Teach memray to patch libraries that are part of the macOS linker cache #401
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pablogsal
force-pushed
the
upterm
branch
2 times, most recently
from
77eb601
to
e961828
Compare
Codecov ReportPatch coverage has no change and project coverage change:
Additional details and impacted files@@ Coverage Diff @@
## main #401 +/- ##
==========================================
- Coverage 85.00% 84.94% -0.06%
==========================================
Files 29 29
Lines 3621 3621
==========================================
- Hits 3078 3076 -2
- Misses 543 545 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
pablogsal
force-pushed
the
upterm
branch
9 times, most recently
from
b184793
to
cb6a9ea
Compare
pablogsal
changed the title
pablogsal
force-pushed
the
upterm
branch
2 times, most recently
from
23d7a19
to
b7ff4bf
Compare
godlygeek
reviewed
Jun 16, 2023
Comment on lines
72
to
87
| // Constants for ARM64 architecture | ||
| constexpr uint32_t ADRP_MASK = 0x9F000000; | ||
| constexpr uint32_t ADRP_INSTRUCTION = 0x90000000; | ||
| constexpr uint32_t ADRP_ARG_MASK1 = 0x00FFFFE0; | ||
| constexpr uint32_t ADRP_ARG_SHIFT1 = 3; | ||
| constexpr uint32_t ADRP_ARG_MASK2 = 0x60000000; | ||
| constexpr uint32_t ADRP_ARG_SHIFT2 = 29; | ||
| constexpr uint32_t ADRP_ARG_NEGATIVE = 0x00800000; | ||
| constexpr int32_t ADRP_ARG_SIGN_EXTEND = 0xFFF00000; | ||
| constexpr uint32_t ADD_INSTRUCTION_MASK = 0xDFC00000; | ||
| constexpr uint32_t ADD_INSTRUCTION = 0x91000000; | ||
| constexpr uint32_t ADD_ARG_MASK = 0x00000FFF; | ||
|
|
||
| // Constants for x86_64 architecture | ||
| constexpr uint32_t JMP_INSTRUCTION = 0x25ff; | ||
| constexpr size_t X86_64_PLT_ENTRY_SIZE = 6; |
There was a problem hiding this comment.
Personally, I don't find these named constants particularly helpful. Each one is used in only a single function, their names are super arbitrary (ADRP_ARG_SHIFT2 is a terrible name), and having to jump around in the code to reference them makes it harder to understand this code than it would be if you could just see the constants' values at the point where they're used.
I've taken a swing at making this code more readable - as readable as possible, at least. I also made sort of a lot of changes, considering that I can't easily test this myself - sorry 😅
I believe I've left all of the implementation the same, and just rearranged and renamed things to make what's happening clearer for future readers, but I'll need you to check my work.
godlygeek
approved these changes
Jun 16, 2023
Since macOS Ventura there have been changes in the way symbols are included in libraries in the shared linker cache. Specifically, the symbols that we care about are now stored in a Procedure Linkage Table (PLT) that does't have an associated GOT in a separate DATA segment that can be easily read. To understand this change, let's first explain the purpose of the PLT and the GOT. In dynamic linking, the PLT is a data structure used to handle the resolution of function calls to external symbols. It contains a sequence of instructions that redirect the control flow to the appropriate symbol implementation. The PLT acts as a dynamic dispatch table, allowing the resolution of symbols at runtime. On the other hand, the GOT is a data structure used for position-independent code. It stores addresses of external symbols that are referenced by the shared object. The addresses in the GOT are initially set to point to stub functions, which are small pieces of code responsible for resolving the actual addresses of the symbols during runtime. When a function is called, the stub code in the PLT is executed, looks for the address in the GOT and redirects the control flow to it. In previous versions of macOS, the symbols of interest were stored in a GOT that resided in a separate DATA segment that could be easily read and modified. This allowed us to know immediately where to patch by reading the metadata in the relevant DATA section. However, starting from macOS Ventura, the symbols of interest are no longer stored in a GOT that we can easily locate by reading DATA segments. This commit adds functionality to patch symbols in the __stubs/__auth_stubs PLT section of shared libraries that are part of the shared cache. This is necessary because the symbols in this section point to a Global Offset Table (GOT) that cannot be accessed directly through data sections. The commit implements the logic to analyze the assembly code of the PLT stubs and calculate the address of the GOT entry. The patching process is performed for each hooked function in the section, applying the necessary modifications to redirect the symbols to the corresponding hook functions. This allows for proper interception and manipulation of the function calls in system libraries (like the C++ standard template library) that are part of the linker shared cache. Signed-off-by: Pablo Galindo <pablogsal@gmail.com>
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.