From 9ee2e7567c8a68504fe614746935636f3ba8c718 Mon Sep 17 00:00:00 2001 From: Katy Coe Date: Sat, 26 Oct 2019 15:18:55 +0200 Subject: [PATCH] Fix x86 analysis based on ELF PLT --- .../FileFormatReaders/ElfReader.cs | 10 +- Il2CppInspector/Il2CppBinaryX86.cs | 94 ++++++++++--------- 2 files changed, 59 insertions(+), 45 deletions(-) diff --git a/Il2CppInspector/FileFormatReaders/ElfReader.cs b/Il2CppInspector/FileFormatReaders/ElfReader.cs index 0ba18b8..466f619 100644 --- a/Il2CppInspector/FileFormatReaders/ElfReader.cs +++ b/Il2CppInspector/FileFormatReaders/ElfReader.cs @@ -79,7 +79,12 @@ namespace Il2CppInspector public uint[] UIntArray(ulong[] a) => Array.ConvertAll(a, x => (uint) x); } - internal abstract class ElfReader : FileFormatReader + interface IElfReader + { + uint GetPLTAddress(); + } + + internal abstract class ElfReader : FileFormatReader, IElfReader where TWord : struct where TPHdr : Ielf_phdr, new() where TSym : Ielf_sym, new() @@ -335,5 +340,8 @@ namespace Il2CppInspector var program_header_table = this.program_header_table.First(x => uiAddr >= math.ULong(x.p_vaddr) && uiAddr <= math.ULong(math.Add(x.p_vaddr, x.p_filesz))); return (uint) (uiAddr - math.ULong(math.Sub(program_header_table.p_vaddr, program_header_table.p_offset))); } + + // Get the address of the procedure linkage table (.got.plt) which is needed for some disassemblies + public uint GetPLTAddress() => (uint) math.ULong(getDynamic(Elf.DT_PLTGOT).d_un); } } \ No newline at end of file diff --git a/Il2CppInspector/Il2CppBinaryX86.cs b/Il2CppInspector/Il2CppBinaryX86.cs index cd88891..20d71d2 100644 --- a/Il2CppInspector/Il2CppBinaryX86.cs +++ b/Il2CppInspector/Il2CppBinaryX86.cs @@ -15,73 +15,79 @@ namespace Il2CppInspector protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) { ulong metadata, code; - long funcPtr; - ushort opcode; - - // Variant 1 + long pCgr; + // x86 // Assembly bytes to search for at start of each function var bytes = new byte[] {0x6A, 0x00, 0x6A, 0x00, 0x68}; image.Position = loc; var buff = image.ReadBytes(5); if (bytes.SequenceEqual(buff)) { // Next 4 bytes are the function pointer being pushed onto the stack - funcPtr = image.ReadUInt32(); + pCgr = image.ReadUInt32(); // Start of next instruction if (image.ReadByte() != 0xB9) return (0, 0); // Jump to Il2CppCodegenRegistration - image.Position = image.MapVATR((ulong) funcPtr + 6); + image.Position = image.MapVATR((ulong) pCgr + 6); metadata = image.ReadUInt32(); - image.Position = image.MapVATR((ulong) funcPtr + 11); + image.Position = image.MapVATR((ulong) pCgr + 11); code = image.ReadUInt32(); return (code, metadata); } - // Variant 2 - bytes = new byte[] - {0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B}; - image.Position = loc; - buff = image.ReadBytes(16); - if (!bytes.SequenceEqual(buff)) - return (0, 0); + // x86 based on ELF PLT + if (image is IElfReader elf) { + var plt = elf.GetPLTAddress(); - image.Position += 8; - funcPtr = image.MapVATR(image.ReadUInt32() + image.GlobalOffset); - if (funcPtr > image.Length) - return (0, 0); + // push ebp; mov ebp, esp; push ebx; and esp, 0FFFFFFF0h; sub esp, 20h; call $+5; pop ebx + bytes = new byte[] + {0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B}; + image.Position = loc; + buff = image.ReadBytes(16); + if (!bytes.SequenceEqual(buff)) + return (0, 0); - // Extract Metadata pointer - // An 0x838D opcode indicates LEA (no indirection) - image.Position = funcPtr + 0x20; - opcode = image.ReadUInt16(); - metadata = image.ReadUInt32() + image.GlobalOffset; + // lea eax, (pCgr - offset)[ebx] (Position + 6 is the opcode lea eax; Position + 8 is the operand) + image.Position += 8; + pCgr = image.MapVATR(image.ReadUInt32() + plt); + if (pCgr > image.Length) + return (0, 0); - // An 8x838B opcode indicates MOV (pointer indirection) - if (opcode == 0x838B) { - image.Position = image.MapVATR(metadata); - metadata = image.ReadUInt32(); + // Extract Metadata pointer + // An 0x838D opcode indicates LEA (no indirection) + image.Position = pCgr + 0x20; + var opcode = image.ReadUInt16(); + metadata = image.ReadUInt32() + plt; + + // An 8x838B opcode indicates MOV (pointer indirection) + if (opcode == 0x838B) { + image.Position = image.MapVATR(metadata); + metadata = image.ReadUInt32(); + } + + if (opcode != 0x838B && opcode != 0x838D) + return (0, 0); + + // Repeat the same logic for extracting the Code pointer + image.Position = pCgr + 0x2A; + opcode = image.ReadUInt16(); + code = image.ReadUInt32() + plt; + + if (opcode == 0x838B) { + image.Position = image.MapVATR(code); + code = image.ReadUInt32(); + } + + if (opcode != 0x838B && opcode != 0x838D) + return (0, 0); + + return (code, metadata); } - if (opcode != 0x838B && opcode != 0x838D) - return (0, 0); - - // Repeat the same logic for extracting the Code pointer - image.Position = funcPtr + 0x2A; - opcode = image.ReadUInt16(); - code = image.ReadUInt32() + image.GlobalOffset; - - if (opcode == 0x838B) { - image.Position = image.MapVATR(code); - code = image.ReadUInt32(); - } - - if (opcode != 0x838B && opcode != 0x838D) - return (0, 0); - - return (code, metadata); + return (0, 0); } } }