpr;
653	RTDATADECL(const char * volatile) g_pszRTAssertFile;
654	RTDATADECL(uint32_t volatile) g_u32RTAssertLine;
655	RTDATADECL(const char * volatile) g_pszRTAssertFunction;
656
657	RTDECL(bool) RTAssertMayPanic(void)
658	{
659	return true;
660	}
661
662
663	RTDECL(void) RTAssertMsg1(const char pszExpr, unsigned uLine, const char pszFile, const char *pszFunction)
664	{
665	/*
666	* Fill in the globals.
667	*/
668	g_pszRTAssertExpr = pszExpr;
669	g_pszRTAssertFile = pszFile;
670	g_pszRTAssertFunction = pszFunction;
671	g_u32RTAssertLine = uLine;
672	snprintf(g_szRTAssertMsg1, sizeof(g_szRTAssertMsg1),
673	"\n!!Assertion Failed!!\n"
674	"Expression: %s\n"
675	"Location : %s(%u) %s\n",
676	pszExpr, pszFile, uLine, pszFunction);
677	}
678
679
680	RTDECL(void) RTAssertMsg2V(const char *pszFormat, va_list va)
681	{
682	vsnprintf(g_szRTAssertMsg2, sizeof(g_szRTAssertMsg2), pszFormat, va);
683	if (g_enmSupR3HardenedMainState < SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN)
684	supR3HardenedFatalMsg(g_pszRTAssertExpr, kSupInitOp_Misc, VERR_INTERNAL_ERROR,
685	"%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
686	else
687	supR3HardenedError(VERR_INTERNAL_ERROR, false/fFatal/, "%s%s", g_szRTAssertMsg1, g_szRTAssertMsg2);
688	}
689

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp@ 92651

Download in other formats: