Loading...
src/ImageLoaderMachOClassic.cpp dyld-210.2.3 dyld-360.22
--- dyld/dyld-210.2.3/src/ImageLoaderMachOClassic.cpp
+++ dyld/dyld-360.22/src/ImageLoaderMachOClassic.cpp
@@ -55,7 +55,7 @@
 #include "mach-o/dyld_images.h"
 
 // in dyldStartup.s
-extern "C" void fast_stub_binding_helper_interface();
+extern "C" void stub_binding_helper_i386_old();
 
 
 #if __x86_64__
@@ -97,7 +97,8 @@
 	// for PIE record end of program, to know where to start loading dylibs
 	if ( slide != 0 )
 		fgNextPIEDylibAddress = (uintptr_t)image->getEnd();
-	
+
+	image->disableCoverageCheck();
 	image->instantiateFinish(context);
 	image->setMapped(context);
 
@@ -126,7 +127,7 @@
 }
 
 // create image by mapping in a mach-o file
-ImageLoaderMachOClassic* ImageLoaderMachOClassic::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, 
+ImageLoaderMachOClassic* ImageLoaderMachOClassic::instantiateFromFile(const char* path, int fd, const uint8_t* fileData, size_t lenFileData,
 															uint64_t offsetInFat, uint64_t lenInFat, const struct stat& info, 
 															unsigned int segCount, unsigned int libCount, 
 															const struct linkedit_data_command* codeSigCmd, const LinkContext& context)
@@ -136,12 +137,12 @@
 		// record info about file  
 		image->setFileInfo(info.st_dev, info.st_ino, info.st_mtime);
 
-	#if CODESIGNING_SUPPORT
 		// if this image is code signed, let kernel validate signature before mapping any pages from image
-		if ( codeSigCmd != NULL )
-			image->loadCodeSignature(codeSigCmd, fd, offsetInFat);
-	#endif
+		image->loadCodeSignature(codeSigCmd, fd, offsetInFat, context);
 		
+		// Validate that first data we read with pread actually matches with code signature
+		image->validateFirstPages(codeSigCmd, fd, fileData, lenFileData, offsetInFat, context);
+
 		// mmap segments
 		image->mapSegmentsClassic(fd, offsetInFat, lenInFat, info.st_size, context);
 
@@ -195,6 +196,7 @@
 		// remember this is from shared cache and cannot be unloaded
 		image->fInSharedCache = true;
 		image->setNeverUnload();
+		image->disableCoverageCheck();
 
 		// segments already mapped in cache
 		if ( context.verboseMapping ) {
@@ -233,6 +235,8 @@
 		// for compatibility, never unload dylibs loaded from memory
 		image->setNeverUnload();
 
+		image->disableCoverageCheck();
+
 		// bundle loads need path copied
 		if ( moduleName != NULL ) 
 			image->setPath(moduleName);
@@ -276,7 +280,7 @@
 void ImageLoaderMachOClassic::instantiateFinish(const LinkContext& context)
 {
 	// now that segments are mapped in, get real fMachOData, fLinkEditBase, and fSlide
-	this->parseLoadCmds();
+	this->parseLoadCmds(context);
 }
 
 ImageLoaderMachOClassic::~ImageLoaderMachOClassic()
@@ -355,11 +359,11 @@
 		end += fSymbolTable[fDynamicInfo->iextdefsym+fDynamicInfo->nextdefsym-1].n_un.n_strx;
 		
 	// round to whole pages
-	start = start & (-4096);
-	end = (end + 4095) & (-4096);
+	start = dyld_page_trunc(start);
+	end = dyld_page_round(end);
 	
 	// skip if there is only one page
-	if ( (end-start) > 4096 ) {
+	if ( (end-start) > dyld_page_size ) {
 		madvise((void*)start, end-start, MADV_WILLNEED);
 		fgTotalBytesPreFetched += (end-start);
 		if ( context.verboseMapping ) {
@@ -622,7 +626,7 @@
 			const char* lastSlash = strrchr(childInstallPath, '/');
 			if ( lastSlash != NULL ) {
 				const char* firstDot = strchr(lastSlash, '.');
-				int len;
+				size_t len;
 				if ( firstDot == NULL )
 					len = strlen(lastSlash);
 				else
@@ -953,7 +957,7 @@
 }
 
 
-uintptr_t ImageLoaderMachOClassic::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, bool runResolver) const
+uintptr_t ImageLoaderMachOClassic::exportedSymbolAddress(const LinkContext& context, const Symbol* symbol, const ImageLoader* requestor, bool runResolver) const
 {
 	const struct macho_nlist* sym = (macho_nlist*)symbol;
 	uintptr_t result = sym->n_value + fSlide;
@@ -1058,8 +1062,8 @@
 		}
 		const Symbol* sym;
 		if ( context.flatExportFinder(symbolName, &sym, foundIn) ) {
-			if ( (*foundIn != this) && !(*foundIn)->neverUnload() )
-					this->addDynamicReference(*foundIn);
+			if ( *foundIn != this )
+				context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
 			return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 		}
 		// if a bundle is loaded privately the above will not find its exports
@@ -1074,15 +1078,15 @@
 			// if reference is weak_import, then it is ok, just return 0
 			return 0;
 		}
-		throwSymbolNotFound(context, symbolName, this->getPath(), "flat namespace");
+		throwSymbolNotFound(context, symbolName, this->getPath(), "", "flat namespace");
 	}
 	else {
 		// symbol requires searching images with coalesced symbols (not done during prebinding)
 		if ( !context.prebinding && !dontCoalesce && (symbolIsWeakReference(undefinedSymbol) || symbolIsWeakDefinition(undefinedSymbol)) ) {
 			const Symbol* sym;
 			if ( context.coalescedExportFinder(symbolName, &sym, foundIn) ) {
-				if ( (*foundIn != this) && !(*foundIn)->neverUnload() )
-					this->addDynamicReference(*foundIn);
+				if ( *foundIn != this )
+					context.addDynamicReference(this, const_cast<ImageLoader*>(*foundIn));
 				return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 			}
 			//throwSymbolNotFound(context, symbolName, this->getPath(), "coalesced namespace");
@@ -1119,7 +1123,7 @@
 			if ( context.flatExportFinder(symbolName, &sym, foundIn) )
 				return (*foundIn)->getExportedSymbolAddress(sym, context, this);
 			
-			throwSymbolNotFound(context, symbolName, this->getPath(), "dynamic lookup");
+			throwSymbolNotFound(context, symbolName, this->getPath(), "", "dynamic lookup");
 		}
 		else if ( ord <= libraryCount() ) {
 			target = libImage(ord-1);
@@ -1153,7 +1157,7 @@
 		}
 		
 		// nowhere to be found
-		throwSymbolNotFound(context, symbolName, this->getPath(), target->getPath());
+		throwSymbolNotFound(context, symbolName, this->getPath(), "", target->getPath());
 	}
 }
 
@@ -1405,11 +1409,11 @@
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						uint32_t symbolIndex = INDIRECT_SYMBOL_LOCAL;
 						if ( type == S_LAZY_SYMBOL_POINTERS ) {
-							const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
 							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
 							if ( (lazyPointer >= symbolPointers) && (lazyPointer < &symbolPointers[pointerCount]) ) {
 								const uint32_t indirectTableOffset = sect->reserved1;
-								const uint32_t lazyIndex = lazyPointer - symbolPointers;
+								const size_t lazyIndex = lazyPointer - symbolPointers;
 								symbolIndex = indirectTable[indirectTableOffset + lazyIndex];
 							}
 						}
@@ -1522,7 +1526,7 @@
 		symbol_index = toc[it.curIndex-1].symbol_index;
 	}
 	else {
-		symbol_index = fDynamicInfo->iextdefsym+it.curIndex-1;
+		symbol_index = fDynamicInfo->iextdefsym + (uint32_t)it.curIndex - 1;
 	}	
 	const struct macho_nlist* sym = &fSymbolTable[symbol_index];
 	//dyld::log("getAddressCoalIterator() => 0x%llX, %s symbol_index=%d, in %s\n", (uint64_t)(sym->n_value + fSlide), &fStrings[sym->n_un.n_strx], symbol_index, this->getPath());
@@ -1557,7 +1561,7 @@
 		symbol_index = toc[it.curIndex-1].symbol_index;
 	}
 	else {
-		symbol_index = fDynamicInfo->iextdefsym+it.curIndex-1;
+		symbol_index = fDynamicInfo->iextdefsym + (uint32_t)it.curIndex - 1;
 	}	
 
 	// if this image's copy of the symbol is not a weak definition nor a weak reference then nothing to coalesce here
@@ -1667,11 +1671,11 @@
 					case S_NON_LAZY_SYMBOL_POINTERS:
 					case S_LAZY_SYMBOL_POINTERS:
 					{
-						uint32_t elementCount = sect->size / elementSize;
+						size_t elementCount = sect->size / elementSize;
 						const uint32_t indirectTableOffset = sect->reserved1;
 						uint8_t* ptrToBind = (uint8_t*)(sect->addr + fSlide);
 						//dyld::log(" scanning section %s of %s starting at %p\n", sect->sectname, this->getShortName(), ptrToBind);
-						for (uint32_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
+						for (size_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
 							if ( indirectTable[indirectTableOffset + j] == symbol_index ) {
 								//dyld::log("  found symbol index match at %d/%d, ptrToBind=%p\n", j, elementCount, ptrToBind);
 								// update pointer
@@ -1686,8 +1690,9 @@
 		}
 		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 	}
-	if ( boundSomething && (targetImage != this) && !targetImage->neverUnload() )
-		this->addDynamicReference(targetImage);
+	if ( boundSomething && (targetImage != this) ) {
+		context.addDynamicReference(this, targetImage);
+	}
 	
 	// mark that this symbol has already been bound, so we don't try to bind again
 	it.type = 1;
@@ -1713,7 +1718,7 @@
 						bool isLazySymbol = false;
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						uint32_t elementSize = sizeof(uintptr_t);
-						uint32_t elementCount = sect->size / elementSize;
+						size_t elementCount = sect->size / elementSize;
 						if ( type == S_NON_LAZY_SYMBOL_POINTERS ) {
 							if ( ! bindNonLazys )
 								continue;
@@ -1741,7 +1746,7 @@
 						}
 						const uint32_t indirectTableOffset = sect->reserved1;
 						uint8_t* ptrToBind = (uint8_t*)(sect->addr + fSlide);
-						for (uint32_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
+						for (size_t j=0; j < elementCount; ++j, ptrToBind += elementSize) {
 				#if LINKEDIT_USAGE_DEBUG
 							noteAccessedLinkEditAddress(&indirectTable[indirectTableOffset + j]);
 				#endif
@@ -1834,7 +1839,7 @@
 							const uint32_t* const indirectTable = (uint32_t*)&fLinkEditBase[fDynamicInfo->indirectsymoff];
 							uint8_t* start = (uint8_t*)(sect->addr + this->fSlide);
 							uint8_t* end = start + sect->size;
-							uintptr_t dyldHandler = (uintptr_t)&fast_stub_binding_helper_interface;
+							uintptr_t dyldHandler = (uintptr_t)&stub_binding_helper_i386_old;
 							uint32_t entryIndex = 0;
 							for (uint8_t* entry = start; entry < end; entry += 5, ++entryIndex) {
 								bool installLazyHandler = true;
@@ -1952,19 +1957,12 @@
 					for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						if ( (type == S_NON_LAZY_SYMBOL_POINTERS) || (type == S_LAZY_SYMBOL_POINTERS) ) {
-							const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
 							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
-							for (uint32_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
-								for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
-									// replace all references to 'replacee' with 'replacement'
-									if ( (symbolPointers[pointerIndex] == it->replacee) && (this != it->replacementImage) ) {
-										if ( context.verboseInterposing ) {
-											dyld::log("dyld: interposing: at %p replace 0x%lX with 0x%lX in %s\n", 
-												&symbolPointers[pointerIndex], it->replacee, it->replacement, this->getPath());
-										}
-										symbolPointers[pointerIndex] = it->replacement;
-									}
-								}
+							for (size_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
+								uintptr_t newValue = interposedAddress(context, symbolPointers[pointerIndex], this);
+								if ( newValue != symbolPointers[pointerIndex] )
+									symbolPointers[pointerIndex] = newValue;
 							}
 						}
 				#if __i386__
@@ -1977,16 +1975,10 @@
 								if ( entry[0] == 0xE9 ) { // 0xE9 == JMP 
 									uint32_t rel32 = *((uint32_t*)&entry[1]); // assume unaligned load of uint32_t is ok
 									uint32_t target = (uint32_t)&entry[5] + rel32;
-									for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
-										// replace all references to 'replacee' with 'replacement'
-										if ( (it->replacee == target) && (this != it->replacementImage) ) {
-											if ( context.verboseInterposing ) {
-												dyld::log("dyld: interposing: at %p replace JMP 0x%lX with JMP 0x%lX in %s\n", 
-													&entry[1], it->replacee, it->replacement, this->getPath());
-											}
-											uint32_t newRel32 = it->replacement - (uint32_t)&entry[5];
-											*((uint32_t*)&entry[1]) = newRel32; // assume unaligned store of uint32_t is ok
-										}
+									uint32_t newTarget = interposedAddress(context, target, this);
+									if ( newTarget != target ) {
+										uint32_t newRel32 = newTarget - (uint32_t)&entry[5];
+										*((uint32_t*)&entry[1]) = newRel32; // assume unaligned store of uint32_t is ok
 									}
 								}
 							}
@@ -2009,14 +2001,76 @@
 				case POINTER_RELOC:
 					{
 						uintptr_t* location = ((uintptr_t*)(reloc->r_address + relocBase));
-						for (std::vector<InterposeTuple>::iterator it=fgInterposingTuples.begin(); it != fgInterposingTuples.end(); it++) {
+						uintptr_t value = *location;
+						uintptr_t newValue = interposedAddress(context, value, this);
+						if ( newValue != value )
+							*location = newValue;
+					}
+					break;
+			}
+		}
+	}
+}
+
+void ImageLoaderMachOClassic::dynamicInterpose(const LinkContext& context) 
+{
+	if ( context.verboseInterposing )
+		dyld::log("dyld: dynamic interposing %lu tuples onto image: %s\n", context.dynamicInterposeCount, this->getPath());
+
+	// scan indirect symbols
+	const uint32_t cmd_count = ((macho_header*)fMachOData)->ncmds;
+	const struct load_command* const cmds = (struct load_command*)&fMachOData[sizeof(macho_header)];
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+			case LC_SEGMENT_COMMAND:
+				{
+					const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+					const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
+					const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
+					for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
+						const uint8_t type = sect->flags & SECTION_TYPE;
+						if ( (type == S_NON_LAZY_SYMBOL_POINTERS) || (type == S_LAZY_SYMBOL_POINTERS) ) {
+							const size_t pointerCount = sect->size / sizeof(uintptr_t);
+							uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + fSlide);
+							for (size_t pointerIndex=0; pointerIndex < pointerCount; ++pointerIndex) {
+								for(size_t i=0; i < context.dynamicInterposeCount; ++i) {
+									// replace all references to 'replacee' with 'replacement'
+									if ( symbolPointers[pointerIndex] == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
+										if ( context.verboseInterposing ) {
+											dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
+												&symbolPointers[pointerIndex], context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
+										}
+										symbolPointers[pointerIndex] = (uintptr_t)context.dynamicInterposeArray[i].replacement;
+									}
+								}
+							}
+						}
+					}
+				}
+				break;
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+	
+	// scan external relocations 
+	const uintptr_t relocBase = this->getRelocBase();
+	const relocation_info* const relocsStart = (struct relocation_info*)(&fLinkEditBase[fDynamicInfo->extreloff]);
+	const relocation_info* const relocsEnd = &relocsStart[fDynamicInfo->nextrel];
+	for (const relocation_info* reloc=relocsStart; reloc < relocsEnd; ++reloc) {
+		if (reloc->r_length == RELOC_SIZE) {
+			switch(reloc->r_type) {
+				case POINTER_RELOC:
+					{
+						uintptr_t* location = ((uintptr_t*)(reloc->r_address + relocBase));
+						for(size_t i=0; i < context.dynamicInterposeCount; ++i) {
 							// replace all references to 'replacee' with 'replacement'
-							if ( (*location == it->replacee) && (this != it->replacementImage) ) {
+							if ( *location == (uintptr_t)context.dynamicInterposeArray[i].replacee ) {
 								if ( context.verboseInterposing ) {
-									dyld::log("dyld: interposing: at %p replace 0x%lX with 0x%lX in %s\n", 
-										location, it->replacee, it->replacement, this->getPath());
+									dyld::log("dyld: dynamic interposing: at %p replace %p with %p in %s\n", 
+										location, context.dynamicInterposeArray[i].replacee, context.dynamicInterposeArray[i].replacement, this->getPath());
 								}
-								*location = it->replacement;
+								*location = (uintptr_t)context.dynamicInterposeArray[i].replacement;
 							}
 						}
 					}