Commit 29adbb4f authored by swift_gan's avatar swift_gan Committed by swift_gan

[NativeHook]add decode filter

parent 1ca0a145
...@@ -23,7 +23,7 @@ goto label_matched; \ ...@@ -23,7 +23,7 @@ goto label_matched; \
Arm32Decoder* Arm32Decoder::instant = new Arm32Decoder(); Arm32Decoder* Arm32Decoder::instant = new Arm32Decoder();
void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) { void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) {
bool thumb = isThumbCode(reinterpret_cast<Addr>(codeStart)); bool thumb = isThumbCode(reinterpret_cast<Addr>(codeStart));
if (thumb) { if (thumb) {
codeStart = getThumbCodeAddress(codeStart); codeStart = getThumbCodeAddress(codeStart);
...@@ -36,9 +36,11 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) { ...@@ -36,9 +36,11 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
if (thumb && thumb32) { if (thumb && thumb32) {
CASE_T32(B32) CASE_T32(B32)
CASE_T32(LDR_LIT) CASE_T32(LDR_LIT)
CASE_T32(LDR_IMM) if (!onlyPcRelInst) {
CASE_T32(LDR_UIMM) CASE_T32(LDR_IMM)
CASE_T32(MOV_MOVT_IMM) CASE_T32(LDR_UIMM)
CASE_T32(MOV_MOVT_IMM)
}
if (unit == nullptr) { if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc))); unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
} }
...@@ -50,17 +52,19 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) { ...@@ -50,17 +52,19 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
CASE_T16(LDR_LIT) CASE_T16(LDR_LIT)
CASE_T16(ADD_IMM_RDN) CASE_T16(ADD_IMM_RDN)
CASE_T16(ADR) CASE_T16(ADR)
CASE_T16(ADD_REG) if (!onlyPcRelInst) {
CASE_T16(CMP_REG) CASE_T16(ADD_REG)
CASE_T16(CMP_REG_EXT) CASE_T16(CMP_REG)
CASE_T16(MOV_REG) CASE_T16(CMP_REG_EXT)
CASE_T16(POP) CASE_T16(MOV_REG)
CASE_T16(PUSH) CASE_T16(POP)
CASE_T16(PUSH)
}
if (unit == nullptr) { if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T16(UNKNOW)(*reinterpret_cast<STRUCT_T16(UNKNOW) *>(pc))); unit = reinterpret_cast<Unit<Base> *>(new INST_T16(UNKNOW)(*reinterpret_cast<STRUCT_T16(UNKNOW) *>(pc)));
} }
} else { } else {
//TODO //TODO arm32 support
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc))); unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
} }
......
...@@ -12,7 +12,7 @@ namespace SandHook { ...@@ -12,7 +12,7 @@ namespace SandHook {
class Arm32Decoder : public InstDecoder { class Arm32Decoder : public InstDecoder {
public: public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override; void decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) override;
public: public:
static Arm32Decoder* instant; static Arm32Decoder* instant;
}; };
......
...@@ -44,7 +44,7 @@ void* CodeRelocateA32::relocate(void *startPc, Addr len, void *toPc = nullptr) t ...@@ -44,7 +44,7 @@ void* CodeRelocateA32::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__ allocBufferFirst(static_cast<U32>(len * 8)); __ allocBufferFirst(static_cast<U32>(len * 8));
void* curPc = __ getPC(); void* curPc = __ getPC();
if (toPc == nullptr) { if (toPc == nullptr) {
Disassembler::get()->decode(startPc, len, *this); Disassembler::get()->decode(startPc, len, *this, true);
} else { } else {
//TODO //TODO
} }
......
...@@ -17,26 +17,29 @@ goto label_matched; \ ...@@ -17,26 +17,29 @@ goto label_matched; \
Arm64Decoder* Arm64Decoder::instant = new Arm64Decoder(); Arm64Decoder* Arm64Decoder::instant = new Arm64Decoder();
void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) { void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) {
InstA64 *pc = reinterpret_cast<InstA64 *>(codeStart); InstA64 *pc = reinterpret_cast<InstA64 *>(codeStart);
Addr endAddr = (Addr) codeStart + codeLen; Addr endAddr = (Addr) codeStart + codeLen;
Unit<Base>* unit = nullptr; Unit<Base>* unit = nullptr;
while((Addr) pc < endAddr) { while((Addr) pc < endAddr) {
// pc relate insts
CASE(B_BL)
CASE(B_COND)
CASE(CBZ_CBNZ)
CASE(TBZ_TBNZ)
CASE(LDR_LIT)
CASE(ADR_ADRP)
if (onlyPcRelInst)
goto label_matched;
CASE(MOV_WIDE) CASE(MOV_WIDE)
CASE(MOV_REG) CASE(MOV_REG)
CASE(ADR_ADRP)
CASE(LDR_LIT)
CASE(LDR_IMM) CASE(LDR_IMM)
CASE(LDR_UIMM) CASE(LDR_UIMM)
CASE(LDRSW_IMM) CASE(LDRSW_IMM)
CASE(LDRSW_UIMM) CASE(LDRSW_UIMM)
CASE(STR_UIMM) CASE(STR_UIMM)
CASE(STR_IMM) CASE(STR_IMM)
CASE(B_BL)
CASE(B_COND)
CASE(BR_BLR_RET) CASE(BR_BLR_RET)
CASE(CBZ_CBNZ)
CASE(TBZ_TBNZ)
CASE(SUB_EXT_REG) CASE(SUB_EXT_REG)
CASE(SVC) CASE(SVC)
CASE(EXCEPTION_GEN) CASE(EXCEPTION_GEN)
......
...@@ -12,7 +12,7 @@ namespace SandHook { ...@@ -12,7 +12,7 @@ namespace SandHook {
class Arm64Decoder : public InstDecoder { class Arm64Decoder : public InstDecoder {
public: public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override; void decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) override;
public: public:
static Arm64Decoder* instant; static Arm64Decoder* instant;
}; };
......
...@@ -41,7 +41,7 @@ void* CodeRelocateA64::relocate(void *startPc, Addr len, void *toPc = nullptr) t ...@@ -41,7 +41,7 @@ void* CodeRelocateA64::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__ allocBufferFirst(static_cast<U32>(len * 8)); __ allocBufferFirst(static_cast<U32>(len * 8));
void* curPc = __ getPC(); void* curPc = __ getPC();
if (toPc == nullptr) { if (toPc == nullptr) {
Disassembler::get()->decode(startPc, len, *this); Disassembler::get()->decode(startPc, len, *this, true);
} else { } else {
//TODO //TODO
} }
......
...@@ -21,7 +21,7 @@ namespace SandHook { ...@@ -21,7 +21,7 @@ namespace SandHook {
class InstDecoder { class InstDecoder {
public: public:
virtual void decode(void* codeStart, Addr codeLen, InstVisitor& visitor) = 0; virtual void decode(void* codeStart, Addr codeLen, InstVisitor& visitor, bool onlyPcRelInst = false) = 0;
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment