//===-- interception.h ------------------------------------------*- C++ -*-===// // // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. // See https://llvm.org/LICENSE.txt for license information. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception // //===----------------------------------------------------------------------===// // // This file is a part of AddressSanitizer, an address sanity checker. // // Machinery for providing replacements/wrappers for system functions. //===----------------------------------------------------------------------===// #ifndef INTERCEPTION_H #define INTERCEPTION_H #include "sanitizer_common/sanitizer_asm.h" #include "sanitizer_common/sanitizer_internal_defs.h" #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \ !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \ !SANITIZER_SOLARIS # error "Interception doesn't work on this operating system." #endif // These typedefs should be used only in the interceptor definitions to replace // the standard system types (e.g. SSIZE_T instead of ssize_t) // On Windows the system headers (basetsd.h) provide a conflicting definition // of SIZE_T/SSIZE_T that do not match the real size_t/ssize_t for 32-bit // systems (using long instead of the expected int). Work around the typedef // redefinition by #defining SIZE_T instead of using a typedef. // TODO: We should be using __sanitizer::usize (and a new ssize) instead of // these new macros as long as we ensure they match the real system definitions. #if SANITIZER_WINDOWS // Ensure that (S)SIZE_T were already defined as we are about to override them. # include <basetsd.h> #endif #define SIZE_T … #define SSIZE_T … PTRDIFF_T; INTMAX_T; UINTMAX_T; OFF_T; OFF64_T; // How to add an interceptor: // Suppose you need to wrap/replace system function (generally, from libc): // int foo(const char *bar, double baz); // You'll need to: // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in // your source file. See the notes below for cases when // INTERCEPTOR_WITH_SUFFIX(...) should be used instead. // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo". // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was // intercepted successfully. // You can access original function by calling REAL(foo)(bar, baz). // By default, REAL(foo) will be visible only inside your interceptor, and if // you want to use it in other parts of RTL, you'll need to: // 3a) add DECLARE_REAL(int, foo, const char*, double) to a // header file. // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to: // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double) // to a header file. // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or // DECLARE_REAL(...) are located inside namespaces. // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to // effectively redirect calls from "foo" to "zoo". In this case // you aren't required to implement // INTERCEPTOR(int, foo, const char *bar, double baz) {...} // but instead you'll have to add // DECLARE_REAL(int, foo, const char *bar, double baz) in your // source file (to define a pointer to overriden function). // 3. Some Mac functions have symbol variants discriminated by // additional suffixes, e.g. _$UNIX2003 (see // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html // for more details). To intercept such functions you need to use the // INTERCEPTOR_WITH_SUFFIX(...) macro. // How it works on Linux // --------------------- // // To replace system functions on Linux we just need to declare functions with // the same names in our library and then obtain the real function pointers // using dlsym(). // // There is one complication: a user may also intercept some of the functions we // intercept. To allow for up to 3 interceptors (including ours) of a given // function "func", the interceptor implementation is in ___interceptor_func, // which is aliased by a weak function __interceptor_func, which in turn is // aliased (via a trampoline) by weak wrapper function "func". // // Most user interceptors should define a foreign interceptor as follows: // // - provide a non-weak function "func" that performs interception; // - if __interceptor_func exists, call it to perform the real functionality; // - if it does not exist, figure out the real function and call it instead. // // In rare cases, a foreign interceptor (of another dynamic analysis runtime) // may be defined as follows (on supported architectures): // // - provide a non-weak function __interceptor_func that performs interception; // - if ___interceptor_func exists, call it to perform the real functionality; // - if it does not exist, figure out the real function and call it instead; // - provide a weak function "func" that is an alias to __interceptor_func. // // With this protocol, sanitizer interceptors, foreign user interceptors, and // foreign interceptors of other dynamic analysis runtimes, or any combination // thereof, may co-exist simultaneously. // // How it works on Mac OS // ---------------------- // // This is not so on Mac OS, where the two-level namespace makes our replacement // functions invisible to other libraries. This may be overcomed using the // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in // Chromium were noticed when doing so. // // Instead we create a dylib containing a __DATA,__interpose section that // associates library functions with their wrappers. When this dylib is // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the // calls to interposed functions done through stubs to the wrapper functions. // // As it's decided at compile time which functions are to be intercepted on Mac, // INTERCEPT_FUNCTION() is effectively a no-op on this system. #if SANITIZER_APPLE #include <sys/cdefs.h> // For __DARWIN_ALIAS_C(). // Just a pair of pointers. struct interpose_substitution { const __sanitizer::uptr replacement; const __sanitizer::uptr original; }; // For a function foo() create a global pair of pointers { wrap_foo, foo } in // the __DATA,__interpose section. // As a result all the calls to foo() will be routed to wrap_foo() at runtime. #define INTERPOSER … // For a function foo() and a wrapper function bar() create a global pair // of pointers { bar, foo } in the __DATA,__interpose section. // As a result all the calls to foo() will be routed to bar() at runtime. #define INTERPOSER_2 … #define WRAP … #define TRAMPOLINE … #define INTERCEPTOR_ATTRIBUTE #define DECLARE_WRAPPER … #elif SANITIZER_WINDOWS #define WRAP … #define TRAMPOLINE … #define INTERCEPTOR_ATTRIBUTE … #define DECLARE_WRAPPER … #define DECLARE_WRAPPER_WINAPI … #elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS #define INTERCEPTOR_ATTRIBUTE … # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT // Weak aliases of weak aliases do not work, therefore we need to set up a // trampoline function. The function "func" is a weak alias to the trampoline // (so that we may check if "func" was overridden), which calls the weak // function __interceptor_func, which in turn aliases the actual interceptor // implementation ___interceptor_func: // // [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)] // | // +--------(tail call)-------+ // | // v // [__interceptor_func: weak] --(alias)--> [WRAP(func)] // // We use inline assembly to define most of this, because not all compilers // support functions with the "naked" attribute with every architecture. #define WRAP(x) … #define TRAMPOLINE(x) … # if SANITIZER_FREEBSD || SANITIZER_NETBSD // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher // priority than weak ones so weak aliases won't work for indirect calls // in position-independent (-fPIC / -fPIE) mode. #define __ASM_WEAK_WRAPPER … # else #define __ASM_WEAK_WRAPPER(func) … # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD # if defined(__arm__) || defined(__aarch64__) #define ASM_TYPE_FUNCTION_STR … # else #define ASM_TYPE_FUNCTION_STR … # endif // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h #define DECLARE_WRAPPER(ret_type, func, ...) … # else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT // Some architectures cannot implement efficient interceptor trampolines with // just a plain jump due to complexities of resolving a preemptible symbol. In // those cases, revert to just this scheme: // // [wrapper "func": weak] --(alias)--> [WRAP(func)] // #define WRAP … #define TRAMPOLINE … # if SANITIZER_FREEBSD || SANITIZER_NETBSD #define __ATTRIBUTE_WEAK_WRAPPER # else #define __ATTRIBUTE_WEAK_WRAPPER … # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD #define DECLARE_WRAPPER … # endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT #endif #if SANITIZER_FUCHSIA // There is no general interception at all on Fuchsia. // Sanitizer runtimes just define functions directly to preempt them, // and have bespoke ways to access the underlying libc functions. # include <zircon/sanitizer.h> #define INTERCEPTOR_ATTRIBUTE … #define REAL … #define DECLARE_REAL … #elif !SANITIZER_APPLE #define PTR_TO_REAL(x) … #define REAL(x) … #define FUNC_TYPE(x) … #define DECLARE_REAL(ret_type, func, ...) … #define ASSIGN_REAL(dst, src) … #else // SANITIZER_APPLE #define REAL … #define DECLARE_REAL … #define ASSIGN_REAL … #endif // SANITIZER_APPLE #if !SANITIZER_FUCHSIA #define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) … // Declare an interceptor and its wrapper defined in a different translation // unit (ex. asm). #define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) … #else #define DECLARE_REAL_AND_INTERCEPTOR … #define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER … #endif // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR // macros does its job. In exceptional cases you may need to call REAL(foo) // without defining INTERCEPTOR(..., foo, ...). For example, if you override // foo with an interceptor for other function. #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA #define DEFINE_REAL(ret_type, func, ...) … #else #define DEFINE_REAL … #endif #if SANITIZER_FUCHSIA // We need to define the __interceptor_func name just to get // sanitizer_common/scripts/gen_dynamic_list.py to export func. // But we don't need to export __interceptor_func to get that. #define INTERCEPTOR … #elif !SANITIZER_APPLE #define INTERCEPTOR(ret_type, func, ...) … // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now. #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) … #else // SANITIZER_APPLE #define INTERCEPTOR_ZZZ … #define INTERCEPTOR … #define INTERCEPTOR_WITH_SUFFIX … // Override |overridee| with |overrider|. #define OVERRIDE_FUNCTION … #endif #if SANITIZER_WINDOWS #define INTERCEPTOR_WINAPI … #endif // ISO C++ forbids casting between pointer-to-function and pointer-to-object, // so we use casts via uintptr_t (the local __sanitizer::uptr equivalent). namespace __interception { #if defined(__ELF__) && !SANITIZER_FUCHSIA // The use of interceptors makes many sanitizers unusable for static linking. // Define a function, if called, will cause a linker error (undefined _DYNAMIC). // However, -static-pie (which is not common) cannot be detected at link time. extern uptr kDynamic[] asm(_DYNAMIC); inline void DoesNotSupportStaticLinking() { … } #else inline void DoesNotSupportStaticLinking() {} #endif } // namespace __interception #define INCLUDED_FROM_INTERCEPTION_LIB #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \ SANITIZER_SOLARIS # include "interception_linux.h" #define INTERCEPT_FUNCTION(func) … #define INTERCEPT_FUNCTION_VER(func, symver) … #elif SANITIZER_APPLE # include "interception_mac.h" #define INTERCEPT_FUNCTION … #define INTERCEPT_FUNCTION_VER … #elif SANITIZER_WINDOWS # include "interception_win.h" #define INTERCEPT_FUNCTION … #define INTERCEPT_FUNCTION_VER … #endif #undef INCLUDED_FROM_INTERCEPTION_LIB #endif // INTERCEPTION_H
Codebase Browser
llvm