forked from GJDuck/e9patch
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathe9loader.cpp
More file actions
407 lines (354 loc) · 10.3 KB
/
e9loader.cpp
File metadata and controls
407 lines (354 loc) · 10.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
/*
* e9loader.cpp
* Copyright (C) 2020 National University of Singapore
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <cerrno>
#include <csignal>
#include <cstdint>
#include <cstdlib>
#include <dirent.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#include "e9loader.h"
#define NO_INLINE __attribute__((__noinline__))
#define NO_RETURN __attribute__((__noreturn__))
#define STRING(x) STRING_2(x)
#define STRING_2(x) #x
#define BUFSIZ 8192
static NO_INLINE int e9binary(char *path_buf);
extern const char mapsname[];
extern const char maps_err_str[];
extern const char open_err_str[];
extern const char mmap_err_str[];
extern const char common_err_str[];
extern "C"
{
int e9entry(void);
NO_INLINE NO_RETURN void e9error(const char *err_str, int err);
}
/*
* Directory entry structure.
*/
struct linux_dirent64
{
ino64_t d_ino;
off64_t d_off;
unsigned short d_reclen;
unsigned char d_type;
char d_name[];
};
asm (
/*
* Entry into stage #1. We:
* (1) save the state.
* (2) call e9entry()
* (3) setup stage #2 parameters
* (4) jump to stage #2
*/
".globl _entry\n"
".type _entry,@function\n"
"_entry:\n"
// (1) save the state
"\tpushq %r15\n"
"\tpushq %r14\n"
"\tpushq %r13\n"
"\tpushq %r12\n"
"\tpushq %r11\n"
"\tpushq %r10\n"
"\tpushq %r9\n"
"\tpushq %r8\n"
"\tpushq %rcx\n"
"\tpushq %rdx\n"
"\tpushq %rsi\n"
"\tpushq %rdi\n"
// (2) call e9entry()
"\tcallq e9entry\n" // Call main entry routine
// (3) setup stage #2 parameters
// Stage #2 expects certain parameters to be in specific registers:
"\tmov %eax, %r8d\n" // fd into %r8
"\tleaq _entry(%rip), %r12\n" // base into %r12
"\tmovabs $" STRING(LOADER_ADDRESS) ",%rdx\n"
"\tsubq %rdx,%r12\n"
"\tmov $9, %r13d\n" // SYS_MMAP into %r13
"\tleaq .LMMAP_ERROR(%rip), %r14\n" // mmap error handler into %r14
// (4) jump to stage #2
// Stage #2 will be placed at the end of the (.text) section.
"\tjmp __etext\n"
/*
* The following defines the read-only data used by the loader.
* Note that we define the data as executable code to keep everything
* in the (.text) section.
*/
".global mapsname\n"
".type mapsname,@function\n"
"mapsname:\n"
".ascii \"/proc/self/map_files/\"\n"
".byte 0x00\n"
".globl maps_err_str\n"
".type maps_err_str,@function\n"
"maps_err_str:\n"
".ascii \"find shared object path (errno=%d)\\n\"\n"
".byte 0x00\n"
".globl open_err_str\n"
".type open_err_str,@function\n"
"open_err_str:\n"
".ascii \"open file \\\"%s\\\" for reading (errno=%d)\\n\"\n"
".byte 0x00\n"
".globl mmap_err_str\n"
".type mmap_err_str,@function\n"
"mmap_err_str:\n"
".ascii \"map file \\\"%s\\\" (errno=%d)\\n\"\n"
".byte 0x00\n"
".globl common_err_str\n"
".type common_err_str,@function\n"
"common_err_str:\n"
".ascii \"e9loader error: failed to \"\n"
".byte 0x00\n"
/*
* mmap() error handling code goes here.
*/
".LMMAP_ERROR:\n"
"\tleaq mmap_err_str(%rip), %rdi\n"
"\tmov %rax, %rsi\n"
"\tneg %rsi\n"
"\tjmp e9error\n"
);
static int e9open(const char *filename_0, int flags_0, int mode_0)
{
register uintptr_t filename asm("rdi") = (uintptr_t)filename_0;
register uintptr_t flags asm("rsi") = (uintptr_t)flags_0;
register uintptr_t mode asm("rdx") = (uintptr_t)mode_0;
register intptr_t fd asm("rax");
asm volatile (
"mov $2, %%eax\n\t" // SYS_OPEN
"syscall"
: "=rax"(fd) : "r"(filename), "r"(flags), "r"(mode) : "rcx", "r11");
return (int)fd;
}
static int e9write(int fd_0, const char *buf_0, size_t len_0)
{
register uintptr_t fd asm("rdi") = (uintptr_t)fd_0;
register uintptr_t buf asm("rsi") = (uintptr_t)buf_0;
register uintptr_t len asm("rdx") = (uintptr_t)len_0;
register intptr_t err asm("rax");
asm volatile (
"mov $1, %%eax\n\t" // SYS_WRITE
"syscall"
: "=rax"(err) : "r"(fd), "r"(buf), "r"(len) : "rcx", "r11");
return (int)err;
}
static int e9kill(pid_t pid_0, int sig_0)
{
register uintptr_t pid asm("rdi") = (uintptr_t)pid_0;
register uintptr_t sig asm("rsi") = (uintptr_t)sig_0;
register intptr_t err asm("rax");
asm volatile (
"mov $62, %%eax\n\t" // SYS_KILL
"syscall"
: "=rax"(err) : "r"(pid), "r"(sig): "rcx", "r11");
return (int)err;
}
static int e9readlink(const char *path_0, char *buf_0, size_t len_0)
{
register uintptr_t path asm("rdi") = (uintptr_t)path_0;
register uintptr_t buf asm("rsi") = (uintptr_t)buf_0;
register uintptr_t len asm("rdx") = (uintptr_t)len_0;
register intptr_t err asm("rax");
asm volatile (
"mov $89, %%eax\n\t" // SYS_READLINK
"syscall"
: "=rax"(err) : "r"(path), "r"(buf), "r"(len) : "rcx", "r11");
return (int)err;
}
static int e9getdents64(int fd_0, struct linux_dirent64 *dirp_0,
unsigned count_0)
{
register uintptr_t fd asm("rdi") = (uintptr_t)fd_0;
register uintptr_t dirp asm("rsi") = (uintptr_t)dirp_0;
register uintptr_t count asm("rdx") = (uintptr_t)count_0;
register intptr_t len asm("rax");
asm volatile (
"mov $217, %%eax\n\t" // SYS_GETDENTS64
"syscall"
: "=rax"(len) : "r"(fd), "r"(dirp), "r"(count) : "rcx", "r11");
return (int)len;
}
static int e9close(int fd_0)
{
register uintptr_t fd asm("rdi") = (uintptr_t)fd_0;
register intptr_t err asm("rax");
asm volatile (
"mov $3, %%eax\n\t" // SYS_CLOSE
"syscall"
: "=rax"(err) : "r"(fd) : "rcx", "r11");
return (int)err;
}
/*
* Convert a number into a string.
*/
static char *e9num2str(char *str, int x)
{
int r = 1000000000;
bool seen = false;
while (r != 0)
{
char c = '0' + x / r;
x %= r;
r /= 10;
if (!seen && c == '0')
continue;
seen = true;
*str++ = c;
}
if (!seen)
*str++ = '0';
return str;
}
/*
* Print an error message to stderr and abort.
*/
NO_INLINE NO_RETURN void e9error(const char *err_str, int err)
{
char path_buf[BUFSIZ];
int result = e9binary(path_buf);
if (result != 0)
{
path_buf[0] = path_buf[1] = path_buf[2] = '?';
path_buf[3] = '\0';
}
const char *path = path_buf;
char str_buf[BUFSIZ];
char *str = str_buf;
const char *err_str_0 = common_err_str;
while (*err_str_0 != '\0')
*str++ = *err_str_0++;
while (*err_str != '\0')
{
if (*err_str == '%')
{
err_str++;
switch (*err_str++)
{
case 'd':
str = e9num2str(str, err);
break;
case 's':
while (*path != '\0')
*str++ = *path++;
break;
}
}
else
*str++ = *err_str++;
}
(void)e9write(STDERR_FILENO, str_buf, str - str_buf);
(void)e9kill(/*pid=*/0, SIGABRT);
asm volatile ("ud2");
__builtin_unreachable();
}
/*
* Convert a hex string into a number.
*/
static intptr_t e9hexstr2num(const char **str_ptr)
{
const char *str = *str_ptr;
intptr_t x = 0;
while (true)
{
char c = *str++;
if (c >= '0' && c <= '9')
{
x <<= 4;
x |= (intptr_t)(c - '0');
}
else if (c >= 'a' && c <= 'f')
{
x <<= 4;
x |= (intptr_t)(10 + c - 'a');
}
else
{
*str_ptr = str;
return x;
}
}
}
/*
* Place the pathname of enclosing binary into `path_buf'.
*/
static NO_INLINE int e9binary(char *path_buf)
{
// Step (1): Read contents of /proc/self/map_files/
int fd = e9open(mapsname, O_RDONLY | O_DIRECTORY, 0);
if (fd < 0)
return fd;
uint8_t buf[BUFSIZ];
// Step (2): Search for an entry corresponding to the enclosing function.
intptr_t code = (intptr_t)&e9binary;
bool found = false;
while (!found)
{
int len = e9getdents64(fd, (struct linux_dirent64 *)buf, sizeof(buf));
if (len < 0)
{
e9close(fd);
return len;
}
for (int i = 0; !found && i < len; )
{
struct linux_dirent64 *entry = (struct linux_dirent64 *)(buf + i);
i += entry->d_reclen;
if (entry->d_type != DT_LNK)
continue;
const char *name = entry->d_name;
intptr_t lo = e9hexstr2num(&name);
if (code < lo)
continue;
intptr_t hi = e9hexstr2num(&name);
if (code <= hi)
{
int j;
for (j = 0; mapsname[j] != '\0'; j++)
path_buf[j] = mapsname[j];
name = entry->d_name;
for (int k = 0; name[k] != '\0'; k++)
path_buf[j++] = name[k];
path_buf[j] = '\0';
found = true;
}
}
}
// Step (3): Read the link.
// Note: this is necessary since Linux does not allow the path to be
// opened directy.
int len = e9readlink(path_buf, path_buf, BUFSIZ);
if (len < 0)
return len;
path_buf[len] = '\0';
return 0;
}
int e9entry(void)
{
char path_buf[BUFSIZ];
int err = e9binary(path_buf);
if (err != 0)
e9error(maps_err_str, -err);
int fd = e9open(path_buf, O_RDONLY, 0);
if (fd < 0)
e9error(open_err_str, -fd);
return fd;
}