This is an archive of the discontinued LLVM Phabricator instance.

Add support for intercepting thunks of the form `jmp dword ptr ds:[WWZZYYXX]`
ClosedPublic

Authored by • ehsan on Jul 5 2014, 8:10 AM.

Download Raw Diff

Details

Reviewers

timurrrr
• ehsan

Diff Detail

Event Timeline

• ehsan updated this revision to Diff 11099.Jul 5 2014, 8:10 AM

• ehsan retitled this revision from to Add support for intercepting thunks of the form `jmp dword ptr ds:[WWZZYYXX]`.

• ehsan updated this object.

• ehsan edited the test plan for this revision. (Show Details)

• ehsan added a reviewer: timurrrr.

• ehsan added a subscriber: Unknown Object (MLST).

ping?

LGTM
What function/CRT version does require this?

Do you have committer rights or should I commit on your behalf?

Sorry for the delay, I haven't seen the patch. Feel free to send ASan/Win
specific patches with me as a reviewer.
14 июля 2014 г. 21:52 пользователь "Ehsan Akhgari" <ehsan.akhgari@gmail.com>
написал:

ping?

http://reviews.llvm.org/D4397

IIRC some str* function in the MSVCRT dll... I do have commit access,
thanks for the review!

Ehsan
http://ehsanakhgari.org/

Fixed in r212979.

This revision is now accepted and ready to land.Jul 14 2014, 1:37 PM

• ehsan closed this revision.Jul 14 2014, 1:37 PM

Revision Contents

Path

Size

lib/

interception/

interception_win.cc

1 line

Diff 11099

lib/interception/interception_win.cc

Show First 20 Lines • Show All 107 Lines • ▼ Show 20 Lines	switch ((unsigned short)(code + cursor)) { // NOLINT
cursor += 2;		cursor += 2;
continue;		continue;
case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh]		case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh]
case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]		case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]
case 0xEC83: // 83 EC XX = sub esp, XX		case 0xEC83: // 83 EC XX = sub esp, XX
cursor += 3;		cursor += 3;
continue;		continue;
case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX		case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
		case 0x25FF: // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX]
cursor += 6;		cursor += 6;
continue;		continue;
case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX		case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
cursor += 7;		cursor += 7;
continue;		continue;
}		}
switch (0x00FFFFFF & (unsigned int)(code + cursor)) {		switch (0x00FFFFFF & (unsigned int)(code + cursor)) {
case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]		case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
▲ Show 20 Lines • Show All 75 Lines • Show Last 20 Lines