Menooker / PFishHook

An x64 inline hook library
Apache License 2.0
30 stars 10 forks source link

Fix issue#1 #2

Closed ghost closed 6 years ago

ghost commented 6 years ago

fix issue#1

Menooker commented 6 years ago

Thanks for your PR. However, you code won't compile on my machine. In C, struct cannot be used as type names, so maybe you should define the struct with

typedef struct {
... 
}ldtt;

Another critical problem is that your code with "modify_ldt" does not return the base address of .text segment. Instead it returns the something like the base address of the heap. I have found a possibly portable way to find the start of the text segment here.

Here is a program to check your method and the method in the link:

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
//https://stackoverflow.com/questions/4308996/finding-the-address-range-of-the-data-segment
//https://stackoverflow.com/questions/1765969/where-are-the-symbols-etext-edata-and-end-defined
//https://www.systutorials.com/docs/linux/man/3-edata/
#include<sys/syscall.h>
typedef struct {
               unsigned int  entry_number;
               unsigned long base_addr;
               unsigned int  limit;
               unsigned int  seg_32bit:1;
               unsigned int  contents:2;
               unsigned int  read_exec_only:1;
               unsigned int  limit_in_pages:1;
               unsigned int  seg_not_present:1;
               unsigned int  useable:1;
           }ldtt;

uintptr_t GetTextAddr(){
    ldtt tmp;
    syscall(SYS_modify_ldt,0,&tmp,sizeof(tmp));
    return (uintptr_t)tmp.base_addr;
}

extern char  etext, edata, end; 

int
main(int argc, char **argv)
{
    printf("First address beyond:\n");
    printf("    program text segment(etext)      %10p\n", &etext);
    printf("    initialized data segment(edata)  %10p\n", &edata);
    printf("    uninitialized data segment (end) %10p\n", &end);

    printf("Base Addr by LDT %10p\n", GetTextAddr());
    printf("Address of  Main %10p\n",&main);
    return EXIT_SUCCESS;
}

It returns

First address beyond:
    program text segment(etext)        0x40078d
    initialized data segment(edata)    0x601050
    uninitialized data segment (end)   0x601058
Base Addr by LDT 0x7f26d40537fa
Address of  Main   0x400677

The command "cat /proc/self/maps" returns:

00400000-0040c000 r-xp 00000000 08:01 262168                             /bin/cat
0060b000-0060c000 r--p 0000b000 08:01 262168                             /bin/cat
0060c000-0060d000 rw-p 0000c000 08:01 262168                             /bin/cat
008bb000-008dc000 rw-p 00000000 00:00 0                                  [heap]
7f854fc44000-7f854ff1c000 r--p 00000000 08:01 2235815                    /usr/lib/locale/locale-archive
7f854ff1c000-7f85500dc000 r-xp 00000000 08:01 1835094                    /lib/x86_64-linux-gnu/libc-2.23.so
7f85500dc000-7f85502dc000 ---p 001c0000 08:01 1835094                    /lib/x86_64-linux-gnu/libc-2.23.so
7f85502dc000-7f85502e0000 r--p 001c0000 08:01 1835094                    /lib/x86_64-linux-gnu/libc-2.23.so
7f85502e0000-7f85502e2000 rw-p 001c4000 08:01 1835094                    /lib/x86_64-linux-gnu/libc-2.23.so
7f85502e2000-7f85502e6000 rw-p 00000000 00:00 0 
7f85502e6000-7f855030c000 r-xp 00000000 08:01 1835092                    /lib/x86_64-linux-gnu/ld-2.23.so
7f85504d0000-7f85504f5000 rw-p 00000000 00:00 0 
7f855050b000-7f855050c000 r--p 00025000 08:01 1835092                    /lib/x86_64-linux-gnu/ld-2.23.so
7f855050c000-7f855050d000 rw-p 00026000 08:01 1835092                    /lib/x86_64-linux-gnu/ld-2.23.so
7f855050d000-7f855050e000 rw-p 00000000 00:00 0 
7ffc0dd2c000-7ffc0dd4d000 rw-p 00000000 00:00 0                          [stack]
7ffc0ddda000-7ffc0dddd000 r--p 00000000 00:00 0                          [vvar]
7ffc0dddd000-7ffc0dddf000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

I am not sure if I have correctly used your code.

BTW. 中秋快乐

ghost commented 6 years ago

when I use etext in the shared library,etext points to the address where my library loads.

ghost commented 6 years ago

中秋快乐!

Menooker commented 6 years ago

Cool! PR merged. Acutally it's my first bug-fix PR received! Thanks a lot!

ghost commented 6 years ago

You're welcome :D