Changeset 108712 in vbox for trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp

Timestamp:

Mar 24, 2025 11:02:34 AM (4 weeks ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

168129

Message:

HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp: We don't support 32-bit x86 hosts anymore, so drop the dead code, bugref:10391 [revert as our 32bit buildboxes are unhappy, even though the code is never run, no time to fix this]

File:

• trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/posix/SUPR3HardenedMain-posix.cpp

@@ -510 +510 @@
 
 #else  /* !RT_ARCH_AMD64 */
-# error "Port me"
+    /*
+     * Patch 32-bit hosts.
+     */
+    /* Just use the disassembler to skip 5 bytes or more. */
+    while (offJmpBack < 5)
+    {
+        cbInstr = 1;
+        int rc = DISInstr(pbTarget + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr);
+        if (   RT_FAILURE(rc)
+            || (   (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
+                && Dis.pCurInstr->uOpcode != OP_CALL))
+            return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
+
+        if (   Dis.pCurInstr->uOpcode == OP_CALL
+            && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
+            cbPatchMem += 10; /* push imm32 + jmp rel32 */
+        else
+            cbPatchMem += cbInstr;
+
+        offJmpBack += cbInstr;
+    }
+
+    /* Allocate suitable exectuable memory available. */
+    uint8_t *pbPatchMem = supR3HardenedMainPosixExecMemAlloc(cbPatchMem, pbTarget, false /* fRipRelAddr */);
+    if (!pbPatchMem)
+        return VERR_NO_MEMORY;
+
+    /* Assemble the code for resuming the call.*/
+    *ppfnReal = (uintptr_t)pbPatchMem;
+
+    /* Go through the instructions to patch and fixup any relative call instructions. */
+    uint32_t offInsn = 0;
+    while (offInsn < offJmpBack)
+    {
+        cbInstr = 1;
+        int rc = DISInstr(pbTarget + offInsn, DISCPUMODE_32BIT, &Dis, &cbInstr);
+        if (   RT_FAILURE(rc)
+            || (   (Dis.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
+                && Dis.pCurInstr->uOpcode != OP_CALL))
+            return VERR_SUPLIB_UNEXPECTED_INSTRUCTION;
+
+        if (   Dis.pCurInstr->uOpcode == OP_CALL
+            && (Dis.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW))
+        {
+            /*
+             * Don't use a call instruction directly but push the original return address
+             * onto the stack and use a relative jump to the call target.
+             * The reason here is that on Linux the called method saves the return
+             * address from the stack which will be different from the original because
+             * the code is executed from our patch memory.
+             *
+             * Luckily the call instruction is 5 bytes long which means it is always the
+             * last instruction to patch and we don't need to return from the call
+             * to patch memory anyway but can use this method to resume the original call.
+             */
+            AssertReturn(offInsn + cbInstr >= offJmpBack, VERR_SUPLIB_UNEXPECTED_INSTRUCTION); /* Must be last instruction! */
+
+            /* push return address */
+            uint32_t const uAddrReturn = (uintptr_t)&pbTarget[offInsn + cbInstr]; /* The return address to push to the stack. */
+
+            *pbPatchMem++           = 0x68; /* push dword */
+            *(uint32_t *)pbPatchMem = uAddrReturn;
+            pbPatchMem             += sizeof(uint32_t);
+
+            /* jmp rel32 to the call target */
+            uintptr_t const uAddr      = uAddrReturn + (int32_t)Dis.aParams[0].uValue;
+            int32_t   const i32DispNew = uAddr - (uintptr_t)&pbPatchMem[5];
+
+            *pbPatchMem++          = 0xe9; /* jmp rel32 */
+            *(int32_t *)pbPatchMem = i32DispNew;
+            pbPatchMem            += sizeof(int32_t);
+        }
+        else
+        {
+            memcpy(pbPatchMem, pbTarget + offInsn, cbInstr);
+            pbPatchMem += cbInstr;
+        }
+
+        offInsn += cbInstr;
+    }
+
+    *pbPatchMem++ = 0xe9; /* jmp rel32 */
+    *(uint32_t *)pbPatchMem = (uintptr_t)&pbTarget[offJmpBack] - ((uintptr_t)pbPatchMem + 4);
+
+    /* Assemble the patch. */
+    Assert(offJmpBack >= 5);
+    pbTarget[0] = 0xe9;
+    *(uint32_t *)&pbTarget[1] = (uintptr_t)pfnHook - (uintptr_t)&pbTarget[1+4];
 #endif /* !RT_ARCH_AMD64 */