X-Git-Url: https://git.saurik.com/apple/dyld.git/blobdiff_plain/2fd3f4e8fd2c2f2c7d149fbea471d8b3fb56f15a..ba4c3badc27ea8c4637b4e91a49725742a02a53c:/src/dyldInitialization.cpp diff --git a/src/dyldInitialization.cpp b/src/dyldInitialization.cpp index 7957c0c..e58d08e 100644 --- a/src/dyldInitialization.cpp +++ b/src/dyldInitialization.cpp @@ -67,6 +67,23 @@ extern void syncProcessInfo(); #define POINTER_RELOC GENERIC_RELOC_VANILLA #endif +#ifndef BIND_OPCODE_THREADED +#define BIND_OPCODE_THREADED 0xD0 +#endif + +#ifndef BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB +#define BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB 0x00 +#endif + +#ifndef BIND_SUBOPCODE_THREADED_APPLY +#define BIND_SUBOPCODE_THREADED_APPLY 0x01 +#endif + + +#if __has_feature(ptrauth_calls) +#include +#endif + #if TARGET_IPHONE_SIMULATOR const dyld::SyscallHelpers* gSyscallHelpers = NULL; @@ -115,7 +132,7 @@ static uintptr_t slideOfMainExecutable(const struct macho_header* mh) for (uint32_t i = 0; i < cmd_count; ++i) { if ( cmd->cmd == LC_SEGMENT_COMMAND ) { const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd; - if ( strcmp(segCmd->segname, "__TEXT") == 0 ) { + if ( (segCmd->fileoff == 0) && (segCmd->filesize != 0)) { return (uintptr_t)mh - segCmd->vmaddr; } } @@ -124,6 +141,43 @@ static uintptr_t slideOfMainExecutable(const struct macho_header* mh) return 0; } +inline uint64_t read_uleb128(const uint8_t*& p, const uint8_t* end) { + uint64_t result = 0; + int bit = 0; + do { + if (p == end) + throw "malformed uleb128 extends beyond trie"; + uint64_t slice = *p & 0x7f; + + if (bit >= 64 || slice << bit >> bit != slice) + throw "uleb128 too big for 64-bits"; + else { + result |= (slice << bit); + bit += 7; + } + } + while (*p++ & 0x80); + return result; +} + +inline int64_t read_sleb128(const uint8_t*& p, const uint8_t* end) +{ + int64_t result = 0; + int bit = 0; + uint8_t byte; + do { + if (p == end) + throw "malformed sleb128"; + byte = *p++; + result |= (((int64_t)(byte & 0x7f)) << bit); + bit += 7; + } while (byte & 0x80); + // sign extend negative numbers + if ( (byte & 0x40) != 0 ) + result |= (~0ULL) << bit; + return result; +} + // // If the kernel does not load dyld at its preferred address, we need to apply @@ -136,7 +190,215 @@ static void rebaseDyld(const struct macho_header* mh, intptr_t slide) const uint32_t cmd_count = mh->ncmds; const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header)); const struct load_command* cmd = cmds; - const struct macho_segment_command* linkEditSeg = NULL; + + // First look for compressed info and use it if it exists. + const struct macho_segment_command* linkEditSeg = NULL; + const dyld_info_command* dyldInfoCmd = NULL; + for (uint32_t i = 0; i < cmd_count; ++i) { + switch (cmd->cmd) { + case LC_SEGMENT_COMMAND: + { + const struct macho_segment_command* seg = (struct macho_segment_command*)cmd; + if ( strcmp(seg->segname, "__LINKEDIT") == 0 ) + linkEditSeg = seg; + break; + } + case LC_DYLD_INFO_ONLY: + dyldInfoCmd = (struct dyld_info_command*)cmd; + break; + } + if (dyldInfoCmd && linkEditSeg) + break; + cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize); + } + if ( linkEditSeg == NULL ) + throw "dyld missing LINKEDIT"; + + // Reset the iterator. + cmd = cmds; + + auto getSegmentAtIndex = [cmd_count, cmds](unsigned segIndex) -> const struct macho_segment_command* { + const struct load_command* cmd = cmds; + for (uint32_t i = 0; i < cmd_count; ++i) { + switch (cmd->cmd) { + case LC_SEGMENT_COMMAND: + if (!segIndex) { + const struct macho_segment_command* seg = (struct macho_segment_command*)cmd; + return seg; + } + --segIndex; + break; + } + cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize); + } + throw "out of bounds command"; + return 0; + }; + + auto segActualLoadAddress = [&](unsigned segIndex) -> uintptr_t { + const struct macho_segment_command* seg = getSegmentAtIndex(segIndex); + return seg->vmaddr + slide; + }; + +#if __has_feature(ptrauth_calls) + auto imageBaseAddress = [cmds, cmd_count]() -> uintptr_t { + const struct load_command* cmd = cmds; + for (uint32_t i = 0; i < cmd_count; ++i) { + switch (cmd->cmd) { + case LC_SEGMENT_COMMAND: { + const struct macho_segment_command* seg = (struct macho_segment_command*)cmd; + if ( (seg->fileoff == 0) && (seg->filesize != 0) ) + return seg->vmaddr; + break; + } + } + cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize); + } + return 0; + }; +#endif + + if (dyldInfoCmd && (dyldInfoCmd->bind_size != 0) ) { + if ( dyldInfoCmd->rebase_size != 0 ) + throw "unthreaded rebases are not supported"; + + const uint8_t* linkEditBase = (uint8_t*)(linkEditSeg->vmaddr + slide - linkEditSeg->fileoff); + + const uint8_t* const start = linkEditBase + dyldInfoCmd->bind_off; + const uint8_t* const end = &start[dyldInfoCmd->bind_size]; + const uint8_t* p = start; + + uintptr_t segmentStartAddress = 0; + uint64_t segOffset = 0; + int segIndex = 0; +#if __has_feature(ptrauth_calls) + uintptr_t fBaseAddress = imageBaseAddress(); +#endif + bool done = false; + + while ( !done && (p < end) ) { + uint8_t immediate = *p & BIND_IMMEDIATE_MASK; + uint8_t opcode = *p & BIND_OPCODE_MASK; + ++p; + switch (opcode) { + case BIND_OPCODE_DONE: + done = true; + break; + case BIND_OPCODE_SET_DYLIB_ORDINAL_IMM: + break; + case BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB: + break; + case BIND_OPCODE_SET_DYLIB_SPECIAL_IMM: + break; + case BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM: + while (*p != '\0') + ++p; + ++p; + break; + case BIND_OPCODE_SET_TYPE_IMM: + break; + case BIND_OPCODE_SET_ADDEND_SLEB: + read_sleb128(p, end); + break; + case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB: + segIndex = immediate; + segmentStartAddress = segActualLoadAddress(segIndex); + segOffset = read_uleb128(p, end); + break; + case BIND_OPCODE_ADD_ADDR_ULEB: + segOffset += read_uleb128(p, end); + break; + case BIND_OPCODE_DO_BIND: + break; + case BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB: + break; + case BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED: + break; + case BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB: + read_uleb128(p, end); + read_uleb128(p, end); + break; + case BIND_OPCODE_THREADED: + // Note the immediate is a sub opcode + switch (immediate) { + case BIND_SUBOPCODE_THREADED_SET_BIND_ORDINAL_TABLE_SIZE_ULEB: + read_uleb128(p, end); + break; + case BIND_SUBOPCODE_THREADED_APPLY: { + uint64_t delta = 0; + do { + uintptr_t address = segmentStartAddress + (uintptr_t)segOffset; + uint64_t value = *(uint64_t*)address; + +#if __has_feature(ptrauth_calls) + uint16_t diversity = (uint16_t)(value >> 32); + bool hasAddressDiversity = (value & (1ULL << 48)) != 0; + ptrauth_key key = (ptrauth_key)((value >> 49) & 0x3); + bool isAuthenticated = (value & (1ULL << 63)) != 0; +#endif + bool isRebase = (value & (1ULL << 62)) == 0; + if (isRebase) { + +#if __has_feature(ptrauth_calls) + if (isAuthenticated) { + // The new value for a rebase is the low 32-bits of the threaded value plus the slide. + uint64_t newValue = (value & 0xFFFFFFFF) + slide; + // Add in the offset from the mach_header + newValue += fBaseAddress; + // We have bits to merge in to the discriminator + uintptr_t discriminator = diversity; + if (hasAddressDiversity) { + // First calculate a new discriminator using the address of where we are trying to store the value + discriminator = __builtin_ptrauth_blend_discriminator((void*)address, discriminator); + } + switch (key) { + case ptrauth_key_asia: + newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asia, discriminator); + break; + case ptrauth_key_asib: + newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asib, discriminator); + break; + case ptrauth_key_asda: + newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asda, discriminator); + break; + case ptrauth_key_asdb: + newValue = (uintptr_t)__builtin_ptrauth_sign_unauthenticated((void*)newValue, ptrauth_key_asdb, discriminator); + break; + } + *(uint64_t*)address = newValue; + } else +#endif + { + // Regular pointer which needs to fit in 51-bits of value. + // C++ RTTI uses the top bit, so we'll allow the whole top-byte + // and the signed-extended bottom 43-bits to be fit in to 51-bits. + uint64_t top8Bits = value & 0x0007F80000000000ULL; + uint64_t bottom43Bits = value & 0x000007FFFFFFFFFFULL; + uint64_t targetValue = ( top8Bits << 13 ) | (((intptr_t)(bottom43Bits << 21) >> 21) & 0x00FFFFFFFFFFFFFF); + targetValue = targetValue + slide; + *(uint64_t*)address = targetValue; + } + } + + // The delta is bits [51..61] + // And bit 62 is to tell us if we are a rebase (0) or bind (1) + value &= ~(1ULL << 62); + delta = ( value & 0x3FF8000000000000 ) >> 51; + segOffset += delta * sizeof(uintptr_t); + } while ( delta != 0 ); + break; + } + default: + throw "unknown threaded bind subopcode"; + } + break; + default: + throw "unknown bind opcode"; + } + } + return; + } + #if __x86_64__ const struct macho_segment_command* firstWritableSeg = NULL; #endif @@ -146,15 +408,13 @@ static void rebaseDyld(const struct macho_header* mh, intptr_t slide) case LC_SEGMENT_COMMAND: { const struct macho_segment_command* seg = (struct macho_segment_command*)cmd; - if ( strcmp(seg->segname, "__LINKEDIT") == 0 ) - linkEditSeg = seg; const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command)); const struct macho_section* const sectionsEnd = §ionsStart[seg->nsects]; for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) { const uint8_t type = sect->flags & SECTION_TYPE; if ( type == S_NON_LAZY_SYMBOL_POINTERS ) { // rebase non-lazy pointers (which all point internal to dyld, since dyld uses no shared libraries) - const uint32_t pointerCount = sect->size / sizeof(uintptr_t); + const uint32_t pointerCount = (uint32_t)(sect->size / sizeof(uintptr_t)); uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + slide); for (uint32_t j=0; j < pointerCount; ++j) { symbolPointers[j] += slide; @@ -176,6 +436,8 @@ static void rebaseDyld(const struct macho_header* mh, intptr_t slide) // use reloc's to rebase all random data pointers #if __x86_64__ + if ( firstWritableSeg == NULL ) + throw "no writable segment in dyld"; const uintptr_t relocBase = firstWritableSeg->vmaddr + slide; #else const uintptr_t relocBase = (uintptr_t)mh; @@ -209,9 +471,14 @@ uintptr_t start(const struct macho_header* appsMachHeader, int argc, const char* { // if kernel had to slide dyld, we need to fix up load sensitive locations // we have to do this before using any global variables - if ( slide != 0 ) { - rebaseDyld(dyldsMachHeader, slide); - } + slide = slideOfMainExecutable(dyldsMachHeader); + bool shouldRebase = slide != 0; +#if __has_feature(ptrauth_calls) + shouldRebase = true; +#endif + if ( shouldRebase ) { + rebaseDyld(dyldsMachHeader, slide); + } // allow dyld to use mach messaging mach_init();