1 | //===-- interception.h ------------------------------------------*- C++ -*-===// |
2 | // |
3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | // See https://llvm.org/LICENSE.txt for license information. |
5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | // |
7 | //===----------------------------------------------------------------------===// |
8 | // |
9 | // This file is a part of AddressSanitizer, an address sanity checker. |
10 | // |
11 | // Machinery for providing replacements/wrappers for system functions. |
12 | //===----------------------------------------------------------------------===// |
13 | |
14 | #ifndef INTERCEPTION_H |
15 | #define INTERCEPTION_H |
16 | |
17 | #include "sanitizer_common/sanitizer_asm.h" |
18 | #include "sanitizer_common/sanitizer_internal_defs.h" |
19 | |
20 | #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \ |
21 | !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \ |
22 | !SANITIZER_SOLARIS |
23 | # error "Interception doesn't work on this operating system." |
24 | #endif |
25 | |
26 | // These typedefs should be used only in the interceptor definitions to replace |
27 | // the standard system types (e.g. SSIZE_T instead of ssize_t) |
28 | typedef __sanitizer::uptr SIZE_T; |
29 | typedef __sanitizer::sptr SSIZE_T; |
30 | typedef __sanitizer::sptr PTRDIFF_T; |
31 | typedef __sanitizer::s64 INTMAX_T; |
32 | typedef __sanitizer::u64 UINTMAX_T; |
33 | typedef __sanitizer::OFF_T OFF_T; |
34 | typedef __sanitizer::OFF64_T OFF64_T; |
35 | |
36 | // How to add an interceptor: |
37 | // Suppose you need to wrap/replace system function (generally, from libc): |
38 | // int foo(const char *bar, double baz); |
39 | // You'll need to: |
40 | // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in |
41 | // your source file. See the notes below for cases when |
42 | // INTERCEPTOR_WITH_SUFFIX(...) should be used instead. |
43 | // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo". |
44 | // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was |
45 | // intercepted successfully. |
46 | // You can access original function by calling REAL(foo)(bar, baz). |
47 | // By default, REAL(foo) will be visible only inside your interceptor, and if |
48 | // you want to use it in other parts of RTL, you'll need to: |
49 | // 3a) add DECLARE_REAL(int, foo, const char*, double) to a |
50 | // header file. |
51 | // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for |
52 | // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to: |
53 | // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double) |
54 | // to a header file. |
55 | |
56 | // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or |
57 | // DECLARE_REAL(...) are located inside namespaces. |
58 | // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to |
59 | // effectively redirect calls from "foo" to "zoo". In this case |
60 | // you aren't required to implement |
61 | // INTERCEPTOR(int, foo, const char *bar, double baz) {...} |
62 | // but instead you'll have to add |
63 | // DECLARE_REAL(int, foo, const char *bar, double baz) in your |
64 | // source file (to define a pointer to overriden function). |
65 | // 3. Some Mac functions have symbol variants discriminated by |
66 | // additional suffixes, e.g. _$UNIX2003 (see |
67 | // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html |
68 | // for more details). To intercept such functions you need to use the |
69 | // INTERCEPTOR_WITH_SUFFIX(...) macro. |
70 | |
71 | // How it works on Linux |
72 | // --------------------- |
73 | // |
74 | // To replace system functions on Linux we just need to declare functions with |
75 | // the same names in our library and then obtain the real function pointers |
76 | // using dlsym(). |
77 | // |
78 | // There is one complication: a user may also intercept some of the functions we |
79 | // intercept. To allow for up to 3 interceptors (including ours) of a given |
80 | // function "func", the interceptor implementation is in ___interceptor_func, |
81 | // which is aliased by a weak function __interceptor_func, which in turn is |
82 | // aliased (via a trampoline) by weak wrapper function "func". |
83 | // |
84 | // Most user interceptors should define a foreign interceptor as follows: |
85 | // |
86 | // - provide a non-weak function "func" that performs interception; |
87 | // - if __interceptor_func exists, call it to perform the real functionality; |
88 | // - if it does not exist, figure out the real function and call it instead. |
89 | // |
90 | // In rare cases, a foreign interceptor (of another dynamic analysis runtime) |
91 | // may be defined as follows (on supported architectures): |
92 | // |
93 | // - provide a non-weak function __interceptor_func that performs interception; |
94 | // - if ___interceptor_func exists, call it to perform the real functionality; |
95 | // - if it does not exist, figure out the real function and call it instead; |
96 | // - provide a weak function "func" that is an alias to __interceptor_func. |
97 | // |
98 | // With this protocol, sanitizer interceptors, foreign user interceptors, and |
99 | // foreign interceptors of other dynamic analysis runtimes, or any combination |
100 | // thereof, may co-exist simultaneously. |
101 | // |
102 | // How it works on Mac OS |
103 | // ---------------------- |
104 | // |
105 | // This is not so on Mac OS, where the two-level namespace makes our replacement |
106 | // functions invisible to other libraries. This may be overcomed using the |
107 | // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in |
108 | // Chromium were noticed when doing so. |
109 | // |
110 | // Instead we create a dylib containing a __DATA,__interpose section that |
111 | // associates library functions with their wrappers. When this dylib is |
112 | // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the |
113 | // calls to interposed functions done through stubs to the wrapper functions. |
114 | // |
115 | // As it's decided at compile time which functions are to be intercepted on Mac, |
116 | // INTERCEPT_FUNCTION() is effectively a no-op on this system. |
117 | |
118 | #if SANITIZER_APPLE |
119 | #include <sys/cdefs.h> // For __DARWIN_ALIAS_C(). |
120 | |
121 | // Just a pair of pointers. |
122 | struct interpose_substitution { |
123 | const __sanitizer::uptr replacement; |
124 | const __sanitizer::uptr original; |
125 | }; |
126 | |
127 | // For a function foo() create a global pair of pointers { wrap_foo, foo } in |
128 | // the __DATA,__interpose section. |
129 | // As a result all the calls to foo() will be routed to wrap_foo() at runtime. |
130 | #define INTERPOSER(func_name) __attribute__((used)) \ |
131 | const interpose_substitution substitution_##func_name[] \ |
132 | __attribute__((section("__DATA, __interpose"))) = { \ |
133 | { reinterpret_cast<const uptr>(WRAP(func_name)), \ |
134 | reinterpret_cast<const uptr>(func_name) } \ |
135 | } |
136 | |
137 | // For a function foo() and a wrapper function bar() create a global pair |
138 | // of pointers { bar, foo } in the __DATA,__interpose section. |
139 | // As a result all the calls to foo() will be routed to bar() at runtime. |
140 | #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \ |
141 | const interpose_substitution substitution_##func_name[] \ |
142 | __attribute__((section("__DATA, __interpose"))) = { \ |
143 | { reinterpret_cast<const uptr>(wrapper_name), \ |
144 | reinterpret_cast<const uptr>(func_name) } \ |
145 | } |
146 | |
147 | # define WRAP(x) wrap_##x |
148 | # define TRAMPOLINE(x) WRAP(x) |
149 | # define INTERCEPTOR_ATTRIBUTE |
150 | # define DECLARE_WRAPPER(ret_type, func, ...) |
151 | |
152 | #elif SANITIZER_WINDOWS |
153 | # define WRAP(x) __asan_wrap_##x |
154 | # define TRAMPOLINE(x) WRAP(x) |
155 | # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport) |
156 | # define DECLARE_WRAPPER(ret_type, func, ...) \ |
157 | extern "C" ret_type func(__VA_ARGS__); |
158 | # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \ |
159 | extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__); |
160 | #elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS |
161 | # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) |
162 | # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT |
163 | // Weak aliases of weak aliases do not work, therefore we need to set up a |
164 | // trampoline function. The function "func" is a weak alias to the trampoline |
165 | // (so that we may check if "func" was overridden), which calls the weak |
166 | // function __interceptor_func, which in turn aliases the actual interceptor |
167 | // implementation ___interceptor_func: |
168 | // |
169 | // [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)] |
170 | // | |
171 | // +--------(tail call)-------+ |
172 | // | |
173 | // v |
174 | // [__interceptor_func: weak] --(alias)--> [WRAP(func)] |
175 | // |
176 | // We use inline assembly to define most of this, because not all compilers |
177 | // support functions with the "naked" attribute with every architecture. |
178 | # define WRAP(x) ___interceptor_ ## x |
179 | # define TRAMPOLINE(x) __interceptor_trampoline_ ## x |
180 | # if SANITIZER_FREEBSD || SANITIZER_NETBSD |
181 | // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher |
182 | // priority than weak ones so weak aliases won't work for indirect calls |
183 | // in position-independent (-fPIC / -fPIE) mode. |
184 | # define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n" |
185 | # else |
186 | # define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n" |
187 | # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD |
188 | # if defined(__arm__) || defined(__aarch64__) |
189 | # define ASM_TYPE_FUNCTION_STR "%function" |
190 | # else |
191 | # define ASM_TYPE_FUNCTION_STR "@function" |
192 | # endif |
193 | // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h |
194 | # define DECLARE_WRAPPER(ret_type, func, ...) \ |
195 | extern "C" ret_type func(__VA_ARGS__); \ |
196 | extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ |
197 | extern "C" ret_type __interceptor_##func(__VA_ARGS__) \ |
198 | INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \ |
199 | asm( \ |
200 | ".text\n" \ |
201 | __ASM_WEAK_WRAPPER(func) \ |
202 | ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ |
203 | ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ |
204 | ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ |
205 | ASM_TYPE_FUNCTION_STR "\n" \ |
206 | SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \ |
207 | C_ASM_STARTPROC "\n" \ |
208 | C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \ |
209 | "__interceptor_" \ |
210 | SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \ |
211 | C_ASM_ENDPROC "\n" \ |
212 | ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ |
213 | ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ |
214 | ); |
215 | # else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT |
216 | // Some architectures cannot implement efficient interceptor trampolines with |
217 | // just a plain jump due to complexities of resolving a preemptible symbol. In |
218 | // those cases, revert to just this scheme: |
219 | // |
220 | // [wrapper "func": weak] --(alias)--> [WRAP(func)] |
221 | // |
222 | # define WRAP(x) __interceptor_ ## x |
223 | # define TRAMPOLINE(x) WRAP(x) |
224 | # if SANITIZER_FREEBSD || SANITIZER_NETBSD |
225 | # define __ATTRIBUTE_WEAK_WRAPPER |
226 | # else |
227 | # define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak)) |
228 | # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD |
229 | # define DECLARE_WRAPPER(ret_type, func, ...) \ |
230 | extern "C" ret_type func(__VA_ARGS__) \ |
231 | INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func)); |
232 | # endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT |
233 | #endif |
234 | |
235 | #if SANITIZER_FUCHSIA |
236 | // There is no general interception at all on Fuchsia. |
237 | // Sanitizer runtimes just define functions directly to preempt them, |
238 | // and have bespoke ways to access the underlying libc functions. |
239 | # include <zircon/sanitizer.h> |
240 | # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) |
241 | # define REAL(x) __unsanitized_##x |
242 | # define DECLARE_REAL(ret_type, func, ...) |
243 | #elif !SANITIZER_APPLE |
244 | # define PTR_TO_REAL(x) real_##x |
245 | # define REAL(x) __interception::PTR_TO_REAL(x) |
246 | # define FUNC_TYPE(x) x##_type |
247 | |
248 | # define DECLARE_REAL(ret_type, func, ...) \ |
249 | typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ |
250 | namespace __interception { \ |
251 | extern FUNC_TYPE(func) PTR_TO_REAL(func); \ |
252 | } |
253 | # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src) |
254 | #else // SANITIZER_APPLE |
255 | # define REAL(x) x |
256 | # define DECLARE_REAL(ret_type, func, ...) \ |
257 | extern "C" ret_type func(__VA_ARGS__); |
258 | # define ASSIGN_REAL(x, y) |
259 | #endif // SANITIZER_APPLE |
260 | |
261 | #if !SANITIZER_FUCHSIA |
262 | # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \ |
263 | DECLARE_REAL(ret_type, func, __VA_ARGS__) \ |
264 | extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ |
265 | extern "C" ret_type WRAP(func)(__VA_ARGS__); |
266 | // Declare an interceptor and its wrapper defined in a different translation |
267 | // unit (ex. asm). |
268 | # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \ |
269 | extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ |
270 | extern "C" ret_type WRAP(func)(__VA_ARGS__); \ |
271 | extern "C" ret_type func(__VA_ARGS__); |
272 | #else |
273 | # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) |
274 | # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) |
275 | #endif |
276 | |
277 | // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR |
278 | // macros does its job. In exceptional cases you may need to call REAL(foo) |
279 | // without defining INTERCEPTOR(..., foo, ...). For example, if you override |
280 | // foo with an interceptor for other function. |
281 | #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA |
282 | # define DEFINE_REAL(ret_type, func, ...) \ |
283 | typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ |
284 | namespace __interception { \ |
285 | FUNC_TYPE(func) PTR_TO_REAL(func); \ |
286 | } |
287 | #else |
288 | # define DEFINE_REAL(ret_type, func, ...) |
289 | #endif |
290 | |
291 | #if SANITIZER_FUCHSIA |
292 | |
293 | // We need to define the __interceptor_func name just to get |
294 | // sanitizer_common/scripts/gen_dynamic_list.py to export func. |
295 | // But we don't need to export __interceptor_func to get that. |
296 | #define INTERCEPTOR(ret_type, func, ...) \ |
297 | extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \ |
298 | __interceptor_##func(__VA_ARGS__); \ |
299 | extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__) |
300 | |
301 | #elif !SANITIZER_APPLE |
302 | |
303 | #define INTERCEPTOR(ret_type, func, ...) \ |
304 | DEFINE_REAL(ret_type, func, __VA_ARGS__) \ |
305 | DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \ |
306 | extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) |
307 | |
308 | // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now. |
309 | #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ |
310 | INTERCEPTOR(ret_type, func, __VA_ARGS__) |
311 | |
312 | #else // SANITIZER_APPLE |
313 | |
314 | #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \ |
315 | extern "C" ret_type func(__VA_ARGS__) suffix; \ |
316 | extern "C" ret_type WRAP(func)(__VA_ARGS__); \ |
317 | INTERPOSER(func); \ |
318 | extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) |
319 | |
320 | #define INTERCEPTOR(ret_type, func, ...) \ |
321 | INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__) |
322 | |
323 | #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ |
324 | INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__) |
325 | |
326 | // Override |overridee| with |overrider|. |
327 | #define OVERRIDE_FUNCTION(overridee, overrider) \ |
328 | INTERPOSER_2(overridee, WRAP(overrider)) |
329 | #endif |
330 | |
331 | #if SANITIZER_WINDOWS |
332 | # define INTERCEPTOR_WINAPI(ret_type, func, ...) \ |
333 | typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \ |
334 | namespace __interception { \ |
335 | FUNC_TYPE(func) PTR_TO_REAL(func); \ |
336 | } \ |
337 | extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__) |
338 | #endif |
339 | |
340 | // ISO C++ forbids casting between pointer-to-function and pointer-to-object, |
341 | // so we use casting via an integral type __interception::uptr, |
342 | // assuming that system is POSIX-compliant. Using other hacks seem |
343 | // challenging, as we don't even pass function type to |
344 | // INTERCEPT_FUNCTION macro, only its name. |
345 | namespace __interception { |
346 | #if defined(_WIN64) |
347 | typedef unsigned long long uptr; |
348 | #else |
349 | typedef unsigned long uptr; |
350 | #endif // _WIN64 |
351 | |
352 | #if defined(__ELF__) && !SANITIZER_FUCHSIA |
353 | // The use of interceptors makes many sanitizers unusable for static linking. |
354 | // Define a function, if called, will cause a linker error (undefined _DYNAMIC). |
355 | // However, -static-pie (which is not common) cannot be detected at link time. |
356 | extern uptr kDynamic[] asm("_DYNAMIC" ); |
357 | inline void DoesNotSupportStaticLinking() { |
358 | [[maybe_unused]] volatile auto x = &kDynamic; |
359 | } |
360 | #else |
361 | inline void DoesNotSupportStaticLinking() {} |
362 | #endif |
363 | } // namespace __interception |
364 | |
365 | #define INCLUDED_FROM_INTERCEPTION_LIB |
366 | |
367 | #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \ |
368 | SANITIZER_SOLARIS |
369 | |
370 | # include "interception_linux.h" |
371 | # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func) |
372 | # define INTERCEPT_FUNCTION_VER(func, symver) \ |
373 | INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) |
374 | #elif SANITIZER_APPLE |
375 | # include "interception_mac.h" |
376 | # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func) |
377 | # define INTERCEPT_FUNCTION_VER(func, symver) \ |
378 | INTERCEPT_FUNCTION_VER_MAC(func, symver) |
379 | #elif SANITIZER_WINDOWS |
380 | # include "interception_win.h" |
381 | # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func) |
382 | # define INTERCEPT_FUNCTION_VER(func, symver) \ |
383 | INTERCEPT_FUNCTION_VER_WIN(func, symver) |
384 | #endif |
385 | |
386 | #undef INCLUDED_FROM_INTERCEPTION_LIB |
387 | |
388 | #endif // INTERCEPTION_H |
389 | |