Add missing decoding patterns toRoundUpToInstrBoundary

[etienneb]

Summary

The RoundUpToInstrBoundary determines intructions boundary and it's used to determine how to patch (intercept) functions.

The current x64-bit implementation is incomplete. This patch is adding patterns observed when trying to sanitize a 64-bit executable on my computer.

Thw two current functions not intercepted are:

RaiseExceptionStub:
000000007720C3B0 EB 06                jmp         RaiseException (07720C3B8h)  
000000007720C3B2 90                   nop  
000000007720C3B3 90                   nop  
000000007720C3B4 90                   nop  
000000007720C3B5 90                   nop  
000000007720C3B6 90                   nop  
000000007720C3B7 90                   nop  
RaiseException:
000000007720C3B8 FF 25 3A 18 09 00    jmp         qword ptr [__imp_RaiseException (07729DBF8h)]  
000000007720C3BE 8B 44 24 54          mov         eax,dword ptr [rsp+54h]  
000000007720C3C2 85 C0                test        eax,eax  
000000007720C3C4 0F 84 F5 05 00 00    je          Wow64NtCreateKey+12Fh (07720C9BFh)

CreateThreadStub:
0000000077215A10 48 83 EC 48          sub         rsp,48h  
0000000077215A14 48 8B 44 24 78       mov         rax,qword ptr [rsp+78h]  
0000000077215A19 48 89 44 24 38       mov         qword ptr [rsp+38h],rax  
0000000077215A1E 8B 44 24 70          mov         eax,dword ptr [rsp+70h]

[wang0109]

The jmp in head, when separated from its "body", would break the trampoline machanism where original function is preserved, because jump from head could go to some unknown region int the tampoline area. See my artwork at: http://imgur.com/5vMplUn . But in 32-bit the same problem likely exists, so it's not worse.

[etienneb]

In D21519#462255, @wang0109 wrote:

The jmp in head, when separated from its "body", would break the trampoline machanism where original function is preserved, because jump from head could go to some unknown region int the tampoline area. See my artwork at: http://imgur.com/5vMplUn . But in 32-bit the same problem likely exists, so it's not worse.

I'm gonna make a quick fix over my patch. It is still not a general solution, but it's working.
Interception is not yet solved, but we can move forward.

[etienneb]

update

[rnk]

lgtm

[wang0109]

LGTM

lib/interception/interception_win.cc

 #if SANITIZER_WINDOWS64
   // Win64 RoundUpToInstrBoundary is a work in progress.
   size_t cursor = 0;
   while (cursor < size) {
     switch (code[cursor]) {
       case '\x57':  // 57 : push rdi
         cursor++;
         continue;
+      case '\x90':  // 90 : nop
+        cursor++;
+        continue;
       case '\xb8':  // b8 XX XX XX XX : mov eax, XX XX XX XX
         cursor += 5;
         continue;
     }
 
     switch (*(unsigned short*)(code + cursor)) {  // NOLINT
       case 0x5540:  // 40 55 : rex push rbp
       case 0x5340:  // 40 53 : rex push rbx
switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) {
       case 0x058b48:    // 48 8b 05 XX XX XX XX
                         // = mov rax, QWORD PTR [rip+ 0xXXXXXXXX]
       case 0x25ff48:    // 48 ff 25 XX XX XX XX
                         // = rex.W jmp QWORD PTR [rip + 0xXXXXXXXX]
         cursor += 7;
         continue;
     }
 
+    switch (*(unsigned int*)(code + cursor)) {
+      case 0x24448b48:  // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX]
+        cursor += 5;
+        continue;
+    }
+
     // Check first 5 bytes.
     switch (0xFFFFFFFFFFull & *(unsigned long long*)(code + cursor)) {
       case 0x08245c8948:    // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx
       case 0x1024748948:    // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi
         cursor += 5;
         continue;
     }
 
+    // Check 8 bytes.
+    switch (*(unsigned long long*)(code + cursor)) {
+      case 0x90909090909006EBull:  // JMP +6,  6x NOP
+        cursor += 8;
+        continue;
+    }
+
     // Unknown instructions!
     __debugbreak();
   }
 
   return cursor;
 #else
   size_t cursor = 0;
   while (cursor < size) {