+62 -28

src/dyld/Trampoline.cpp

reviewed

··· 19 19 20 20 extern "C" void reg_saveall(); 21 21 extern "C" void reg_restoreall(); 22 22 + extern "C" void* trampoline_start; 23 23 + extern "C" void* trampoline_end; 24 24 + 25 25 + #ifndef TEST 22 26 extern char** g_argv; 27 27 + #else 28 28 + const char* g_argv[] = { "Trampoline", 0 }; 29 29 + #endif 23 30 24 31 TrampolineMgr::TrampolineMgr(int entries) 25 32 : m_nNext(0) ··· 301 308 302 309 void Trampoline::init(uint32_t i, void* (*pDebug)(uint32_t,TrampolineMgr::CallStack*), void* (*pDebugR)(uint32_t,TrampolineMgr::CallStack*)) 303 310 { 304 304 - // See trampoline in trampoline_helper.asm for source 305 305 - #ifdef __x86_64__ 306 306 - memcpy(this, "\x49\xba\xb6\xb5\xb4\xb3\xb2\xb1\xb0\x00\x41\xff\xd2\xbf" 307 307 - "\x56\x34\x12\x00\x48\x89\xe6\x48\xb9\xff\xee\xdd\xcc\xbb\xaa\x00\x00" 308 308 - "\xff\xd1\x49\x89\xc3\x49\xba\xc6\xc5\xc4\xc3\xc2\xc1\xc0\x00\x41\xff" 309 309 - "\xd2\x4c\x8d\x15\x08\x00\x00\x00\x4c\x89\x14\x24\x41\xff\xe3\x90\x49" 310 310 - "\xba\xb6\xb5\xb4\xb3\xb2\xb1\xb0\x00\x41\xff\xd2\xbf\x56\x34\x12\x00" 311 311 - "\x48\x89\xe6\x48\xb9\xa6\xa5\xa4\xa3\xa2\xa1\xa0\x00\xff\xd1\x49\x89" 312 312 - "\xc3\x49\xba\xc6\xc5\xc4\xc3\xc2\xc1\xc0\x00\x41\xff\xd2\x41\xff\xe3", 313 313 - sizeof(*this) 314 314 - ); 315 315 - #else 316 316 - memcpy(this, "\x68\xa3\xa2\xa1\xa0\xc3\x54\x68\x78\x56\x34\x12\x68\xb3" 317 317 - "\xb2\xb1\xb0\xc3\x89\x44\x24\xf8\x68\xc3\xc2\xc1\xc0\xc3\xe8\x00" 318 318 - "\x00\x00\x00\x8b\x04\x24\x83\xc0\x10\x89\x04\x24\x8b\x44\x24\xe0" 319 319 - "\xff\xe0\x90\x68\xa3\xa2\xa1\xa0\xc3\x54\x68\x78\x56\x34\x12\x68" 320 320 - "\xb9\xb9\xb9\xb9\xc3\x89\x44\x24\xf8\x68\xc3\xc2\xc1\xc0\xc3\x8b" 321 321 - "\x4c\x24\xe0\xff\xe1", 322 322 - sizeof(*this) 323 323 - ); 324 324 - 325 325 - #endif 311 311 + uintptr_t funcLen = uintptr_t(&trampoline_end) - uintptr_t(&trampoline_start); 312 312 + memcpy(this, &trampoline_start, funcLen); 326 313 327 314 this->reg_saveall = reinterpret_cast<uint64_t>(::reg_saveall); 328 315 this->reg_saveall2 = reinterpret_cast<uint64_t>(::reg_saveall); ··· 509 496 ss << m_stack->rax; 510 497 else if (type == 'c') 511 498 ss << char(m_stack->rax); 512 512 - else if (type == 'i') 499 499 + else if (type == 'i' || type == 'q') 513 500 { 514 501 uint64_t u = m_stack->rax; 515 502 ss << *((int64_t*) &u); ··· 540 527 std::string TrampolineMgr::ArgumentWalker::ret(char type) 541 528 { 542 529 std::stringstream ss; 543 543 - // TODO 530 530 + 531 531 + if (type == 'u') 532 532 + ss << m_stack->eax; 533 533 + else if (type == 'c') 534 534 + ss << char(m_stack->eax); 535 535 + else if (type == 'i') 536 536 + { 537 537 + uint32_t u = m_stack->eax; 538 538 + ss << *((int32_t*) &u); 539 539 + } 540 540 + else if (type == 'q') 541 541 + { 542 542 + union 543 543 + { 544 544 + int64_t v64; 545 545 + uint32_t v32[2]; 546 546 + } q; 547 547 + 548 548 + q.v32[0] = m_stack->eax; 549 549 + q.v32[1] = m_stack->edx; 550 550 + 551 551 + ss << q.v64; 552 552 + } 553 553 + else if (type == 'f') 554 554 + { 555 555 + double d = m_stack->st0; 556 556 + ss << * (((float*)&d)+1); 557 557 + } 558 558 + else if (type == 'd') 559 559 + { 560 560 + double d = m_stack->st0; 561 561 + ss << d; 562 562 + } 563 563 + else if (type == 'p' || isupper(type)) 564 564 + ss << (void*)m_stack->eax << std::dec; 565 565 + else if (type == 's') 566 566 + { 567 567 + const char* s = (const char*) m_stack->eax; 568 568 + ss << (void*)s << " \"" << safeString(s) << '"'; 569 569 + } 570 570 + else 571 571 + ss << '?'; 572 572 + 544 573 return ss.str(); 545 574 } 546 575 #endif ··· 573 602 574 603 #ifdef TEST 575 604 576 576 - double mytestfunc(int a, int b, double c) 605 605 + float mytestfunc(int a, int b, double c) 577 606 { 578 607 return a*b+c; 608 608 + } 609 609 + 610 610 + long long qfunc() 611 611 + { 612 612 + return 1; 579 613 } 580 614 581 615 int main() ··· 583 617 TrampolineMgr* mgr = new TrampolineMgr; 584 618 TrampolineMgr::loadFunctionInfo("/tmp/fi"); 585 619 586 586 - double (*pFunc)(int,int,double) = (double (*)(int,int,double)) mgr->generate((void*) &mytestfunc, "mytestfunc"); 620 620 + float (*pFunc)(int,int,double) = (float (*)(int,int,double)) mgr->generate((void*) &mytestfunc, "mytestfunc"); 587 621 int (*pPrintf)(FILE* f, const char*,...) = (int (*)(FILE* f, const char*,...)) mgr->generate((void*) &fprintf, "printf"); 588 588 - //std::cout << pFunc(2,3,0.5) << std::endl; 589 589 - pPrintf(stdout, "Hello world: %s\n", "Test"); 622 622 + std::cout << pFunc(2,3,0.5) << std::endl; 623 623 + //pPrintf(stdout, "Hello world: %s\n", "Test"); 590 624 591 625 delete mgr; 592 626 return 0;

+10 -9

src/dyld/Trampoline.h

reviewed

··· 33 33 #else 34 34 struct CallStack 35 35 { 36 36 + double st0; 36 37 uint32_t edi, esi, edx, ecx, ebx, eax; 37 38 void* retAddr; 38 39 uint32_t arguments[]; ··· 145 146 char code9[9]; 146 147 char padding[1]; 147 148 #else 148 148 - // 83 bytes 149 149 - char code1; 149 149 + // 62+4*8=94 bytes 150 150 + char code1[2]; 150 151 uint32_t reg_saveall; 151 151 - char code2[3]; 152 152 + char code2[4]; 152 153 uint32_t index; 153 154 char code3; 154 155 uint32_t debugFcn; 155 155 - char code4[6]; 156 156 + char code4[10]; 156 157 uint32_t reg_restoreall; 157 157 - char code5[23]; 158 158 + char code5[22]; 158 159 uint32_t reg_saveall2; 159 159 - char code6[3]; 160 160 + char code6[4]; 160 161 uint32_t index2; 161 162 char code7; 162 163 uint32_t debugFcnR; 163 163 - char code8[6]; 164 164 + char code8[10]; 164 165 uint32_t reg_restoreall2; 165 165 - char code9[7]; 166 166 - char padding[1]; 166 166 + char code9[8]; 167 167 + //char padding[1]; 167 168 168 169 #endif 169 170 };

+60 -50

src/dyld/trampoline_helper.nasm

reviewed

··· 1 1 + global trampoline_start 2 2 + global trampoline_end 3 3 + global reg_saveall 4 4 + global reg_restoreall 5 5 + 1 6 %ifidn __OUTPUT_FORMAT__, elf64 2 7 3 8 BITS 64 4 9 section text 5 5 - 6 6 - ;global trampoline 7 7 - global reg_saveall 8 8 - global reg_restoreall 9 10 10 11 reg_saveall: ; 192 bytes on stack 11 12 pop r10 ; remove retaddr from stack ··· 35 36 reg_restoreall: 36 37 pop r10 ; remove retaddr from stack 37 38 movdqu xmm7, [rsp+112] 38 38 - movdqu xmm6, [rsp+96] 39 39 - movdqu xmm5, [rsp+80] 40 40 - movdqu xmm4, [rsp+64] 41 41 - movdqu xmm3, [rsp+48] 42 42 - movdqu xmm2, [rsp+32] 43 43 - movdqu xmm1, [rsp+16] 44 44 - movdqu xmm0, [rsp] 45 45 - add rsp, 128 46 46 - pop r15 47 47 - pop r14 48 48 - pop r13 49 49 - pop r12 50 50 - pop r9 51 51 - pop r8 52 52 - pop rcx 53 53 - pop rdx 54 54 - pop rsi 55 55 - pop rdi 56 56 - pop rbx 57 57 - pop rax 39 39 + movdqu xmm6, [rsp+96] 40 40 + movdqu xmm5, [rsp+80] 41 41 + movdqu xmm4, [rsp+64] 42 42 + movdqu xmm3, [rsp+48] 43 43 + movdqu xmm2, [rsp+32] 44 44 + movdqu xmm1, [rsp+16] 45 45 + movdqu xmm0, [rsp] 46 46 + add rsp, 128 47 47 + pop r15 48 48 + pop r14 49 49 + pop r13 50 50 + pop r12 51 51 + pop r9 52 52 + pop r8 53 53 + pop rcx 54 54 + pop rdx 55 55 + pop rsi 56 56 + pop rdi 57 57 + pop rbx 58 58 + pop rax 58 59 jmp r10 59 60 60 61 ; This is duplicated for every mapped function ··· 93 94 mov r10, qword 0xc0c1c2c3c4c5c6 ; call reg_restoreall 94 95 call r10 95 96 jmp r11 ; now we "return" to the original function 96 96 - 97 97 + trampoline_end: 98 98 + nop 97 99 %elifidn __OUTPUT_FORMAT__, elf 98 100 99 101 BITS 32 100 102 section text 101 103 102 102 - ;global trampoline 103 103 - global reg_saveall 104 104 - global reg_restoreall 104 104 + %define SavedRegLen 32 105 105 106 106 reg_saveall: ; 24 bytes on stack 107 107 - xchg eax, [esp] 107 107 + pop eax 108 108 109 109 push ebx 110 110 push ecx 111 111 push edx 112 112 push esi 113 113 push edi 114 114 + sub esp, 8 115 115 + ;fstp qword [esp] 114 116 115 115 - jmp eax 117 117 + jmp eax 116 118 117 119 reg_restoreall: 118 120 pop ebx 119 119 - mov eax, [esp+24] 120 120 - mov [esp+24], ebx 121 121 + mov eax, [esp+SavedRegLen-4] 122 122 + mov [esp+SavedRegLen-4], ebx 121 123 124 124 + ;fld qword [esp] 125 125 + add esp, 8 122 126 pop edi 123 127 pop esi 124 128 pop edx ··· 127 131 128 132 ret 129 133 130 130 - trampoline: 131 131 - push 0xa0a1a2a3 ; call reg_saveall 132 132 - ret 134 134 + trampoline_start: 135 135 + push eax 136 136 + mov eax, 0xa0a1a2a3 ; call reg_saveall 137 137 + call eax 138 138 + 133 139 push esp 134 140 push 0x12345678 ; index in entry table 135 135 - push 0xb0b1b2b3 136 136 - ret ; call print function 141 141 + mov eax, 0xb0b1b2b3 142 142 + call eax ; call print function 143 143 + add esp, 8 137 144 138 145 mov [esp-8], eax 139 139 - push 0xc0c1c2c3 ; call reg_restoreall 140 140 - ret 146 146 + mov eax, 0xc0c1c2c3 ; call reg_restoreall 147 147 + call eax 141 148 142 149 ; we cannot use IP-relative lea on 32bit x86 143 150 call get_eip 144 151 get_eip: 145 145 - mov eax, [esp] 146 146 - add eax, 0x10 ; this gives us the address of after_jump 152 152 + pop eax 153 153 + add eax, 0xD ; this gives us the address of after_jump 147 154 mov [esp], eax 148 148 - mov eax, [esp-32] 155 155 + mov eax, [esp-SavedRegLen-8] 149 156 150 157 jmp eax ; call the real function 151 158 152 159 ALIGN 2 153 160 after_jump: 154 154 - push 0xa0a1a2a3 155 155 - ret ; call reg_saveall 161 161 + push eax 162 162 + mov eax, 0xa0a1a2a3 163 163 + call eax ; call reg_saveall 156 164 push esp 157 165 push 0x12345678 ; index in entry table 158 158 - push 0xb9b9b9b9 ; print function 2 159 159 - ret 166 166 + mov eax, 0xb9b9b9b9 ; print function 2 167 167 + call eax 168 168 + add esp, 8 160 169 161 170 mov [esp-8], eax ; real return address 162 162 - push 0xc0c1c2c3 163 163 - ret ; call reg_restoreall 171 171 + mov eax, 0xc0c1c2c3 172 172 + call eax ; call reg_restoreall 164 173 165 165 - mov ecx, [esp-32] 174 174 + mov ecx, [esp-SavedRegLen-8] 166 175 jmp ecx ; return to the original caller 167 167 - 176 176 + trampoline_end: 177 177 + nop 168 178 %else 169 179 170 180 %error "Unsupported platform"