dyldInitialization.cpp [plain text]
#define __STDC_LIMIT_MACROS
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#include <stdlib.h>
#include <mach/mach.h>
#include <mach-o/loader.h>
#include <mach-o/ldsyms.h>
#include <mach-o/reloc.h>
#if __ppc__ || __ppc64__
#include <mach-o/ppc/reloc.h>
#endif
#if __x86_64__
#include <mach-o/x86_64/reloc.h>
#endif
#include "dyld.h"
#ifndef MH_PIE
#define MH_PIE 0x200000
#endif
#if __LP64__
#define macho_header mach_header_64
#define LC_SEGMENT_COMMAND LC_SEGMENT_64
#define macho_segment_command segment_command_64
#define macho_section section_64
#define RELOC_SIZE 3
#else
#define macho_header mach_header
#define LC_SEGMENT_COMMAND LC_SEGMENT
#define macho_segment_command segment_command
#define macho_section section
#define RELOC_SIZE 2
#endif
#if __x86_64__
#define POINTER_RELOC X86_64_RELOC_UNSIGNED
#else
#define POINTER_RELOC GENERIC_RELOC_VANILLA
#endif
namespace dyld { extern bool isRosetta(); };
namespace dyldbootstrap {
typedef void (*Initializer)(int argc, const char* argv[], const char* envp[], const char* apple[]);
static void runDyldInitializers(const struct macho_header* mh, intptr_t slide, int argc, const char* argv[], const char* envp[], const char* apple[])
{
const uint32_t cmd_count = mh->ncmds;
const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
const struct load_command* cmd = cmds;
for (uint32_t i = 0; i < cmd_count; ++i) {
switch (cmd->cmd) {
case LC_SEGMENT_COMMAND:
{
const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
const struct macho_section* const sectionsEnd = §ionsStart[seg->nsects];
for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
const uint8_t type = sect->flags & SECTION_TYPE;
if ( type == S_MOD_INIT_FUNC_POINTERS ){
Initializer* inits = (Initializer*)(sect->addr + slide);
const uint32_t count = sect->size / sizeof(uintptr_t);
for (uint32_t i=0; i < count; ++i) {
Initializer func = inits[i];
func(argc, argv, envp, apple);
}
}
}
}
break;
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}
}
static void rebaseDyld(const struct macho_header* mh, intptr_t slide)
{
const uint32_t cmd_count = mh->ncmds;
const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
const struct load_command* cmd = cmds;
const struct macho_segment_command* linkEditSeg = NULL;
#if __x86_64__
const struct macho_segment_command* firstWritableSeg = NULL;
#endif
const struct dysymtab_command* dynamicSymbolTable = NULL;
for (uint32_t i = 0; i < cmd_count; ++i) {
switch (cmd->cmd) {
case LC_SEGMENT_COMMAND:
{
const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
if ( strcmp(seg->segname, "__LINKEDIT") == 0 )
linkEditSeg = seg;
const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
const struct macho_section* const sectionsEnd = §ionsStart[seg->nsects];
for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
const uint8_t type = sect->flags & SECTION_TYPE;
if ( type == S_NON_LAZY_SYMBOL_POINTERS ) {
const uint32_t pointerCount = sect->size / sizeof(uintptr_t);
uintptr_t* const symbolPointers = (uintptr_t*)(sect->addr + slide);
for (uint32_t j=0; j < pointerCount; ++j) {
symbolPointers[j] += slide;
}
}
}
#if __x86_64__
if ( (firstWritableSeg == NULL) && (seg->initprot & VM_PROT_WRITE) )
firstWritableSeg = seg;
#endif
}
break;
case LC_DYSYMTAB:
dynamicSymbolTable = (struct dysymtab_command *)cmd;
break;
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}
#if __x86_64__
const uintptr_t relocBase = firstWritableSeg->vmaddr + slide;
#else
const uintptr_t relocBase = (uintptr_t)mh;
#endif
const relocation_info* const relocsStart = (struct relocation_info*)(linkEditSeg->vmaddr + slide + dynamicSymbolTable->locreloff - linkEditSeg->fileoff);
const relocation_info* const relocsEnd = &relocsStart[dynamicSymbolTable->nlocrel];
for (const relocation_info* reloc=relocsStart; reloc < relocsEnd; ++reloc) {
#if __ppc__ || __ppc64__ || __i36__
if ( (reloc->r_address & R_SCATTERED) != 0 )
throw "scattered relocation in dyld";
#endif
if ( reloc->r_length != RELOC_SIZE )
throw "relocation in dyld has wrong size";
if ( reloc->r_type != POINTER_RELOC )
throw "relocation in dyld has wrong type";
*((uintptr_t*)(reloc->r_address + relocBase)) += slide;
}
}
static void segmentProtectDyld(const struct macho_header* mh, intptr_t slide)
{
const uint32_t cmd_count = mh->ncmds;
const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
const struct load_command* cmd = cmds;
for (uint32_t i = 0; i < cmd_count; ++i) {
switch (cmd->cmd) {
case LC_SEGMENT_COMMAND:
{
const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
vm_address_t addr = seg->vmaddr + slide;
vm_size_t size = seg->vmsize;
const bool setCurrentPermissions = false;
vm_protect(mach_task_self(), addr, size, setCurrentPermissions, seg->initprot);
}
break;
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}
}
static const struct mach_header* randomizeExecutableLoadAddress(const struct mach_header* orgMH, uintptr_t* appsSlide)
{
#if __ppc__
if ( dyld::isRosetta() )
return orgMH;
#endif
uint32_t segCount = 0;
const uint32_t cmd_count = orgMH->ncmds;
const struct load_command* const cmds = (struct load_command*)(((char*)orgMH)+sizeof(macho_header));
const struct load_command* cmd = cmds;
for (uint32_t i = 0; i < cmd_count; ++i) {
if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd;
if ( (strcmp(segCmd->segname, "__PAGEZERO") != 0) && (strcmp(segCmd->segname, "__UNIXSTACK") != 0) )
++segCount;
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}
macho_segment_command segs[segCount];
uint32_t index = 0;
uintptr_t highestAddressUsed = 0;
uintptr_t lowestAddressUsed = UINTPTR_MAX;
cmd = cmds;
for (uint32_t i = 0; i < cmd_count; ++i) {
if ( cmd->cmd == LC_SEGMENT_COMMAND ) {
const struct macho_segment_command* segCmd = (struct macho_segment_command*)cmd;
if ( (strcmp(segCmd->segname, "__PAGEZERO") != 0) && (strcmp(segCmd->segname, "__UNIXSTACK") != 0) ) {
segs[index++] = *segCmd;
if ( (segCmd->vmaddr + segCmd->vmsize) > highestAddressUsed )
highestAddressUsed = ((segCmd->vmaddr + segCmd->vmsize) + 4095) & -4096;
if ( segCmd->vmaddr < lowestAddressUsed )
lowestAddressUsed = segCmd->vmaddr;
if ( (strcmp(segCmd->segname, "__TEXT") == 0) && (segCmd->vmaddr != (uintptr_t)orgMH) )
return orgMH;
}
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}
#if __LP64__
uintptr_t highestAddressPossible = highestAddressUsed + 0x100000000ULL;
#else
uintptr_t highestAddressPossible = 0x80000000;
#endif
uintptr_t sizeNeeded = highestAddressUsed-lowestAddressUsed;
if ( (highestAddressPossible-sizeNeeded) < highestAddressUsed ) {
return orgMH;
}
uintptr_t possibleRange = (highestAddressPossible-sizeNeeded) - highestAddressUsed;
uintptr_t newBaseAddress = highestAddressUsed + ((arc4random() % possibleRange) & -4096);
vm_address_t addr = newBaseAddress;
if ( vm_allocate(mach_task_self(), &addr, sizeNeeded, VM_FLAGS_FIXED) == KERN_SUCCESS ) {
for (uint32_t i = 0; i < segCount; ++i) {
uintptr_t newSegAddress = segs[i].vmaddr - lowestAddressUsed + newBaseAddress;
if ( (vm_copy(mach_task_self(), segs[i].vmaddr, segs[i].vmsize, newSegAddress) != KERN_SUCCESS)
|| (vm_protect(mach_task_self(), newSegAddress, segs[i].vmsize, true, segs[i].maxprot) != KERN_SUCCESS)
|| (vm_protect(mach_task_self(), newSegAddress, segs[i].vmsize, false, segs[i].initprot) != KERN_SUCCESS) ) {
vm_deallocate(mach_task_self(), newBaseAddress, sizeNeeded);
dyld::warn("could not relocate position independent exectable\n");
return orgMH;
}
}
vm_deallocate(mach_task_self(), lowestAddressUsed, highestAddressUsed-lowestAddressUsed);
*appsSlide = newBaseAddress - lowestAddressUsed;
return (const struct mach_header*)newBaseAddress;
}
return orgMH;
}
extern "C" void dyld_exceptions_init(const struct macho_header*, uintptr_t slide); extern "C" void mach_init();
extern "C" {
extern int __pthread_tsd_first;
extern void _pthread_keys_init();
}
uintptr_t start(const struct mach_header* appsMachHeader, int argc, const char* argv[], intptr_t slide)
{
const struct macho_header* dyldsMachHeader = (const struct macho_header*)(((char*)&_mh_dylinker_header)+slide);
if ( slide != 0 ) {
rebaseDyld(dyldsMachHeader, slide);
}
uintptr_t appsSlide = 0;
__pthread_tsd_first = 1;
_pthread_keys_init();
dyld_exceptions_init(dyldsMachHeader, slide);
mach_init();
segmentProtectDyld(dyldsMachHeader, slide);
const char** envp = &argv[argc+1];
const char** apple = envp;
while(*apple != NULL) { ++apple; }
++apple;
runDyldInitializers(dyldsMachHeader, slide, argc, argv, envp, apple);
if ( appsMachHeader->flags & MH_PIE )
appsMachHeader = randomizeExecutableLoadAddress(appsMachHeader, &appsSlide);
return dyld::_main(appsMachHeader, appsSlide, argc, argv, envp, apple);
}
}