HexHive / retrowrite

RetroWrite -- Retrofitting compiler passes through binary rewriting
Other
655 stars 78 forks source link

Improve Jump Table Symbolization Algorithm #36

Open witbring opened 2 years ago

witbring commented 2 years ago

I observed that RetroWrite missed some jump table entries when they refers to the function boundary. The following assembly code that gcc-9 compiler emitted represents the error case. Since the second jump table entry refers to label .LBB38_624, which was defined at the function boundary, RetroWrite misses 6 jump table entries.

get_machine_flags:
    # ...
    leaq    .LJTI38_6(%rip), %rax
    movslq  (%rax,%r15,4), %rcx
    addq    %rax, %rcx
    jmpq    *%rcx
    # ...
    jmp .LBB38_535        #end of get_machine_flags
.LBB38_624:
    .cfi_endproc

.LJTI38_6:
    .long   .LBB38_47-.LJTI38_6
    .long   .LBB38_624-.LJTI38_6  # Miss
    .long   .LBB38_355-.LJTI38_6  # Miss
    .long   .LBB38_624-.LJTI38_6  # Miss
    .long   .LBB38_360-.LJTI38_6  # Miss
    .long   .LBB38_624-.LJTI38_6  # Miss
    .long   .LBB38_353-.LJTI38_6  # Miss

I added is_located_at_the_end_of_function() method to check function boundary and define additional label to symbolize jump table entry. Also, I revised symbolize_switch_tables() method to resolve the error.