Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IP Relative data instruction fail to relocate #14

Closed
stevemk14ebr opened this issue Dec 7, 2018 · 2 comments
Closed

IP Relative data instruction fail to relocate #14

stevemk14ebr opened this issue Dec 7, 2018 · 2 comments

Comments

@stevemk14ebr
Copy link
Owner

stevemk14ebr commented Dec 7, 2018

Some IP relative data instructions (non control flow modifying) fail to have their offset adjusted. Noticed this in x64 SIMD register accesses. Needs fixed, or at least should fail gracefully.

[+] Info: Prologue to overwrite:
7ff643d0f2c0 [3]: 0f 57 d2                      xorps xmm2, xmm2
7ff643d0f2c3 [7]: 48 8d 0d 96 79 07 00          lea rcx, [rip + 0x77996] -> 7ff643d86c60
7ff643d0f2ca [4]: f3 0f 5a d0                   cvtss2sd xmm2, xmm0
7ff643d0f2ce [8]: f3 0f 58 05 ea 61 07 00       addss xmm0, dword ptr [rip + 0x761ea] -> 7ff643d854c0

[+] Info: Trampoline:
1877c6f9910 [3]: 0f 57 d2                      xorps xmm2, xmm2
1877c6f9913 [7]: 48 8d 0d 96 79 07 00          lea rcx, [rip + 0x77996] -> 1877c7712b0
1877c6f991a [4]: f3 0f 5a d0                   cvtss2sd xmm2, xmm0
1877c6f991e [8]: f3 0f 58 05 ea 61 07 00       addss xmm0, dword ptr [rip + 0x761ea] -> 1877c76fb10
1877c6f9926 [6]: ff 25 46 00 00 00             jmp qword ptr [rip + 0x46] -> 1877c6f9972
@stevemk14ebr
Copy link
Owner Author

Resolved, full fix requires jit-ing

3e30a04

@stevemk14ebr
Copy link
Owner Author

Final fix in master: 28aa975
This is a compromise for now. If the instruction's displacement width fits then we write it in, but we can actually relocate farther than some instructions can encode. So for that case we emit an error and fail.

The full solution is to JIT an equivalent snippet to load the data in the farther region. This is complex in the general case so we'll leave that to the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant