launch-cache/dsc_slider.cpp

   1 /* -*- mode: C++; c-basic-offset: 4; tab-width: 4 -*-
   2  *
   3  * Copyright (c) 2010 Apple Inc. All rights reserved.
   4  *
   5  * @APPLE_LICENSE_HEADER_START@
   6  *
   7  * This file contains Original Code and/or Modifications of Original Code
   8  * as defined in and that are subject to the Apple Public Source License
   9  * Version 2.0 (the 'License'). You may not use this file except in
  10  * compliance with the License. Please obtain a copy of the License at
  11  * http://www.opensource.apple.com/apsl/ and read it before using this
  12  * file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  19  * Please see the License for the specific language governing rights and
  20  * limitations under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 #include <stdlib.h>
  26 #include <stdio.h>
  27 #include <stdarg.h>
  28 #include <fcntl.h>
  29 #include <unistd.h>
  30 #include <errno.h>
  31 #include <Availability.h>
  32
  33 #define NO_ULEB 1
  34 #include "dyld_cache_format.h"
  35 #include "Architectures.hpp"
  36 #include "MachOFileAbstraction.hpp"
  37 #include "CacheFileAbstraction.hpp"
  38
  39 #include "dsc_slider.h"
  40
  41 int update_dyld_shared_cache_load_address(const char* path, void (*logProc)(const char* format, ...) )
  42 {
  43         int fd = open(path, O_RDONLY, 0);
  44         if ( fd == -1 ) {
  45                 (*logProc)("open(%s) failed, errno=%d\n", path, errno);
  46                 return -1;
  47         }
  48         (void)fcntl(fd, F_NOCACHE, 1); // tell kernel to not cache file content
  49
  50         uint8_t buffer[4096];
  51         if ( read(fd, buffer, 4096) != 4096 ) {
  52                 (*logProc)("read(%s) failed, errno=%d\n", path, errno);
  53                 close(fd);
  54                 return -1;
  55         }
  56         bool has64BitPointers = false;
  57         bool isBigEndian = false;
  58         uint64_t startReadOnlySharedRegion = 0;
  59         uint64_t endReadOnlySharedRegion = 0;
  60         uint64_t startReadWriteSharedRegion = 0;
  61         uint64_t endReadWriteSharedRegion = 0;
  62         if ( strcmp((char*)buffer, "dyld_v1    i386") == 0 ) {
  63                 has64BitPointers = false;
  64                 isBigEndian = false;
  65         }
  66         else if ( strcmp((char*)buffer, "dyld_v1  x86_64") == 0 ) {
  67                 has64BitPointers = true;
  68                 isBigEndian = false;
  69                 startReadOnlySharedRegion  = 0x7FFF80000000LL;
  70                 endReadOnlySharedRegion    = 0x7FFFC0000000LL;
  71                 startReadWriteSharedRegion = 0x7FFF70000000LL;
  72                 endReadWriteSharedRegion   = 0x7FFF80000000LL;
  73         }
  74         else if ( strcmp((char*)buffer, "dyld_v1     ppc") == 0 ) {
  75                 has64BitPointers = false;
  76                 isBigEndian = true;
  77         }
  78         else if ( strcmp((char*)buffer, "dyld_v1   armv5") == 0 ) {
  79                 has64BitPointers = false;
  80                 isBigEndian = false;
  81                 startReadOnlySharedRegion  = 0x30000000LL;
  82                 endReadOnlySharedRegion    = 0x3E000000LL;
  83                 startReadWriteSharedRegion = 0x3E000000LL;
  84                 endReadWriteSharedRegion   = 0x40000000LL;
  85         }
  86         else if ( strcmp((char*)buffer, "dyld_v1   armv6") == 0 ) {
  87                 has64BitPointers = false;
  88                 isBigEndian = false;
  89                 startReadOnlySharedRegion  = 0x30000000LL;
  90                 endReadOnlySharedRegion    = 0x3E000000LL;
  91                 startReadWriteSharedRegion = 0x3E000000LL;
  92                 endReadWriteSharedRegion   = 0x40000000LL;
  93         }
  94         else if ( strcmp((char*)buffer, "dyld_v1   armv7") == 0 ) {
  95                 has64BitPointers = false;
  96                 isBigEndian = false;
  97                 startReadOnlySharedRegion  = 0x30000000LL;
  98                 endReadOnlySharedRegion    = 0x3E000000LL;
  99                 startReadWriteSharedRegion = 0x3E000000LL;
 100                 endReadWriteSharedRegion   = 0x40000000LL;
 101         }
 102         else {
 103                 (*logProc)("file %s is not a known dyld shared cache file\n", path);
 104                 close(fd);
 105                 return -1;
 106         }
 107 #if __BIG_ENDIAN__
 108         bool swap = !isBigEndian;
 109 #else
 110         bool swap = isBigEndian;
 111 #endif
 112
 113         const dyld_cache_header* header = (dyld_cache_header*)buffer;
 114         uint32_t mappingOffset = swap ? OSSwapInt32(header->mappingOffset) : header->mappingOffset;
 115         if ( mappingOffset < 0x48 ) {
 116                 (*logProc)("dyld shared cache file %s is old format\n", path);
 117                 close(fd);
 118                 return -1;
 119         }
 120
 121         uint32_t mappingCount = swap ? OSSwapInt32(header->mappingCount) : header->mappingCount;
 122         if ( mappingCount != 3 ) {
 123                 (*logProc)("dyld shared cache file %s has wrong mapping count\n", path);
 124                 close(fd);
 125                 return -1;
 126         }
 127
 128         uint64_t slidePointersOffset = swap ? OSSwapInt64(header->slidePointersOffset) : header->slidePointersOffset;
 129         uint64_t slidePointersSize = swap ? OSSwapInt64(header->slidePointersSize) : header->slidePointersSize;
 130         if ( (slidePointersOffset == 0) || (slidePointersSize == 0) ) {
 131                 (*logProc)("dyld shared cache file %s is missing slide information\n", path);
 132                 close(fd);
 133                 return -1;
 134         }
 135
 136         // read slide info
 137         void* slideInfo = malloc(slidePointersSize);
 138         if ( slideInfo == NULL ) {
 139                 (*logProc)("malloc(%llu) failed\n", slidePointersSize);
 140                 close(fd);
 141                 return -1;
 142         }
 143         int64_t amountRead = pread(fd, slideInfo, slidePointersSize, slidePointersOffset);
 144         if ( amountRead != (int64_t)slidePointersSize ) {
 145                 (*logProc)("slide info pread(fd, buf, %llu, %llu) failed\n", slidePointersSize, slidePointersOffset);
 146                 close(fd);
 147                 return -1;
 148         }
 149
 150         // read all DATA
 151         const dyld_cache_mapping_info* mappings = (dyld_cache_mapping_info*)&buffer[mappingOffset];
 152         uint64_t dataFileOffset = swap ? OSSwapInt64(mappings[1].fileOffset) : mappings[1].fileOffset;
 153         uint64_t dataSize = swap ? OSSwapInt64(mappings[1].size) : mappings[1].size;
 154         uint8_t* data = (uint8_t*)malloc(dataSize);
 155         amountRead = pread(fd, data, dataSize, dataFileOffset);
 156         if ( amountRead != (int64_t)dataSize ) {
 157                 (*logProc)("data pread(fd, buf, %llu, %llu) failed\n", data, dataSize);
 158                 close(fd);
 159                 return -1;
 160         }
 161
 162         // close read-only file
 163         close(fd);
 164
 165         // extract current slide
 166         uint64_t headerDataUses;
 167         if ( has64BitPointers ) {
 168                 headerDataUses = *((uint64_t*)data);
 169                 if ( swap )
 170                         headerDataUses = OSSwapInt64(headerDataUses);
 171         }
 172         else {
 173                 uint32_t temp = *((uint32_t*)data);
 174                 if ( swap )
 175                         temp = OSSwapInt32(temp);
 176                 headerDataUses = temp;
 177         }
 178         uint64_t textAddress = swap ? OSSwapInt64(mappings[0].address) : mappings[0].address;
 179         uint32_t currentSlide = headerDataUses - textAddress;
 180         (*logProc)("currentSlide=0x%08X\n", currentSlide);
 181
 182         // find read-only space
 183         uint64_t linkeditAddress = swap ? OSSwapInt64(mappings[2].address) : mappings[2].address;
 184         uint64_t linkeditSize = swap ? OSSwapInt64(mappings[2].size) : mappings[2].size;
 185         uint64_t linkeditEnd = linkeditAddress + linkeditSize;
 186         uint64_t roSpace = endReadOnlySharedRegion - linkeditEnd;
 187         (*logProc)("ro space=0x%08llX\n", roSpace);
 188
 189         // find read-write space
 190         uint64_t dataAddress = swap ? OSSwapInt64(mappings[1].address) : mappings[1].address;
 191         uint64_t dataEnd = dataAddress + dataSize;
 192         uint64_t rwSpace = endReadWriteSharedRegion - dataEnd;
 193         (*logProc)("rw space=0x%08llX\n", rwSpace);
 194
 195         // choose new random slide
 196         uint32_t slideSpace = rwSpace;
 197         if ( roSpace < rwSpace )
 198                 slideSpace = roSpace;
 199         uint32_t newSlide = (arc4random() % slideSpace) & (-4096);
 200         (*logProc)("newSlide=0x%08X\n", newSlide);
 201         int32_t slideAdjustment = newSlide - currentSlide;
 202
 203         // update DATA with slide info
 204         uint64_t offsetInCacheFile = 0;
 205         const uint8_t* infoStart = (uint8_t*)slideInfo;
 206         const uint8_t* infoEnd = infoStart + slidePointersSize;
 207         for(const uint8_t* p = infoStart; (*p != 0) && (p < infoEnd); ) {
 208                 uint64_t delta = 0;
 209                 uint32_t shift = 0;
 210                 bool more = true;
 211                 do {
 212                         uint8_t byte = *p++;
 213                         delta |= ((byte & 0x7F) << shift);
 214                         shift += 7;
 215                         if ( byte < 0x80 ) {
 216                                 offsetInCacheFile += delta;
 217                                 // verify in DATA range
 218                                 if ( (offsetInCacheFile < dataFileOffset) || (offsetInCacheFile > (dataFileOffset+dataSize)) ) {
 219                                         (*logProc)("pointer offset 0x%llX outside DATA range\n", offsetInCacheFile);
 220                                         return -1;
 221                                 }
 222                                 uint32_t offsetInData = offsetInCacheFile - dataFileOffset;
 223                                 if ( has64BitPointers ) {
 224                                         uint64_t value64 = *((uint64_t*)(&data[offsetInData]));
 225                                         if ( swap )
 226                                                 value64 = OSSwapInt64(value64);
 227                                         value64 += slideAdjustment;
 228                                         if ( swap )
 229                                                 value64 = OSSwapInt64(value64);
 230                                         *((uint64_t*)(&data[offsetInData])) = value64;
 231                                 }
 232                                 else {
 233                                         uint64_t value32 = *((uint32_t*)(&data[offsetInData]));
 234                                         if ( swap )
 235                                                 value32 = OSSwapInt32(value32);
 236                                         value32 += slideAdjustment;
 237                                         if ( swap )
 238                                                 value32 = OSSwapInt32(value32);
 239                                         *((uint32_t*)(&data[offsetInData])) = value32;
 240                                 }
 241                                 //(*logProc)("update pointer at offset 0x%08X", offsetInData);
 242                                 more = false;
 243                         }
 244                 } while (more);
 245         }
 246         free(slideInfo);
 247         slideInfo = NULL;
 248
 249         // re-open cache file and overwrite DATA range
 250         fd = open(path, O_RDWR, 0);
 251         if ( fd == -1 ) {
 252                 (*logProc)("open(%s) failed, errno=%d\n", path, errno);
 253                 return -1;
 254         }
 255         (void)fcntl(fd, F_NOCACHE, 1); // tell kernel to not cache file content
 256         uint64_t amountWrote = pwrite(fd, data, dataSize, dataFileOffset);
 257         if ( amountWrote != dataSize ) {
 258                 (*logProc)("data pwrite(fd, buf, %llu, %llu) failed\n", data, dataSize);
 259                 close(fd);
 260                 return -1;
 261         }
 262         close(fd);
 263
 264         // re-open and re-read to verify write
 265         fd = open(path, O_RDONLY, 0);
 266         if ( fd == -1 ) {
 267                 (*logProc)("verify open(%s) failed, errno=%d\n", path, errno);
 268                 return -1;
 269         }
 270         (void)fcntl(fd, F_NOCACHE, 1); // tell kernel to not cache file content
 271         uint8_t* dataVerify = (uint8_t*)malloc(dataSize);
 272         amountRead = pread(fd, dataVerify, dataSize, dataFileOffset);
 273         if ( amountRead != (int64_t)dataSize ) {
 274                 (*logProc)("verify data pread(fd, buf, %llu, %llu) failed\n", data, dataSize);
 275                 close(fd);
 276                 return -1;
 277         }
 278         close(fd);
 279         if ( memcmp(data, dataVerify, dataSize) != 0 ) {
 280                 (*logProc)("data update verification failed\n");
 281                 return -1;
 282         }
 283         free(data);
 284         free(dataVerify);
 285
 286
 287         // success
 288         return 0;
 289 }
 290
 291
 292 #if 0
 293 static void logger(const char* format, ...)
 294 {
 295         va_list list;
 296         va_start(list, format);
 297         fprintf(stderr, "error: ");
 298         vfprintf(stderr, format, list);
 299 }
 300
 301
 302 int main(int argc, const char* argv[])
 303 {
 304         return update_dyld_shared_cache_load_address(argv[1], logger);
 305 }
 306 #endif
 307
 308