This patch attempts to primitive support for Win64 asan

[wang0109]

Summary

Some known issues are:

• When "head" include instructions that involve branching, the "cut and paste" approach may break down in a way that function interception still work but calling back the original function does not work.
• The jmp [rip -8] saves some bytes in the "head" but finding the safe zone of 0xCC is not implemented yet. So it may stomp on preceding codes.
• The shadow offset is not working yet on Win64. More complexity maybe involved since there are some differences regarding virtual address space between Window 8 and Windows 8.1/10.

[kcc]

lib/asan/asan_interceptors.cc

733 ↗

(On Diff #59295)

define SANITIZER_WIN64 similar to SANITIZER_LINUX and use it instead of _WIN64

734 ↗

(On Diff #59295)

Then define SANITIZER_INTERCEPT_MEMCPY similar to SANITIZER_INTERCEPT_MEMCHR
Make it 0 under SANITIZER_WIN64, and there explain why.

lib/interception/interception_win.cc

46

I hope someone else can review this code :)

[wang0109]

• Define the platform SANITIZER_WINDOWS64

and the double interception was due to memcpy and memmov
has the same address on windows 64. So don't try to intercept
twice.

[kcc]

LGTM for non-windows code.
Please let someone else review the code in lib/interception/interception_win.cc

[etienneb]

lib/interception/interception_win.cc

48

I'm used to look instructions encoding on this site: http://ref.x86asm.net/

0x68: PUSH	imm16/32
0xC7: MOV	r/m16/32/64	imm16/32
0x44:     MOD:  [sib]+disp8
0x24:     SIB:     ESP (no scale index)
0x04:     offset (+4)
0xC3: RETN

It seems right to me.

68

*(jmp_from + 5) -> jmp_from[5]
and below

80

0xFF: JMP (opcode 4, encoded in 0x25)
0x25: [RIP/EIP]+disp32
... : offset -8

82

*jmp_from + x -> jmp_from[x]

306

indent is strange here.

lib/sanitizer_common/sanitizer_platform_interceptors.h

88

problamatic -> problematic

[wang0109]

• Update diff to fix array access format and typos, also improve some comments

[rnk]

lib/interception/interception_win.cc

68–71

Would this be cleaner with array indexing?

jmp_from[5] = '\xc7';
jmp_from[6] = '\x44;
jmp_from[7] = '\x24;
...

Obviously doesn't apply to the store of the immediate.

85

ditto

180–181

These can be 4 byte checks, the displacement is in the fifth byte and doesn't need to be checked.

186

We don't need three exclamation points, we know the table above isn't complete, it's just good enough for what we're trying to do.

278

Can we do this now? There really isn't much difference between the 32-bit and 64-bit code, just different trampolines, which I think you could abstract pretty easily.

296

It's probably simpler to use this code here:

jmp [rip+5] # not sure about precise offset
.quad target_address

To help with the 32/64 code merge, I'd create two entry points, WriteTrampolineJumpInstruction and WriteInterceptorJumpInstruction which behave differently on 32 and 64bit. On 64-bit, they would both delegate to WriteIndirectJumpInstruction, which would take two pointers, a code pointer a pointer to the address to jump through. A prototype:

void WriteTrampolineJumpInstruction(char *jmp_from, char *to) {
  // Emit an indirect jump through immediately following bytes:
  // jmp_from:
  //   jmp [rip + 5]
  //   .quad to
  // Store the address.
  uptr *indirect_target = (uptr *)(jmp_from + 6);
  *indirect_target = (uptr)to;
  // Write the indirect jump.
  WriteIndirectJumpInstruction(jmp_from, indirect_target);
}

void WriteInterceptorJumpInstruction(char *jmp_from, char *to) {
  // Emit an indirect jump through immediately preceding bytes:
  //   .quad to
  // jmp_from:
  //   jmp [rip - 8]
  // Store the address.
  uptr *indirect_target = (uptr *)(jmp_from - 8);
  *indirect_target = (uptr)to;
  // Write the indirect jump.
  WriteIndirectJumpInstruction(jmp_from, indirect_target);
}

For 32-bit they would both write a normal 5 byte jump

[wang0109]

• Merge implementations of 32bit/64bit windows interception.

[rnk]

This is pretty close

lib/interception/interception_win.cc

38

This will be unused in the win64 build, so you should do:

#ifndef SANITIZER_WINDOWS64
static void WriteJumpInstruction(...) { ... }
#else
static void WriteIndirectJumpInstruction(...) { ... }
#endif

Otherwise you'll trigger warnings on Linux.

46

Why NOLINT?

351

Can you write this in terms of constants that you've computed conditionally above, like you do for the trampoline?

359

What is the linter complaining about here? Mash clang-format if it's line length.

[wang0109]

lib/interception/interception_win.cc

46

If I remember correctly, it's over 80-characters in width. I'll double check.

[wang0109]

• update diff to remove some NOLINT and add kExtraPrevBytes

[rnk]

Looks good, but there's some formatting issues around the VirtualProtect calls.

Etienne, do you mind landing this patch? We should probably bug [e-mail] for commit access at this point.

lib/interception/interception_win.cc

359–360

I'd recommend getting clang-format: http://clang.llvm.org/docs/ClangFormat.html
It has editor integrations for VS, Vim, emacs, and BBEdit(?). I'm surprised Sublime isn't in that list... Anyway, it's really worth taking the time to get it wired up to some editor keypress to avoid discussing code formatting.

[etienneb]

Etienne, do you mind landing this patch?

Ack. landing...

[wang0109]

• update diff to use clang-format for VirtualProtect

[pcc]

compiler-rt/trunk/lib/interception/interception_win.cc

267 ↗

(On Diff #59751)

Do we ever actually need to do this on Windows? It looks like most of the functions we are intercepting are C standard library functions which we could easily implement ourselves.

[rnk]

compiler-rt/trunk/lib/interception/interception_win.cc

267 ↗

(On Diff #59751)

Sure, but we'd have to remove all uses of REAL in asan_interceptors.cc and sanitizer_common_interceptors.inc, which would be a lot of work and would mean Windows has special rules for writing interceptors.

[pcc]

compiler-rt/trunk/lib/interception/interception_win.cc

267 ↗

(On Diff #59751)

Sure, but we'd have to remove all uses of REAL in asan_interceptors.cc and sanitizer_common_interceptors.inc

Not necessarily, we could define REAL as something like #define REAL(x) real_##x on Windows, and provide sanitizer_common implementations of whichever real_foo functions are needed on Windows.

would mean Windows has special rules for writing interceptors.

That's unfortunate, but it seems less fragile than trying to pattern match every possible instruction sequence here.

lib/asan/asan_internal.h

 
 void ReserveShadowMemoryRange(uptr beg, uptr end, const char *name);
 
 // Platform-specific options.
 #if SANITIZER_MAC
 bool PlatformHasDifferentMemcpyAndMemmove();
 # define PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE \
     (PlatformHasDifferentMemcpyAndMemmove())
+#elif SANITIZER_WINDOWS64
+# define PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE false
 #else
 # define PLATFORM_HAS_DIFFERENT_MEMCPY_AND_MEMMOVE true
 #endif  // SANITIZER_MAC
 
 // Add convenient macro for interface functions that may be represented as
 // weak hooks.
 #define ASAN_MALLOC_HOOK(ptr, size) \
   if (&__sanitizer_malloc_hook) __sanitizer_malloc_hook(ptr, size)

lib/asan/asan_rtl.cc

bool full_shadow_is_available =
       MemoryRangeIsAvailable(shadow_start, kHighShadowEnd);
 
 #if SANITIZER_LINUX && defined(__x86_64__) && defined(_LP64) &&                \
     !ASAN_FIXED_MAPPING
   if (!full_shadow_is_available) {
     kMidMemBeg = kLowMemEnd < 0x3000000000ULL ? 0x3000000000ULL : 0;
     kMidMemEnd = kLowMemEnd < 0x3000000000ULL ? 0x4fffffffffULL : 0;
   }
+#elif SANITIZER_WINDOWS64
+  // Disable the "mid mem" shadow layout.
+  if (!full_shadow_is_available) {
+    kMidMemBeg = 0;
+    kMidMemEnd = 0;
+  }
 #endif
 
   if (Verbosity()) PrintAddressSpaceLayout();
 
   DisableCoreDumperIfNecessary();
 
   if (full_shadow_is_available) {
     // mmap the low shadow plus at least one page at the left.

lib/interception/interception_win.cc

 
 static void _memcpy(void *dst, void *src, size_t sz) {
   char *dst_c = (char*)dst,
        *src_c = (char*)src;
   for (size_t i = 0; i < sz; ++i)
     dst_c[i] = src_c[i];
 }
 
 static void WriteJumpInstruction(char *jmp_from, char *to) {
   // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset from jmp_from
   // to the next instruction to the destination.
   ptrdiff_t offset = to - jmp_from - 5;
   *jmp_from = '\xE9';
   *(ptrdiff_t*)(jmp_from + 1) = offset;
 }
 
+static void WriteJumpInstruction_14I(char *jmp_from, char *to) {
+  // Jump to any address with 14 instruction bytes on x64.
+  // Ref: https://blogs.oracle.com/nike/entry/long_absolute_jumps_on_amd64
+  //
+  // push DWORD          ; = 68 XX XX XX XX
+  //                     ; The lower 32 bits of a 64-bit address.
+  //                     ; Note that "push" in 64-bit mode sign-extends
+  //                     ; an imm32 to 64-bit.
+  // mov [rsp+4], DWORD  ; = c7 44 24 04 XX XX XX XX
+  //                     ; Overwrite the higher 32 bits.
+  // ret                 ; = c3
+  //                     ; The jump makes use of full 64-bit address.
+  //
+  // Example machine codes to jump to 0x8877665544332211 are:
+  // Codes:  68  11  22  33  44  c7  44  24  04  55  66  77  88  c3.
+  //        [68][LL][LL][LL][LL][c7][44][24][04][HH][HH][HH][HH][c3].
+  // Index: -00--01--02--03--04--05--06--07--08--09--10--11--12--13-
+  //
+  // Lower 4 bytes of the full 64-bit address.
+  unsigned long long to_addr  = (unsigned long long)to;
+  unsigned int to_addr_lower  = (unsigned int)(to_addr & 0xFFFFFFFFull);
+  unsigned int to_addr_higher = (to_addr & 0xFFFFFFFF00000000) >> 32;
+
+  jmp_from[0] = '\x68'; // Opcode for PUSH.
+  *(unsigned int*)(jmp_from + 1) = to_addr_lower;
+  jmp_from[5] = '\xC7'; // Opcodes for mov(4 bytes).
+  jmp_from[6] = '\x44';
+  jmp_from[7] = '\x24';
+  jmp_from[8] = '\x04';
+  // Higher 4 bytes of the full 64-bit address.
+  *(unsigned int*)(jmp_from + 9) = to_addr_higher;
+  jmp_from[13] = '\xC3'; // Opcode for RET.
+}
+
+static void WriteJumpInstruction_6I8D(char *jmp_from, char *to) {
+  // Jump to any address with 6 instruction bytes and 8 bytes of data.
+  // jmp [rip - 8] = ff 25 f8 ff ff ff
+  jmp_from[0] = '\xFF';
+  jmp_from[1] = '\x25';
+  jmp_from[2] = '\xF8';
+  jmp_from[3] = '\xFF';
+  jmp_from[4] = '\xFF';
+  jmp_from[5] = '\xFF';
+  // FIXME(wwchrome): We are betting on 0xCC paddings, but in practice
+  // it will sometimes stomp on valid bytes, in somecases will cause
+  // access violations. Need to implement a proper way that search
+  // for some room and handle violations.
+  // Put the full address at previous 8 bytes.
+  unsigned long long to_addr = (unsigned long long)to;
+  *(unsigned long long*)(jmp_from - 8) = to_addr;
+}
+
 static char *GetMemoryForTrampoline(size_t size) {
   // Trampolines are allocated from a common pool.
   const int POOL_SIZE = 1024;
   static char *pool = NULL;
   static size_t pool_used = 0;
   if (!pool) {
     pool = (char *)VirtualAlloc(NULL, POOL_SIZE, MEM_RESERVE | MEM_COMMIT,
                                 PAGE_EXECUTE_READWRITE);
static char *GetMemoryForTrampoline(size_t size) {
 
   char *ret = pool + pool_used;
   pool_used += size;
   return ret;
 }
 
 // Returns 0 on error.
 static size_t RoundUpToInstrBoundary(size_t size, char *code) {
-#ifdef _WIN64
-  // TODO(wwchrome): Implement similar logic for x64 instructions.
-  // Win64 RoundUpToInstrBoundary is not supported yet.
+#if SANITIZER_WINDOWS64
+  // Win64 RoundUpToInstrBoundary is a work in progress.
+  size_t cursor = 0;
+  while (cursor < size) {
+    switch (code[cursor]) {
+      case '\x57':  // 57 : push rdi
+        cursor++;
+        continue;
+      case '\xb8':  // b8 XX XX XX XX : mov eax, XX XX XX XX
+        cursor += 5;
+        continue;
+    }
+
+    switch (*(unsigned short*)(code + cursor)) {  // NOLINT
+      case 0x5540:  // 40 55 : rex push rbp
+      case 0x5340:  // 40 53 : rex push rbx
+        cursor += 2;
+        continue;
+    }
+
+    switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) {
+      case 0xc18b48:    // 48 8b c1 : mov rax, rcx
+      case 0xc48b48:    // 48 8b c4 : mov rax, rsp
+      case 0xd9f748:    // 48 f7 d9 : neg rcx
+      case 0xd12b48:    // 48 2b d1 : sub rdx, rcx
+      case 0x07c1f6:    // f6 c1 07 : test cl, 0x7
+      case 0xc0854d:    // 4d 85 c0 : test r8, r8
+      case 0xc2b60f:    // 0f b6 c2 : movzx eax, dl
+      case 0xc03345:    // 45 33 c0 : xor r8d, r8d
+      case 0xd98b4c:    // 4c 8b d9 : mov r11, rcx
+      case 0xd28b4c:    // 4c 8b d2 : mov r10, rdx
+      case 0xd2b60f:    // 0f b6 d2 : movzx edx, dl
+      case 0xca2b48:    // 48 2b ca : sub rcx, rdx
+      case 0x10b70f:    // 0f b7 10 : movzx edx, WORD PTR [rax]
+      case 0xc00b4d:    // 3d 0b c0 : or r8, r8
+      case 0xd18b48:    // 48 8b d1 : mov rdx, rcx
+      case 0xdc8b4c:    // 4c 8b dc : mov r11,rsp
+      case 0xd18b4c:    // 4c 8b d1 : mov r10, rcx
+        cursor += 3;
+        continue;
+
+      case 0xec8348:    // 48 83 ec XX : sub rsp, 0xXX
+      case 0xf88349:    // 49 83 f8 XX : cmp r8, XX
+      case 0x588948:    // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
+        cursor += 4;
+        continue;
+
+      case 0x058b48:    // 48 8b 05 XX XX XX XX
+                        // = mov rax, QWORD PTR [rip+ 0xXXXXXXXX]
+      case 0x25ff48:    // 48 ff 25 XX XX XX XX
+                        // = rex.W jmp QWORD PTR [rip + 0xXXXXXXXX]
+        cursor += 7;
+        continue;
+    }
+
+    // Check first 5 bytes.
+    switch (0xFFFFFFFFFFull & *(unsigned long long*)(code + cursor)) {
+      case 0x08245c8948:    // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx
+      case 0x1024748948:    // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi
+        cursor += 5;
+        continue;
+    }
+
+    // Unknown instructions!!!
     __debugbreak();
-  return 0;
+  }
+
+  return cursor;
 #else
   size_t cursor = 0;
   while (cursor < size) {
     switch (code[cursor]) {
       case '\x51':  // push ecx
       case '\x52':  // push edx
       case '\x53':  // push ebx
       case '\x54':  // push esp
while (cursor < size) {
     return 0;
   }
 
   return cursor;
 #endif
 }
 
 bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
-#ifdef _WIN64
-  // TODO(wwchrome): Implement using x64 jmp.
-  // OverrideFunction is not yet supported on x64.
-  __debugbreak();
+#if SANITIZER_WINDOWS64
+  // Function overriding works basically like this:
+  // We write "jmp [rip -8]" (6 bytes) at the beginning of the 'old_func'
+  // to override it.
+  // We might want to be able to execute the original 'old_func' from the
+  // wrapper, in this case we need to keep the leading 6+ bytes ('head')
+  // of the original code somewhere with a "jmp <old_func+head>".
+  // We call these 'head'+6 bytes of instructions a "trampoline".
+  char *old_bytes = (char *)old_func;
+
+  // TODO(wwchrome): Merge with the 32-bit version maybe.
+  size_t kHeadMin = 6; // The minimum size of the head.
+  size_t head = kHeadMin;
+  if (orig_old_func) {
+    // Find out the number of bytes of the instructions we need to copy
+    // to the trampoline and store it in 'head'.
+
+    head = RoundUpToInstrBoundary(kHeadMin, old_bytes);
+    if (!head)
       return false;
+
+    // Put the needed instructions into the trampoline bytes.
+    // Because the 'jmp' at the end of trampoline we can afford
+    // to use 14 bytes and it is simpler.
+    char *trampoline = GetMemoryForTrampoline(head + 14);
+    if (!trampoline)
+      return false;
+    _memcpy(trampoline, old_bytes, head);
+    WriteJumpInstruction_14I(trampoline + head, old_bytes + head);
+    *orig_old_func = (uptr)trampoline;
+  }
+
+  // Now put the "jmp <new_func>" instruction at the original code location.
+  // We should preserve the EXECUTE flag as some of our own code might be
+  // located in the same page (sic!).  FIXME: might consider putting the
+  // __interception code into a separate section or something?
+  DWORD old_prot, unused_prot;
+  // Need to mark extra 8 bytes because jmp [rip -8]
+  if (!VirtualProtect((void *)(old_bytes - 8), head + 8,
+        PAGE_EXECUTE_READWRITE, &old_prot))
+    return false;
+
+  WriteJumpInstruction_6I8D(old_bytes, (char *)new_func);
+  _memset(old_bytes + kHeadMin, 0xCC /* int 3 */, head - kHeadMin);
+
+  // Restore the original permissions.
+  if (!VirtualProtect((void *) (old_bytes - 8), head + 8, old_prot, &unused_prot)) // NOLINT
+    return false;  // not clear if this failure bothers us.
+
+  return true;
 #else
   // Function overriding works basically like this:
   // We write "jmp <new_func>" (5 bytes) at the beginning of the 'old_func'
   // to override it.
   // We might want to be able to execute the original 'old_func' from the
   // wrapper, in this case we need to keep the leading 5+ bytes ('head')
   // of the original code somewhere with a "jmp <old_func+head>".
   // We call these 'head'+5 bytes of instructions a "trampoline".
if (orig_old_func) {
     *orig_old_func = (uptr)trampoline;
   }
 
   // Now put the "jmp <new_func>" instruction at the original code location.
   // We should preserve the EXECUTE flag as some of our own code might be
   // located in the same page (sic!).  FIXME: might consider putting the
   // __interception code into a separate section or something?
   DWORD old_prot, unused_prot;
   if (!VirtualProtect((void *)old_bytes, head, PAGE_EXECUTE_READWRITE,
                       &old_prot))
     return false;
 
   WriteJumpInstruction(old_bytes, (char *)new_func);
   _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5);
 
   // Restore the original permissions.
   if (!VirtualProtect((void *)old_bytes, head, old_prot, &unused_prot))
     return false;  // not clear if this failure bothers us.
 
   return true;
 #endif
 }
 
 static void **InterestingDLLsAvailable() {
   const char *InterestingDLLs[] = {
       "kernel32.dll",

lib/sanitizer_common/sanitizer_platform.h

 #endif
 
 #if defined(_WIN32)
 # define SANITIZER_WINDOWS 1
 #else
 # define SANITIZER_WINDOWS 0
 #endif
 
+#if defined(_WIN64)
+# define SANITIZER_WINDOWS64 1
+#else
+# define SANITIZER_WINDOWS64 0
+#endif
+
 #if defined(__ANDROID__)
 # define SANITIZER_ANDROID 1
 #else
 # define SANITIZER_ANDROID 0
 #endif
 
 #define SANITIZER_POSIX (SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_MAC)
 

lib/sanitizer_common/sanitizer_platform_interceptors.h

 #define SANITIZER_INTERCEPT_STRSPN 1
 #define SANITIZER_INTERCEPT_STRPBRK 1
 #define SANITIZER_INTERCEPT_TEXTDOMAIN SI_LINUX_NOT_ANDROID
 #define SANITIZER_INTERCEPT_STRCASECMP SI_NOT_WINDOWS
 #define SANITIZER_INTERCEPT_MEMSET 1
 #define SANITIZER_INTERCEPT_MEMMOVE 1
 #define SANITIZER_INTERCEPT_MEMCPY 1
 #define SANITIZER_INTERCEPT_MEMCMP 1
+// TODO(wwchrome): Re-enable intercepting memchr() when ready.
+// The function memchr() contains a jump in the first 6 bytes
+// that is problematic to intercept correctly on Win64.
+// Disable memchr() interception for Win64 temporarily.
+#if SANITIZER_WINDOWS64
+#define SANITIZER_INTERCEPT_MEMCHR 0
+#else
 #define SANITIZER_INTERCEPT_MEMCHR 1
+#endif
 #define SANITIZER_INTERCEPT_MEMRCHR SI_FREEBSD || SI_LINUX
 
 #define SANITIZER_INTERCEPT_READ   SI_NOT_WINDOWS
 #define SANITIZER_INTERCEPT_PREAD  SI_NOT_WINDOWS
 #define SANITIZER_INTERCEPT_WRITE  SI_NOT_WINDOWS
 #define SANITIZER_INTERCEPT_PWRITE SI_NOT_WINDOWS
 
 #define SANITIZER_INTERCEPT_PREAD64 SI_LINUX_NOT_ANDROID