search

advanced-microcode-patching / shiva

A custom ELF linker/loader for installing ET_REL binary patches at runtime
Other
146 stars 13 forks source link

Build the Shiva function splicing transformation technology #5

Closed elfmaster closed 1 year ago

elfmaster commented 1 year ago

STATUS: Nearly complete. Currently we are able to splice code into existing functions. This requires the following operation:

  1. Copy first half (Up until patch insertion offset) of function that is being transformed, into a new memory location.

  2. Copy the relocatable patch code into place at the patch offset.

  3. Copy the remaining code from the original function down into the third half of our new function.

  4. Local branch instructions (i.e. jmp's) that branch to offsets before or after the patch-code must be re-linked to account for the patch insertion.

  5. Branch-with-link instructions must be re-linked to account for the new memory location of the callee function, thus changing the offset to call another function.

  6. Adrp/add: The adrp offset must be updated to reflect the new page offset to the global variable segment (i.e. data segment). In the event that it's referencing a .text encoded data field, we may need to update the offset to the add instruction too.

  7. Eventually the apply_relocation() function is called and the relocatable code that was spliced into the function is properly relocated. The Shiva linker computes the transform offsets with the relocation offsets to solve the transformation.

So far all of the above are done except for items 6, and 7. Working on them now.

elfmaster commented 1 year ago

Transformations v1 is complete. Currently we can only splice one function in a given patch. We cannot splice more than one time into a function.