| 329 | } |
| 330 | |
| 331 | bool AssembleHelper::patchTLSInstruction(void* code) |
| 332 | { |
| 333 | bool ret = false; |
| 334 | |
| 335 | #pragma pack(1) |
| 336 | struct JMP_CODE_HEAD |
| 337 | { |
| 338 | // push xxxx |
| 339 | unsigned char byPush = 0x68; |
| 340 | unsigned int nPushVal; |
| 341 | // mov dword ptr [rsp + 4], xxxx |
| 342 | unsigned char byMovEsp[4] = { 0xC7, 0x44, 0x24, 0x04 }; |
| 343 | unsigned int nMovVal; |
| 344 | // jmp [nJmpVal] |
| 345 | unsigned char byJmp[6] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 }; |
| 346 | unsigned long long nJmpVal; |
| 347 | }; |
| 348 | |
| 349 | struct JMP_CODE_FOOT |
| 350 | { |
| 351 | // jmp [nJmpVal] |
| 352 | unsigned char byJmp[6] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 }; |
| 353 | unsigned long long nJmpVal; |
| 354 | }; |
| 355 | #pragma pack() |
| 356 | |
| 357 | do |
| 358 | { |
| 359 | if (!code) |
| 360 | { |
| 361 | break; |
| 362 | } |
| 363 | |
| 364 | uint32_t nPatchedLen = getPatchLen((uint8_t*)code, sizeof(JMP_CODE_HEAD)); |
| 365 | if (!nPatchedLen) |
| 366 | { |
| 367 | break; |
| 368 | } |
| 369 | |
| 370 | // first, build foot jmp code |
| 371 | JMP_CODE_FOOT jmpFoot; |
| 372 | jmpFoot.nJmpVal = (uint64_t)((uint8_t*)code + nPatchedLen); |
| 373 | uint32_t nMovFsLen = 0; |
| 374 | int64_t fsOffset = 0; |
| 375 | getMovFsInfo(code, nMovFsLen, fsOffset); |
| 376 | |
| 377 | // delete mov rax, fs:[0] |
| 378 | // go straight to next instruction |
| 379 | uint8_t* pMovNext = (uint8_t*)code + nMovFsLen; |
| 380 | uint32_t nMovLeftLen = nPatchedLen - nMovFsLen; |
| 381 | uint32_t nFootCodeLen = nMovLeftLen + sizeof(jmpFoot); |
| 382 | uint8_t* pFootCode = (uint8_t*)plat::VMAllocate(nullptr, nFootCodeLen, |
| 383 | plat::VMAT_RESERVE_COMMIT, plat::VMPF_CPU_RWX); |
| 384 | if (!pFootCode) |
| 385 | { |
| 386 | break; |
| 387 | } |
| 388 |
nothing calls this directly
no test coverage detected