search

ddvk / remarkable2-framebuffer

remarkable2 framebuffer reversing
MIT License
279 stars 22 forks source link

Implement indirect signatures and use them for locating update_fn #62

Closed matteodelabre closed 3 years ago

matteodelabre commented 3 years ago

This PR contains an implementation for what I call “indirect signatures”, i.e., instead of searching for a byte sequence located a fixed distance away from the start of the function of interest, we search for a byte sequence next to a jump instruction that points to the function of interest. We can take advantage of this technique to find a signature for update_fn that is stable across multiple versions (I checked in 2.3, 2.5, 2.6, and 2.8).

This patch will need to be tested on multiple Xochitl versions (for each one, the thing to be tested is that Xochitl correctly displays its interface when launched with LD_PRELOAD=path/to/librm2fb_client.so.1.0.1). Currently, I only tested it on 2.8.0, and I will take care of testing more versions tomorrow.

matteodelabre commented 3 years ago

(This PR replaces #60.)

raisjn commented 3 years ago

very nice, just read through it :-D

matteodelabre commented 3 years ago

I tested the patch on several system releases and I haven’t found any issues in the latest versions. The testing steps I followed were to install the release with remarkable-update, start the rm2fb server, start xochitl with the client shim, and make sure that it finds the location of the four functions to replace.

Specifically, for versions 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0 it’s working fine. On versions 2.2.0 and 2.2.1, it fails to find create_fn. On version 2.3.0, it fails to find wait_fn. I don’t know whether the three versions that are failing were tested before, so I’m not sure if it’s a regression or not.

matteodelabre commented 3 years ago

the earliest version i see that i've tested rm2fb on is 2.3.1.27 (since i didn't get rm2 until sometime in october 2020, iirc), so i don't think it's a regression, we just never supported versions that old

Thanks for confirming this!