1 //===-- interception.h ------------------------------------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 // Machinery for providing replacements/wrappers for system functions. 13 //===----------------------------------------------------------------------===// 14 15 #ifndef INTERCEPTION_H 16 #define INTERCEPTION_H 17 18 #include "sanitizer_common/sanitizer_internal_defs.h" 19 20 #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_MAC && \ 21 !SANITIZER_NETBSD && !SANITIZER_OPENBSD && !SANITIZER_WINDOWS && \ 22 !SANITIZER_FUCHSIA && !SANITIZER_RTEMS && !SANITIZER_SOLARIS 23 # error "Interception doesn't work on this operating system." 24 #endif 25 26 // These typedefs should be used only in the interceptor definitions to replace 27 // the standard system types (e.g. SSIZE_T instead of ssize_t) 28 typedef __sanitizer::uptr SIZE_T; 29 typedef __sanitizer::sptr SSIZE_T; 30 typedef __sanitizer::sptr PTRDIFF_T; 31 typedef __sanitizer::s64 INTMAX_T; 32 typedef __sanitizer::u64 UINTMAX_T; 33 typedef __sanitizer::OFF_T OFF_T; 34 typedef __sanitizer::OFF64_T OFF64_T; 35 36 // How to add an interceptor: 37 // Suppose you need to wrap/replace system function (generally, from libc): 38 // int foo(const char *bar, double baz); 39 // You'll need to: 40 // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in 41 // your source file. See the notes below for cases when 42 // INTERCEPTOR_WITH_SUFFIX(...) should be used instead. 43 // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo". 44 // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was 45 // intercepted successfully. 46 // You can access original function by calling REAL(foo)(bar, baz). 47 // By default, REAL(foo) will be visible only inside your interceptor, and if 48 // you want to use it in other parts of RTL, you'll need to: 49 // 3a) add DECLARE_REAL(int, foo, const char*, double) to a 50 // header file. 51 // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for 52 // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to: 53 // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double) 54 // to a header file. 55 56 // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or 57 // DECLARE_REAL(...) are located inside namespaces. 58 // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to 59 // effectively redirect calls from "foo" to "zoo". In this case 60 // you aren't required to implement 61 // INTERCEPTOR(int, foo, const char *bar, double baz) {...} 62 // but instead you'll have to add 63 // DECLARE_REAL(int, foo, const char *bar, double baz) in your 64 // source file (to define a pointer to overriden function). 65 // 3. Some Mac functions have symbol variants discriminated by 66 // additional suffixes, e.g. _$UNIX2003 (see 67 // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html 68 // for more details). To intercept such functions you need to use the 69 // INTERCEPTOR_WITH_SUFFIX(...) macro. 70 71 // How it works: 72 // To replace system functions on Linux we just need to declare functions 73 // with same names in our library and then obtain the real function pointers 74 // using dlsym(). 75 // There is one complication. A user may also intercept some of the functions 76 // we intercept. To resolve this we declare our interceptors with __interceptor_ 77 // prefix, and then make actual interceptors weak aliases to __interceptor_ 78 // functions. 79 // 80 // This is not so on Mac OS, where the two-level namespace makes 81 // our replacement functions invisible to other libraries. This may be overcomed 82 // using the DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared 83 // libraries in Chromium were noticed when doing so. 84 // Instead we create a dylib containing a __DATA,__interpose section that 85 // associates library functions with their wrappers. When this dylib is 86 // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all 87 // the calls to interposed functions done through stubs to the wrapper 88 // functions. 89 // As it's decided at compile time which functions are to be intercepted on Mac, 90 // INTERCEPT_FUNCTION() is effectively a no-op on this system. 91 92 #if SANITIZER_MAC 93 #include <sys/cdefs.h> // For __DARWIN_ALIAS_C(). 94 95 // Just a pair of pointers. 96 struct interpose_substitution { 97 const __sanitizer::uptr replacement; 98 const __sanitizer::uptr original; 99 }; 100 101 // For a function foo() create a global pair of pointers { wrap_foo, foo } in 102 // the __DATA,__interpose section. 103 // As a result all the calls to foo() will be routed to wrap_foo() at runtime. 104 #define INTERPOSER(func_name) __attribute__((used)) \ 105 const interpose_substitution substitution_##func_name[] \ 106 __attribute__((section("__DATA, __interpose"))) = { \ 107 { reinterpret_cast<const uptr>(WRAP(func_name)), \ 108 reinterpret_cast<const uptr>(func_name) } \ 109 } 110 111 // For a function foo() and a wrapper function bar() create a global pair 112 // of pointers { bar, foo } in the __DATA,__interpose section. 113 // As a result all the calls to foo() will be routed to bar() at runtime. 114 #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \ 115 const interpose_substitution substitution_##func_name[] \ 116 __attribute__((section("__DATA, __interpose"))) = { \ 117 { reinterpret_cast<const uptr>(wrapper_name), \ 118 reinterpret_cast<const uptr>(func_name) } \ 119 } 120 121 # define WRAP(x) wrap_##x 122 # define WRAPPER_NAME(x) "wrap_"#x 123 # define INTERCEPTOR_ATTRIBUTE 124 # define DECLARE_WRAPPER(ret_type, func, ...) 125 126 #elif SANITIZER_WINDOWS 127 # define WRAP(x) __asan_wrap_##x 128 # define WRAPPER_NAME(x) "__asan_wrap_"#x 129 # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport) 130 # define DECLARE_WRAPPER(ret_type, func, ...) \ 131 extern "C" ret_type func(__VA_ARGS__); 132 # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \ 133 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__); 134 #elif SANITIZER_RTEMS 135 # define WRAP(x) x 136 # define WRAPPER_NAME(x) #x 137 # define INTERCEPTOR_ATTRIBUTE 138 # define DECLARE_WRAPPER(ret_type, func, ...) 139 #elif SANITIZER_FREEBSD || SANITIZER_NETBSD 140 # define WRAP(x) __interceptor_ ## x 141 # define WRAPPER_NAME(x) "__interceptor_" #x 142 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 143 // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher 144 // priority than weak ones so weak aliases won't work for indirect calls 145 // in position-independent (-fPIC / -fPIE) mode. 146 # define DECLARE_WRAPPER(ret_type, func, ...) \ 147 extern "C" ret_type func(__VA_ARGS__) \ 148 __attribute__((alias("__interceptor_" #func), visibility("default"))); 149 #elif !SANITIZER_FUCHSIA 150 # define WRAP(x) __interceptor_ ## x 151 # define WRAPPER_NAME(x) "__interceptor_" #x 152 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 153 # define DECLARE_WRAPPER(ret_type, func, ...) \ 154 extern "C" ret_type func(__VA_ARGS__) \ 155 __attribute__((weak, alias("__interceptor_" #func), visibility("default"))); 156 #endif 157 158 #if SANITIZER_FUCHSIA 159 // There is no general interception at all on Fuchsia. 160 // Sanitizer runtimes just define functions directly to preempt them, 161 // and have bespoke ways to access the underlying libc functions. 162 # include <zircon/sanitizer.h> 163 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 164 # define REAL(x) __unsanitized_##x 165 # define DECLARE_REAL(ret_type, func, ...) 166 #elif SANITIZER_RTEMS 167 # define REAL(x) __real_ ## x 168 # define DECLARE_REAL(ret_type, func, ...) \ 169 extern "C" ret_type REAL(func)(__VA_ARGS__); 170 #elif !SANITIZER_MAC 171 # define PTR_TO_REAL(x) real_##x 172 # define REAL(x) __interception::PTR_TO_REAL(x) 173 # define FUNC_TYPE(x) x##_type 174 175 # define DECLARE_REAL(ret_type, func, ...) \ 176 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 177 namespace __interception { \ 178 extern FUNC_TYPE(func) PTR_TO_REAL(func); \ 179 } 180 # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src) 181 #else // SANITIZER_MAC 182 # define REAL(x) x 183 # define DECLARE_REAL(ret_type, func, ...) \ 184 extern "C" ret_type func(__VA_ARGS__); 185 # define ASSIGN_REAL(x, y) 186 #endif // SANITIZER_MAC 187 188 #if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS 189 #define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \ 190 DECLARE_REAL(ret_type, func, __VA_ARGS__) \ 191 extern "C" ret_type WRAP(func)(__VA_ARGS__); 192 #else 193 #define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) 194 #endif 195 196 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR 197 // macros does its job. In exceptional cases you may need to call REAL(foo) 198 // without defining INTERCEPTOR(..., foo, ...). For example, if you override 199 // foo with an interceptor for other function. 200 #if !SANITIZER_MAC && !SANITIZER_FUCHSIA && !SANITIZER_RTEMS 201 # define DEFINE_REAL(ret_type, func, ...) \ 202 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 203 namespace __interception { \ 204 FUNC_TYPE(func) PTR_TO_REAL(func); \ 205 } 206 #else 207 # define DEFINE_REAL(ret_type, func, ...) 208 #endif 209 210 #if SANITIZER_FUCHSIA 211 212 // We need to define the __interceptor_func name just to get 213 // sanitizer_common/scripts/gen_dynamic_list.py to export func. 214 // But we don't need to export __interceptor_func to get that. 215 #define INTERCEPTOR(ret_type, func, ...) \ 216 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \ 217 __interceptor_##func(__VA_ARGS__); \ 218 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__) 219 220 #elif !SANITIZER_MAC 221 222 #define INTERCEPTOR(ret_type, func, ...) \ 223 DEFINE_REAL(ret_type, func, __VA_ARGS__) \ 224 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \ 225 extern "C" \ 226 INTERCEPTOR_ATTRIBUTE \ 227 ret_type WRAP(func)(__VA_ARGS__) 228 229 // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now. 230 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 231 INTERCEPTOR(ret_type, func, __VA_ARGS__) 232 233 #else // SANITIZER_MAC 234 235 #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \ 236 extern "C" ret_type func(__VA_ARGS__) suffix; \ 237 extern "C" ret_type WRAP(func)(__VA_ARGS__); \ 238 INTERPOSER(func); \ 239 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) 240 241 #define INTERCEPTOR(ret_type, func, ...) \ 242 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__) 243 244 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 245 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__) 246 247 // Override |overridee| with |overrider|. 248 #define OVERRIDE_FUNCTION(overridee, overrider) \ 249 INTERPOSER_2(overridee, WRAP(overrider)) 250 #endif 251 252 #if SANITIZER_WINDOWS 253 # define INTERCEPTOR_WINAPI(ret_type, func, ...) \ 254 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \ 255 namespace __interception { \ 256 FUNC_TYPE(func) PTR_TO_REAL(func); \ 257 } \ 258 extern "C" \ 259 INTERCEPTOR_ATTRIBUTE \ 260 ret_type __stdcall WRAP(func)(__VA_ARGS__) 261 #endif 262 263 // ISO C++ forbids casting between pointer-to-function and pointer-to-object, 264 // so we use casting via an integral type __interception::uptr, 265 // assuming that system is POSIX-compliant. Using other hacks seem 266 // challenging, as we don't even pass function type to 267 // INTERCEPT_FUNCTION macro, only its name. 268 namespace __interception { 269 #if defined(_WIN64) 270 typedef unsigned long long uptr; // NOLINT 271 #else 272 typedef unsigned long uptr; // NOLINT 273 #endif // _WIN64 274 } // namespace __interception 275 276 #define INCLUDED_FROM_INTERCEPTION_LIB 277 278 #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \ 279 SANITIZER_OPENBSD || SANITIZER_SOLARIS 280 281 # include "interception_linux.h" 282 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func) 283 # define INTERCEPT_FUNCTION_VER(func, symver) \ 284 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) 285 #elif SANITIZER_MAC 286 # include "interception_mac.h" 287 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func) 288 # define INTERCEPT_FUNCTION_VER(func, symver) \ 289 INTERCEPT_FUNCTION_VER_MAC(func, symver) 290 #elif SANITIZER_WINDOWS 291 # include "interception_win.h" 292 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func) 293 # define INTERCEPT_FUNCTION_VER(func, symver) \ 294 INTERCEPT_FUNCTION_VER_WIN(func, symver) 295 #endif 296 297 #undef INCLUDED_FROM_INTERCEPTION_LIB 298 299 #endif // INTERCEPTION_H 300