You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
244 lines
10 KiB
244 lines
10 KiB
// All rights reserved.
|
|
//
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions are
|
|
// met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright
|
|
// notice, this list of conditions and the following disclaimer.
|
|
// * Redistributions in binary form must reproduce the above
|
|
// copyright notice, this list of conditions and the following disclaimer
|
|
// in the documentation and/or other materials provided with the
|
|
// distribution.
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
// contributors may be used to endorse or promote products derived from
|
|
// this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
#include <unistd.h>
|
|
|
|
#include "breakpad_googletest_includes.h"
|
|
#include "processor/disassembler_x86.h"
|
|
#include "third_party/libdisasm/libdis.h"
|
|
|
|
namespace {
|
|
|
|
using google_breakpad::DisassemblerX86;
|
|
|
|
unsigned char just_return[] = "\xc3"; // retn
|
|
|
|
unsigned char invalid_instruction[] = "\x00"; // invalid
|
|
|
|
unsigned char read_eax_jmp_eax[] =
|
|
"\x8b\x18" // mov ebx, [eax];
|
|
"\x33\xc9" // xor ebx, ebx;
|
|
"\xff\x20" // jmp eax;
|
|
"\xc3"; // retn;
|
|
|
|
unsigned char write_eax_arg_to_call[] =
|
|
"\x89\xa8\x00\x02\x00\x00" // mov [eax+200], ebp;
|
|
"\xc1\xeb\x02" // shr ebx, 2;
|
|
"\x50" // push eax;
|
|
"\xe8\xd1\x24\x77\x88" // call something;
|
|
"\xc3"; // retn;
|
|
|
|
unsigned char read_edi_stosb[] =
|
|
"\x8b\x07" // mov eax, [edi];
|
|
"\x8b\xc8" // mov ecx, eax;
|
|
"\xf3\xaa" // rep stosb;
|
|
"\xc3"; // retn;
|
|
|
|
unsigned char read_clobber_write[] =
|
|
"\x03\x18" // add ebx, [eax];
|
|
"\x8b\xc1" // mov eax, ecx;
|
|
"\x89\x10" // mov [eax], edx;
|
|
"\xc3"; // retn;
|
|
|
|
unsigned char read_xchg_write[] =
|
|
"\x03\x18" // add ebx, [eax];
|
|
"\x91" // xchg eax, ecx;
|
|
"\x89\x18" // mov [eax], ebx;
|
|
"\x89\x11" // mov [ecx], edx;
|
|
"\xc3"; // retn;
|
|
|
|
unsigned char read_cmp[] =
|
|
"\x03\x18" // add ebx, [eax];
|
|
"\x83\xf8\x00" // cmp eax, 0;
|
|
"\x74\x04" // je +4;
|
|
"\xc3"; // retn;
|
|
|
|
TEST(DisassemblerX86Test, SimpleReturnInstruction) {
|
|
DisassemblerX86 dis(just_return, sizeof(just_return)-1, 0);
|
|
EXPECT_EQ(1, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(true, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_controlflow, dis.currentInstructionGroup());
|
|
const libdis::x86_insn_t* instruction = dis.currentInstruction();
|
|
EXPECT_EQ(libdis::insn_controlflow, instruction->group);
|
|
EXPECT_EQ(libdis::insn_return, instruction->type);
|
|
EXPECT_EQ(0, dis.NextInstruction());
|
|
EXPECT_EQ(false, dis.currentInstructionValid());
|
|
EXPECT_EQ(NULL, dis.currentInstruction());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, SimpleInvalidInstruction) {
|
|
DisassemblerX86 dis(invalid_instruction, sizeof(invalid_instruction)-1, 0);
|
|
EXPECT_EQ(0, dis.NextInstruction());
|
|
EXPECT_EQ(false, dis.currentInstructionValid());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, BadReadLeadsToBranch) {
|
|
DisassemblerX86 dis(read_eax_jmp_eax, sizeof(read_eax_jmp_eax)-1, 0);
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadRead());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_logic, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_BRANCH_TARGET, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_controlflow, dis.currentInstructionGroup());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, BadWriteLeadsToPushedArg) {
|
|
DisassemblerX86 dis(write_eax_arg_to_call,
|
|
sizeof(write_eax_arg_to_call)-1, 0);
|
|
EXPECT_EQ(6, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadWrite());
|
|
EXPECT_EQ(3, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_arithmetic, dis.currentInstructionGroup());
|
|
EXPECT_EQ(1, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(5, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_ARGUMENT_PASSED, dis.flags());
|
|
EXPECT_EQ(libdis::insn_controlflow, dis.currentInstructionGroup());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
}
|
|
|
|
|
|
TEST(DisassemblerX86Test, BadReadLeadsToBlockWrite) {
|
|
DisassemblerX86 dis(read_edi_stosb, sizeof(read_edi_stosb)-1, 0);
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadRead());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_BLOCK_WRITE, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_string, dis.currentInstructionGroup());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, BadReadClobberThenWrite) {
|
|
DisassemblerX86 dis(read_clobber_write, sizeof(read_clobber_write)-1, 0);
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_arithmetic, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadRead());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, BadReadXCHGThenWrite) {
|
|
DisassemblerX86 dis(read_xchg_write, sizeof(read_xchg_write)-1, 0);
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_arithmetic, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadRead());
|
|
EXPECT_EQ(1, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_WRITE, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_move, dis.currentInstructionGroup());
|
|
}
|
|
|
|
TEST(DisassemblerX86Test, BadReadThenCMP) {
|
|
DisassemblerX86 dis(read_cmp, sizeof(read_cmp)-1, 0);
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(0, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_arithmetic, dis.currentInstructionGroup());
|
|
EXPECT_EQ(true, dis.setBadRead());
|
|
EXPECT_EQ(3, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_COMPARISON, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_comparison, dis.currentInstructionGroup());
|
|
EXPECT_EQ(2, dis.NextInstruction());
|
|
EXPECT_EQ(true, dis.currentInstructionValid());
|
|
EXPECT_EQ(google_breakpad::DISX86_BAD_COMPARISON, dis.flags());
|
|
EXPECT_EQ(false, dis.endOfBlock());
|
|
EXPECT_EQ(libdis::insn_controlflow, dis.currentInstructionGroup());
|
|
}
|
|
}
|
|
|
|
|