Page MenuHomePhabricator

Add missing decoding patterns toRoundUpToInstrBoundary
ClosedPublic

Authored by etienneb on Jun 20 2016, 9:29 AM.

Details

Summary

The RoundUpToInstrBoundary determines intructions boundary and it's used to determine how to patch (intercept) functions.

The current x64-bit implementation is incomplete. This patch is adding patterns observed when trying to sanitize a 64-bit executable on my computer.

Thw two current functions not intercepted are:

RaiseExceptionStub:
000000007720C3B0 EB 06                jmp         RaiseException (07720C3B8h)  
000000007720C3B2 90                   nop  
000000007720C3B3 90                   nop  
000000007720C3B4 90                   nop  
000000007720C3B5 90                   nop  
000000007720C3B6 90                   nop  
000000007720C3B7 90                   nop  
RaiseException:
000000007720C3B8 FF 25 3A 18 09 00    jmp         qword ptr [__imp_RaiseException (07729DBF8h)]  
000000007720C3BE 8B 44 24 54          mov         eax,dword ptr [rsp+54h]  
000000007720C3C2 85 C0                test        eax,eax  
000000007720C3C4 0F 84 F5 05 00 00    je          Wow64NtCreateKey+12Fh (07720C9BFh)
CreateThreadStub:
0000000077215A10 48 83 EC 48          sub         rsp,48h  
0000000077215A14 48 8B 44 24 78       mov         rax,qword ptr [rsp+78h]  
0000000077215A19 48 89 44 24 38       mov         qword ptr [rsp+38h],rax  
0000000077215A1E 8B 44 24 70          mov         eax,dword ptr [rsp+70h]

Diff Detail

Event Timeline

etienneb updated this revision to Diff 61258.Jun 20 2016, 9:29 AM
etienneb retitled this revision from to Add missing decoding patterns toRoundUpToInstrBoundary.
etienneb updated this object.
etienneb added a reviewer: rnk.
etienneb added a subscriber: chrisha.

The jmp in head, when separated from its "body", would break the trampoline machanism where original function is preserved, because jump from head could go to some unknown region int the tampoline area. See my artwork at: http://imgur.com/5vMplUn . But in 32-bit the same problem likely exists, so it's not worse.

etienneb updated this object.Jun 20 2016, 10:44 AM

The jmp in head, when separated from its "body", would break the trampoline machanism where original function is preserved, because jump from head could go to some unknown region int the tampoline area. See my artwork at: http://imgur.com/5vMplUn . But in 32-bit the same problem likely exists, so it's not worse.

I'm gonna make a quick fix over my patch. It is still not a general solution, but it's working.
Interception is not yet solved, but we can move forward.

rnk accepted this revision.Jun 20 2016, 10:50 AM
rnk edited edge metadata.

lgtm

This revision is now accepted and ready to land.Jun 20 2016, 10:50 AM
etienneb closed this revision.Jun 20 2016, 11:06 AM