jmpews / Dobby

a lightweight, multi-platform, multi-architecture hook framework.
Apache License 2.0
3.88k stars 794 forks source link

handle consecutive PC-relative instructions #238

Open segfault-bilibili opened 12 months ago

segfault-bilibili commented 12 months ago

Disclaimer: I'm not very familiar with C++ or armeabi-v7a architecture.

However we encountered a problem using Dobby.

We hooked a function which originally does just one simple thing: read a int32 value from hard-coded vmaddr and return it. We changed the return value in the hook to meet our demand.

However this hook turned out to fail to work correctly on armeabi-v7a architecture.

After some investigation, I realized that it's Dobby which cannot handle this situation correctly yet. Therefore I made a patch to deal with this problem.

Example1:

     ldr r0, [pc, #4]
     ldr r0, [pc, r0]  ; <- we are here
     bx lr
     dcd vmaddr_offset_relative_to_pc

Example2:

     ldr r1, [pc, #8]
     add r1, pc, r1    ; <- we are here
     str r0, [r1]
     bx lr
     dcd vmaddr_offset_relative_to_pc

The highlighted instruction adds the value of pc and vmaddr_offset_relative_to_pc. When not relocated, this worked fine. The added-up sum value is meant to be a pointer which points to a "hard-coded" memory address which stores a "globally used" variable.

However, after being relocated, pc has now changed. Now pc no longer points to the value it was originally meant to be. Therefore the added-up sum value now effectively becomes a wild pointer which points to some random place, which might lead to process crash or other malfunction.

This patch changes the highlighted instruction to make it add the original un-relocated pc instead of the current relocated pc, so that the added-up sum value is recovered to point to the originally supposed position. Thus, the problem is fixed, only in this situation which I encountered - I think it's obvious that there are other situations, but fixing them is beyond my capabilities.

segfault-bilibili commented 10 months ago

I've updated my description of this problem to just re-clarify it.