Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

handle consecutive PC-relative instructions #238

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

segfault-bilibili
Copy link

@segfault-bilibili segfault-bilibili commented Jul 7, 2023

Disclaimer: I'm not very familiar with C++ or armeabi-v7a architecture.

However we encountered a problem using Dobby.

We hooked a function which originally does just one simple thing: read a int32 value from hard-coded vmaddr and return it. We changed the return value in the hook to meet our demand.

However this hook turned out to fail to work correctly on armeabi-v7a architecture.

After some investigation, I realized that it's Dobby which cannot handle this situation correctly yet. Therefore I made a patch to deal with this problem.

Example1:

     ldr r0, [pc, #4]
     ldr r0, [pc, r0]  ; <- we are here
     bx lr
     dcd vmaddr_offset_relative_to_pc

Example2:

     ldr r1, [pc, #8]
     add r1, pc, r1    ; <- we are here
     str r0, [r1]
     bx lr
     dcd vmaddr_offset_relative_to_pc

The highlighted instruction adds the value of pc and vmaddr_offset_relative_to_pc. When not relocated, this worked fine. The added-up sum value is meant to be a pointer which points to a "hard-coded" memory address which stores a "globally used" variable.

However, after being relocated, pc has now changed. Now pc no longer points to the value it was originally meant to be. Therefore the added-up sum value now effectively becomes a wild pointer which points to some random place, which might lead to process crash or other malfunction.

This patch changes the highlighted instruction to make it add the original un-relocated pc instead of the current relocated pc, so that the added-up sum value is recovered to point to the originally supposed position. Thus, the problem is fixed, only in this situation which I encountered - I think it's obvious that there are other situations, but fixing them is beyond my capabilities.

@segfault-bilibili segfault-bilibili force-pushed the 20230706-fix-consecutive-ldr-upstream branch from b26ac41 to 4dc03d8 Compare July 9, 2023 09:10
@segfault-bilibili segfault-bilibili force-pushed the 20230706-fix-consecutive-ldr-upstream branch from 4dc03d8 to f574bc1 Compare July 11, 2023 12:19
change Rn to something else than pc, fill it with value of origin pc

example1:
     ldr r0, [pc, jmpews#4]
     ldr r0, [pc, r0]  ; <- we are here
     bx lr
     dcd vmaddr_offset_relative_to_pc

example2:
     ldr r1, [pc, jmpews#8]
     add r1, pc, r1    ; <- we are here
     str r0, [r1]
     bx lr
     dcd vmaddr_offset_relative_to_pc
@segfault-bilibili
Copy link
Author

I've updated my description of this problem to just re-clarify it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant