dyld3/shared-cache/AdjustDylibSegments.cpp

   1 /* -*- mode: C++; c-basic-offset: 4; indent-tabs-mode: nil -*-
   2  *
   3  * Copyright (c) 2014 Apple Inc. All rights reserved.
   4  *
   5  * @APPLE_LICENSE_HEADER_START@
   6  *
   7  * This file contains Original Code and/or Modifications of Original Code
   8  * as defined in and that are subject to the Apple Public Source License
   9  * Version 2.0 (the 'License'). You may not use this file except in
  10  * compliance with the License. Please obtain a copy of the License at
  11  * http://www.opensource.apple.com/apsl/ and read it before using this
  12  * file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  19  * Please see the License for the specific language governing rights and
  20  * limitations under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25
  26 #include <dirent.h>
  27 #include <sys/errno.h>
  28 #include <sys/fcntl.h>
  29 #include <mach-o/loader.h>
  30 #include <mach-o/fat.h>
  31 #include <assert.h>
  32
  33 #include <fstream>
  34 #include <string>
  35 #include <algorithm>
  36 #include <unordered_map>
  37 #include <unordered_set>
  38
  39 #include "CacheBuilder.h"
  40 #include "Diagnostics.h"
  41 #include "DyldSharedCache.h"
  42 #include "Trie.hpp"
  43 #include "MachOFileAbstraction.hpp"
  44 #include "MachOLoaded.h"
  45 #include "MachOAnalyzer.h"
  46
  47
  48 #ifndef EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE
  49     #define EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE 0x02
  50 #endif
  51
  52 namespace {
  53
  54 template <typename P>
  55 class Adjustor {
  56 public:
  57                     Adjustor(DyldSharedCache* cacheBuffer, macho_header<P>* mh, const std::vector<CacheBuilder::SegmentMappingInfo>& mappingInfo, Diagnostics& diag);
  58     void            adjustImageForNewSegmentLocations(CacheBuilder::ASLR_Tracker& aslrTracker,
  59                                                       CacheBuilder::LOH_Tracker& lohTracker,
  60                                                       const CacheBuilder::CacheCoalescedText& coalescedText,
  61                                                       const CacheBuilder::DylibTextCoalescer& textCoalescer);
  62
  63 private:
  64     void            adjustReferencesUsingInfoV2(CacheBuilder::ASLR_Tracker& aslrTracker, CacheBuilder::LOH_Tracker& lohTracker,
  65                                                 const CacheBuilder::CacheCoalescedText& coalescedText,
  66                                                 const CacheBuilder::DylibTextCoalescer& textCoalescer);
  67     void            adjustReference(uint32_t kind, uint8_t* mappedAddr, uint64_t fromNewAddress, uint64_t toNewAddress, int64_t adjust, int64_t targetSlide,
  68                                     uint64_t imageStartAddress, uint64_t imageEndAddress,
  69                                     CacheBuilder::ASLR_Tracker& aslrTracker, CacheBuilder::LOH_Tracker* lohTracker,
  70                                     uint32_t*& lastMappedAddr32, uint32_t& lastKind, uint64_t& lastToNewAddress);
  71     void            adjustDataPointers(CacheBuilder::ASLR_Tracker& aslrTracker);
  72     void            slidePointer(int segIndex, uint64_t segOffset, uint8_t type, CacheBuilder::ASLR_Tracker& aslrTracker);
  73     void            adjustSymbolTable();
  74     void            adjustChainedFixups();
  75     void            adjustExportsTrie(std::vector<uint8_t>& newTrieBytes);
  76     void            rebuildLinkEdit();
  77     void            adjustCode();
  78     void            adjustInstruction(uint8_t kind, uint8_t* textLoc, uint64_t codeToDataDelta);
  79     void            rebuildLinkEditAndLoadCommands(const CacheBuilder::DylibTextCoalescer& textCoalescer);
  80     uint64_t        slideForOrigAddress(uint64_t addr);
  81
  82     typedef typename P::uint_t pint_t;
  83     typedef typename P::E E;
  84
  85     DyldSharedCache*                                        _cacheBuffer;
  86     macho_header<P>*                                        _mh;
  87     Diagnostics&                                            _diagnostics;
  88     const uint8_t*                                          _linkeditBias       = nullptr;
  89     unsigned                                                _linkeditSegIndex   = 0;
  90     bool                                                    _maskPointers       = false;
  91     bool                                                    _splitSegInfoV2     = false;
  92     const char*                                             _installName        = nullptr;
  93     macho_symtab_command<P>*                                _symTabCmd          = nullptr;
  94     macho_dysymtab_command<P>*                              _dynSymTabCmd       = nullptr;
  95     macho_dyld_info_command<P>*                             _dyldInfo           = nullptr;
  96     macho_linkedit_data_command<P>*                         _splitSegInfoCmd    = nullptr;
  97     macho_linkedit_data_command<P>*                         _functionStartsCmd  = nullptr;
  98     macho_linkedit_data_command<P>*                         _dataInCodeCmd      = nullptr;
  99     macho_linkedit_data_command<P>*                         _exportTrieCmd      = nullptr;
 100     macho_linkedit_data_command<P>*                         _chainedFixupsCmd   = nullptr;
 101     std::vector<uint64_t>                                   _segOrigStartAddresses;
 102     std::vector<uint64_t>                                   _segSlides;
 103     std::vector<macho_segment_command<P>*>                  _segCmds;
 104     const std::vector<CacheBuilder::SegmentMappingInfo>&    _mappingInfo;
 105 };
 106
 107 template <typename P>
 108 Adjustor<P>::Adjustor(DyldSharedCache* cacheBuffer, macho_header<P>* mh, const std::vector<CacheBuilder::SegmentMappingInfo>& mappingInfo, Diagnostics& diag)
 109     : _cacheBuffer(cacheBuffer), _mh(mh), _diagnostics(diag), _mappingInfo(mappingInfo)
 110 {
 111     assert((mh->magic() == MH_MAGIC) || (mh->magic() == MH_MAGIC_64));
 112     macho_segment_command<P>* segCmd;
 113     const macho_load_command<P>* const cmds = (macho_load_command<P>*)((uint8_t*)mh + sizeof(macho_header<P>));
 114     const uint32_t cmd_count = mh->ncmds();
 115     const macho_load_command<P>* cmd = cmds;
 116     unsigned segIndex = 0;
 117     for (uint32_t i = 0; i < cmd_count; ++i) {
 118         switch (cmd->cmd()) {
 119             case LC_ID_DYLIB:
 120                 _installName = ((macho_dylib_command<P>*)cmd)->name();
 121                 break;
 122             case LC_SYMTAB:
 123                 _symTabCmd = (macho_symtab_command<P>*)cmd;
 124                 break;
 125             case LC_DYSYMTAB:
 126                 _dynSymTabCmd = (macho_dysymtab_command<P>*)cmd;
 127                 break;
 128             case LC_DYLD_INFO:
 129             case LC_DYLD_INFO_ONLY:
 130                 _dyldInfo = (macho_dyld_info_command<P>*)cmd;
 131                 break;
 132             case LC_SEGMENT_SPLIT_INFO:
 133                 _splitSegInfoCmd = (macho_linkedit_data_command<P>*)cmd;
 134                 break;
 135             case LC_FUNCTION_STARTS:
 136                 _functionStartsCmd = (macho_linkedit_data_command<P>*)cmd;
 137                 break;
 138             case LC_DATA_IN_CODE:
 139                 _dataInCodeCmd = (macho_linkedit_data_command<P>*)cmd;
 140                 break;
 141             case LC_DYLD_CHAINED_FIXUPS:
 142                 _chainedFixupsCmd = (macho_linkedit_data_command<P>*)cmd;
 143                 break;
 144             case LC_DYLD_EXPORTS_TRIE:
 145                 _exportTrieCmd = (macho_linkedit_data_command<P>*)cmd;
 146                 break;
 147             case macho_segment_command<P>::CMD:
 148                 segCmd = (macho_segment_command<P>*)cmd;
 149                 _segCmds.push_back(segCmd);
 150                 _segOrigStartAddresses.push_back(segCmd->vmaddr());
 151                 _segSlides.push_back(_mappingInfo[segIndex].dstCacheUnslidAddress - segCmd->vmaddr());
 152                 if ( strcmp(segCmd->segname(), "__LINKEDIT") == 0 ) {
 153                     _linkeditBias = (uint8_t*)_mappingInfo[segIndex].dstSegment - segCmd->fileoff();
 154                     _linkeditSegIndex = segIndex;
 155                 }
 156                 ++segIndex;
 157                 break;
 158         }
 159         cmd = (const macho_load_command<P>*)(((uint8_t*)cmd)+cmd->cmdsize());
 160     }
 161     _maskPointers = (P::E::get32(mh->cputype()) == CPU_TYPE_ARM64) || (P::E::get32(mh->cputype()) == CPU_TYPE_ARM64_32);
 162     if ( _splitSegInfoCmd != NULL ) {
 163         const uint8_t* infoStart = &_linkeditBias[_splitSegInfoCmd->dataoff()];
 164         _splitSegInfoV2 = (*infoStart == DYLD_CACHE_ADJ_V2_FORMAT);
 165     }
 166     else {
 167         _diagnostics.error("missing LC_SEGMENT_SPLIT_INFO in %s", _installName);
 168     }
 169 }
 170
 171 template <typename P>
 172 void Adjustor<P>::adjustImageForNewSegmentLocations(CacheBuilder::ASLR_Tracker& aslrTracker,
 173                                                     CacheBuilder::LOH_Tracker& lohTracker,
 174                                                     const CacheBuilder::CacheCoalescedText& coalescedText,
 175                                                     const CacheBuilder::DylibTextCoalescer& textCoalescer)
 176 {
 177     if ( _diagnostics.hasError() )
 178         return;
 179     if ( _splitSegInfoV2 ) {
 180         adjustReferencesUsingInfoV2(aslrTracker, lohTracker, coalescedText, textCoalescer);
 181     }
 182     else {
 183         adjustDataPointers(aslrTracker);
 184         adjustCode();
 185     }
 186     if ( _diagnostics.hasError() )
 187         return;
 188     adjustSymbolTable();
 189     if ( _diagnostics.hasError() )
 190         return;
 191     adjustChainedFixups();
 192     if ( _diagnostics.hasError() )
 193         return;
 194     rebuildLinkEditAndLoadCommands(textCoalescer);
 195
 196 #if DEBUG
 197     Diagnostics  diag;
 198     ((dyld3::MachOAnalyzer*)_mh)->validateDyldCacheDylib(diag, _installName);
 199     if ( diag.hasError() ) {
 200         fprintf(stderr, "%s\n", diag.errorMessage().c_str());
 201     }
 202 #endif
 203 }
 204
 205 template <typename P>
 206 uint64_t Adjustor<P>::slideForOrigAddress(uint64_t addr)
 207 {
 208     for (unsigned i=0; i < _segOrigStartAddresses.size(); ++i) {
 209         if ( (_segOrigStartAddresses[i] <= addr) && (addr < (_segOrigStartAddresses[i]+_segCmds[i]->vmsize())) )
 210             return _segSlides[i];
 211     }
 212     // On arm64, high nibble of pointers can have extra bits
 213     if ( _maskPointers && (addr & 0xF000000000000000) ) {
 214         return slideForOrigAddress(addr & 0x0FFFFFFFFFFFFFFF);
 215     }
 216     _diagnostics.error("slide not known for dylib address 0x%llX in %s", addr, _installName);
 217     return 0;
 218 }
 219
 220 template <typename P>
 221 void Adjustor<P>::rebuildLinkEditAndLoadCommands(const CacheBuilder::DylibTextCoalescer& textCoalescer)
 222 {
 223     // Exports trie is only data structure in LINKEDIT that might grow
 224     std::vector<uint8_t> newTrieBytes;
 225     adjustExportsTrie(newTrieBytes);
 226
 227     // Remove: code signature, rebase info, code-sign-dirs, split seg info
 228     uint32_t chainedFixupsOffset = 0;
 229     uint32_t chainedFixupsSize   = _chainedFixupsCmd ? _chainedFixupsCmd->datasize() : 0;
 230     uint32_t bindOffset          = chainedFixupsOffset + chainedFixupsSize;
 231     uint32_t bindSize            = _dyldInfo ? _dyldInfo->bind_size() : 0;
 232     uint32_t weakBindOffset      = bindOffset + bindSize;
 233     uint32_t weakBindSize        = _dyldInfo ? _dyldInfo->weak_bind_size() : 0;
 234     uint32_t lazyBindOffset      = weakBindOffset + weakBindSize;
 235     uint32_t lazyBindSize        = _dyldInfo ? _dyldInfo->lazy_bind_size() : 0;
 236     uint32_t exportOffset        = lazyBindOffset + lazyBindSize;
 237     uint32_t exportSize          = (uint32_t)newTrieBytes.size();
 238     uint32_t splitSegInfoOffset  = exportOffset + exportSize;
 239     uint32_t splitSegInfosSize   = (_splitSegInfoCmd ? _splitSegInfoCmd->datasize() : 0);
 240     uint32_t funcStartsOffset    = splitSegInfoOffset + splitSegInfosSize;
 241     uint32_t funcStartsSize      = (_functionStartsCmd ? _functionStartsCmd->datasize() : 0);
 242     uint32_t dataInCodeOffset    = funcStartsOffset + funcStartsSize;
 243     uint32_t dataInCodeSize      = (_dataInCodeCmd ? _dataInCodeCmd->datasize() : 0);
 244     uint32_t symbolTableOffset   = dataInCodeOffset + dataInCodeSize;
 245     uint32_t symbolTableSize     = _symTabCmd->nsyms() * sizeof(macho_nlist<P>);
 246     uint32_t indirectTableOffset = symbolTableOffset + symbolTableSize;
 247     uint32_t indirectTableSize   = _dynSymTabCmd->nindirectsyms() * sizeof(uint32_t);
 248     uint32_t symbolStringsOffset = indirectTableOffset + indirectTableSize;
 249     uint32_t symbolStringsSize   = _symTabCmd->strsize();
 250     uint32_t newLinkEditSize     = symbolStringsOffset + symbolStringsSize;
 251
 252     size_t linkeditBufferSize = align(_segCmds[_linkeditSegIndex]->vmsize(), 12);
 253     if ( linkeditBufferSize < newLinkEditSize ) {
 254         _diagnostics.error("LINKEDIT overflow in %s", _installName);
 255         return;
 256     }
 257
 258     uint8_t* newLinkeditBufer = (uint8_t*)::calloc(linkeditBufferSize, 1);
 259     if ( chainedFixupsSize )
 260         memcpy(&newLinkeditBufer[chainedFixupsOffset], &_linkeditBias[_chainedFixupsCmd->dataoff()], chainedFixupsSize);
 261     if ( bindSize )
 262         memcpy(&newLinkeditBufer[bindOffset], &_linkeditBias[_dyldInfo->bind_off()], bindSize);
 263     if ( lazyBindSize )
 264         memcpy(&newLinkeditBufer[lazyBindOffset], &_linkeditBias[_dyldInfo->lazy_bind_off()], lazyBindSize);
 265     if ( weakBindSize )
 266         memcpy(&newLinkeditBufer[weakBindOffset], &_linkeditBias[_dyldInfo->weak_bind_off()], weakBindSize);
 267     if ( exportSize )
 268         memcpy(&newLinkeditBufer[exportOffset], &newTrieBytes[0], exportSize);
 269     if ( splitSegInfosSize )
 270         memcpy(&newLinkeditBufer[splitSegInfoOffset], &_linkeditBias[_splitSegInfoCmd->dataoff()], splitSegInfosSize);
 271     if ( funcStartsSize )
 272         memcpy(&newLinkeditBufer[funcStartsOffset], &_linkeditBias[_functionStartsCmd->dataoff()], funcStartsSize);
 273     if ( dataInCodeSize )
 274         memcpy(&newLinkeditBufer[dataInCodeOffset], &_linkeditBias[_dataInCodeCmd->dataoff()], dataInCodeSize);
 275     if ( symbolTableSize )
 276         memcpy(&newLinkeditBufer[symbolTableOffset], &_linkeditBias[_symTabCmd->symoff()], symbolTableSize);
 277     if ( indirectTableSize )
 278         memcpy(&newLinkeditBufer[indirectTableOffset], &_linkeditBias[_dynSymTabCmd->indirectsymoff()], indirectTableSize);
 279     if ( symbolStringsSize )
 280         memcpy(&newLinkeditBufer[symbolStringsOffset], &_linkeditBias[_symTabCmd->stroff()], symbolStringsSize);
 281
 282     memcpy(_mappingInfo[_linkeditSegIndex].dstSegment, newLinkeditBufer, newLinkEditSize);
 283     ::bzero(((uint8_t*)_mappingInfo[_linkeditSegIndex].dstSegment)+newLinkEditSize, linkeditBufferSize-newLinkEditSize);
 284     ::free(newLinkeditBufer);
 285     uint32_t linkeditStartOffset = (uint32_t)_mappingInfo[_linkeditSegIndex].dstCacheFileOffset;
 286
 287     // updates load commands and removed ones no longer needed
 288     macho_load_command<P>* const cmds = (macho_load_command<P>*)((uint8_t*)_mh + sizeof(macho_header<P>));
 289     uint32_t cmd_count = _mh->ncmds();
 290     const macho_load_command<P>* cmd = cmds;
 291     const unsigned origLoadCommandsSize = _mh->sizeofcmds();
 292     unsigned bytesRemaining = origLoadCommandsSize;
 293     unsigned removedCount = 0;
 294     unsigned segIndex = 0;
 295     for (uint32_t i = 0; i < cmd_count; ++i) {
 296         macho_symtab_command<P>*           symTabCmd;
 297         macho_dysymtab_command<P>*         dynSymTabCmd;
 298         macho_dyld_info_command<P>*        dyldInfo;
 299         macho_linkedit_data_command<P>*    functionStartsCmd;
 300         macho_linkedit_data_command<P>*    dataInCodeCmd;
 301         macho_linkedit_data_command<P>*    chainedFixupsCmd;
 302         macho_linkedit_data_command<P>*    exportTrieCmd;
 303         macho_linkedit_data_command<P>*    splitSegInfoCmd;
 304         macho_segment_command<P>*          segCmd;
 305         macho_routines_command<P>*         routinesCmd;
 306         macho_dylib_command<P>*            dylibIDCmd;
 307         uint32_t cmdSize = cmd->cmdsize();
 308         int32_t segFileOffsetDelta;
 309         bool remove = false;
 310         switch ( cmd->cmd() ) {
 311             case LC_ID_DYLIB:
 312                 dylibIDCmd = (macho_dylib_command<P>*)cmd;
 313                 dylibIDCmd->set_timestamp(2); // match what static linker sets in LC_LOAD_DYLIB
 314                 break;
 315             case LC_SYMTAB:
 316                 symTabCmd = (macho_symtab_command<P>*)cmd;
 317                 symTabCmd->set_symoff(linkeditStartOffset+symbolTableOffset);
 318                 symTabCmd->set_stroff(linkeditStartOffset+symbolStringsOffset);
 319               break;
 320             case LC_DYSYMTAB:
 321                 dynSymTabCmd = (macho_dysymtab_command<P>*)cmd;
 322                 dynSymTabCmd->set_indirectsymoff(linkeditStartOffset+indirectTableOffset);
 323                 break;
 324             case LC_DYLD_INFO:
 325             case LC_DYLD_INFO_ONLY:
 326                 dyldInfo = (macho_dyld_info_command<P>*)cmd;
 327                 dyldInfo->set_rebase_off(0);
 328                 dyldInfo->set_rebase_size(0);
 329                 dyldInfo->set_bind_off(bindSize ? linkeditStartOffset+bindOffset : 0);
 330                 dyldInfo->set_bind_size(bindSize);
 331                 dyldInfo->set_weak_bind_off(weakBindSize ? linkeditStartOffset+weakBindOffset : 0);
 332                 dyldInfo->set_weak_bind_size(weakBindSize);
 333                 dyldInfo->set_lazy_bind_off(lazyBindSize ? linkeditStartOffset+lazyBindOffset : 0);
 334                 dyldInfo->set_lazy_bind_size(lazyBindSize);
 335                 dyldInfo->set_export_off(exportSize ? linkeditStartOffset+exportOffset : 0);
 336                 dyldInfo->set_export_size(exportSize);
 337                 break;
 338             case LC_FUNCTION_STARTS:
 339                 functionStartsCmd = (macho_linkedit_data_command<P>*)cmd;
 340                 functionStartsCmd->set_dataoff(linkeditStartOffset+funcStartsOffset);
 341                break;
 342             case LC_DATA_IN_CODE:
 343                 dataInCodeCmd = (macho_linkedit_data_command<P>*)cmd;
 344                 dataInCodeCmd->set_dataoff(linkeditStartOffset+dataInCodeOffset);
 345                 break;
 346             case LC_DYLD_CHAINED_FIXUPS:
 347                 chainedFixupsCmd = (macho_linkedit_data_command<P>*)cmd;
 348                 chainedFixupsCmd->set_dataoff(chainedFixupsSize ? linkeditStartOffset+chainedFixupsOffset : 0);
 349                 chainedFixupsCmd->set_datasize(chainedFixupsSize);
 350                 break;
 351             case LC_DYLD_EXPORTS_TRIE:
 352                 exportTrieCmd = (macho_linkedit_data_command<P>*)cmd;
 353                 exportTrieCmd->set_dataoff(exportSize ? linkeditStartOffset+exportOffset : 0);
 354                 exportTrieCmd->set_datasize(exportSize);
 355                 break;
 356             case macho_routines_command<P>::CMD:
 357                 routinesCmd = (macho_routines_command<P>*)cmd;
 358                 routinesCmd->set_init_address(routinesCmd->init_address()+slideForOrigAddress(routinesCmd->init_address()));
 359                 break;
 360             case macho_segment_command<P>::CMD:
 361                 segCmd = (macho_segment_command<P>*)cmd;
 362                 segFileOffsetDelta = (int32_t)(_mappingInfo[segIndex].dstCacheFileOffset - segCmd->fileoff());
 363                 segCmd->set_vmaddr(_mappingInfo[segIndex].dstCacheUnslidAddress);
 364                 segCmd->set_vmsize(_mappingInfo[segIndex].dstCacheSegmentSize);
 365                 segCmd->set_fileoff(_mappingInfo[segIndex].dstCacheFileOffset);
 366                 segCmd->set_filesize(_mappingInfo[segIndex].dstCacheFileSize);
 367                 if ( strcmp(segCmd->segname(), "__LINKEDIT") == 0 )
 368                     segCmd->set_vmsize(linkeditBufferSize);
 369                 if ( segCmd->nsects() > 0 ) {
 370                     macho_section<P>* const sectionsStart = (macho_section<P>*)((uint8_t*)segCmd + sizeof(macho_segment_command<P>));
 371                     macho_section<P>* const sectionsEnd = &sectionsStart[segCmd->nsects()];
 372
 373                     for (macho_section<P>*  sect=sectionsStart; sect < sectionsEnd; ++sect) {
 374                         if ( (strcmp(segCmd->segname(), "__TEXT") == 0) && textCoalescer.sectionWasCoalesced(sect->sectname())) {
 375                             // Put coalesced sections at the end of the segment
 376                             sect->set_addr(segCmd->vmaddr() + segCmd->filesize());
 377                             sect->set_offset(0);
 378                             sect->set_size(0);
 379                         } else {
 380                             sect->set_addr(sect->addr() + _segSlides[segIndex]);
 381                             if ( sect->offset() != 0 )
 382                                 sect->set_offset(sect->offset() + segFileOffsetDelta);
 383                         }
 384                     }
 385                 }
 386                 ++segIndex;
 387                 break;
 388              case LC_RPATH:
 389                 _diagnostics.warning("dyld shared cache does not support LC_RPATH found in %s", _installName);
 390                 remove = true;
 391                 break;
 392             case LC_SEGMENT_SPLIT_INFO:
 393                 splitSegInfoCmd = (macho_linkedit_data_command<P>*)cmd;
 394                 splitSegInfoCmd->set_dataoff(linkeditStartOffset+splitSegInfoOffset);
 395                 break;
 396             case LC_CODE_SIGNATURE:
 397             case LC_DYLIB_CODE_SIGN_DRS:
 398                 remove = true;
 399                 break;
 400             default:
 401                 break;
 402         }
 403         macho_load_command<P>* nextCmd = (macho_load_command<P>*)(((uint8_t*)cmd)+cmdSize);
 404         if ( remove ) {
 405             ::memmove((void*)cmd, (void*)nextCmd, bytesRemaining);
 406             ++removedCount;
 407         }
 408         else {
 409             bytesRemaining -= cmdSize;
 410             cmd = nextCmd;
 411         }
 412     }
 413     // zero out stuff removed
 414     ::bzero((void*)cmd, bytesRemaining);
 415     // update header
 416     _mh->set_ncmds(cmd_count-removedCount);
 417     _mh->set_sizeofcmds(origLoadCommandsSize-bytesRemaining);
 418     _mh->set_flags(_mh->flags() | 0x80000000);
 419 }
 420
 421
 422 template <typename P>
 423 void Adjustor<P>::adjustSymbolTable()
 424 {
 425     macho_nlist<P>*  symbolTable = (macho_nlist<P>*)&_linkeditBias[_symTabCmd->symoff()];
 426
 427     // adjust global symbol table entries
 428     macho_nlist<P>* lastExport = &symbolTable[_dynSymTabCmd->iextdefsym()+_dynSymTabCmd->nextdefsym()];
 429     for (macho_nlist<P>* entry = &symbolTable[_dynSymTabCmd->iextdefsym()]; entry < lastExport; ++entry) {
 430         if ( (entry->n_type() & N_TYPE) == N_SECT )
 431             entry->set_n_value(entry->n_value() + slideForOrigAddress(entry->n_value()));
 432     }
 433
 434     // adjust local symbol table entries
 435     macho_nlist<P>*  lastLocal = &symbolTable[_dynSymTabCmd->ilocalsym()+_dynSymTabCmd->nlocalsym()];
 436     for (macho_nlist<P>* entry = &symbolTable[_dynSymTabCmd->ilocalsym()]; entry < lastLocal; ++entry) {
 437         if ( (entry->n_sect() != NO_SECT) && ((entry->n_type() & N_STAB) == 0) )
 438             entry->set_n_value(entry->n_value() + slideForOrigAddress(entry->n_value()));
 439     }
 440 }
 441
 442
 443 template <typename P>
 444 void Adjustor<P>::adjustChainedFixups()
 445 {
 446     if ( _chainedFixupsCmd == nullptr )
 447         return;
 448
 449     // Pass a start hint in to withChainStarts which takes account of the LINKEDIT shifting but we haven't
 450     // yet updated that LC_SEGMENT to point to the new data
 451     const dyld_chained_fixups_header* header = (dyld_chained_fixups_header*)&_linkeditBias[_chainedFixupsCmd->dataoff()];
 452     uint64_t startsOffset = ((uint64_t)header + header->starts_offset) - (uint64_t)_mh;
 453
 454     // segment_offset in dyld_chained_starts_in_segment is wrong.  We need to move it to the new segment offset
 455     ((dyld3::MachOAnalyzer*)_mh)->withChainStarts(_diagnostics, startsOffset, ^(const dyld_chained_starts_in_image* starts) {
 456         for (uint32_t segIndex=0; segIndex < starts->seg_count; ++segIndex) {
 457             if ( starts->seg_info_offset[segIndex] == 0 )
 458                 continue;
 459             dyld_chained_starts_in_segment* segInfo = (dyld_chained_starts_in_segment*)((uint8_t*)starts + starts->seg_info_offset[segIndex]);
 460             segInfo->segment_offset = (uint64_t)_mappingInfo[segIndex].dstSegment - (uint64_t)_mh;
 461         }
 462     });
 463 }
 464
 465 template <typename P>
 466 void Adjustor<P>::slidePointer(int segIndex, uint64_t segOffset, uint8_t type, CacheBuilder::ASLR_Tracker& aslrTracker)
 467 {
 468     pint_t*   mappedAddrP  = (pint_t*)((uint8_t*)_mappingInfo[segIndex].dstSegment + segOffset);
 469     uint32_t* mappedAddr32 = (uint32_t*)mappedAddrP;
 470     pint_t    valueP;
 471     uint32_t  value32;
 472     switch ( type ) {
 473         case REBASE_TYPE_POINTER:
 474             valueP = (pint_t)P::getP(*mappedAddrP);
 475             P::setP(*mappedAddrP, valueP + slideForOrigAddress(valueP));
 476             aslrTracker.add(mappedAddrP);
 477             break;
 478
 479         case REBASE_TYPE_TEXT_ABSOLUTE32:
 480             value32 = P::E::get32(*mappedAddr32);
 481             P::E::set32(*mappedAddr32, value32 + (uint32_t)slideForOrigAddress(value32));
 482             break;
 483
 484         case REBASE_TYPE_TEXT_PCREL32:
 485             // general text relocs not support
 486         default:
 487             _diagnostics.error("unknown rebase type 0x%02X in %s", type, _installName);
 488     }
 489 }
 490
 491
 492 static bool isThumbMovw(uint32_t instruction)
 493 {
 494     return ( (instruction & 0x8000FBF0) == 0x0000F240 );
 495 }
 496
 497 static bool isThumbMovt(uint32_t instruction)
 498 {
 499     return ( (instruction & 0x8000FBF0) == 0x0000F2C0 );
 500 }
 501
 502 static uint16_t getThumbWord(uint32_t instruction)
 503 {
 504     uint32_t i = ((instruction & 0x00000400) >> 10);
 505     uint32_t imm4 = (instruction & 0x0000000F);
 506     uint32_t imm3 = ((instruction & 0x70000000) >> 28);
 507     uint32_t imm8 = ((instruction & 0x00FF0000) >> 16);
 508     return ((imm4 << 12) | (i << 11) | (imm3 << 8) | imm8);
 509 }
 510
 511 static uint32_t setThumbWord(uint32_t instruction, uint16_t word) {
 512     uint32_t imm4 = (word & 0xF000) >> 12;
 513     uint32_t i =    (word & 0x0800) >> 11;
 514     uint32_t imm3 = (word & 0x0700) >> 8;
 515     uint32_t imm8 =  word & 0x00FF;
 516     return (instruction & 0x8F00FBF0) | imm4 | (i << 10) | (imm3 << 28) | (imm8 << 16);
 517 }
 518
 519 static bool isArmMovw(uint32_t instruction)
 520 {
 521     return (instruction & 0x0FF00000) == 0x03000000;
 522 }
 523
 524 static bool isArmMovt(uint32_t instruction)
 525 {
 526     return (instruction & 0x0FF00000) == 0x03400000;
 527 }
 528
 529 static uint16_t getArmWord(uint32_t instruction)
 530 {
 531     uint32_t imm4 = ((instruction & 0x000F0000) >> 16);
 532     uint32_t imm12 = (instruction & 0x00000FFF);
 533     return (imm4 << 12) | imm12;
 534 }
 535
 536 static uint32_t setArmWord(uint32_t instruction, uint16_t word) {
 537     uint32_t imm4 = (word & 0xF000) >> 12;
 538     uint32_t imm12 = word & 0x0FFF;
 539     return (instruction & 0xFFF0F000) | (imm4 << 16) | imm12;
 540 }
 541
 542 template <typename P>
 543 void Adjustor<P>::adjustReference(uint32_t kind, uint8_t* mappedAddr, uint64_t fromNewAddress, uint64_t toNewAddress,
 544                                   int64_t adjust, int64_t targetSlide, uint64_t imageStartAddress, uint64_t imageEndAddress,
 545                                   CacheBuilder::ASLR_Tracker& aslrTracker, CacheBuilder::LOH_Tracker* lohTracker,
 546                                   uint32_t*& lastMappedAddr32, uint32_t& lastKind, uint64_t& lastToNewAddress)
 547 {
 548     uint64_t value64;
 549     uint64_t* mappedAddr64 = 0;
 550     uint32_t value32;
 551     uint32_t* mappedAddr32 = 0;
 552     uint32_t instruction;
 553     dyld3::MachOLoaded::ChainedFixupPointerOnDisk chainPtr;
 554     int64_t offsetAdjust;
 555     int64_t delta;
 556     switch ( kind ) {
 557         case DYLD_CACHE_ADJ_V2_DELTA_32:
 558             mappedAddr32 = (uint32_t*)mappedAddr;
 559             value32 = P::E::get32(*mappedAddr32);
 560             delta = (int32_t)value32;
 561             delta += adjust;
 562             if ( (delta > 0x80000000) || (-delta > 0x80000000) ) {
 563                 _diagnostics.error("DYLD_CACHE_ADJ_V2_DELTA_32 can't be adjust by 0x%016llX in %s", adjust, _installName);
 564                 return;
 565             }
 566             P::E::set32(*mappedAddr32, (int32_t)delta);
 567             break;
 568         case DYLD_CACHE_ADJ_V2_POINTER_32:
 569             mappedAddr32 = (uint32_t*)mappedAddr;
 570             if ( toNewAddress != (uint64_t)(E::get32(*mappedAddr32) + targetSlide) ) {
 571                 _diagnostics.error("bad DYLD_CACHE_ADJ_V2_POINTER_32 value not as expected at address 0x%llX in %s", fromNewAddress, _installName);
 572                 return;
 573             }
 574             E::set32(*mappedAddr32, (uint32_t)toNewAddress);
 575             aslrTracker.add(mappedAddr32);
 576             break;
 577         case DYLD_CACHE_ADJ_V2_POINTER_64:
 578             mappedAddr64 = (uint64_t*)mappedAddr;
 579             if ( toNewAddress != (E::get64(*mappedAddr64) + targetSlide) ) {
 580                 _diagnostics.error("bad DYLD_CACHE_ADJ_V2_POINTER_64 value not as expected at address 0x%llX in %s", fromNewAddress, _installName);
 581                 return;
 582             }
 583             E::set64(*mappedAddr64, toNewAddress);
 584             aslrTracker.add(mappedAddr64);
 585             break;
 586         case DYLD_CACHE_ADJ_V2_THREADED_POINTER_64:
 587             mappedAddr64 = (uint64_t*)mappedAddr;
 588             chainPtr.raw64 = E::get64(*mappedAddr64);
 589             // ignore binds, fix up rebases to have new targets
 590             if ( chainPtr.arm64e.authRebase.bind == 0 ) {
 591                 if ( chainPtr.arm64e.authRebase.auth ) {
 592                     // auth pointer target is offset in dyld cache
 593                     chainPtr.arm64e.authRebase.target += (((dyld3::MachOAnalyzer*)_mh)->preferredLoadAddress() + targetSlide - _cacheBuffer->header.sharedRegionStart);
 594                 }
 595                 else {
 596                     // plain pointer target is unslid address of target
 597                     chainPtr.arm64e.rebase.target += targetSlide;
 598                 }
 599                 // Note, the pointer remains a chain with just the target of the rebase adjusted to the new target location
 600                 E::set64(*mappedAddr64, chainPtr.raw64);
 601             }
 602             break;
 603        case DYLD_CACHE_ADJ_V2_DELTA_64:
 604             mappedAddr64 = (uint64_t*)mappedAddr;
 605             value64 = P::E::get64(*mappedAddr64);
 606             E::set64(*mappedAddr64, value64 + adjust);
 607             break;
 608         case DYLD_CACHE_ADJ_V2_IMAGE_OFF_32:
 609             if ( adjust == 0 )
 610                 break;
 611             mappedAddr32 = (uint32_t*)mappedAddr;
 612             value32 = P::E::get32(*mappedAddr32);
 613             value64 = toNewAddress - imageStartAddress;
 614             if ( value64 > imageEndAddress ) {
 615                 _diagnostics.error("DYLD_CACHE_ADJ_V2_IMAGE_OFF_32 can't be adjust to 0x%016llX in %s", toNewAddress, _installName);
 616                 return;
 617             }
 618             P::E::set32(*mappedAddr32, (uint32_t)value64);
 619             break;
 620         case DYLD_CACHE_ADJ_V2_ARM64_ADRP:
 621             mappedAddr32 = (uint32_t*)mappedAddr;
 622             if (lohTracker)
 623                 (*lohTracker)[toNewAddress].insert(mappedAddr);
 624             instruction = P::E::get32(*mappedAddr32);
 625             if ( (instruction & 0x9F000000) == 0x90000000 ) {
 626                 int64_t pageDistance = ((toNewAddress & ~0xFFF) - (fromNewAddress & ~0xFFF));
 627                 int64_t newPage21 = pageDistance >> 12;
 628                 if ( (newPage21 > 2097151) || (newPage21 < -2097151) ) {
 629                     _diagnostics.error("DYLD_CACHE_ADJ_V2_ARM64_ADRP can't be adjusted that far in %s", _installName);
 630                     return;
 631                 }
 632                 instruction = (instruction & 0x9F00001F) | ((newPage21 << 29) & 0x60000000) | ((newPage21 << 3) & 0x00FFFFE0);
 633                 P::E::set32(*mappedAddr32, instruction);
 634             }
 635             else {
 636                 // ADRP instructions are sometimes optimized to other instructions (e.g. ADR) after the split-seg-info is generated
 637             }
 638             break;
 639         case DYLD_CACHE_ADJ_V2_ARM64_OFF12:
 640             mappedAddr32 = (uint32_t*)mappedAddr;
 641             if (lohTracker)
 642                 (*lohTracker)[toNewAddress].insert(mappedAddr);
 643             instruction = P::E::get32(*mappedAddr32);
 644             offsetAdjust = (adjust & 0xFFF);
 645             if ( offsetAdjust == 0 )
 646                 break;
 647             if ( (instruction & 0x3B000000) == 0x39000000 ) {
 648                 // LDR/STR imm12
 649                 if ( offsetAdjust != 0 ) {
 650                     uint32_t encodedAddend = ((instruction & 0x003FFC00) >> 10);
 651                     uint32_t newAddend = 0;
 652                     switch ( instruction & 0xC0000000 ) {
 653                         case 0x00000000:
 654                             if ( (instruction & 0x04800000) == 0x04800000 ) {
 655                                 if ( offsetAdjust & 0xF ) {
 656                                     _diagnostics.error("can't adjust off12 scale=16 instruction by %lld bytes at mapped address=%p in %s", offsetAdjust, mappedAddr, _installName);
 657                                     return;
 658                                 }
 659                                 if ( encodedAddend*16 >= 4096 ) {
 660                                     _diagnostics.error("off12 scale=16 instruction points outside its page at mapped address=%p in %s", mappedAddr, _installName);
 661                                 }
 662                                 newAddend = (encodedAddend + offsetAdjust/16) % 256;
 663                             }
 664                             else {
 665                                 // scale=1
 666                                 newAddend = (encodedAddend + (int32_t)offsetAdjust) % 4096;
 667                             }
 668                             break;
 669                         case 0x40000000:
 670                             if ( offsetAdjust & 1 ) {
 671                                 _diagnostics.error("can't adjust off12 scale=2 instruction by %lld bytes at mapped address=%p in %s", offsetAdjust, mappedAddr, _installName);
 672                                 return;
 673                             }
 674                             if ( encodedAddend*2 >= 4096 ) {
 675                                 _diagnostics.error("off12 scale=2 instruction points outside its page at mapped address=%p in %s", mappedAddr, _installName);
 676                                 return;
 677                             }
 678                             newAddend = (encodedAddend + offsetAdjust/2) % 2048;
 679                             break;
 680                         case 0x80000000:
 681                             if ( offsetAdjust & 3 ) {
 682                                 _diagnostics.error("can't adjust off12 scale=4 instruction by %lld bytes at mapped address=%p in %s", offsetAdjust, mappedAddr, _installName);
 683                                 return;
 684                             }
 685                             if ( encodedAddend*4 >= 4096 ) {
 686                                 _diagnostics.error("off12 scale=4 instruction points outside its page at mapped address=%p in %s", mappedAddr, _installName);
 687                                 return;
 688                             }
 689                             newAddend = (encodedAddend + offsetAdjust/4) % 1024;
 690                             break;
 691                         case 0xC0000000:
 692                             if ( offsetAdjust & 7 ) {
 693                                 _diagnostics.error("can't adjust off12 scale=8 instruction by %lld bytes at mapped address=%p in %s", offsetAdjust, mappedAddr, _installName);
 694                                 return;
 695                             }
 696                             if ( encodedAddend*8 >= 4096 ) {
 697                                 _diagnostics.error("off12 scale=8 instruction points outside its page at mapped address=%p in %s", mappedAddr, _installName);
 698                                 return;
 699                             }
 700                             newAddend = (encodedAddend + offsetAdjust/8) % 512;
 701                             break;
 702                     }
 703                     uint32_t newInstruction = (instruction & 0xFFC003FF) | (newAddend << 10);
 704                     P::E::set32(*mappedAddr32, newInstruction);
 705                 }
 706             }
 707             else if ( (instruction & 0xFFC00000) == 0x91000000 ) {
 708                 // ADD imm12
 709                 if ( instruction & 0x00C00000 ) {
 710                     _diagnostics.error("ADD off12 uses shift at mapped address=%p in %s", mappedAddr, _installName);
 711                     return;
 712                 }
 713                 uint32_t encodedAddend = ((instruction & 0x003FFC00) >> 10);
 714                 uint32_t newAddend = (encodedAddend + offsetAdjust) & 0xFFF;
 715                 uint32_t newInstruction = (instruction & 0xFFC003FF) | (newAddend << 10);
 716                 P::E::set32(*mappedAddr32, newInstruction);
 717             }
 718             else if ( instruction != 0xD503201F ) {
 719                 // ignore imm12 instructions optimized into a NOP, but warn about others
 720                 _diagnostics.error("unknown off12 instruction 0x%08X at 0x%0llX in %s", instruction, fromNewAddress, _installName);
 721                 return;
 722             }
 723             break;
 724         case DYLD_CACHE_ADJ_V2_THUMB_MOVW_MOVT:
 725             mappedAddr32 = (uint32_t*)mappedAddr;
 726             // to update a movw/movt pair we need to extract the 32-bit they will make,
 727             // add the adjust and write back the new movw/movt pair.
 728             if ( lastKind == kind ) {
 729                 if ( lastToNewAddress == toNewAddress ) {
 730                     uint32_t instruction1 = P::E::get32(*lastMappedAddr32);
 731                     uint32_t instruction2 = P::E::get32(*mappedAddr32);
 732                     if ( isThumbMovw(instruction1) && isThumbMovt(instruction2) ) {
 733                         uint16_t high = getThumbWord(instruction2);
 734                         uint16_t low  = getThumbWord(instruction1);
 735                         uint32_t full = high << 16 | low;
 736                         full += adjust;
 737                         instruction1 = setThumbWord(instruction1, full & 0xFFFF);
 738                         instruction2 = setThumbWord(instruction2, full >> 16);
 739                     }
 740                     else if ( isThumbMovt(instruction1) && isThumbMovw(instruction2) ) {
 741                         uint16_t high = getThumbWord(instruction1);
 742                         uint16_t low  = getThumbWord(instruction2);
 743                         uint32_t full = high << 16 | low;
 744                         full += adjust;
 745                         instruction2 = setThumbWord(instruction2, full & 0xFFFF);
 746                         instruction1 = setThumbWord(instruction1, full >> 16);
 747                     }
 748                     else {
 749                         _diagnostics.error("two DYLD_CACHE_ADJ_V2_THUMB_MOVW_MOVT in a row but not paried in %s", _installName);
 750                         return;
 751                     }
 752                     P::E::set32(*lastMappedAddr32, instruction1);
 753                     P::E::set32(*mappedAddr32, instruction2);
 754                     kind = 0;
 755                 }
 756                 else {
 757                     _diagnostics.error("two DYLD_CACHE_ADJ_V2_THUMB_MOVW_MOVT in a row but target different addresses in %s", _installName);
 758                     return;
 759                 }
 760             }
 761             break;
 762         case DYLD_CACHE_ADJ_V2_ARM_MOVW_MOVT:
 763             mappedAddr32 = (uint32_t*)mappedAddr;
 764             // to update a movw/movt pair we need to extract the 32-bit they will make,
 765             // add the adjust and write back the new movw/movt pair.
 766             if ( lastKind == kind ) {
 767                 if ( lastToNewAddress == toNewAddress ) {
 768                     uint32_t instruction1 = P::E::get32(*lastMappedAddr32);
 769                     uint32_t instruction2 = P::E::get32(*mappedAddr32);
 770                     if ( isArmMovw(instruction1) && isArmMovt(instruction2) ) {
 771                         uint16_t high = getArmWord(instruction2);
 772                         uint16_t low  = getArmWord(instruction1);
 773                         uint32_t full = high << 16 | low;
 774                         full += adjust;
 775                         instruction1 = setArmWord(instruction1, full & 0xFFFF);
 776                         instruction2 = setArmWord(instruction2, full >> 16);
 777                     }
 778                     else if ( isArmMovt(instruction1) && isArmMovw(instruction2) ) {
 779                         uint16_t high = getArmWord(instruction1);
 780                         uint16_t low  = getArmWord(instruction2);
 781                         uint32_t full = high << 16 | low;
 782                         full += adjust;
 783                         instruction2 = setArmWord(instruction2, full & 0xFFFF);
 784                         instruction1 = setArmWord(instruction1, full >> 16);
 785                     }
 786                     else {
 787                         _diagnostics.error("two DYLD_CACHE_ADJ_V2_ARM_MOVW_MOVT in a row but not paired in %s", _installName);
 788                         return;
 789                     }
 790                     P::E::set32(*lastMappedAddr32, instruction1);
 791                     P::E::set32(*mappedAddr32, instruction2);
 792                     kind = 0;
 793                 }
 794                 else {
 795                     _diagnostics.error("two DYLD_CACHE_ADJ_V2_ARM_MOVW_MOVT in a row but target different addresses in %s", _installName);
 796                     return;
 797                 }
 798             }
 799             break;
 800         case DYLD_CACHE_ADJ_V2_ARM64_BR26:
 801         case DYLD_CACHE_ADJ_V2_THUMB_BR22:
 802         case DYLD_CACHE_ADJ_V2_ARM_BR24:
 803             // nothing to do with calls to stubs
 804             break;
 805         default:
 806             _diagnostics.error("unknown split seg kind=%d in %s", kind, _installName);
 807             return;
 808     }
 809     lastKind = kind;
 810     lastToNewAddress = toNewAddress;
 811     lastMappedAddr32 = mappedAddr32;
 812 }
 813
 814 template <typename P>
 815 void Adjustor<P>::adjustReferencesUsingInfoV2(CacheBuilder::ASLR_Tracker& aslrTracker,
 816                                               CacheBuilder::LOH_Tracker& lohTracker,
 817                                               const CacheBuilder::CacheCoalescedText& coalescedText,
 818                                               const CacheBuilder::DylibTextCoalescer& textCoalescer)
 819 {
 820     static const bool log = false;
 821
 822     const uint8_t* infoStart = &_linkeditBias[_splitSegInfoCmd->dataoff()];
 823     const uint8_t* infoEnd = &infoStart[_splitSegInfoCmd->datasize()];
 824     if ( *infoStart++ != DYLD_CACHE_ADJ_V2_FORMAT ) {
 825         _diagnostics.error("malformed split seg info in %s", _installName);
 826         return;
 827     }
 828     // build section arrays of slide and mapped address for each section
 829     std::vector<uint64_t> sectionSlides;
 830     std::vector<uint64_t> sectionNewAddress;
 831     std::vector<uint8_t*> sectionMappedAddress;
 832     sectionSlides.reserve(16);
 833     sectionNewAddress.reserve(16);
 834     sectionMappedAddress.reserve(16);
 835     // section index 0 refers to mach_header
 836     sectionMappedAddress.push_back((uint8_t*)_mappingInfo[0].dstSegment);
 837     sectionSlides.push_back(_segSlides[0]);
 838     sectionNewAddress.push_back(_mappingInfo[0].dstCacheUnslidAddress);
 839     // section 1 and later refer to real sections
 840     unsigned sectionIndex = 0;
 841     unsigned objcSelRefsSectionIndex = ~0U;
 842     std::map<uint64_t, std::string_view> coalescedSectionNames;
 843     std::map<uint64_t, uint64_t> coalescedSectionOriginalVMAddrs;
 844     for (unsigned segmentIndex=0; segmentIndex < _segCmds.size(); ++segmentIndex) {
 845         macho_segment_command<P>* segCmd = _segCmds[segmentIndex];
 846         macho_section<P>* const sectionsStart = (macho_section<P>*)((char*)segCmd + sizeof(macho_segment_command<P>));
 847         macho_section<P>* const sectionsEnd = &sectionsStart[segCmd->nsects()];
 848
 849         for(macho_section<P>* sect = sectionsStart; sect < sectionsEnd; ++sect) {
 850             if ( (strcmp(segCmd->segname(), "__TEXT") == 0) && textCoalescer.sectionWasCoalesced(sect->sectname())) {
 851                 // If we coalesced the segment then the sections aren't really there to be fixed up
 852                 sectionMappedAddress.push_back(nullptr);
 853                 sectionSlides.push_back(0);
 854                 sectionNewAddress.push_back(0);
 855                 if (log) {
 856                     fprintf(stderr, " %s/%s, sectIndex=%d, mapped at=%p\n",
 857                             sect->segname(), sect->sectname(), sectionIndex, sectionMappedAddress.back());
 858                 }
 859                 ++sectionIndex;
 860                 std::string_view sectionName = sect->sectname();
 861                 if (sectionName.size() > 16)
 862                     sectionName = sectionName.substr(0, 16);
 863                 coalescedSectionNames[sectionIndex] = sectionName;
 864                 coalescedSectionOriginalVMAddrs[sectionIndex] = sect->addr();
 865             } else {
 866                 sectionMappedAddress.push_back((uint8_t*)_mappingInfo[segmentIndex].dstSegment + sect->addr() - segCmd->vmaddr());
 867                 sectionSlides.push_back(_segSlides[segmentIndex]);
 868                 sectionNewAddress.push_back(_mappingInfo[segmentIndex].dstCacheUnslidAddress + sect->addr() - segCmd->vmaddr());
 869                 if (log) {
 870                     fprintf(stderr, " %s/%s, sectIndex=%d, mapped at=%p\n",
 871                             sect->segname(), sect->sectname(), sectionIndex, sectionMappedAddress.back());
 872                 }
 873                 ++sectionIndex;
 874                 if (!strcmp(sect->segname(), "__DATA") && !strcmp(sect->sectname(), "__objc_selrefs"))
 875                     objcSelRefsSectionIndex = sectionIndex;
 876             }
 877         }
 878     }
 879
 880     // Whole         :== <count> FromToSection+
 881     // FromToSection :== <from-sect-index> <to-sect-index> <count> ToOffset+
 882     // ToOffset         :== <to-sect-offset-delta> <count> FromOffset+
 883     // FromOffset     :== <kind> <count> <from-sect-offset-delta>
 884     const uint8_t* p = infoStart;
 885     uint64_t sectionCount = read_uleb128(p, infoEnd);
 886     for (uint64_t i=0; i < sectionCount; ++i) {
 887         uint32_t* lastMappedAddr32 = NULL;
 888         uint32_t lastKind = 0;
 889         uint64_t lastToNewAddress = 0;
 890         uint64_t fromSectionIndex = read_uleb128(p, infoEnd);
 891         uint64_t toSectionIndex = read_uleb128(p, infoEnd);
 892         uint64_t toOffsetCount = read_uleb128(p, infoEnd);
 893         uint64_t fromSectionSlide = sectionSlides[fromSectionIndex];
 894         uint64_t fromSectionNewAddress = sectionNewAddress[fromSectionIndex];
 895         uint8_t* fromSectionMappedAddress = sectionMappedAddress[fromSectionIndex];
 896         uint64_t toSectionSlide = sectionSlides[toSectionIndex];
 897         uint64_t toSectionNewAddress = sectionNewAddress[toSectionIndex];
 898         CacheBuilder::LOH_Tracker* lohTrackerPtr = (toSectionIndex == objcSelRefsSectionIndex) ? &lohTracker : nullptr;
 899         if (log) printf(" from sect=%lld (mapped=%p), to sect=%lld (new addr=0x%llX):\n", fromSectionIndex, fromSectionMappedAddress, toSectionIndex, toSectionNewAddress);
 900         uint64_t toSectionOffset = 0;
 901
 902         // We don't support updating split seg from a coalesced segment
 903         if (coalescedSectionNames.find(fromSectionIndex) != coalescedSectionNames.end()) {
 904             _diagnostics.error("split seg from coalesced segment in %s", _installName);
 905             return;
 906         }
 907         for (uint64_t j=0; j < toOffsetCount; ++j) {
 908             uint64_t toSectionDelta = read_uleb128(p, infoEnd);
 909             uint64_t fromOffsetCount = read_uleb128(p, infoEnd);
 910             toSectionOffset += toSectionDelta;
 911             for (uint64_t k=0; k < fromOffsetCount; ++k) {
 912                 uint64_t kind = read_uleb128(p, infoEnd);
 913                 if ( kind > 13 ) {
 914                     _diagnostics.error("unknown split seg info v2 kind value (%llu) in %s", kind, _installName);
 915                     return;
 916                 }
 917                 uint64_t fromSectDeltaCount = read_uleb128(p, infoEnd);
 918                 uint64_t fromSectionOffset = 0;
 919                 for (uint64_t l=0; l < fromSectDeltaCount; ++l) {
 920                     uint64_t delta = read_uleb128(p, infoEnd);
 921                     fromSectionOffset += delta;
 922                     //if (log) printf("   kind=%lld, from offset=0x%0llX, to offset=0x%0llX, adjust=0x%llX, targetSlide=0x%llX\n", kind, fromSectionOffset, toSectionOffset, deltaAdjust, toSectionSlide);
 923
 924                     uint8_t*  fromMappedAddr = fromSectionMappedAddress + fromSectionOffset;
 925                     uint64_t toNewAddress = toSectionNewAddress + toSectionOffset;
 926                     uint64_t fromNewAddress = fromSectionNewAddress + fromSectionOffset;
 927                     uint64_t imageStartAddress = sectionNewAddress.front();
 928                     uint64_t imageEndAddress = sectionNewAddress.back();
 929                     if ( toSectionIndex != 255 ) {
 930                         auto textCoalIt = coalescedSectionNames.find(toSectionIndex);
 931                         if (textCoalIt != coalescedSectionNames.end() ) {
 932                             //printf("Section name: %s\n", textCoalIt->second.data());
 933                             const CacheBuilder::DylibTextCoalescer::DylibSectionOffsetToCacheSectionOffset& offsetMap = textCoalescer.getSectionCoalescer(textCoalIt->second);
 934                             auto offsetIt = offsetMap.find((uint32_t)toSectionOffset);
 935                             assert(offsetIt != offsetMap.end());
 936                             uint64_t baseVMAddr = coalescedText.getSectionData(textCoalIt->second).bufferVMAddr;
 937                             toNewAddress = baseVMAddr + offsetIt->second;
 938
 939                             // The 'to' section is gone, but we still need the 'to' slide.  Instead of a section slide, compute the slide
 940                             // for this individual atom
 941                             uint64_t toAtomOriginalVMAddr = coalescedSectionOriginalVMAddrs[toSectionIndex] + toSectionOffset;
 942                             uint64_t toAtomSlide = toNewAddress - toAtomOriginalVMAddr;
 943                             int64_t deltaAdjust = toAtomSlide - fromSectionSlide;
 944                             adjustReference((uint32_t)kind, fromMappedAddr, fromNewAddress, toNewAddress, deltaAdjust, toAtomSlide,
 945                                             imageStartAddress, imageEndAddress, aslrTracker, lohTrackerPtr, lastMappedAddr32, lastKind, lastToNewAddress);
 946
 947                         } else {
 948                             int64_t deltaAdjust = toSectionSlide - fromSectionSlide;
 949                             adjustReference((uint32_t)kind, fromMappedAddr, fromNewAddress, toNewAddress, deltaAdjust, toSectionSlide,
 950                                             imageStartAddress, imageEndAddress, aslrTracker, lohTrackerPtr, lastMappedAddr32, lastKind, lastToNewAddress);
 951                         }
 952                     }
 953                     if ( _diagnostics.hasError() )
 954                         return;
 955                 }
 956             }
 957         }
 958     }
 959
 960 }
 961
 962 template <typename P>
 963 void Adjustor<P>::adjustDataPointers(CacheBuilder::ASLR_Tracker& aslrTracker)
 964 {
 965     const uint8_t* p = &_linkeditBias[_dyldInfo->rebase_off()];
 966     const uint8_t* end = &p[_dyldInfo->rebase_size()];
 967
 968     uint8_t type = 0;
 969     int segIndex = 0;
 970     uint64_t segOffset = 0;
 971     uint64_t count;
 972     uint64_t skip;
 973     bool done = false;
 974     while ( !done && (p < end) ) {
 975         uint8_t immediate = *p & REBASE_IMMEDIATE_MASK;
 976         uint8_t opcode = *p & REBASE_OPCODE_MASK;
 977         ++p;
 978         switch (opcode) {
 979             case REBASE_OPCODE_DONE:
 980                 done = true;
 981                 break;
 982             case REBASE_OPCODE_SET_TYPE_IMM:
 983                 type = immediate;
 984                 break;
 985             case REBASE_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 986                 segIndex = immediate;
 987                 segOffset = read_uleb128(p, end);
 988                 break;
 989             case REBASE_OPCODE_ADD_ADDR_ULEB:
 990                 segOffset += read_uleb128(p, end);
 991                 break;
 992             case REBASE_OPCODE_ADD_ADDR_IMM_SCALED:
 993                 segOffset += immediate*sizeof(pint_t);
 994                 break;
 995             case REBASE_OPCODE_DO_REBASE_IMM_TIMES:
 996                 for (int i=0; i < immediate; ++i) {
 997                     slidePointer(segIndex, segOffset, type, aslrTracker);
 998                     segOffset += sizeof(pint_t);
 999                 }
1000                 break;
1001             case REBASE_OPCODE_DO_REBASE_ULEB_TIMES:
1002                 count = read_uleb128(p, end);
1003                 for (uint32_t i=0; i < count; ++i) {
1004                     slidePointer(segIndex, segOffset, type, aslrTracker);
1005                     segOffset += sizeof(pint_t);
1006                 }
1007                 break;
1008             case REBASE_OPCODE_DO_REBASE_ADD_ADDR_ULEB:
1009                 slidePointer(segIndex, segOffset, type, aslrTracker);
1010                 segOffset += read_uleb128(p, end) + sizeof(pint_t);
1011                 break;
1012             case REBASE_OPCODE_DO_REBASE_ULEB_TIMES_SKIPPING_ULEB:
1013                 count = read_uleb128(p, end);
1014                 skip = read_uleb128(p, end);
1015                 for (uint32_t i=0; i < count; ++i) {
1016                     slidePointer(segIndex, segOffset, type, aslrTracker);
1017                     segOffset += skip + sizeof(pint_t);
1018                 }
1019                 break;
1020             default:
1021                 _diagnostics.error("unknown rebase opcode 0x%02X in %s", opcode, _installName);
1022                 done = true;
1023                 break;
1024         }
1025     }
1026 }
1027
1028
1029 template <typename P>
1030 void Adjustor<P>::adjustInstruction(uint8_t kind, uint8_t* textLoc, uint64_t codeToDataDelta)
1031 {
1032     uint32_t* fixupLoc32 = (uint32_t*)textLoc;
1033     uint64_t* fixupLoc64 = (uint64_t*)textLoc;
1034     uint32_t instruction;
1035     uint32_t value32;
1036     uint64_t value64;
1037
1038     switch (kind) {
1039     case 1:    // 32-bit pointer (including x86_64 RIP-rel)
1040         value32 = P::E::get32(*fixupLoc32);
1041         value32 += codeToDataDelta;
1042         P::E::set32(*fixupLoc32, value32);
1043         break;
1044     case 2: // 64-bit pointer
1045         value64 =  P::E::get64(*fixupLoc64);
1046         value64 += codeToDataDelta;
1047         P::E::set64(*fixupLoc64, value64);
1048         break;
1049     case 4:    // only used for i386, a reference to something in the IMPORT segment
1050         break;
1051     case 5: // used by thumb2 movw
1052         instruction = P::E::get32(*fixupLoc32);
1053         // slide is always a multiple of 4096, so only top 4 bits of lo16 will ever need adjusting
1054         value32 = (instruction & 0x0000000F) + ((uint32_t)codeToDataDelta >> 12);
1055         instruction = (instruction & 0xFFFFFFF0) | (value32 & 0x0000000F);
1056         P::E::set32(*fixupLoc32, instruction);
1057         break;
1058     case 6: // used by ARM movw
1059         instruction = P::E::get32(*fixupLoc32);
1060         // slide is always a multiple of 4096, so only top 4 bits of lo16 will ever need adjusting
1061         value32 = ((instruction & 0x000F0000) >> 16) + ((uint32_t)codeToDataDelta >> 12);
1062         instruction = (instruction & 0xFFF0FFFF) | ((value32 <<16) & 0x000F0000);
1063         P::E::set32(*fixupLoc32, instruction);
1064         break;
1065     case 0x10:
1066     case 0x11:
1067     case 0x12:
1068     case 0x13:
1069     case 0x14:
1070     case 0x15:
1071     case 0x16:
1072     case 0x17:
1073     case 0x18:
1074     case 0x19:
1075     case 0x1A:
1076     case 0x1B:
1077     case 0x1C:
1078     case 0x1D:
1079     case 0x1E:
1080     case 0x1F:
1081         // used by thumb2 movt (low nibble of kind is high 4-bits of paired movw)
1082         {
1083             instruction = P::E::get32(*fixupLoc32);
1084             assert((instruction & 0x8000FBF0) == 0x0000F2C0);
1085             // extract 16-bit value from instruction
1086             uint32_t i     = ((instruction & 0x00000400) >> 10);
1087             uint32_t imm4  =  (instruction & 0x0000000F);
1088             uint32_t imm3  = ((instruction & 0x70000000) >> 28);
1089             uint32_t imm8  = ((instruction & 0x00FF0000) >> 16);
1090             uint32_t imm16 = (imm4 << 12) | (i << 11) | (imm3 << 8) | imm8;
1091             // combine with codeToDataDelta and kind nibble
1092             uint32_t targetValue = (imm16 << 16) | ((kind & 0xF) << 12);
1093             uint32_t newTargetValue = targetValue + (uint32_t)codeToDataDelta;
1094             // construct new bits slices
1095             uint32_t imm4_    = (newTargetValue & 0xF0000000) >> 28;
1096             uint32_t i_       = (newTargetValue & 0x08000000) >> 27;
1097             uint32_t imm3_    = (newTargetValue & 0x07000000) >> 24;
1098             uint32_t imm8_    = (newTargetValue & 0x00FF0000) >> 16;
1099             // update instruction to match codeToDataDelta
1100             uint32_t newInstruction = (instruction & 0x8F00FBF0) | imm4_ | (i_ << 10) | (imm3_ << 28) | (imm8_ << 16);
1101             P::E::set32(*fixupLoc32, newInstruction);
1102         }
1103         break;
1104     case 0x20:
1105     case 0x21:
1106     case 0x22:
1107     case 0x23:
1108     case 0x24:
1109     case 0x25:
1110     case 0x26:
1111     case 0x27:
1112     case 0x28:
1113     case 0x29:
1114     case 0x2A:
1115     case 0x2B:
1116     case 0x2C:
1117     case 0x2D:
1118     case 0x2E:
1119     case 0x2F:
1120         // used by arm movt (low nibble of kind is high 4-bits of paired movw)
1121         {
1122             instruction = P::E::get32(*fixupLoc32);
1123             // extract 16-bit value from instruction
1124             uint32_t imm4 = ((instruction & 0x000F0000) >> 16);
1125             uint32_t imm12 = (instruction & 0x00000FFF);
1126             uint32_t imm16 = (imm4 << 12) | imm12;
1127             // combine with codeToDataDelta and kind nibble
1128             uint32_t targetValue = (imm16 << 16) | ((kind & 0xF) << 12);
1129             uint32_t newTargetValue = targetValue + (uint32_t)codeToDataDelta;
1130             // construct new bits slices
1131             uint32_t imm4_  = (newTargetValue & 0xF0000000) >> 28;
1132             uint32_t imm12_ = (newTargetValue & 0x0FFF0000) >> 16;
1133             // update instruction to match codeToDataDelta
1134             uint32_t newInstruction = (instruction & 0xFFF0F000) | (imm4_ << 16) | imm12_;
1135             P::E::set32(*fixupLoc32, newInstruction);
1136         }
1137         break;
1138     case 3: // used for arm64 ADRP
1139         instruction = P::E::get32(*fixupLoc32);
1140         if ( (instruction & 0x9F000000) == 0x90000000 ) {
1141             // codeToDataDelta is always a multiple of 4096, so only top 4 bits of lo16 will ever need adjusting
1142             value64 = ((instruction & 0x60000000) >> 17) | ((instruction & 0x00FFFFE0) << 9);
1143             value64 += codeToDataDelta;
1144             instruction = (instruction & 0x9F00001F) | ((value64 << 17) & 0x60000000) | ((value64 >> 9) & 0x00FFFFE0);
1145             P::E::set32(*fixupLoc32, instruction);
1146         }
1147         break;
1148     default:
1149         break;
1150     }
1151 }
1152
1153 template <typename P>
1154 void Adjustor<P>::adjustCode()
1155 {
1156     // find compressed info on how code needs to be updated
1157     const uint8_t* infoStart = &_linkeditBias[_splitSegInfoCmd->dataoff()];
1158     const uint8_t* infoEnd = &infoStart[_splitSegInfoCmd->datasize()];;
1159
1160     // This encoding only works if all data segments slide by the same amount
1161     uint64_t codeToDataDelta = _segSlides[1] - _segSlides[0];
1162
1163     // compressed data is:  [ <kind> [uleb128-delta]+ <0> ] + <0>
1164     for (const uint8_t* p = infoStart; (*p != 0) && (p < infoEnd);) {
1165         uint8_t kind = *p++;
1166         uint8_t* textLoc = (uint8_t*)_mappingInfo[0].dstSegment;
1167         while (uint64_t delta = read_uleb128(p, infoEnd)) {
1168             textLoc += delta;
1169             adjustInstruction(kind, textLoc, codeToDataDelta);
1170         }
1171     }
1172 }
1173
1174
1175 template <typename P>
1176 void Adjustor<P>::adjustExportsTrie(std::vector<uint8_t>& newTrieBytes)
1177 {
1178     // if no export info, nothing to adjust
1179     uint32_t exportOffset   = 0;
1180     uint32_t exportSize     = 0;
1181     if ( _dyldInfo != nullptr ) {
1182         exportOffset = _dyldInfo->export_off();
1183         exportSize = _dyldInfo->export_size();
1184     } else {
1185         exportOffset = _exportTrieCmd->dataoff();
1186         exportSize = _exportTrieCmd->datasize();
1187     }
1188
1189     if ( exportSize == 0 )
1190         return;
1191
1192     // since export info addresses are offsets from mach_header, everything in __TEXT is fine
1193     // only __DATA addresses need to be updated
1194     const uint8_t* start = &_linkeditBias[exportOffset];
1195     const uint8_t* end = &start[exportSize];
1196     std::vector<ExportInfoTrie::Entry> originalExports;
1197     if ( !ExportInfoTrie::parseTrie(start, end, originalExports) ) {
1198         _diagnostics.error("malformed exports trie in %s", _installName);
1199         return;
1200     }
1201
1202     std::vector<ExportInfoTrie::Entry> newExports;
1203     newExports.reserve(originalExports.size());
1204     uint64_t baseAddress = _segOrigStartAddresses[0];
1205     uint64_t baseAddressSlide = slideForOrigAddress(baseAddress);
1206     for (auto& entry:  originalExports) {
1207         // remove symbols used by the static linker only
1208         if (   (strncmp(entry.name.c_str(), "$ld$", 4) == 0)
1209             || (strncmp(entry.name.c_str(), ".objc_class_name",16) == 0)
1210             || (strncmp(entry.name.c_str(), ".objc_category_name",19) == 0) ) {
1211             continue;
1212         }
1213         // adjust symbols in slid segments
1214         if ( (entry.info.flags & EXPORT_SYMBOL_FLAGS_KIND_MASK) != EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE )
1215             entry.info.address += (slideForOrigAddress(entry.info.address + baseAddress) - baseAddressSlide);
1216         newExports.push_back(entry);
1217     }
1218
1219     // rebuild export trie
1220     newTrieBytes.reserve(exportSize);
1221
1222     ExportInfoTrie(newExports).emit(newTrieBytes);
1223     // align
1224     while ( (newTrieBytes.size() % sizeof(pint_t)) != 0 )
1225         newTrieBytes.push_back(0);
1226 }
1227
1228
1229 } // anonymous namespace
1230
1231 void CacheBuilder::adjustDylibSegments(const DylibInfo& dylib, Diagnostics& diag) const
1232 {
1233     DyldSharedCache* cache = (DyldSharedCache*)_readExecuteRegion.buffer;
1234     if ( _archLayout->is64 ) {
1235         Adjustor<Pointer64<LittleEndian>> adjustor64(cache, (macho_header<Pointer64<LittleEndian>>*)dylib.cacheLocation[0].dstSegment, dylib.cacheLocation, diag);
1236         adjustor64.adjustImageForNewSegmentLocations(_aslrTracker, _lohTracker, _coalescedText, dylib.textCoalescer);
1237     }
1238     else {
1239         Adjustor<Pointer32<LittleEndian>> adjustor32(cache, (macho_header<Pointer32<LittleEndian>>*)dylib.cacheLocation[0].dstSegment, dylib.cacheLocation, diag);
1240         adjustor32.adjustImageForNewSegmentLocations(_aslrTracker, _lohTracker, _coalescedText, dylib.textCoalescer);
1241     }
1242 }
1243
1244
1245
1246
1247
1248