srg-imperial / SaBRe

Load-time selective binary rewriting
Other
152 stars 16 forks source link

Use xmm0 to pass context to post_clone_hook #88

Closed RiscInside closed 2 years ago

RiscInside commented 2 years ago

This PR modifies clone_syscall and clone3_syscall signatures to accept context argument (one void *). This context argument can then be accessed from the post clone hook.

The implementation uses xmm0 as a vehicle to pass the context argument to the child. The assumption is that it's unlikely libc clone() wrappers or other clone() users will depend on the value of xmm0 in the child thread. xmm0 value is set to NaN (ff bit pattern) after post_clone_hook exits, which should allow us to catch some instances of that not being the case.

Parent can use xmm0 freely, as we save its value on clone_syscall /clone3_syscall function entry.

Note that this PR does not make SaBRe any less stable. For example, if the client depends on the rbx value in the child, it will get corrupted, as exit path for clone_syscall bypasses normal register restore procedure, so the assumption that the child will just call the callback and do nothing else is already there.

RiscInside commented 2 years ago

CI fail was caused by me doing +16(%rbp) (as opposed to 16(%rbp)). This worked with my toolchain, but not with the one on CI. Fixed now

andronat commented 2 years ago

Excellent! Fix those nits and we merge it asap 😎

RiscInside commented 2 years ago

@andronat should be fixed now