597 lines
18 KiB
C++
597 lines
18 KiB
C++
/*
|
|
https://github.com/peterix/dfhack
|
|
Copyright (c) 2009-2012 Petr Mrázek (peterix@gmail.com)
|
|
|
|
This software is provided 'as-is', without any express or implied
|
|
warranty. In no event will the authors be held liable for any
|
|
damages arising from the use of this software.
|
|
|
|
Permission is granted to anyone to use this software for any
|
|
purpose, including commercial applications, and to alter it and
|
|
redistribute it freely, subject to the following restrictions:
|
|
|
|
1. The origin of this software must not be misrepresented; you must
|
|
not claim that you wrote the original software. If you use this
|
|
software in a product, an acknowledgment in the product documentation
|
|
would be appreciated but is not required.
|
|
|
|
2. Altered source versions must be plainly marked as such, and
|
|
must not be misrepresented as being the original software.
|
|
|
|
3. This notice may not be removed or altered from any source
|
|
distribution.
|
|
*/
|
|
|
|
#include "Internal.h"
|
|
|
|
#include <iostream>
|
|
#include <string>
|
|
#include <vector>
|
|
#include <map>
|
|
|
|
#include "MemAccess.h"
|
|
#include "Core.h"
|
|
#include "VersionInfo.h"
|
|
#include "VTableInterpose.h"
|
|
|
|
#include "MiscUtils.h"
|
|
|
|
using namespace std;
|
|
using namespace DFHack;
|
|
|
|
/*
|
|
* Code for accessing method pointers directly. Very compiler-specific.
|
|
*
|
|
* Pointers to methods in C++ are conceptually similar to pointers to
|
|
* functions, but with some complications. Specifically, the target of
|
|
* such pointer can be either:
|
|
*
|
|
* - An ordinary non-virtual method, in which case the pointer behaves
|
|
* not much differently from a simple function pointer.
|
|
* - A virtual method, in which case calling the pointer must emulate
|
|
* an ordinary call to that method, i.e. fetch the real code address
|
|
* from the vtable at the appropriate index.
|
|
*
|
|
* This means that pointers to virtual methods actually have to encode
|
|
* the relevant vtable index value in some way. Also, since these two
|
|
* types of pointers cannot be distinguished by data type and differ
|
|
* only in value, any sane compiler would ensure that any non-virtual
|
|
* method that can potentially be called via a pointer uses the same
|
|
* parameter passing rules as an equivalent virtual method, so that
|
|
* the same parameter passing code would work with both types of pointer.
|
|
*
|
|
* This means that with a few small low-level compiler-specific wrappers
|
|
* to access the data inside such pointers it is possible to:
|
|
*
|
|
* - Convert a non-virtual method pointer into a code address that
|
|
* can be directly put into a vtable.
|
|
* - Convert a pointer taken out of a vtable into a fake non-virtual
|
|
* method pointer that can be used to easily call the original
|
|
* vmethod body.
|
|
* - Extract a vtable index out of a virtual method pointer.
|
|
*
|
|
* Taken together, these features allow delegating all the difficult
|
|
* and fragile tasks like passing parameters and calculating the
|
|
* vtable index to the C++ compiler.
|
|
*/
|
|
|
|
#if defined(_MSC_VER)
|
|
|
|
// MSVC may use up to 3 different representations
|
|
// based on context, but adding the /vmg /vmm options
|
|
// forces it to stick to this one. It can accomodate
|
|
// multiple, but not virtual inheritance.
|
|
struct MSVC_MPTR {
|
|
void *method;
|
|
uint32_t this_shift; // was intptr_t pre-0.43.05
|
|
};
|
|
|
|
// Debug builds sometimes use additional thunks that
|
|
// just jump to the real one, presumably to attach some
|
|
// additional debug info.
|
|
static uint32_t *follow_jmp(void *ptr)
|
|
{
|
|
uint8_t *p = (uint8_t*)ptr;
|
|
|
|
for (;;)
|
|
{
|
|
switch (*p)
|
|
{
|
|
#ifdef DFHACK64
|
|
case 0x48: // REX prefix
|
|
p++;
|
|
break;
|
|
#endif
|
|
case 0xE9: // jmp near rel32
|
|
p += 5 + *(int32_t*)(p+1);
|
|
break;
|
|
case 0xEB: // jmp short rel8
|
|
p += 2 + *(int8_t*)(p+1);
|
|
break;
|
|
default:
|
|
return (uint32_t*)p;
|
|
}
|
|
}
|
|
}
|
|
|
|
bool DFHack::is_vmethod_pointer_(void *pptr)
|
|
{
|
|
auto pobj = (MSVC_MPTR*)pptr;
|
|
if (!pobj->method) return false;
|
|
|
|
// MSVC implements pointers to vmethods via thunks.
|
|
// This expects that they all follow a very specific pattern.
|
|
auto pval = follow_jmp(pobj->method);
|
|
switch (pval[0]) {
|
|
case 0x20FF018BU: // mov eax, [ecx]; jmp [eax]
|
|
case 0x60FF018BU: // mov eax, [ecx]; jmp [eax+0x??]
|
|
case 0xA0FF018BU: // mov eax, [ecx]; jmp [eax+0x????????]
|
|
return true;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
int DFHack::vmethod_pointer_to_idx_(void *pptr)
|
|
{
|
|
auto pobj = (MSVC_MPTR*)pptr;
|
|
if (!pobj->method || pobj->this_shift != 0) return -1;
|
|
|
|
auto pval = follow_jmp(pobj->method);
|
|
switch (pval[0]) {
|
|
case 0x20FF018BU: // mov eax, [ecx]; jmp [eax]
|
|
return 0;
|
|
case 0x60FF018BU: // mov eax, [ecx]; jmp [eax+0x??]
|
|
return ((int8_t)pval[1])/sizeof(void*);
|
|
case 0xA0FF018BU: // mov eax, [ecx]; jmp [eax+0x????????]
|
|
return ((int32_t)pval[1])/sizeof(void*);
|
|
default:
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
void* DFHack::method_pointer_to_addr_(void *pptr)
|
|
{
|
|
if (is_vmethod_pointer_(pptr)) return NULL;
|
|
auto pobj = (MSVC_MPTR*)pptr;
|
|
return pobj->method;
|
|
}
|
|
|
|
void DFHack::addr_to_method_pointer_(void *pptr, void *addr)
|
|
{
|
|
auto pobj = (MSVC_MPTR*)pptr;
|
|
pobj->method = addr;
|
|
pobj->this_shift = 0;
|
|
}
|
|
|
|
#elif defined(__GXX_ABI_VERSION)
|
|
|
|
// GCC seems to always use this structure - possibly unless
|
|
// virtual inheritance is involved, but that's irrelevant.
|
|
struct GCC_MPTR {
|
|
intptr_t method; // Code pointer or tagged vtable offset
|
|
intptr_t this_shift;
|
|
};
|
|
|
|
bool DFHack::is_vmethod_pointer_(void *pptr)
|
|
{
|
|
auto pobj = (GCC_MPTR*)pptr;
|
|
return (pobj->method & 1) != 0;
|
|
}
|
|
|
|
int DFHack::vmethod_pointer_to_idx_(void *pptr)
|
|
{
|
|
auto pobj = (GCC_MPTR*)pptr;
|
|
if ((pobj->method & 1) == 0 || pobj->this_shift != 0)
|
|
return -1;
|
|
return (pobj->method-1)/sizeof(void*);
|
|
}
|
|
|
|
void* DFHack::method_pointer_to_addr_(void *pptr)
|
|
{
|
|
auto pobj = (GCC_MPTR*)pptr;
|
|
if ((pobj->method & 1) != 0 || pobj->this_shift != 0)
|
|
return NULL;
|
|
return (void*)pobj->method;
|
|
}
|
|
|
|
void DFHack::addr_to_method_pointer_(void *pptr, void *addr)
|
|
{
|
|
auto pobj = (GCC_MPTR*)pptr;
|
|
pobj->method = (intptr_t)addr;
|
|
pobj->this_shift = 0;
|
|
}
|
|
|
|
#else
|
|
#error Unknown compiler type
|
|
#endif
|
|
|
|
void *virtual_identity::get_vmethod_ptr(int idx)
|
|
{
|
|
assert(idx >= 0);
|
|
void **vtable = (void**)vtable_ptr;
|
|
if (!vtable) return NULL;
|
|
return vtable[idx];
|
|
}
|
|
|
|
bool virtual_identity::set_vmethod_ptr(MemoryPatcher &patcher, int idx, void *ptr)
|
|
{
|
|
assert(idx >= 0);
|
|
void **vtable = (void**)vtable_ptr;
|
|
if (!vtable) return NULL;
|
|
return patcher.write(&vtable[idx], &ptr, sizeof(void*));
|
|
}
|
|
|
|
/*
|
|
VMethod interposing data structures.
|
|
|
|
In order to properly support adding and removing hooks,
|
|
it is necessary to track them. This is what this class
|
|
is for. The task is further complicated by propagating
|
|
hooks to child classes that use exactly the same original
|
|
vmethod implementation.
|
|
|
|
Every applied link contains in the saved_chain field a
|
|
pointer to the next vmethod body that should be called
|
|
by the hook the link represents. This is the actual
|
|
control flow structure that needs to be maintained.
|
|
|
|
There also are connections between link objects themselves,
|
|
which constitute the bookkeeping for doing that. Finally,
|
|
every link is associated with a fixed virtual_identity host,
|
|
which represents the point in the class hierarchy where
|
|
the hook is applied.
|
|
|
|
When there are no subclasses (i.e. only one host), the
|
|
structures look like this:
|
|
|
|
+--------------+ +------------+
|
|
| link1 |-next------->| link2 |-next=NULL
|
|
|s_c: original |<-------prev-|s_c: $link1 |<--+
|
|
+--------------+ +------------+ |
|
|
|
|
|
host->interpose_list[vmethod_idx] ------+
|
|
vtable: $link2
|
|
|
|
The original vtable entry is stored in the saved_chain of the
|
|
first link. The interpose_list map points to the last one.
|
|
The hooks are called in order: link2 -> link1 -> original.
|
|
|
|
When there are subclasses that use the same vmethod, but don't
|
|
hook it, the topmost link gets a set of the child_hosts, and
|
|
the hosts have the link added to their interpose_list:
|
|
|
|
+--------------+ +----------------+
|
|
| link0 @host0 |<--+-interpose_list-| host1 |
|
|
| |-child_hosts-+----->| vtable: $link |
|
|
+--------------+ | | +----------------+
|
|
| |
|
|
| | +----------------+
|
|
+-interpose_list-| host2 |
|
|
+----->| vtable: $link |
|
|
+----------------+
|
|
|
|
When a child defines its own hook, the child_hosts link is
|
|
severed and replaced with a child_next pointer to the new
|
|
hook. The hook still points back the chain with prev.
|
|
All child links to subclasses of host2 are migrated from
|
|
link1 to link2.
|
|
|
|
+--------------+-next=NULL +--------------+-next=NULL
|
|
| link1 @host1 |-child_next------->| link2 @host2 |-child_*--->subclasses
|
|
| |<-------------prev-|s_c: $link1 |
|
|
+--------------+<-------+ +--------------+<-------+
|
|
| |
|
|
+--------------+ | +--------------+ |
|
|
| host1 |-i_list-+ | host2 |-i_list-+
|
|
|vtable: $link1| |vtable: $link2|
|
|
+--------------+ +--------------+
|
|
|
|
*/
|
|
|
|
void VMethodInterposeLinkBase::set_chain(void *chain)
|
|
{
|
|
saved_chain = chain;
|
|
addr_to_method_pointer_(chain_mptr, chain);
|
|
}
|
|
|
|
VMethodInterposeLinkBase::VMethodInterposeLinkBase(virtual_identity *host, int vmethod_idx, void *interpose_method, void *chain_mptr, int priority, const char *name)
|
|
: host(host), vmethod_idx(vmethod_idx), interpose_method(interpose_method),
|
|
chain_mptr(chain_mptr), priority(priority), name_str(name),
|
|
applied(false), saved_chain(NULL), next(NULL), prev(NULL)
|
|
{
|
|
if (vmethod_idx < 0 || interpose_method == NULL)
|
|
{
|
|
/*
|
|
* A failure here almost certainly means a problem in one
|
|
* of the pointer-to-method access wrappers above:
|
|
*
|
|
* - vmethod_idx comes from vmethod_pointer_to_idx_
|
|
* - interpose_method comes from method_pointer_to_addr_
|
|
*/
|
|
|
|
fprintf(stderr, "Bad VMethodInterposeLinkBase arguments: %d %p (%s)\n",
|
|
vmethod_idx, interpose_method, name_str);
|
|
fflush(stderr);
|
|
abort();
|
|
}
|
|
}
|
|
|
|
VMethodInterposeLinkBase::~VMethodInterposeLinkBase()
|
|
{
|
|
if (is_applied())
|
|
remove();
|
|
}
|
|
|
|
VMethodInterposeLinkBase *VMethodInterposeLinkBase::get_first_interpose(virtual_identity *id)
|
|
{
|
|
auto item = id->interpose_list[vmethod_idx];
|
|
if (!item)
|
|
return NULL;
|
|
|
|
if (item->host != id)
|
|
return NULL;
|
|
while (item->prev && item->prev->host == id)
|
|
item = item->prev;
|
|
|
|
return item;
|
|
}
|
|
|
|
bool VMethodInterposeLinkBase::find_child_hosts(virtual_identity *cur, void *vmptr)
|
|
{
|
|
auto &children = cur->getChildren();
|
|
bool found = false;
|
|
|
|
for (size_t i = 0; i < children.size(); i++)
|
|
{
|
|
auto child = static_cast<virtual_identity*>(children[i]);
|
|
auto base = get_first_interpose(child);
|
|
|
|
if (base)
|
|
{
|
|
assert(base->prev == NULL);
|
|
|
|
if (base->saved_chain != vmptr)
|
|
continue;
|
|
|
|
child_next.insert(base);
|
|
found = true;
|
|
}
|
|
else if (child->vtable_ptr)
|
|
{
|
|
void *cptr = child->get_vmethod_ptr(vmethod_idx);
|
|
if (cptr != vmptr)
|
|
continue;
|
|
|
|
child_hosts.insert(child);
|
|
found = true;
|
|
|
|
find_child_hosts(child, vmptr);
|
|
}
|
|
else
|
|
{
|
|
// If this vtable is not known, but any of the children
|
|
// have the same vmethod, this one definitely does too
|
|
if (find_child_hosts(child, vmptr))
|
|
{
|
|
child_hosts.insert(child);
|
|
found = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
return found;
|
|
}
|
|
|
|
void VMethodInterposeLinkBase::on_host_delete(virtual_identity *from)
|
|
{
|
|
if (from == host)
|
|
{
|
|
// When in own host, fully delete
|
|
remove();
|
|
}
|
|
else
|
|
{
|
|
// Otherwise, drop the link to that child:
|
|
assert(child_hosts.count(from) != 0 &&
|
|
from->interpose_list[vmethod_idx] == this);
|
|
|
|
// Find and restore the original vmethod ptr
|
|
auto last = this;
|
|
while (last->prev) last = last->prev;
|
|
|
|
MemoryPatcher patcher;
|
|
|
|
from->set_vmethod_ptr(patcher, vmethod_idx, last->saved_chain);
|
|
|
|
// Unlink the chains
|
|
child_hosts.erase(from);
|
|
from->interpose_list[vmethod_idx] = NULL;
|
|
}
|
|
}
|
|
|
|
bool VMethodInterposeLinkBase::apply(bool enable)
|
|
{
|
|
if (!enable)
|
|
{
|
|
remove();
|
|
return true;
|
|
}
|
|
|
|
if (is_applied())
|
|
return true;
|
|
if (!host->vtable_ptr)
|
|
{
|
|
std::cerr << "VMethodInterposeLinkBase::apply(" << enable << "): " << name()
|
|
<< ": no vtable pointer: " << host->getName() << endl;
|
|
return false;
|
|
}
|
|
|
|
// Retrieve the current vtable entry
|
|
VMethodInterposeLinkBase *old_link = host->interpose_list[vmethod_idx];
|
|
VMethodInterposeLinkBase *next_link = NULL;
|
|
|
|
while (old_link && old_link->host == host && old_link->priority > priority)
|
|
{
|
|
next_link = old_link;
|
|
old_link = old_link->prev;
|
|
}
|
|
|
|
void *old_ptr = next_link ? next_link->saved_chain : host->get_vmethod_ptr(vmethod_idx);
|
|
assert(old_ptr != NULL && (!old_link || old_link->interpose_method == old_ptr));
|
|
|
|
// Apply the new method ptr
|
|
MemoryPatcher patcher;
|
|
|
|
set_chain(old_ptr);
|
|
|
|
if (next_link)
|
|
{
|
|
next_link->set_chain(interpose_method);
|
|
}
|
|
else if (!host->set_vmethod_ptr(patcher, vmethod_idx, interpose_method))
|
|
{
|
|
std::cerr << "VMethodInterposeLinkBase::apply(" << enable << "): " << name() << ": set_vmethod_ptr failed" << endl;
|
|
set_chain(NULL);
|
|
return false;
|
|
}
|
|
|
|
// Push the current link into the home host
|
|
applied = true;
|
|
prev = old_link;
|
|
next = next_link;
|
|
|
|
if (next_link)
|
|
next_link->prev = this;
|
|
else
|
|
host->interpose_list[vmethod_idx] = this;
|
|
|
|
child_hosts.clear();
|
|
child_next.clear();
|
|
|
|
if (old_link && old_link->host == host)
|
|
{
|
|
// If the old link is home, just push into the plain chain
|
|
assert(old_link->next == next_link);
|
|
old_link->next = this;
|
|
|
|
// Child links belong to the topmost local entry
|
|
child_hosts.swap(old_link->child_hosts);
|
|
child_next.swap(old_link->child_next);
|
|
}
|
|
else if (next_link)
|
|
{
|
|
if (old_link)
|
|
{
|
|
assert(old_link->child_next.count(next_link));
|
|
old_link->child_next.erase(next_link);
|
|
old_link->child_next.insert(this);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// If creating a new local chain, find children with same vmethod
|
|
find_child_hosts(host, old_ptr);
|
|
|
|
if (old_link)
|
|
{
|
|
// Enter the child chain set
|
|
assert(old_link->child_hosts.count(host));
|
|
old_link->child_hosts.erase(host);
|
|
old_link->child_next.insert(this);
|
|
|
|
// Subtract our own children from the parent's sets
|
|
for (auto it = child_next.begin(); it != child_next.end(); ++it)
|
|
old_link->child_next.erase(*it);
|
|
for (auto it = child_hosts.begin(); it != child_hosts.end(); ++it)
|
|
old_link->child_hosts.erase(*it);
|
|
}
|
|
}
|
|
|
|
assert (!next_link || (child_next.empty() && child_hosts.empty()));
|
|
|
|
// Chain subclass hooks
|
|
for (auto it = child_next.begin(); it != child_next.end(); ++it)
|
|
{
|
|
auto nlink = *it;
|
|
assert(nlink->saved_chain == old_ptr && nlink->prev == old_link);
|
|
nlink->set_chain(interpose_method);
|
|
nlink->prev = this;
|
|
}
|
|
|
|
// Chain passive subclass hosts
|
|
for (auto it = child_hosts.begin(); it != child_hosts.end(); ++it)
|
|
{
|
|
auto nhost = *it;
|
|
assert(nhost->interpose_list[vmethod_idx] == old_link);
|
|
nhost->set_vmethod_ptr(patcher, vmethod_idx, interpose_method);
|
|
nhost->interpose_list[vmethod_idx] = this;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
void VMethodInterposeLinkBase::remove()
|
|
{
|
|
if (!is_applied())
|
|
return;
|
|
|
|
// Remove the link from prev to this
|
|
if (prev)
|
|
{
|
|
if (prev->host == host)
|
|
prev->next = next;
|
|
else
|
|
{
|
|
prev->child_next.erase(this);
|
|
|
|
if (next)
|
|
prev->child_next.insert(next);
|
|
else
|
|
prev->child_hosts.insert(host);
|
|
}
|
|
}
|
|
|
|
if (next)
|
|
{
|
|
next->set_chain(saved_chain);
|
|
next->prev = prev;
|
|
|
|
assert(child_next.empty() && child_hosts.empty());
|
|
}
|
|
else
|
|
{
|
|
MemoryPatcher patcher;
|
|
|
|
// Remove from the list in the identity and vtable
|
|
host->interpose_list[vmethod_idx] = prev;
|
|
host->set_vmethod_ptr(patcher, vmethod_idx, saved_chain);
|
|
|
|
for (auto it = child_next.begin(); it != child_next.end(); ++it)
|
|
{
|
|
auto nlink = *it;
|
|
assert(nlink->saved_chain == interpose_method && nlink->prev == this);
|
|
nlink->set_chain(saved_chain);
|
|
nlink->prev = prev;
|
|
if (prev)
|
|
prev->child_next.insert(nlink);
|
|
}
|
|
|
|
for (auto it = child_hosts.begin(); it != child_hosts.end(); ++it)
|
|
{
|
|
auto nhost = *it;
|
|
assert(nhost->interpose_list[vmethod_idx] == this);
|
|
nhost->interpose_list[vmethod_idx] = prev;
|
|
nhost->set_vmethod_ptr(patcher, vmethod_idx, saved_chain);
|
|
if (prev)
|
|
prev->child_hosts.insert(nhost);
|
|
}
|
|
}
|
|
|
|
applied = false;
|
|
prev = next = NULL;
|
|
child_next.clear();
|
|
child_hosts.clear();
|
|
set_chain(NULL);
|
|
}
|