[compiler-rt] Refactor the interception code on windows.

[etienneb]

Summary

This is a cleanup and refactoring of the interception code on windows

Enhancement:

• Adding the support for 64-bits code
• Adding several hooking technique:
  • Detour
  • JumpRedirect
  • HotPatch
  • Trampoline
• Adding a trampoline memory pool (64-bits) and release the allocated memory in unittests

Cleanup:

• Adding unittests for 64-bits hooking techniques
• Enhancing the RoundUpInstruction by sharing common decoder

[rnk]

lib/interception/interception_win.cc

40–60

static

46

static

53

Doesn't this scan forwards, and aren't we trying to scan backwards?

558

These local variables should probably follow google naming conventions, which is the prevailing local style in the sanitizer libraries.

[etienneb]

add 64-bits unittests

[etienneb]

nits

[etienneb]

added some 64-bits unittests.

lib/interception/interception_win.cc

53

I'll rename the function.
It's scanning a memory region.
The computation for the nop is done at the call size.
This function will have other usage, so let rename it.

558

ok. I'm used to take the llvm coding style.

[etienneb]

more unittests

[etienneb]

nits

[etienneb]

nit

[etienneb]

add more hooking techniques

[etienneb]

cleanup + documentation

[etienneb]

upload real patch

[etienneb]

nits

[etienneb]

nit

[etienneb]

more unittests

[etienneb]

fix typos

[etienneb]

more nits

[etienneb]

decode more instructions

[etienneb]

more nits

[etienneb]

fix dependencies issues

[rnk]

lib/interception/interception_win.cc

48

check overflow

72

Maybe CHECK(offset >= INT_MIN && offset <= INT_MAX) or an equivalent?

80

Check overflow

123

We should protect this with a critical section or some other mutex. The sanitizer_common mutex is probably not accessible from here, so I guess we should use a windows critical section.

383

A comment before this case block that these are all control flow instructions that we can't overwrite, and we indicate failure by returning 0.

lib/interception/tests/CMakeLists.txt

124–125

This file is otherwise unchanged, so I'd revert this whitespace-only change.

lib/interception/tests/interception_win_test.cc

43–44

I don't think these need to be functors, you can just pass function pointers to TestIdentityFunctionPatching and the other guy.

350–352

Do you think this is cleaner without the functor? Do you think we'll need to put other stuff in the overrider class?

I think you can use plain function pointers like this:

typedef void (*Overrider)(uptr, uptr, uptr*);
Overrider o = &OverrideFunctionWithDetour;
FunctionPrefixKind prefix = FunctionPrefixDetour;
TestIdentityFunctionPatching(kIdenti..., prefix, o);
TestIdentityFunctionPatching(kIdenti..., prefix, o);
TestIdentityFunctionPatching(kIdenti..., prefix, o);

[etienneb]

address rnk@ comments

lib/interception/interception_win.cc

123

I do not see why.
I was thinking the patching must occur before threads creation (or after a StopTheWorld).

Otherwise, dynamic rewriting the code will also need critical section.

lib/interception/tests/interception_win_test.cc

350–352

Both are fine to me.
I do not think we need to put more into the functor.
Moved to function pointer.

[rnk]

lgtm

lib/interception/interception_win.cc

123

OK, I believe that.

lib/interception/tests/interception_win_test.cc

307

This should be 'override' instead of 'Override', since it's a variable. Also below.

[etienneb]

nits

lib/interception/interception_win.h

 // Overrides a function only when it is called from a specific DLL. For example,
 // this is used to override calls to HeapAlloc/HeapFree from ucrtbase without
 // affecting other third party libraries.
 bool OverrideImportedFunction(const char *module_to_patch,
                               const char *imported_module,
                               const char *function_name, uptr new_function,
                               uptr *orig_old_func);
 
+#if !SANITIZER_WINDOWS64
+// Exposed for unittests
+bool OverrideFunctionWithDetour(
+    uptr old_func, uptr new_func, uptr *orig_old_func);
+#endif
+
+// Exposed for unittests
+bool OverrideFunctionWithRedirectJump(
+    uptr old_func, uptr new_func, uptr *orig_old_func);
+bool OverrideFunctionWithHotPatch(
+    uptr old_func, uptr new_func, uptr *orig_old_func);
+bool OverrideFunctionWithTrampoline(
+    uptr old_func, uptr new_func, uptr *orig_old_func);
+
+// Exposed for unittests
+void TestOnlyReleaseTrampolineRegions();
+
 }  // namespace __interception
 
 #if defined(INTERCEPTION_DYNAMIC_CRT)
 #define INTERCEPT_FUNCTION_WIN(func)                                           \
   ::__interception::OverrideFunction(#func,                                    \
                                      (::__interception::uptr)WRAP(func),       \
                                      (::__interception::uptr *)&REAL(func))
 #else

lib/interception/interception_win.cc

 // This file is a part of AddressSanitizer, an address sanity checker.
 //
 // Windows-specific interception methods.
 //===----------------------------------------------------------------------===//
 
 #ifdef _WIN32
 
 #include "interception.h"
+#include "sanitizer_common/sanitizer_common.h"
+#include "sanitizer_common/sanitizer_platform.h"
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
 namespace __interception {
 
 // FIXME: internal_str* and internal_mem* functions should be moved from the
 // ASan sources into interception/.
 
 static void _memset(void *p, int value, size_t sz) {
   for (size_t i = 0; i < sz; ++i)
     ((char*)p)[i] = (char)value;
 }
 
 static void _memcpy(void *dst, void *src, size_t sz) {
   char *dst_c = (char*)dst,
        *src_c = (char*)src;
   for (size_t i = 0; i < sz; ++i)
     dst_c[i] = src_c[i];
 }
 
-#if SANITIZER_WINDOWS64
-static void WriteIndirectJumpInstruction(char *jmp_from, uptr *indirect_target) {  // NOLINT
-  // jmp [rip + XXYYZZWW] = FF 25 WW ZZ YY XX, where
-  // XXYYZZWW is an offset from jmp_from.
-  // The displacement is still 32-bit in x64, so indirect_target must be located
-  // within +/- 2GB range.
-  int offset = (int)(indirect_target - (uptr *)jmp_from);
-  jmp_from[0] = '\xFF';
-  jmp_from[1] = '\x25';
-  *(int*)(jmp_from + 2) = offset;
+static bool ChangeMemoryProtection(
+    uptr address, uptr size, DWORD* old_protection) {
+  return ::VirtualProtect((void *)address, size,
+                          PAGE_EXECUTE_READWRITE,
+                          old_protection) != FALSE;
+}
+
+static bool RestoreMemoryProtection(
+    uptr address, uptr size, DWORD old_protection) {
+  DWORD unused;
+  return ::VirtualProtect((void *)address, size,
+                          old_protection,
+                          &unused) != FALSE;
+}
+
+static bool IsMemoryPadding(uptr address, uptr size) {
+  u8* function = (u8*)address;
+  for (size_t i = 0; i < size; ++i)
+    if (function[i] != 0x90 && function[i] != 0xCC)
+      return false;
+  return true;
 }
-#else
-static void WriteJumpInstruction(char *jmp_from, char *to) {
-  // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset from jmp_from
-  // to the next instruction to the destination.
-  ptrdiff_t offset = to - jmp_from - 5;
-  *jmp_from = '\xE9';
-  *(ptrdiff_t*)(jmp_from + 1) = offset;
+
+static void WritePadding(uptr from, uptr size) {
+  _memset((void*)from, 0xCC, (size_t)size);
+}
+
+static void CopyInstructions(uptr from, uptr to, uptr size) {
+  _memcpy((void*)from, (void*)to, (size_t)size);
+}
+
+static void WriteJumpInstruction(uptr from, uptr target) {
+  // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is a relative offset.
+  // The offset is the distance from the end of the jump instruction to the
+  // targeted instruction.
+  const int kInstructionLength = 5;
+  ptrdiff_t offset = target - from - kInstructionLength;
+  *(u8*)from = 0xE9;
+  *(u32*)(from + 1) = offset;
+}
+
+static void WriteShortJumpInstruction(uptr from, uptr target) {
+  const int kInstructionLength = 2;
+  uptr offset = target - from - kInstructionLength;
+  *(u8*)from = 0xEB;
+  *(u8*)(from + 1) = (u8)offset;
+}
+
+#if SANITIZER_WINDOWS64
+static void WriteIndirectJumpInstruction(uptr from, uptr indirect_target) {
+  // jmp [rip + XXYYZZWW] = FF 25 WW ZZ YY XX where XXYYZZWW is a relative
+  // offset.
+  // The offset is the distance from then end of the jump instruction to the
+  // memory location containing the targeted address. The displacement is still
+  // 32-bit in x64, so indirect_target must be located within +/- 2GB range.
+  const int kInstructionLength = 6;
+  int offset = indirect_target - from - kInstructionLength;
+  *(u16*)from = 0x25FF;
+  *(u32*)(from + 2) = offset;
 }
 #endif
 
-static void WriteTrampolineJumpInstruction(char *jmp_from, char *to) {
+static void WriteIndirectJumpToTarget(
+    uptr from, uptr indirect_target, uptr target) {
 #if SANITIZER_WINDOWS64
-  // Emit an indirect jump through immediately following bytes:
-  // jmp_from:
-  //   jmp [rip + 6]
-  //   .quad to
-  // Store the address.
-  uptr *indirect_target = (uptr *)(jmp_from + 6);
-  *indirect_target = (uptr)to;
   // Write the indirect jump.
-  WriteIndirectJumpInstruction(jmp_from, indirect_target);
+  WriteIndirectJumpInstruction(from, indirect_target);
+  // Store the address.
+  *(u64*)indirect_target = target;
 #else
-  WriteJumpInstruction(jmp_from, to);
+  (void)indirect_target;
+  WriteJumpInstruction(from, target);
 #endif
 }
 
-static void WriteInterceptorJumpInstruction(char *jmp_from, char *to) {
+static void WriteDirectJumpInstruction(uptr from, uptr target) {
 #if SANITIZER_WINDOWS64
   // Emit an indirect jump through immediately following bytes:
-  // jmp_from:
-  //   jmp [rip - 8]
-  //   .quad to
-  // Store the address.
-  uptr *indirect_target = (uptr *)(jmp_from - 8);
-  *indirect_target = (uptr)to;
-  // Write the indirect jump.
-  WriteIndirectJumpInstruction(jmp_from, indirect_target);
+  //   jmp [rip + 6]
+  //   .quad <target>
+  const int kInstructionLength = 6;
+  WriteIndirectJumpToTarget(from, from + kInstructionLength, target);
 #else
-  WriteJumpInstruction(jmp_from, to);
+  WriteJumpInstruction(from, target);
 #endif
 }
 
-static char *GetMemoryForTrampoline(size_t size) {
-  // Trampolines are allocated from a common pool.
-  const int POOL_SIZE = 1024;
-  static char *pool = NULL;
-  static size_t pool_used = 0;
-  if (!pool) {
-    pool = (char *)VirtualAlloc(NULL, POOL_SIZE, MEM_RESERVE | MEM_COMMIT,
+#if SANITIZER_WINDOWS64
+struct TrampolineMemoryRegion {
+  uptr content;
+  uptr allocated_size;
+  uptr max_size;
+};
+
+static const uptr kTrampolineScanLimitRange = (1000ULL) << 20; // 1 gig
+static const int kMaxTrampolineyRegion = 1024;
+static TrampolineMemoryRegion TrampolineRegions[kMaxTrampolineyRegion];
+
+static void *AllocateTrampolineRegion(uptr image_address, size_t granularity) {
+  uptr address = image_address;
+  uptr scanned = 0;
+  while (scanned < kTrampolineScanLimitRange) {
+    MEMORY_BASIC_INFORMATION info;
+    if (!::VirtualQuery((void*)address, &info, sizeof(info)))
+      return nullptr;
+
+    // Check whether a region can be allocated at |address|.
+    if (info.State == MEM_FREE && info.RegionSize >= granularity) {
+      void *page = ::VirtualAlloc((void*)RoundUpTo(address, granularity),
+                                  granularity,
+                                  MEM_RESERVE | MEM_COMMIT,
                                   PAGE_EXECUTE_READWRITE);
-    // FIXME: Might want to apply PAGE_EXECUTE_READ access after all the
-    // interceptors are in place.
-    if (!pool)
-      return NULL;
-    _memset(pool, 0xCC /* int 3 */, POOL_SIZE);
-  }
+      return page;
+    }
+
+    // Move to the next region.
+    address = (uptr)info.BaseAddress + info.RegionSize;
+    scanned += info.RegionSize;
+  }
+  return nullptr;
+}
+
+// Used by unittests to release mapped memory space.
+void TestOnlyReleaseTrampolineRegions() {
+  for (size_t bucket = 0; bucket < kMaxTrampolineyRegion; ++bucket) {
+    TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
+    ::VirtualFree((void*)current->content, 0, MEM_RELEASE);
+    current->content = 0;
+  }
 
-  if (pool_used + size > POOL_SIZE)
-    return NULL;
+static void *AllocateMemoryForTrampoline(uptr image_address, size_t size) {
+  // Find a region within 2G with enough space to allocate |size| bytes.
+  TrampolineMemoryRegion* region = nullptr;
+  for (size_t bucket = 0; bucket < kMaxTrampolineyRegion; ++bucket) {
+    TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
+    if (current->content == 0) {
+      // No valid region found, allocate a new region.
+      size_t bucket_size = GetMmapGranularity();
+      void* content  = AllocateTrampolineRegion(image_address, bucket_size);
+      if (content == nullptr)
+        return nullptr;
+
+      current->content = (uptr)content;
+      current->allocated_size = 0;
+      current->max_size = bucket_size;
+      region = current;
+      break;
+    } else if (current->content > image_address &&
+               current->content - image_address < 0x7FFFF0000 &&
+               current->max_size - current->allocated_size > size) {
+      // The space can be allocated in the current region.
+      region = current;
+      break;
+    }
+  }
+
+  // Failed to find a region.
+  if (region == nullptr)
+    return nullptr;
+
+  // Allocate the space in the current region.
+  uptr allocated_space = region->content + region->allocated_size;
+  region->allocated_size += size;
+  return (void *)allocated_space;
+}
 
-  char *ret = pool + pool_used;
-  pool_used += size;
+#else
+
+// Trampolines are allocated the same region.
+static const int kRegionSize = 4096;
+static char *trampoline_memory = NULL;
+static size_t trampoline_memory_used = 0;
+
+static char *AllocateMemoryForTrampoline(uptr image_address, size_t size) {
+  (void)image_address;
+  if (!trampoline_memory) {
+    trampoline_memory = (char *)VirtualAlloc(nullptr, kRegionSize,
+                                             MEM_RESERVE | MEM_COMMIT,
+                                             PAGE_EXECUTE_READWRITE);
+    if (!trampoline_memory)
+      return nullptr;
+    WritePadding((uptr)trampoline_memory, kRegionSize);
+  }
+
+  if (trampoline_memory_used + size > kRegionSize)
+    return nullptr;
+
+  char *ret = trampoline_memory + trampoline_memory_used;
+  trampoline_memory_used += size;
   return ret;
 }
 
+// Used by unittests to release mapped memory space.
+void TestOnlyReleaseTrampolineRegions() {
+  trampoline_memory_used = 0;
+}
+
+#endif  // SANITIZER_WINDOWS64
+
 // Returns 0 on error.
-static size_t RoundUpToInstrBoundary(size_t size, char *code) {
+static size_t GetInstructionSize(uptr address) {
+  switch (*(u8*)address) {
+    case 0x90:  // 90 : nop
+      return 1;
+
+    case 0x50:  // push eax / rax
+    case 0x51:  // push ecx / rcx
+    case 0x52:  // push edx / rdx
+    case 0x53:  // push ebx / rbx
+    case 0x54:  // push esp / rsp
+    case 0x55:  // push ebp / rbp
+    case 0x56:  // push esi / rsi
+    case 0x57:  // push edi / rdi
+    case 0x5D:  // pop ebp / rbp
+      return 1;
+
+    case 0x6A:  // 6A XX = push XX
+      return 2;
+
+    case 0xb8:  // b8 XX XX XX XX : mov eax, XX XX XX XX
+    case 0xB9:  // b9 XX XX XX XX : mov ecx, XX XX XX XX
+      return 5;
+
+    case 0xE9:  // E9 XX XX XX XX : jmp <label>
+      return 0;
+
+    case 0xE8:  // E8 XX XX XX XX : call <func>
+    case 0xC3:  // C3 : ret
+    case 0xEB:  // EB XX : jmp XX (short jump)
+    case 0x70:  // 7X YY : jx XX (short conditional jump)
+    case 0x71:
+    case 0x72:
+    case 0x73:
+    case 0x74:
+    case 0x75:
+    case 0x76:
+    case 0x77:
+    case 0x78:
+    case 0x79:
+    case 0x7A:
+    case 0x7B:
+    case 0x7C:
+    case 0x7D:
+    case 0x7E:
+    case 0x7F:
+      return 0;
+  }
+
+  switch (*(u16*)(address)) {
+    case 0xFF8B:  // 8B FF : mov edi, edi
+    case 0xEC8B:  // 8B EC : mov ebp, esp
+    case 0xc889:  // 89 C8 : mov eax, ecx
+    case 0xC18B:  // 8B C1 : mov eax, ecx
+    case 0xC033:  // 33 C0 : xor eax, eax
+    case 0xC933:  // 33 C9 : xor ecx, ecx
+    case 0xD233:  // 33 D2 : xor edx, edx
+      return 2;
+  }
+
 #if SANITIZER_WINDOWS64
-  // Win64 RoundUpToInstrBoundary is a work in progress.
-  size_t cursor = 0;
-  while (cursor < size) {
-    switch (code[cursor]) {
-      case '\x57':  // 57 : push rdi
-        cursor++;
-        continue;
-      case '\x90':  // 90 : nop
-        cursor++;
-        continue;
-      case '\xb8':  // b8 XX XX XX XX : mov eax, XX XX XX XX
-        cursor += 5;
-        continue;
-    }
-
-    switch (*(u16*)(code + cursor)) {  // NOLINT
-      case 0x5540:  // 40 55 : rex push rbp
-      case 0x5340:  // 40 53 : rex push rbx
-        cursor += 2;
-        continue;
-    }
+  switch (*(u16*)address) {
+    case 0x5040:  // push rax
+    case 0x5140:  // push rcx
+    case 0x5240:  // push rdx
+    case 0x5340:  // push rbx
+    case 0x5440:  // push rsp
+    case 0x5540:  // push rbp
+    case 0x5640:  // push rsi
+    case 0x5740:  // push rdi
+    case 0x5441:  // push r12
+    case 0x5541:  // push r13
+    case 0x5641:  // push r14
+    case 0x5741:  // push r15
+      return 2;
 
-    switch (0x00FFFFFF & *(u32*)(code + cursor)) {
-      case 0xc18b48:    // 48 8b c1 : mov rax, rcx
-      case 0xc48b48:    // 48 8b c4 : mov rax, rsp
-      case 0xd9f748:    // 48 f7 d9 : neg rcx
-      case 0xd12b48:    // 48 2b d1 : sub rdx, rcx
-      case 0x07c1f6:    // f6 c1 07 : test cl, 0x7
-      case 0xc0854d:    // 4d 85 c0 : test r8, r8
-      case 0xc2b60f:    // 0f b6 c2 : movzx eax, dl
-      case 0xc03345:    // 45 33 c0 : xor r8d, r8d
-      case 0xd98b4c:    // 4c 8b d9 : mov r11, rcx
-      case 0xd28b4c:    // 4c 8b d2 : mov r10, rdx
-      case 0xd2b60f:    // 0f b6 d2 : movzx edx, dl
-      case 0xca2b48:    // 48 2b ca : sub rcx, rdx
-      case 0x10b70f:    // 0f b7 10 : movzx edx, WORD PTR [rax]
-      case 0xc00b4d:    // 3d 0b c0 : or r8, r8
-      case 0xd18b48:    // 48 8b d1 : mov rdx, rcx
-      case 0xdc8b4c:    // 4c 8b dc : mov r11,rsp
-      case 0xd18b4c:    // 4c 8b d1 : mov r10, rcx
-        cursor += 3;
-        continue;
+  switch (0x00FFFFFF & *(u32*)address) {
+    case 0xe58948:    // 48 8b c4 : mov rbp, rsp
+      return 3;
 
-      case 0xec8348:    // 48 83 ec XX : sub rsp, 0xXX
-      case 0xf88349:    // 49 83 f8 XX : cmp r8, XX
-      case 0x588948:    // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
-        cursor += 4;
-        continue;
+      return 4;
 
-      case 0x058b48:    // 48 8b 05 XX XX XX XX
-                        // = mov rax, QWORD PTR [rip+ 0xXXXXXXXX]
-      case 0x25ff48:    // 48 ff 25 XX XX XX XX
-                        // = rex.W jmp QWORD PTR [rip + 0xXXXXXXXX]
-        cursor += 7;
-        continue;
-    }
+    case 0x058b48:    // 48 8b 05 XX XX XX XX :
+                      //   mov rax, QWORD PTR [rip+ 0xXXXXXXXX]
+    case 0x25ff48:    // 48 ff 25 XX XX XX XX :
+                      //   rex.W jmp QWORD PTR [rip + 0xXXXXXXXX]
+      return 7;
 
-    switch (*(u32*)(code + cursor)) {
-      case 0x24448b48:  // 48 8b 44 24 XX : mov rax, qword ptr [rsp + 0xXX]
-        cursor += 5;
-        continue;
-    }
+  switch (*(u32*)(address)) {
+      return 5;
 
-    // Check first 5 bytes.
-    switch (0xFFFFFFFFFFull & *(u64*)(code + cursor)) {
-      case 0x08245c8948:    // 48 89 5c 24 08 : mov QWORD PTR [rsp+0x8], rbx
-      case 0x1024748948:    // 48 89 74 24 10 : mov QWORD PTR [rsp+0x10], rsi
-        cursor += 5;
-        continue;
-    }
-
-    // Check 8 bytes.
-    switch (*(u64*)(code + cursor)) {
-      case 0x90909090909006EBull:  // JMP +6,  6x NOP
-        cursor += 8;
-        continue;
-    }
+  switch (0xFFFFFFFFFFull & *(u64*)(address)) {
+      return 5;
 
-    // Unknown instructions!
-    __debugbreak();
-  }
-
-  return cursor;
 #else
-  size_t cursor = 0;
-  while (cursor < size) {
-    switch (code[cursor]) {
-      case '\xE8':  // E8 XX XX XX XX = call <func>
-      case '\xE9':  // E9 XX XX XX XX = jmp <label>
-      case '\xC3':  // C3 = ret
-      case '\xEB':  // EB XX = jmp XX (short jump)
-      case '\x70':  // 7X YY = jx XX (short conditional jump)
-      case '\x71':
-      case '\x72':
-      case '\x73':
-      case '\x74':
-      case '\x75':
-      case '\x76':
-      case '\x77':
-      case '\x78':
-      case '\x79':
-      case '\x7A':
-      case '\x7B':
-      case '\x7C':
-      case '\x7D':
-      case '\x7E':
-      case '\x7F':
-        return 0;
 
-      case '\x50':  // push eax
-      case '\x51':  // push ecx
-      case '\x52':  // push edx
-      case '\x53':  // push ebx
-      case '\x54':  // push esp
-      case '\x55':  // push ebp
-      case '\x56':  // push esi
-      case '\x57':  // push edi
-      case '\x5D':  // pop ebp
-        cursor++;
-        continue;
-      case '\x6A':  // 6A XX = push XX
-        cursor += 2;
-        continue;
-      case '\xB8':  // B8 XX YY ZZ WW = mov eax, WWZZYYXX
-        cursor += 5;
-        continue;
-    }
-    switch (*(u16*)(code + cursor)) {  // NOLINT
-      case 0xFF8B:  // 8B FF = mov edi, edi
-      case 0xEC8B:  // 8B EC = mov ebp, esp
-      case 0xC033:  // 33 C0 = xor eax, eax
-      case 0xC933:  // 33 C9 = xor ecx, ecx
-        cursor += 2;
-        continue;
-      case 0x458B:  // 8B 45 XX = mov eax, dword ptr [ebp+XXh]
-      case 0x5D8B:  // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]
-      case 0x7D8B:  // 8B 7D XX = mov edi, dword ptr [ebp+XXh]
-      case 0xEC83:  // 83 EC XX = sub esp, XX
-      case 0x75FF:  // FF 75 XX = push dword ptr [ebp+XXh]
-        cursor += 3;
-        continue;
-      case 0xC1F7:  // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
-      case 0x25FF:  // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX]
-        cursor += 6;
-        continue;
-      case 0x3D83:  // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
-        cursor += 7;
-        continue;
-      case 0x7D83:  // 83 7D XX YY = cmp dword ptr [ebp+XXh], YY
-        cursor += 4;
-        continue;
-    }
-    switch (0x00FFFFFF & *(u32*)(code + cursor)) {
-      case 0x24448A:  // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
-      case 0x24448B:  // 8B 44 24 XX = mov eax, dword ptr [esp+XXh]
-      case 0x244C8B:  // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
-      case 0x24548B:  // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
-      case 0x24748B:  // 8B 74 24 XX = mov esi, dword ptr [esp+XXh]
-      case 0x247C8B:  // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
-        cursor += 4;
-        continue;
-    }
-    switch (*(u32*)(code + cursor)) {
-      case 0x2444B60F:  // 0F B6 44 24 XX = movzx eax, byte ptr [esp+XXh]
-        cursor += 5;
-        continue;
-    }
+  switch (*(u16*)address) {
+    case 0x458B:  // 8B 45 XX : mov eax, dword ptr [ebp+XXh]
+    case 0x5D8B:  // 8B 5D XX : mov ebx, dword ptr [ebp+XXh]
+    case 0x7D8B:  // 8B 7D XX : mov edi, dword ptr [ebp+XXh]
+    case 0xEC83:  // 83 EC XX : sub esp, XX
+    case 0x75FF:  // FF 75 XX : push dword ptr [ebp+XXh]
+      return 3;
+    case 0xC1F7:  // F7 C1 XX YY ZZ WW : test ecx, WWZZYYXX
+    case 0x25FF:  // FF 25 XX YY ZZ WW : jmp dword ptr ds:[WWZZYYXX]
+      return 6;
+    case 0x3D83:  // 83 3D XX YY ZZ WW TT : cmp TT, WWZZYYXX
+      return 7;
+    case 0x7D83:  // 83 7D XX YY : cmp dword ptr [ebp+XXh], YY
+      return 4;
+  }
+
+  switch (0x00FFFFFF & *(u32*)address) {
+    case 0x24448A:  // 8A 44 24 XX : mov eal, dword ptr [esp+XXh]
+    case 0x24448B:  // 8B 44 24 XX : mov eax, dword ptr [esp+XXh]
+    case 0x244C8B:  // 8B 4C 24 XX : mov ecx, dword ptr [esp+XXh]
+    case 0x24548B:  // 8B 54 24 XX : mov edx, dword ptr [esp+XXh]
+    case 0x24748B:  // 8B 74 24 XX : mov esi, dword ptr [esp+XXh]
+      return 4;
+  }
+
+  switch (*(u32*)address) {
+    case 0x2444B60F:  // 0F B6 44 24 XX : movzx eax, byte ptr [esp+XXh]
+      return 5;
+#endif
 
-    // Unknown instruction!
-    // FIXME: Unknown instruction failures might happen when we add a new
-    // interceptor or a new compiler version. In either case, they should result
-    // in visible and readable error messages. However, merely calling abort()
-    // leads to an infinite recursion in CheckFailed.
-    // Do we have a good way to abort with an error message here?
-    __debugbreak();
-    return 0;
-  }
 
+// Returns 0 on error.
+static size_t RoundUpToInstrBoundary(size_t size, uptr address) {
+  size_t cursor = 0;
+  while (cursor < size) {
+    size_t instruction_size = GetInstructionSize(address + cursor);
+    if (!instruction_size)
+      return 0;
+    cursor += instruction_size;
+  }
   return cursor;
+}
+
+#if !SANITIZER_WINDOWS64
+bool OverrideFunctionWithDetour(
+    uptr old_func, uptr new_func, uptr *orig_old_func) {
+  const int kDetourHeaderLen = 5;
+  const u16 kDetourInstruction = 0xFF8B;
+
+  uptr header = (uptr)old_func - kDetourHeaderLen;
+  uptr patch_length = kDetourHeaderLen + 2;
+
+  // Validate that the function is hookable.
+  if (*(u16*)old_func != kDetourInstruction ||
+      !IsMemoryPadding(header, kDetourHeaderLen))
+    return false;
+
+  // Change memory protection to writable.
+  DWORD protection = 0;
+  if (!ChangeMemoryProtection((uptr)header, patch_length, &protection))
+    return false;
+
+  // Write a relative jump to the redirected function.
+  WriteJumpInstruction(header, new_func);
+
+  // Write the short jump to the function prefix.
+  WriteShortJumpInstruction(old_func, header);
+
+  // Restore previous memory protection.
+  if (!RestoreMemoryProtection((uptr)header, patch_length, protection))
+    return false;
+
+  if (orig_old_func)
+    *orig_old_func = old_func + 2;
+
+  return true;
+}
+#endif
+
+bool OverrideFunctionWithRedirectJump(
+    uptr old_func, uptr new_func, uptr *orig_old_func) {
+  const int kOffsetLen = 4;
+  const int kInstructionLen = 5;
+
+  // Check whether the first instruction is a relative jump.
+  if (*(u8*)old_func != 0xE9)
+    return false;
+
+  if (orig_old_func) {
+    uptr relative_offset = *(u32*)(old_func + 1);
+    uptr absolute_target = old_func + relative_offset + kInstructionLen;
+    *orig_old_func = absolute_target;
+  }
+
+  // If needed, get memory space for a trampoline jump.
+  uptr trampoline = new_func;
+#if SANITIZER_WINDOWS64
+  const size_t kTrampolineJumpSize = FIRST_32_SECOND_64(5, 14);
+  trampoline = (uptr)AllocateMemoryForTrampoline(old_func, kTrampolineJumpSize);
+  WriteDirectJumpInstruction(trampoline, new_func);
+#endif
+
+  // Change memory protection to writable.
+  DWORD protection = 0;
+  if (!ChangeMemoryProtection(old_func, kOffsetLen, &protection))
+    return false;
+
+  // Write a relative jump to the redirected function.
+  WriteJumpInstruction(old_func, trampoline);
+
+  // Restore previous memory protection.
+  if (!RestoreMemoryProtection((uptr)old_func, kOffsetLen, protection))
+    return false;
+
+  return true;
+}
+
+bool OverrideFunctionWithHotPatch(
+    uptr old_func, uptr new_func, uptr *orig_old_func) {
+  const int kHotPatchHeaderLen = FIRST_32_SECOND_64(5, 6);
+  const int kShortJumpInstructionSize = 2;
+  const size_t kTrampolineJumpSize = FIRST_32_SECOND_64(5, 14);
+  const size_t kAddressLength = FIRST_32_SECOND_64(4, 8);
+
+  uptr header = (uptr)old_func - kHotPatchHeaderLen;
+  uptr patch_length = kHotPatchHeaderLen + kShortJumpInstructionSize;
+
+  // Validate that the function is hot patchable.
+  size_t first_instruction_size = GetInstructionSize(old_func);
+  if (first_instruction_size < 2 ||
+      !IsMemoryPadding(header, kHotPatchHeaderLen))
+    return false;
+
+  if (orig_old_func) {
+    // Put the needed instructions into the trampoline bytes.
+    uptr trampoline = (uptr)AllocateMemoryForTrampoline(old_func,
+                                first_instruction_size + kTrampolineJumpSize);
+    if (!trampoline)
+      return false;
+    CopyInstructions(trampoline, old_func, first_instruction_size);
+    WriteDirectJumpInstruction(trampoline + first_instruction_size,
+                               old_func + first_instruction_size);
+    *orig_old_func = trampoline;
+  }
+
+  // If needed, get memory space for indiret address.
+  uptr indirect_address = 0;
+#if SANITIZER_WINDOWS64
+  indirect_address = (uptr)AllocateMemoryForTrampoline(old_func, kAddressLength);
+  if (!indirect_address)
+    return false;
 #endif
+
+  // Change memory protection to writable.
+  DWORD protection = 0;
+  if (!ChangeMemoryProtection((uptr)header, patch_length, &protection))
+    return false;
+
+  // Write jumps to the redirected function.
+  WriteIndirectJumpToTarget(header, indirect_address, new_func);
+  WriteShortJumpInstruction(old_func, header);
+
+  // Restore previous memory protection.
+  if (!RestoreMemoryProtection((uptr)header, patch_length, protection))
+    return false;
+
+  return true;
 }
 
-bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunctionWithTrampoline(
+    uptr old_func, uptr new_func, uptr *orig_old_func) {
   // Function overriding works basically like this:
   // On Win32, We write "jmp <new_func>" (5 bytes) at the beginning of
   // the 'old_func' to override it.
   // On Win64, We write "jmp [rip -8]" (6 bytes) at the beginning of
   // the 'old_func' to override it, and use 8 bytes of data to store
   // the full 64-bit address for new_func.
   // We might want to be able to execute the original 'old_func' from the
   // wrapper, in this case we need to keep the leading 5+ (6+ on Win64)
   // bytes ('head') of the original code somewhere with a "jmp <old_func+head>".
   // We call these 'head'+5/6 bytes of instructions a "trampoline".
-  char *old_bytes = (char *)old_func;
 
-#if SANITIZER_WINDOWS64
-  size_t kHeadMin = 6;  // The minimum size of the head to contain the 'jmp'.
-  size_t kTrampolineJumpSize = 14;  // The total bytes used at the end of
-                                    // trampoline for jumping back to the
-                                    // remains of original function.
-  size_t kExtraPrevBytes = 8;  // The extra bytes we need to mark READWRITE for
-                               // page access, that is preceeding the begin
-                               // of function.
-#else
-  size_t kHeadMin = 5;
-  size_t kTrampolineJumpSize = 5;
-  size_t kExtraPrevBytes = 0;
-#endif
-  size_t head = kHeadMin;
+  // The minimum size of the head to contain the 'jmp'.
+  const size_t kHeadMin = FIRST_32_SECOND_64(5, 6);
+
+  // The total bytes used at the end of trampoline for jumping back to the
+  const size_t kTrampolineJumpSize = FIRST_32_SECOND_64(5, 14);
+
+  // The number of bytes to encode an address for an indirect jump.
+  const size_t kAddressLength = FIRST_32_SECOND_64(4, 8);
+
+  size_t function_padding_size = 0;
+  size_t head_size = kHeadMin;
+  uptr indirect_address = 0;
+
+
   if (orig_old_func) {
     // Find out the number of bytes of the instructions we need to copy
-    // to the trampoline and store it in 'head'.
-    head = RoundUpToInstrBoundary(kHeadMin, old_bytes);
-    if (!head)
+    // to the trampoline.
+    head_size = RoundUpToInstrBoundary(kHeadMin, old_func);
+    if (!head_size)
       return false;
 
     // Put the needed instructions into the trampoline bytes.
-    char *trampoline = GetMemoryForTrampoline(head + kTrampolineJumpSize);
+    uptr trampoline = (uptr)AllocateMemoryForTrampoline(
+                                old_func, head_size + kTrampolineJumpSize);
     if (!trampoline)
       return false;
-    _memcpy(trampoline, old_bytes, head);
-    WriteTrampolineJumpInstruction(trampoline + head, old_bytes + head);
-    *orig_old_func = (uptr)trampoline;
+    CopyInstructions(trampoline, old_func, head_size);
+    WriteDirectJumpInstruction(trampoline + head_size, old_func + head_size);
+    *orig_old_func = trampoline;
   }
 
-  // Now put the "jmp <new_func>" instruction at the original code location.
-  // We should preserve the EXECUTE flag as some of our own code might be
-  // located in the same page (sic!).  FIXME: might consider putting the
-  // __interception code into a separate section or something?
-  DWORD old_prot, unused_prot;
-  // TODO(wwchrome): Properly handle access violations when finding a safe
-  // region to store the indirect jump target address.
-  // Need to mark extra 8 bytes for Win64 because jmp [rip -8]
-  if (!VirtualProtect((void *)(old_bytes - kExtraPrevBytes),
-                      head + kExtraPrevBytes, PAGE_EXECUTE_READWRITE,
-                      &old_prot))
+#if SANITIZER_WINDOWS64
+  // Check if the targeted address can be encoded in the function padding.
+  // Otherwise, allocate it in the trampoline region.
+  if (IsMemoryPadding(old_func - kAddressLength, kAddressLength)) {
+    indirect_address = old_func - kAddressLength;
+    function_padding_size = kAddressLength;
+  } else {
+    indirect_address = (uptr)AllocateMemoryForTrampoline(old_func, kAddressLength);
+    if (!indirect_address)
+      return false;
+  }
+#endif
+
+  // Change memory protection to writable.
+  uptr patch_address = old_func - function_padding_size;
+  uptr patch_len = head_size + function_padding_size;
+  DWORD protection = 0;
+  if (!ChangeMemoryProtection(patch_address, patch_len, &protection))
     return false;
 
-  WriteInterceptorJumpInstruction(old_bytes, (char *)new_func);
-  _memset(old_bytes + kHeadMin, 0xCC /* int 3 */, head - kHeadMin);
+  // Patch the original function.
+  WriteIndirectJumpToTarget(old_func, indirect_address, new_func);
+  WritePadding(old_func + kHeadMin, head_size - kHeadMin);
 
-  // Restore the original permissions.
-  if (!VirtualProtect((void *)(old_bytes - kExtraPrevBytes),
-                      head + kExtraPrevBytes, old_prot, &unused_prot))
-    return false;  // not clear if this failure bothers us.
+  // Restore previous memory protection.
+  if (!RestoreMemoryProtection(patch_address, patch_len, protection))
+    return false;
 
   return true;
 }
 
+bool OverrideFunction(
+    uptr old_func, uptr new_func, uptr *orig_old_func) {
+#if !SANITIZER_WINDOWS64
+  if (OverrideFunctionWithDetour(old_func, new_func, orig_old_func))
+    return true;
+#endif
+  if (OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func))
+    return true;
+  if (OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func))
+    return true;
+  if (OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func))
+    return true;
+  return false;
+}
+
 static void **InterestingDLLsAvailable() {
   static const char *InterestingDLLs[] = {
       "kernel32.dll",
       "msvcr110.dll",      // VS2012
       "msvcr120.dll",      // VS2013
       "vcruntime140.dll",  // VS2015
       "ucrtbase.dll",      // Universal CRT
       // NTDLL should go last as it exports some functions that we should
bool OverrideImportedFunction(const char *module_to_patch,
   HMODULE module = GetModuleHandleA(module_to_patch);
   if (!module)
     return false;
 
   // Check that the module header is full and present.
   RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
   RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
   if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
-      headers->Signature != IMAGE_NT_SIGNATURE ||           // "PE\0\0"
+      headers->Signature != IMAGE_NT_SIGNATURE ||            // "PE\0\0"
       headers->FileHeader.SizeOfOptionalHeader <
           sizeof(IMAGE_OPTIONAL_HEADER)) {
     return false;
   }
 
   IMAGE_DATA_DIRECTORY *import_directory =
       &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
 

lib/interception/tests/CMakeLists.txt

macro(add_interception_tests_for_arch arch)
   # Add unittest target.
   set(INTERCEPTION_TEST_NAME "Interception-${arch}-Test")
   add_compiler_rt_test(InterceptionUnitTests ${INTERCEPTION_TEST_NAME}
                        OBJECTS ${INTERCEPTION_TEST_OBJECTS}
                                ${INTERCEPTION_COMMON_LIB_NAME}
                        DEPS ${INTERCEPTION_TEST_OBJECTS} ${INTERCEPTION_COMMON_LIB}
                        LINK_FLAGS ${INTERCEPTION_TEST_LINK_FLAGS_COMMON}
                                   ${TARGET_FLAGS})
-
-
 endmacro()
 
 if(COMPILER_RT_CAN_EXECUTE_TESTS AND NOT ANDROID AND NOT APPLE)
   # We use just-built clang to build interception unittests, so we must
   # be sure that produced binaries would work.
   if(APPLE)
     add_interceptor_lib("RTInterception.test.osx"
                         $<TARGET_OBJECTS:RTInterception.osx>)
   else()
     foreach(arch ${INTERCEPTION_UNITTEST_SUPPORTED_ARCH})
       add_interceptor_lib("RTInterception.test.${arch}"
-                          $<TARGET_OBJECTS:RTInterception.${arch}>)
+                          $<TARGET_OBJECTS:RTInterception.${arch}>
+                          $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
+                          $<TARGET_OBJECTS:RTSanitizerCommonLibc.${arch}>)
     endforeach()
   endif()
   foreach(arch ${INTERCEPTION_UNITTEST_SUPPORTED_ARCH})
     add_interception_tests_for_arch(${arch})
   endforeach()
 endif()

lib/interception/tests/interception_win_test.cc

 
 // Too slow for debug build
 #if !SANITIZER_DEBUG
 #if SANITIZER_WINDOWS
 
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
+namespace __interception {
 namespace {
 
-typedef int (*IdentityFunction)(int);
+enum FunctionPrefixKind {
+  FunctionPrefixNone,
+  FunctionPrefixPadding,
+  FunctionPrefixHotPatch,
+  FunctionPrefixDetour,
+};
+
+struct TestOverrideFunction {
+  uptr Override(
+      uptr old_func, uptr new_func, uptr *orig_old_func) const {
+    return OverrideFunction(old_func, new_func, orig_old_func);
+  }
+};
 
 #if !SANITIZER_WINDOWS64
+struct TestOverrideFunctionWithDetour {
+  uptr Override(
+      uptr old_func, uptr new_func, uptr *orig_old_func) const {
+    return OverrideFunctionWithDetour(old_func, new_func, orig_old_func);
+  }
+};
+#endif
+
+struct TestOverrideFunctionWithRedirectJump {
+  uptr Override(
+      uptr old_func, uptr new_func, uptr *orig_old_func) const {
+    return OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func);
+  }
+};
+
+struct TestOverrideFunctionWithHotPatch {
+  uptr Override(
+      uptr old_func, uptr new_func, uptr *orig_old_func) const {
+    return OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func);
+  }
+};
+struct TestOverrideFunctionWithTrampoline {
+  uptr Override(
+      uptr old_func, uptr new_func, uptr *orig_old_func) const {
+    return OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func);
+  }
+};
+
+typedef int (*IdentityFunction)(int);
+
+#if SANITIZER_WINDOWS64
+
+const u8 kIdentityCodeWithPrologue[] = {
+    0x55,                   // push        rbp
+    0x48, 0x89, 0xE5,       // mov         rbp,rsp
+    0x8B, 0xC1,             // mov         eax,ecx
+    0x5D,                   // pop         rbp
+    0xC3,                   // ret
+};
+
+const u8 kIdentityCodeWithPushPop[] = {
+    0x55,                   // push        rbp
+    0x48, 0x89, 0xE5,       // mov         rbp,rsp
+    0x53,                   // push        rbx
+    0x50,                   // push        rax
+    0x58,                   // pop         rax
+    0x8B, 0xC1,             // mov         rax,rcx
+    0x5B,                   // pop         rbx
+    0x5D,                   // pop         rbp
+    0xC3,                   // ret
+};
+
+const u8 kIdentityTwiceOffset = 16;
+const u8 kIdentityTwice[] = {
+    0x55,                   // push        rbp
+    0x48, 0x89, 0xE5,       // mov         rbp,rsp
+    0x8B, 0xC1,             // mov         eax,ecx
+    0x5D,                   // pop         rbp
+    0xC3,                   // ret
+    0x90, 0x90, 0x90, 0x90,
+    0x90, 0x90, 0x90, 0x90,
+    0x55,                   // push        rbp
+    0x48, 0x89, 0xE5,       // mov         rbp,rsp
+    0x8B, 0xC1,             // mov         eax,ecx
+    0x5D,                   // pop         rbp
+    0xC3,                   // ret
+};
+
+const u8 kIdentityCodeWithMov[] = {
+    0x89, 0xC8,             // mov         eax, ecx
+    0xC3,                   // ret
+};
+
+const u8 kIdentityCodeWithJump[] = {
+    0xE9, 0x04, 0x00, 0x00,
+    0x00,                   // jmp + 4
+    0xCC, 0xCC, 0xCC, 0xCC,
+    0x89, 0xC8,             // mov         eax, ecx
+    0xC3,                   // ret
+};
+
+#else
 
 const u8 kIdentityCodeWithPrologue[] = {
-    0x55,              // push        ebp
-    0x8B, 0xEC,        // mov         ebp,esp
-    0x8B, 0x45, 0x08,  // mov         eax,dword ptr [ebp + 8]
-    0x5D,              // pop         ebp
-    0xC3,              // ret
+    0x55,                   // push        ebp
+    0x8B, 0xEC,             // mov         ebp,esp
+    0x8B, 0x45, 0x08,       // mov         eax,dword ptr [ebp + 8]
+    0x5D,                   // pop         ebp
+    0xC3,                   // ret
 };
 
 const u8 kIdentityCodeWithPushPop[] = {
-    0x55,              // push        ebp
-    0x8B, 0xEC,        // mov         ebp,esp
-    0x53,              // push        ebx
-    0x50,              // push        eax
-    0x58,              // pop         eax
-    0x8B, 0x45, 0x08,  // mov         eax,dword ptr [ebp + 8]
-    0x5B,              // pop         ebx
-    0x5D,              // pop         ebp
-    0xC3,              // ret
+    0x55,                   // push        ebp
+    0x8B, 0xEC,             // mov         ebp,esp
+    0x53,                   // push        ebx
+    0x50,                   // push        eax
+    0x58,                   // pop         eax
+    0x8B, 0x45, 0x08,       // mov         eax,dword ptr [ebp + 8]
+    0x5B,                   // pop         ebx
+    0x5D,                   // pop         ebp
+    0xC3,                   // ret
 };
 
+const u8 kIdentityTwiceOffset = 8;
+const u8 kIdentityTwice[] = {
+    0x55,                   // push        ebp
+    0x8B, 0xEC,             // mov         ebp,esp
+    0x8B, 0x45, 0x08,       // mov         eax,dword ptr [ebp + 8]
+    0x5D,                   // pop         ebp
+    0xC3,                   // ret
+    0x55,                   // push        ebp
+    0x8B, 0xEC,             // mov         ebp,esp
+    0x8B, 0x45, 0x08,       // mov         eax,dword ptr [ebp + 8]
+    0x5D,                   // pop         ebp
+    0xC3,                   // ret
+};
+
+const u8 kIdentityCodeWithMov[] = {
+    0x8B, 0x44, 0x24, 0x04, // mov         eax,dword ptr [esp + 4]
+    0xC3,                   // ret
+};
+
+const u8 kIdentityCodeWithJump[] = {
+    0xE9, 0x04, 0x00, 0x00,
+    0x00,                   // jmp + 4
+    0xCC, 0xCC, 0xCC, 0xCC,
+    0x8B, 0x44, 0x24, 0x04, // mov         eax,dword ptr [esp + 4]
+    0xC3,                   // ret
+};
+
+#endif
+
 const u8 kPatchableCode1[] = {
     0xB8, 0x4B, 0x00, 0x00, 0x00,   // mov eax,4B
     0x33, 0xC9,                     // xor ecx,ecx
     0xC3,                           // ret
 };
 
 const u8 kPatchableCode2[] = {
     0x55,                           // push ebp
     0x8B, 0xEC,                     // mov ebp,esp
     0x33, 0xC0,                     // xor eax,eax
     0x5D,                           // pop ebp
     0xC3,                           // ret
 };
 
 const u8 kPatchableCode3[] = {
     0x55,                           // push ebp
     0x8B, 0xEC,                     // mov ebp,esp
     0x6A, 0x00,                     // push 0
     0xE8, 0x3D, 0xFF, 0xFF, 0xFF,   // call <func>
 };
 
+const u8 kPatchableCode4[] = {
+    0xE9, 0xCC, 0xCC, 0xCC, 0xCC,   // jmp <label>
+    0x90, 0x90, 0x90, 0x90,
+};
+
 const u8 kUnpatchableCode1[] = {
     0xC3,                           // ret
 };
 
 const u8 kUnpatchableCode2[] = {
     0x33, 0xC9,                     // xor ecx,ecx
     0xC3,                           // ret
 };

 
 const u8 kUnpatchableCode5[] = {
     0xEB, 0x02,                     // jmp <label>
     0x33, 0xC9,                     // xor ecx,ecx
     0xC3,                           // ret
 };
 
 const u8 kUnpatchableCode6[] = {
-    0xE9, 0xCC, 0xCC, 0xCC, 0xCC,   // jmp <label>
-    0x90, 0x90, 0x90, 0x90,
-};
-
-const u8 kUnpatchableCode7[] = {
     0xE8, 0xCC, 0xCC, 0xCC, 0xCC,   // call <func>
     0x90, 0x90, 0x90, 0x90,
 };
 
-#endif
-
 // A buffer holding the dynamically generated code under test.
 u8* ActiveCode;
 size_t ActiveCodeLength = 4096;
 
 template<class T>
-void LoadActiveCode(const T &Code, uptr *EntryPoint) {
+static void LoadActiveCode(
+    const T &code,
+    uptr *entry_point,
+    FunctionPrefixKind prefix_kind = FunctionPrefixNone) {
   if (ActiveCode == nullptr) {
     ActiveCode =
-        (u8*)::VirtualAlloc(nullptr, ActiveCodeLength, MEM_COMMIT | MEM_RESERVE,
+        (u8*)::VirtualAlloc(nullptr, ActiveCodeLength,
+                            MEM_COMMIT | MEM_RESERVE,
                             PAGE_EXECUTE_READWRITE);
     ASSERT_NE(ActiveCode, nullptr);
   }
 
-  size_t Position = 0;
-  *EntryPoint = (uptr)&ActiveCode[0];
+  size_t position = 0;
+
+  // Add padding to avoid memory violation when scanning the prefix.
+  for (int i = 0; i < 16; ++i)
+    ActiveCode[position++] = 0xC3;  // Instruction 'ret'.
+
+  // Add function padding.
+  size_t padding = 0;
+  if (prefix_kind == FunctionPrefixPadding)
+    padding = 16;
+  else if (prefix_kind == FunctionPrefixDetour ||
+           prefix_kind == FunctionPrefixHotPatch)
+    padding = FIRST_32_SECOND_64(5, 6);
+  // Insert |padding| instructions 'nop'.
+  for (size_t i = 0; i < padding; ++i)
+    ActiveCode[position++] = 0x90;
+
+  // Keep track of the entry point.
+  *entry_point = (uptr)&ActiveCode[position];
+
+  // Add the detour instruction (i.e. mov edi, edi)
+  if (prefix_kind == FunctionPrefixDetour) {
+    ActiveCode[position++] = 0x8B;
+    ActiveCode[position++] = 0xFF;
+  }
 
   // Copy the function body.
   for (size_t i = 0; i < sizeof(T); ++i)
-    ActiveCode[Position++] = Code[i];
+    ActiveCode[position++] = code[i];
 }
 
 int InterceptorFunctionCalled;
+IdentityFunction InterceptedRealFunction;
 
-NOINLINE int InterceptorFunction(int x) {
+int InterceptorFunction(int x) {
   ++InterceptorFunctionCalled;
-  return x;
+  return InterceptedRealFunction(x);
 }
 
 }  // namespace
 
-namespace __interception {
-
 // Tests for interception_win.h
 TEST(Interception, InternalGetProcAddress) {
   HMODULE ntdll_handle = ::GetModuleHandle("ntdll");
   ASSERT_NE(nullptr, ntdll_handle);
   uptr DbgPrint_expected = (uptr)::GetProcAddress(ntdll_handle, "DbgPrint");
   uptr isdigit_expected = (uptr)::GetProcAddress(ntdll_handle, "isdigit");
   uptr DbgPrint_adddress = InternalGetProcAddress(ntdll_handle, "DbgPrint");
   uptr isdigit_address = InternalGetProcAddress(ntdll_handle, "isdigit");
 
   EXPECT_EQ(DbgPrint_expected, DbgPrint_adddress);
   EXPECT_EQ(isdigit_expected, isdigit_address);
   EXPECT_NE(DbgPrint_adddress, isdigit_address);
 }
 
-template<class T>
-bool TestFunctionPatching(const T &Code) {
-  uptr Address;
-  int x = sizeof(T);
-
-  LoadActiveCode<T>(Code, &Address);
-  uptr UnusedRealAddress = 0;
-  return OverrideFunction(Address, (uptr)&InterceptorFunction,
-                          &UnusedRealAddress);
-}
-
-template<class T>
-void TestIdentityFunctionPatching(const T &IdentityCode) {
-  uptr IdentityAddress;
-  LoadActiveCode<T>(IdentityCode, &IdentityAddress);
-  IdentityFunction Identity = (IdentityFunction)IdentityAddress;
+template<class Overrider, class T>
+static void TestIdentityFunctionPatching(
+    const T &code,
+    FunctionPrefixKind prefix_kind = FunctionPrefixNone) {
+  uptr identity_address;
+  LoadActiveCode(code, &identity_address, prefix_kind);
+  IdentityFunction identity = (IdentityFunction)identity_address;
 
   // Validate behavior before dynamic patching.
   InterceptorFunctionCalled = 0;
-  EXPECT_EQ(0, Identity(0));
-  EXPECT_EQ(42, Identity(42));
+  EXPECT_EQ(0, identity(0));
+  EXPECT_EQ(42, identity(42));
   EXPECT_EQ(0, InterceptorFunctionCalled);
 
   // Patch the function.
-  uptr RealIdentityAddress = 0;
-  EXPECT_TRUE(OverrideFunction(IdentityAddress, (uptr)&InterceptorFunction,
-                               &RealIdentityAddress));
-  IdentityFunction RealIdentity = (IdentityFunction)RealIdentityAddress;
+  uptr real_identity_address = 0;
+  bool success = Overrider().Override(identity_address,
+                                      (uptr)&InterceptorFunction,
+                                      &real_identity_address);
+  EXPECT_TRUE(success);
+  EXPECT_NE(0U, real_identity_address);
+  IdentityFunction real_identity = (IdentityFunction)real_identity_address;
+  InterceptedRealFunction = real_identity;
+
+  // Do not run other tests if the function was not generated.
+  if (!success || !real_identity_address)
+    return;
 
   // Calling the redirected function.
   InterceptorFunctionCalled = 0;
-  EXPECT_EQ(0, Identity(0));
-  EXPECT_EQ(42, Identity(42));
+  EXPECT_EQ(0, identity(0));
+  EXPECT_EQ(42, identity(42));
   EXPECT_EQ(2, InterceptorFunctionCalled);
 
   // Calling the real function.
   InterceptorFunctionCalled = 0;
-  EXPECT_EQ(0, RealIdentity(0));
-  EXPECT_EQ(42, RealIdentity(42));
+  EXPECT_EQ(0, real_identity(0));
+  EXPECT_EQ(42, real_identity(42));
   EXPECT_EQ(0, InterceptorFunctionCalled);
+
+  TestOnlyReleaseTrampolineRegions();
 }
 
 #if !SANITIZER_WINDOWS64
+TEST(Interception, OverrideFunctionWithDetour) {
+  typedef TestOverrideFunctionWithDetour T;
+  FunctionPrefixKind prefix = FunctionPrefixDetour;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithMov, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithJump, prefix);
+}
+
+TEST(Interception, OverrideFunctionWithRedirectJump) {
+  typedef TestOverrideFunctionWithRedirectJump T;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithJump);
+}
+#endif  // !SANITIZER_WINDOWS64
+
+TEST(Interception, OverrideFunctionWithHotPatch) {
+  typedef TestOverrideFunctionWithHotPatch T;
+  FunctionPrefixKind prefix = FunctionPrefixHotPatch;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithMov, prefix);
+}
+
+TEST(Interception, OverrideFunctionWithTrampoline) {
+  typedef TestOverrideFunctionWithTrampoline T;
+
+  FunctionPrefixKind prefix = FunctionPrefixNone;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+
+  prefix = FunctionPrefixPadding;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+}
+
 TEST(Interception, OverrideFunction) {
-  TestIdentityFunctionPatching(kIdentityCodeWithPrologue);
-  TestIdentityFunctionPatching(kIdentityCodeWithPushPop);
+  typedef TestOverrideFunction T;
+  FunctionPrefixKind prefix = FunctionPrefixNone;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+  // TestIdentityFunctionPatching<T>(kIdentityCodeWithJump, prefix);  // 64?
+
+  prefix = FunctionPrefixPadding;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithMov, prefix);
+  // TestIdentityFunctionPatching<T>(kIdentityCodeWithJump, prefix);
+
+  prefix = FunctionPrefixHotPatch;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithMov, prefix);
+  // TestIdentityFunctionPatching<T>(kIdentityCodeWithJump, prefix);
+
+  prefix = FunctionPrefixDetour;
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPrologue, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithPushPop, prefix);
+  TestIdentityFunctionPatching<T>(kIdentityCodeWithMov, prefix);
+  // TestIdentityFunctionPatching<T>(kIdentityCodeWithJump, prefix);
+}
+
+TEST(Interception, OverrideFunctionTwice) {
+  uptr identity_address1;
+  LoadActiveCode(kIdentityTwice, &identity_address1);
+  uptr identity_address2 = identity_address1 + kIdentityTwiceOffset;
+  IdentityFunction identity1 = (IdentityFunction)identity_address1;
+  IdentityFunction identity2 = (IdentityFunction)identity_address2;
+
+  // Patch the two functions.
+  uptr real_identity_address = 0;
+  EXPECT_TRUE(OverrideFunction(identity_address1,
+                               (uptr)&InterceptorFunction,
+                               &real_identity_address));
+  EXPECT_TRUE(OverrideFunction(identity_address2,
+                               (uptr)&InterceptorFunction,
+                               &real_identity_address));
+  IdentityFunction real_identity = (IdentityFunction)real_identity_address;
+  InterceptedRealFunction = real_identity;
+
+  // Calling the redirected function.
+  InterceptorFunctionCalled = 0;
+  EXPECT_EQ(42, identity1(42));
+  EXPECT_EQ(42, identity2(42));
+  EXPECT_EQ(2, InterceptorFunctionCalled);
+
+  TestOnlyReleaseTrampolineRegions();
+}
+
+template<class Overrider, class T>
+static bool TestFunctionPatching(
+    const T &code,
+    FunctionPrefixKind prefix_kind = FunctionPrefixNone) {
+  uptr address;
+  LoadActiveCode(code, &address, prefix_kind);
+  uptr unused_real_address = 0;
+  bool result = Overrider().Override(
+      address, (uptr)&InterceptorFunction, &unused_real_address);
+
+  TestOnlyReleaseTrampolineRegions();
+  return result;
 }
 
 TEST(Interception, PatchableFunction) {
-  EXPECT_TRUE(TestFunctionPatching(kPatchableCode1));
-  EXPECT_TRUE(TestFunctionPatching(kPatchableCode2));
-  EXPECT_TRUE(TestFunctionPatching(kPatchableCode3));
-
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode1));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode2));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode3));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode4));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode5));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode6));
-  EXPECT_FALSE(TestFunctionPatching(kUnpatchableCode7));
+  typedef TestOverrideFunction T;
+
+  // Test without function padding.
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode1));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode2));
+#if SANITIZER_WINDOWS64
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3));
+#else
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode3));
+#endif
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode4));
+
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode2));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6));
 }
+
+#if !SANITIZER_WINDOWS64
+TEST(Interception, PatchableFunctionWithDetour) {
+  typedef TestOverrideFunctionWithDetour T;
+
+  // Without the prefix, no function can be detoured.
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode1));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode2));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode4));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode2));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6));
+
+  // With the prefix, all functions can be detoured.
+  FunctionPrefixKind prefix = FunctionPrefixDetour;
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode2, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode3, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode4, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode2, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode3, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode4, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode5, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode6, prefix));
+}
+
+TEST(Interception, PatchableFunctionWithRedirectJump) {
+  typedef TestOverrideFunctionWithRedirectJump T;
+
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode1));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode2));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode4));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode2));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6));
+}
+#endif  // !SANITIZER_WINDOWS64
+
+TEST(Interception, PatchableFunctionWithHotPatch) {
+  typedef TestOverrideFunctionWithHotPatch T;
+  FunctionPrefixKind prefix = FunctionPrefixHotPatch;
+
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode1, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode2, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode4, prefix));
+
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode2, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6, prefix));
+}
+
+TEST(Interception, PatchableFunctionWithTrampoline) {
+  typedef TestOverrideFunctionWithTrampoline T;
+  FunctionPrefixKind prefix = FunctionPrefixPadding;
+
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode2, prefix));
+#if SANITIZER_WINDOWS64
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3, prefix));
+#else
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode3, prefix));
 #endif
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode4, prefix));
+
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode2, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6, prefix));
+}
+
+TEST(Interception, PatchableFunctionPadding) {
+  typedef TestOverrideFunction T;
+  FunctionPrefixKind prefix = FunctionPrefixPadding;
+
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode2, prefix));
+#if SANITIZER_WINDOWS64
+  EXPECT_FALSE(TestFunctionPatching<T>(kPatchableCode3, prefix));
+#else
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode3, prefix));
+#endif
+  EXPECT_TRUE(TestFunctionPatching<T>(kPatchableCode4, prefix));
+
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode1, prefix));
+  EXPECT_TRUE(TestFunctionPatching<T>(kUnpatchableCode2, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode3, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode4, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode5, prefix));
+  EXPECT_FALSE(TestFunctionPatching<T>(kUnpatchableCode6, prefix));
+}
 
 }  // namespace __interception
 
 #endif  // SANITIZER_WINDOWS
 #endif  // #if !SANITIZER_DEBUG