-//
-// For some reason the kernel loads dyld with __TEXT and __LINKEDIT writable
-// rdar://problem/3702311
-//
-static void segmentProtectDyld(const struct macho_header* mh, intptr_t slide)
-{
- const uint32_t cmd_count = mh->ncmds;
- const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
- const struct load_command* cmd = cmds;
- for (uint32_t i = 0; i < cmd_count; ++i) {
- switch (cmd->cmd) {
- case LC_SEGMENT_COMMAND:
- {
- const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
- vm_address_t addr = seg->vmaddr + slide;
- vm_size_t size = seg->vmsize;
- const bool setCurrentPermissions = false;
- vm_protect(mach_task_self(), addr, size, setCurrentPermissions, seg->initprot);
- //dyld::log("dyld: segment %s, 0x%08X -> 0x%08X, set to %d\n", seg->segname, addr, addr+size-1, seg->initprot);
- }
- break;
- }
- cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
- }
-
-}
-
-
-//
-// re-map the main executable to a new random address
-//
-static const struct mach_header* randomizeExecutableLoadAddress(const struct mach_header* orgMH, uintptr_t* appsSlide)
-{
-#if __ppc__
- // don't slide PIE programs running under rosetta
- if ( dyld::isRosetta() )
- return orgMH;
-#endif
- // count segments
- uint32_t segCount = 0;
- const uint32_t cmd_count = orgMH->ncmds;
- const struct load_command* const cmds = (struct load_command*)(((char*)orgMH)+sizeof(macho_header));
- const struct load_command* cmd = cmds;
- for (uint32_t i = 0; i < cmd_count; ++i) {
- if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
- const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd;
- // page-zero and custom stacks don't move
- if ( (strcmp(segCmd->segname, "__PAGEZERO") != 0) && (strcmp(segCmd->segname, "__UNIXSTACK") != 0) )
- ++segCount;
- }
- cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
- }
-
- // make copy of segment info
- macho_segment_command segs[segCount];
- uint32_t index = 0;
- uintptr_t highestAddressUsed = 0;
- uintptr_t lowestAddressUsed = UINTPTR_MAX;
- cmd = cmds;
- for (uint32_t i = 0; i < cmd_count; ++i) {
- if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
- const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd;
- if ( (strcmp(segCmd->segname, "__PAGEZERO") != 0) && (strcmp(segCmd->segname, "__UNIXSTACK") != 0) ) {
- segs[index++] = *segCmd;
- if ( (segCmd->vmaddr + segCmd->vmsize) > highestAddressUsed )
- highestAddressUsed = ((segCmd->vmaddr + segCmd->vmsize) + 4095) & -4096;
- if ( segCmd->vmaddr < lowestAddressUsed )
- lowestAddressUsed = segCmd->vmaddr;
- // do nothing if kernel has already randomized load address
- if ( (strcmp(segCmd->segname, "__TEXT") == 0) && (segCmd->vmaddr != (uintptr_t)orgMH) )
- return orgMH;
- }
- }
- cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
- }
-
- // choose a random new base address
-#if __LP64__
- uintptr_t highestAddressPossible = highestAddressUsed + 0x100000000ULL;
-#else
- uintptr_t highestAddressPossible = 0x80000000;
-#endif
- uintptr_t sizeNeeded = highestAddressUsed-lowestAddressUsed;
- if ( (highestAddressPossible-sizeNeeded) < highestAddressUsed ) {
- // new and old segments will overlap
- // need better algorithm for remapping
- // punt and don't re-map
- return orgMH;
- }
- uintptr_t possibleRange = (highestAddressPossible-sizeNeeded) - highestAddressUsed;
- uintptr_t newBaseAddress = highestAddressUsed + ((arc4random() % possibleRange) & -4096);
-
- vm_address_t addr = newBaseAddress;
- // reserve new address range
- if ( vm_allocate(mach_task_self(), &addr, sizeNeeded, VM_FLAGS_FIXED) == KERN_SUCCESS ) {
- // copy each segment to new address
- for (uint32_t i = 0; i < segCount; ++i) {
- uintptr_t newSegAddress = segs[i].vmaddr - lowestAddressUsed + newBaseAddress;
- if ( (vm_copy(mach_task_self(), segs[i].vmaddr, segs[i].vmsize, newSegAddress) != KERN_SUCCESS)
- || (vm_protect(mach_task_self(), newSegAddress, segs[i].vmsize, true, segs[i].maxprot) != KERN_SUCCESS)
- || (vm_protect(mach_task_self(), newSegAddress, segs[i].vmsize, false, segs[i].initprot) != KERN_SUCCESS) ) {
- // can't copy so dealloc new region and run with original base address
- vm_deallocate(mach_task_self(), newBaseAddress, sizeNeeded);
- dyld::warn("could not relocate position independent exectable\n");
- return orgMH;
- }
- }
- // unmap original segments
- vm_deallocate(mach_task_self(), lowestAddressUsed, highestAddressUsed-lowestAddressUsed);
-
- // run with newly mapped executable
- *appsSlide = newBaseAddress - lowestAddressUsed;
- return (const struct mach_header*)newBaseAddress;
- }
-
- // can't get new range, so don't slide to random address
- return orgMH;
-}
-
-
-extern "C" void dyld_exceptions_init(const struct macho_header*, uintptr_t slide); // in dyldExceptions.cpp
projects / apple / dyld.git / blobdiff