You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
238 lines
8.4 KiB
238 lines
8.4 KiB
// copyright notice, this list of conditions and the following disclaimer
|
|
// in the documentation and/or other materials provided with the
|
|
// distribution.
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
// contributors may be used to endorse or promote products derived from
|
|
// this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
// disassembler_x86.cc: simple x86 disassembler.
|
|
//
|
|
// Provides single step disassembly of x86 bytecode and flags instructions
|
|
// that utilize known bad register values.
|
|
//
|
|
// Author: Cris Neckar
|
|
|
|
#include "processor/disassembler_x86.h"
|
|
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
namespace google_breakpad {
|
|
|
|
DisassemblerX86::DisassemblerX86(const u_int8_t *bytecode,
|
|
u_int32_t size,
|
|
u_int32_t virtual_address) :
|
|
bytecode_(bytecode),
|
|
size_(size),
|
|
virtual_address_(virtual_address),
|
|
current_byte_offset_(0),
|
|
current_inst_offset_(0),
|
|
instr_valid_(false),
|
|
register_valid_(false),
|
|
pushed_bad_value_(false),
|
|
end_of_block_(false),
|
|
flags_(0) {
|
|
libdis::x86_init(libdis::opt_none, NULL, NULL);
|
|
}
|
|
|
|
DisassemblerX86::~DisassemblerX86() {
|
|
libdis::x86_cleanup();
|
|
}
|
|
|
|
u_int32_t DisassemblerX86::NextInstruction() {
|
|
if (instr_valid_)
|
|
libdis::x86_oplist_free(¤t_instr_);
|
|
|
|
if (current_byte_offset_ >= size_) {
|
|
instr_valid_ = false;
|
|
return 0;
|
|
}
|
|
u_int32_t instr_size = 0;
|
|
instr_size = libdis::x86_disasm((unsigned char *)bytecode_, size_,
|
|
virtual_address_, current_byte_offset_,
|
|
¤t_instr_);
|
|
if (instr_size == 0) {
|
|
instr_valid_ = false;
|
|
return 0;
|
|
}
|
|
|
|
current_byte_offset_ += instr_size;
|
|
current_inst_offset_++;
|
|
instr_valid_ = libdis::x86_insn_is_valid(¤t_instr_);
|
|
if (!instr_valid_)
|
|
return 0;
|
|
|
|
if (current_instr_.type == libdis::insn_return)
|
|
end_of_block_ = true;
|
|
libdis::x86_op_t *src = libdis::x86_get_src_operand(¤t_instr_);
|
|
libdis::x86_op_t *dest = libdis::x86_get_dest_operand(¤t_instr_);
|
|
|
|
if (register_valid_) {
|
|
switch (current_instr_.group) {
|
|
// Flag branches based off of bad registers and calls that occur
|
|
// after pushing bad values.
|
|
case libdis::insn_controlflow:
|
|
switch (current_instr_.type) {
|
|
case libdis::insn_jmp:
|
|
case libdis::insn_jcc:
|
|
case libdis::insn_call:
|
|
case libdis::insn_callcc:
|
|
if (dest) {
|
|
switch (dest->type) {
|
|
case libdis::op_expression:
|
|
if (dest->data.expression.base.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_BRANCH_TARGET;
|
|
break;
|
|
case libdis::op_register:
|
|
if (dest->data.reg.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_BRANCH_TARGET;
|
|
break;
|
|
default:
|
|
if (pushed_bad_value_ &&
|
|
(current_instr_.type == libdis::insn_call ||
|
|
current_instr_.type == libdis::insn_callcc))
|
|
flags_ |= DISX86_BAD_ARGUMENT_PASSED;
|
|
break;
|
|
}
|
|
}
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
break;
|
|
|
|
// Flag block data operations that use bad registers for src or dest.
|
|
case libdis::insn_string:
|
|
if (dest && dest->type == libdis::op_expression &&
|
|
dest->data.expression.base.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_BLOCK_WRITE;
|
|
if (src && src->type == libdis::op_expression &&
|
|
src->data.expression.base.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_BLOCK_READ;
|
|
break;
|
|
|
|
// Flag comparisons based on bad data.
|
|
case libdis::insn_comparison:
|
|
if ((dest && dest->type == libdis::op_expression &&
|
|
dest->data.expression.base.id == bad_register_.id) ||
|
|
(src && src->type == libdis::op_expression &&
|
|
src->data.expression.base.id == bad_register_.id) ||
|
|
(dest && dest->type == libdis::op_register &&
|
|
dest->data.reg.id == bad_register_.id) ||
|
|
(src && src->type == libdis::op_register &&
|
|
src->data.reg.id == bad_register_.id))
|
|
flags_ |= DISX86_BAD_COMPARISON;
|
|
break;
|
|
|
|
// Flag any other instruction which derefs a bad register for
|
|
// src or dest.
|
|
default:
|
|
if (dest && dest->type == libdis::op_expression &&
|
|
dest->data.expression.base.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_WRITE;
|
|
if (src && src->type == libdis::op_expression &&
|
|
src->data.expression.base.id == bad_register_.id)
|
|
flags_ |= DISX86_BAD_READ;
|
|
break;
|
|
}
|
|
}
|
|
|
|
// When a register is marked as tainted check if it is pushed.
|
|
// TODO(cdn): may also want to check for MOVs into EBP offsets.
|
|
if (register_valid_ && dest && current_instr_.type == libdis::insn_push) {
|
|
switch (dest->type) {
|
|
case libdis::op_expression:
|
|
if (dest->data.expression.base.id == bad_register_.id ||
|
|
dest->data.expression.index.id == bad_register_.id)
|
|
pushed_bad_value_ = true;
|
|
break;
|
|
case libdis::op_register:
|
|
if (dest->data.reg.id == bad_register_.id)
|
|
pushed_bad_value_ = true;
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
// Check if a tainted register value is clobbered.
|
|
// For conditional MOVs and XCHGs assume that
|
|
// there is a hit.
|
|
if (register_valid_) {
|
|
switch (current_instr_.type) {
|
|
case libdis::insn_xor:
|
|
if (src && src->type == libdis::op_register &&
|
|
dest->type == libdis::op_register &&
|
|
src->data.reg.id == bad_register_.id &&
|
|
src->data.reg.id == dest->data.reg.id)
|
|
register_valid_ = false;
|
|
break;
|
|
case libdis::insn_pop:
|
|
case libdis::insn_mov:
|
|
case libdis::insn_movcc:
|
|
if (dest && dest->type == libdis::op_register &&
|
|
dest->data.reg.id == bad_register_.id)
|
|
register_valid_ = false;
|
|
break;
|
|
case libdis::insn_popregs:
|
|
register_valid_ = false;
|
|
break;
|
|
case libdis::insn_xchg:
|
|
case libdis::insn_xchgcc:
|
|
if (dest && dest->type == libdis::op_register &&
|
|
src->type == libdis::op_register) {
|
|
if (dest->data.reg.id == bad_register_.id)
|
|
memcpy(&bad_register_, &src->data.reg, sizeof(libdis::x86_reg_t));
|
|
else if (src->data.reg.id == bad_register_.id)
|
|
memcpy(&bad_register_, &dest->data.reg, sizeof(libdis::x86_reg_t));
|
|
}
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
return instr_size;
|
|
}
|
|
|
|
bool DisassemblerX86::setBadRead() {
|
|
if (!instr_valid_)
|
|
return false;
|
|
|
|
libdis::x86_op_t *operand = libdis::x86_get_src_operand(¤t_instr_);
|
|
if (!operand || operand->type != libdis::op_expression)
|
|
return false;
|
|
|
|
memcpy(&bad_register_, &operand->data.expression.base,
|
|
sizeof(libdis::x86_reg_t));
|
|
register_valid_ = true;
|
|
return true;
|
|
}
|
|
|
|
bool DisassemblerX86::setBadWrite() {
|
|
if (!instr_valid_)
|
|
return false;
|
|
|
|
libdis::x86_op_t *operand = libdis::x86_get_dest_operand(¤t_instr_);
|
|
if (!operand || operand->type != libdis::op_expression)
|
|
return false;
|
|
|
|
memcpy(&bad_register_, &operand->data.expression.base,
|
|
sizeof(libdis::x86_reg_t));
|
|
register_valid_ = true;
|
|
return true;
|
|
}
|
|
|
|
} // namespace google_breakpad
|
|
|