MCPcopy Create free account
hub / github.com/GJDuck/e9patch / e9handler

Function e9handler

src/e9patch/e9loader_elf.cpp:215–285  ·  view source on GitHub ↗

* Signal handler. */

Source from the content-addressed store, hash-verified

213 * Signal handler.
214 */
215void e9handler(int sig, siginfo_t *info, ucontext_t *ctx,
216 const e9_config_s *config)
217{
218 mcontext_t *mctx = &ctx->uc_mcontext;
219 const uint8_t *loader_base = (const uint8_t *)config;
220 const uint8_t *elf_base = loader_base - config->base;
221 const struct e9_trap_s *traps =
222 (const struct e9_trap_s *)(loader_base + config->traps);
223 const uint8_t *rip = (const uint8_t *)mctx->gregs[REG_RIP];
224 int64_t idx = -1;
225 if (rip >= elf_base && rip <= loader_base)
226 {
227 int64_t lo = 0, hi = config->num_traps;
228 intptr_t key = rip - elf_base;
229 while (lo <= hi)
230 {
231 int64_t mid = (lo + hi) / 2;
232 if (key < traps[mid].rip)
233 hi = mid - 1;
234 else if (key > traps[mid].rip)
235 lo = mid + 1;
236 else
237 {
238 idx = mid;
239 break;
240 }
241 }
242 }
243 const uint8_t *trampoline = elf_base + traps[idx].trampoline;
244 if (idx < 0)
245 {
246 // No trampoline found:
247 struct e9scratch_s *scratch = e9scratch(config, /*alloc=*/false);
248 if (scratch->next != NULL)
249 scratch->next(sig, info, ctx); // Try the next binary
250 struct ksigaction action =
251 {
252 (void *)SIG_DFL, SA_NODEFER | SA_RESTORER, NULL, 0
253 };
254 e9syscall(SYS_rt_sigaction, SIGILL, &action, NULL, 8, E9_BACKDOOR);
255 trampoline = (uint8_t *)mctx->gregs[REG_RIP];
256 }
257 void *xstate = (void *)mctx->fpregs;
258 asm volatile (
259 "mov %%rcx,%%fs:0x40\n" // trampoline
260 "xor %%edx,%%edx\n"
261 "mov $0x3FFFF,%%eax\n"
262 "xrstor (%%rsi)\n" // restore xsave state
263 "mov (%%rbx),%%r8\n"
264 "mov 0x08(%%rbx),%%r9\n"
265 "mov 0x10(%%rbx),%%r10\n"
266 "mov 0x18(%%rbx),%%r11\n"
267 "mov 0x20(%%rbx),%%r12\n"
268 "mov 0x28(%%rbx),%%r13\n"
269 "mov 0x30(%%rbx),%%r14\n"
270 "mov 0x38(%%rbx),%%r15\n"
271 "mov 0x40(%%rbx),%%rdi\n"
272 "mov 0x48(%%rbx),%%rsi\n"

Callers

nothing calls this directly

Calls 2

e9scratchFunction · 0.85
nextMethod · 0.80

Tested by

no test coverage detected