This is an archive of the discontinued LLVM Phabricator instance.

Differential D22077

[compiler-rt] Enhance unittest coverage for lib interception
ClosedPublic

Authored by etienneb on Jul 6 2016, 5:30 PM.

Details

Reviewers
rnk
Commits
rG31f4672f93f4: [compiler-rt] Enhance unittest coverage for lib interception
rCRT274775: [compiler-rt] Enhance unittest coverage for lib interception
rL274775: [compiler-rt] Enhance unittest coverage for lib interception
Summary

This patch is adding more unittests for testing the interception
of 32-bits code.

Diff Detail

Event Timeline

etienneb updated this revision to Diff 63004.Jul 6 2016, 5:30 PM
etienneb retitled this revision from to [compiler-rt] Enhance unittest coverage for lib interception.
etienneb updated this object.
etienneb added a reviewer: rnk.
etienneb added subscribers: • chrisha, wang0109, llvm-commits.
rnk accepted this revision.Jul 7 2016, 10:06 AM
rnk edited edge metadata.

lgtm

This revision is now accepted and ready to land.Jul 7 2016, 10:06 AM
etienneb closed this revision.Jul 7 2016, 10:58 AM

Revision Contents

PathSize
lib/
interception/
40 lines
tests/
111 lines

Diff 63004

lib/interception/interception_win.cc

Show First 20 Lines • Show All 123 Lines • ▼ Show 20 Lines switch (code[cursor]) {
case '\x90': // 90 : nop case '\x90': // 90 : nop
cursor++; cursor++;
continue; continue;
case '\xb8': // b8 XX XX XX XX : mov eax, XX XX XX XX case '\xb8': // b8 XX XX XX XX : mov eax, XX XX XX XX
cursor += 5; cursor += 5;
continue; continue;
} }
switch (*(unsigned short*)(code + cursor)) { // NOLINT switch (*(u16*)(code + cursor)) { // NOLINT
case 0x5540: // 40 55 : rex push rbp case 0x5540: // 40 55 : rex push rbp
case 0x5340: // 40 53 : rex push rbx case 0x5340: // 40 53 : rex push rbx
cursor += 2; cursor += 2;
continue; continue;
} }
switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { switch (0x00FFFFFF & *(u32*)(code + cursor)) {
case 0xc18b48: // 48 8b c1 : mov rax, rcx case 0xc18b48: // 48 8b c1 : mov rax, rcx
case 0xc48b48: // 48 8b c4 : mov rax, rsp case 0xc48b48: // 48 8b c4 : mov rax, rsp
case 0xd9f748: // 48 f7 d9 : neg rcx case 0xd9f748: // 48 f7 d9 : neg rcx
case 0xd12b48: // 48 2b d1 : sub rdx, rcx case 0xd12b48: // 48 2b d1 : sub rdx, rcx
case 0x07c1f6: // f6 c1 07 : test cl, 0x7 case 0x07c1f6: // f6 c1 07 : test cl, 0x7
case 0xc0854d: // 4d 85 c0 : test r8, r8 case 0xc0854d: // 4d 85 c0 : test r8, r8
case 0xc2b60f: // 0f b6 c2 : movzx eax, dl case 0xc2b60f: // 0f b6 c2 : movzx eax, dl
case 0xc03345: // 45 33 c0 : xor r8d, r8d case 0xc03345: // 45 33 c0 : xor r8d, r8d
Show All 18 Lines switch (0x00FFFFFF & *(u32*)(code + cursor)) {
case 0x058b48: // 48 8b 05 XX XX XX XX case 0x058b48: // 48 8b 05 XX XX XX XX
// = mov rax, QWORD PTR [rip+ 0xXXXXXXXX] // = mov rax, QWORD PTR [rip+ 0xXXXXXXXX]
case 0x25ff48: // 48 ff 25 XX XX XX XX case 0x25ff48: // 48 ff 25 XX XX XX XX
// = rex.W jmp QWORD PTR [rip + 0xXXXXXXXX] // = rex.W jmp QWORD PTR [rip + 0xXXXXXXXX]
cursor += 7; cursor += 7;
continue; continue;
} }
switch (*(unsigned int*)(code + cursor)) { switch (*(u32*)(code + cursor)) {
case 0x24448b48: // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX] case 0x24448b48: // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX]
cursor += 5; cursor += 5;
continue; continue;
} }
// Check first 5 bytes. // Check first 5 bytes.
switch (0xFFFFFFFFFFull & *(unsigned long long*)(code + cursor)) { switch (0xFFFFFFFFFFull & *(u64*)(code + cursor)) {
case 0x08245c8948: // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx case 0x08245c8948: // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx
case 0x1024748948: // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi case 0x1024748948: // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi
cursor += 5; cursor += 5;
continue; continue;
} }
// Check 8 bytes. // Check 8 bytes.
switch (*(unsigned long long*)(code + cursor)) { switch (*(u64*)(code + cursor)) {
case 0x90909090909006EBull: // JMP +6, 6x NOP case 0x90909090909006EBull: // JMP +6, 6x NOP
cursor += 8; cursor += 8;
continue; continue;
} }
// Unknown instructions! // Unknown instructions!
__debugbreak(); __debugbreak();
} }
return cursor; return cursor;
#else #else
size_t cursor = 0; size_t cursor = 0;
while (cursor < size) { while (cursor < size) {
switch (code[cursor]) { switch (code[cursor]) {
case '\xE8': // E8 XX XX XX XX = call <func>
case '\xE9': // E9 XX XX XX XX = jmp <label>
case '\xC3': // C3 = ret
case '\xEB': // EB XX = jmp XX (short jump)
case '\x70': // 7X YY = jx XX (short conditional jump)
case '\x71':
case '\x72':
case '\x73':
case '\x74':
case '\x75':
case '\x76':
case '\x77':
case '\x78':
case '\x79':
case '\x7A':
case '\x7B':
case '\x7C':
case '\x7D':
case '\x7E':
case '\x7F':
return 0;
case '\x50': // push eax case '\x50': // push eax
case '\x51': // push ecx case '\x51': // push ecx
case '\x52': // push edx case '\x52': // push edx
case '\x53': // push ebx case '\x53': // push ebx
case '\x54': // push esp case '\x54': // push esp
case '\x55': // push ebp case '\x55': // push ebp
case '\x56': // push esi case '\x56': // push esi
case '\x57': // push edi case '\x57': // push edi
case '\x5D': // pop ebp case '\x5D': // pop ebp
cursor++; cursor++;
continue; continue;
case '\x6A': // 6A XX = push XX case '\x6A': // 6A XX = push XX
cursor += 2; cursor += 2;
continue; continue;
case '\xE9': // E9 XX YY ZZ WW = jmp WWZZYYXX
case '\xB8': // B8 XX YY ZZ WW = mov eax, WWZZYYXX case '\xB8': // B8 XX YY ZZ WW = mov eax, WWZZYYXX
cursor += 5; cursor += 5;
continue; continue;
} }
switch (*(unsigned short*)(code + cursor)) { // NOLINT switch (*(u16*)(code + cursor)) { // NOLINT
case 0xFF8B: // 8B FF = mov edi, edi case 0xFF8B: // 8B FF = mov edi, edi
case 0xEC8B: // 8B EC = mov ebp, esp case 0xEC8B: // 8B EC = mov ebp, esp
case 0xC033: // 33 C0 = xor eax, eax case 0xC033: // 33 C0 = xor eax, eax
case 0xC933: // 33 C9 = xor ecx, ecx
cursor += 2; cursor += 2;
continue; continue;
case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh] case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh]
case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh] case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]
case 0x7D8B: // 8B 7D XX = mov edi, dword ptr [ebp+XXh] case 0x7D8B: // 8B 7D XX = mov edi, dword ptr [ebp+XXh]
case 0xEC83: // 83 EC XX = sub esp, XX case 0xEC83: // 83 EC XX = sub esp, XX
case 0x75FF: // FF 75 XX = push dword ptr [ebp+XXh] case 0x75FF: // FF 75 XX = push dword ptr [ebp+XXh]
cursor += 3; cursor += 3;
continue; continue;
case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
case 0x25FF: // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX] case 0x25FF: // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX]
cursor += 6; cursor += 6;
continue; continue;
case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
cursor += 7; cursor += 7;
continue; continue;
case 0x7D83: // 83 7D XX YY = cmp dword ptr [ebp+XXh], YY case 0x7D83: // 83 7D XX YY = cmp dword ptr [ebp+XXh], YY
cursor += 4; cursor += 4;
continue; continue;
} }
switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { switch (0x00FFFFFF & *(u32*)(code + cursor)) {
case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh] case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
case 0x24448B: // 8B 44 24 XX = mov eax, dword ptr [esp+XXh] case 0x24448B: // 8B 44 24 XX = mov eax, dword ptr [esp+XXh]
case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh] case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh] case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
case 0x24748B: // 8B 74 24 XX = mov esi, dword ptr [esp+XXh] case 0x24748B: // 8B 74 24 XX = mov esi, dword ptr [esp+XXh]
case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh] case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
cursor += 4; cursor += 4;
continue; continue;
} }
switch (*(unsigned int *)(code + cursor)) { switch (*(u32*)(code + cursor)) {
case 0x2444B60F: // 0F B6 44 24 XX = movzx eax, byte ptr [esp+XXh] case 0x2444B60F: // 0F B6 44 24 XX = movzx eax, byte ptr [esp+XXh]
cursor += 5; cursor += 5;
continue; continue;
} }
// Unknown instruction! // Unknown instruction!
// FIXME: Unknown instruction failures might happen when we add a new // FIXME: Unknown instruction failures might happen when we add a new
// interceptor or a new compiler version. In either case, they should result // interceptor or a new compiler version. In either case, they should result
▲ Show 20 Lines • Show All 232 Lines • Show Last 20 Lines

lib/interception/tests/interception_win_test.cc

Show All 21 Lines
#define WIN32_LEAN_AND_MEAN #define WIN32_LEAN_AND_MEAN
#include <windows.h> #include <windows.h>
namespace { namespace {
typedef int (*IdentityFunction)(int); typedef int (*IdentityFunction)(int);
#if !SANITIZER_WINDOWS64 #if !SANITIZER_WINDOWS64
u8 kIdentityCodeWithPrologue[] = {
const u8 kIdentityCodeWithPrologue[] = {
0x55, // push ebp 0x55, // push ebp
0x8B, 0xEC, // mov ebp,esp 0x8B, 0xEC, // mov ebp,esp
0x8B, 0x45, 0x08, // mov eax,dword ptr [ebp + 8] 0x8B, 0x45, 0x08, // mov eax,dword ptr [ebp + 8]
0x5D, // pop ebp 0x5D, // pop ebp
0xC3, // ret 0xC3, // ret
}; };
u8 kIdentityCodeWithPushPop[] = { const u8 kIdentityCodeWithPushPop[] = {
0x55, // push ebp 0x55, // push ebp
0x8B, 0xEC, // mov ebp,esp 0x8B, 0xEC, // mov ebp,esp
0x53, // push ebx 0x53, // push ebx
0x50, // push eax 0x50, // push eax
0x58, // pop eax 0x58, // pop eax
0x8B, 0x45, 0x08, // mov eax,dword ptr [ebp + 8] 0x8B, 0x45, 0x08, // mov eax,dword ptr [ebp + 8]
0x5B, // pop ebx 0x5B, // pop ebx
0x5D, // pop ebp 0x5D, // pop ebp
0xC3, // ret 0xC3, // ret
}; };
const u8 kPatchableCode1[] = {
0xB8, 0x4B, 0x00, 0x00, 0x00, // mov eax,4B
0x33, 0xC9, // xor ecx,ecx
0xC3, // ret
};
const u8 kPatchableCode2[] = {
0x55, // push ebp
0x8B, 0xEC, // mov ebp,esp
0x33, 0xC0, // xor eax,eax
0x5D, // pop ebp
0xC3, // ret
};
const u8 kPatchableCode3[] = {
0x55, // push ebp
0x8B, 0xEC, // mov ebp,esp
0x6A, 0x00, // push 0
0xE8, 0x3D, 0xFF, 0xFF, 0xFF, // call <func>
};
const u8 kUnpatchableCode1[] = {
0xC3, // ret
};
const u8 kUnpatchableCode2[] = {
0x33, 0xC9, // xor ecx,ecx
0xC3, // ret
};
const u8 kUnpatchableCode3[] = {
0x75, 0xCC, // jne <label>
0x33, 0xC9, // xor ecx,ecx
0xC3, // ret
};
const u8 kUnpatchableCode4[] = {
0x74, 0xCC, // jne <label>
0x33, 0xC9, // xor ecx,ecx
0xC3, // ret
};
const u8 kUnpatchableCode5[] = {
0xEB, 0x02, // jmp <label>
0x33, 0xC9, // xor ecx,ecx
0xC3, // ret
};
const u8 kUnpatchableCode6[] = {
0xE9, 0xCC, 0xCC, 0xCC, 0xCC, // jmp <label>
0x90, 0x90, 0x90, 0x90,
};
const u8 kUnpatchableCode7[] = {
0xE8, 0xCC, 0xCC, 0xCC, 0xCC, // call <func>
0x90, 0x90, 0x90, 0x90,
};
#endif #endif
// A buffer holding the dynamically generated code under test. // A buffer holding the dynamically generated code under test.
u8* ActiveCode; u8* ActiveCode;
size_t ActiveCodeLength = 4096; size_t ActiveCodeLength = 4096;
bool LoadActiveCode(u8* Code, size_t CodeLength, uptr* EntryPoint) { template<class T>
void LoadActiveCode(const T &Code, uptr *EntryPoint) {
if (ActiveCode == nullptr) { if (ActiveCode == nullptr) {
ActiveCode = ActiveCode =
(u8*)::VirtualAlloc(nullptr, ActiveCodeLength, MEM_COMMIT | MEM_RESERVE, (u8*)::VirtualAlloc(nullptr, ActiveCodeLength, MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE); PAGE_EXECUTE_READWRITE);
if (ActiveCode == nullptr) return false; ASSERT_NE(ActiveCode, nullptr);
} }
size_t Position = 0; size_t Position = 0;
*EntryPoint = (uptr)&ActiveCode[0]; *EntryPoint = (uptr)&ActiveCode[0];
// Copy the function body. // Copy the function body.
for (size_t i = 0; i < CodeLength; ++i) for (size_t i = 0; i < sizeof(T); ++i)
ActiveCode[Position++] = Code[i]; ActiveCode[Position++] = Code[i];
return true;
} }
int InterceptorFunctionCalled; int InterceptorFunctionCalled;
NOINLINE int InterceptorFunction(int x) { NOINLINE int InterceptorFunction(int x) {
++InterceptorFunctionCalled; ++InterceptorFunctionCalled;
return x; return x;
} }
Show All 11 LinesTEST(Interception, InternalGetProcAddress) {
uptr DbgPrint_adddress = InternalGetProcAddress(ntdll_handle, "DbgPrint"); uptr DbgPrint_adddress = InternalGetProcAddress(ntdll_handle, "DbgPrint");
uptr isdigit_address = InternalGetProcAddress(ntdll_handle, "isdigit"); uptr isdigit_address = InternalGetProcAddress(ntdll_handle, "isdigit");
EXPECT_EQ(DbgPrint_expected, DbgPrint_adddress); EXPECT_EQ(DbgPrint_expected, DbgPrint_adddress);
EXPECT_EQ(isdigit_expected, isdigit_address); EXPECT_EQ(isdigit_expected, isdigit_address);
EXPECT_NE(DbgPrint_adddress, isdigit_address); EXPECT_NE(DbgPrint_adddress, isdigit_address);
} }
void TestIdentityFunctionPatching(u8* IdentityCode, size_t IdentityCodeLength) { template<class T>
bool TestFunctionPatching(const T &Code) {
uptr Address;
int x = sizeof(T);
LoadActiveCode<T>(Code, &Address);
uptr UnusedRealAddress = 0;
return OverrideFunction(Address, (uptr)&InterceptorFunction,
&UnusedRealAddress);
}
template<class T>
void TestIdentityFunctionPatching(const T &IdentityCode) {
uptr IdentityAddress; uptr IdentityAddress;
ASSERT_TRUE( LoadActiveCode<T>(IdentityCode, &IdentityAddress);
LoadActiveCode(IdentityCode, IdentityCodeLength, &IdentityAddress));
IdentityFunction Identity = (IdentityFunction)IdentityAddress; IdentityFunction Identity = (IdentityFunction)IdentityAddress;
// Validate behavior before dynamic patching. // Validate behavior before dynamic patching.
InterceptorFunctionCalled = 0; InterceptorFunctionCalled = 0;
EXPECT_EQ(0, Identity(0)); EXPECT_EQ(0, Identity(0));
EXPECT_EQ(42, Identity(42)); EXPECT_EQ(42, Identity(42));
EXPECT_EQ(0, InterceptorFunctionCalled); EXPECT_EQ(0, InterceptorFunctionCalled);
Show All 13 Linesvoid TestIdentityFunctionPatching(const T &IdentityCode) {
InterceptorFunctionCalled = 0; InterceptorFunctionCalled = 0;
EXPECT_EQ(0, RealIdentity(0)); EXPECT_EQ(0, RealIdentity(0));
EXPECT_EQ(42, RealIdentity(42)); EXPECT_EQ(42, RealIdentity(42));
EXPECT_EQ(0, InterceptorFunctionCalled); EXPECT_EQ(0, InterceptorFunctionCalled);
} }
#if !SANITIZER_WINDOWS64 #if !SANITIZER_WINDOWS64
TEST(Interception, OverrideFunction) { TEST(Interception, OverrideFunction) {
TestIdentityFunctionPatching(kIdentityCodeWithPrologue, TestIdentityFunctionPatching(kIdentityCodeWithPrologue);
sizeof(kIdentityCodeWithPrologue)); TestIdentityFunctionPatching(kIdentityCodeWithPushPop);
TestIdentityFunctionPatching(kIdentityCodeWithPushPop, }
sizeof(kIdentityCodeWithPushPop));
TEST(Interception, PatchableFunction) {
EXPECT_TRUE(TestFunctionPatching(kPatchableCode1));
EXPECT_TRUE(TestFunctionPatching(kPatchableCode2));
EXPECT_TRUE(TestFunctionPatching(kPatchableCode3));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode1));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode2));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode3));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode4));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode5));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode6));
EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode7));
} }
#endif #endif
} // namespace __interception } // namespace __interception
#endif // SANITIZER_WINDOWS #endif // SANITIZER_WINDOWS
#endif // #if !SANITIZER_DEBUG #endif // #if !SANITIZER_DEBUG