From fb95177298bb92098b61f09b9f66c1fce32f2f02 Mon Sep 17 00:00:00 2001
From: Matthew Wozniak <me@woz.blue>
Date: Sun, 27 Oct 2024 23:28:51 -0400
Subject: add hooking and IVEngineServer interface

---
 hook.c | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 hook.c

(limited to 'hook.c')

diff --git a/hook.c b/hook.c
new file mode 100644
index 0000000..8d7f409
--- /dev/null
+++ b/hook.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: ISC
+// SPDX-FileCopyrightText: 2024 Michael Smith <mikesmiffy128@gmail.com>
+// SPDX-FileCopyrightText: 2022 Willian Henrique <wsimanbrazil@yahoo.com.br>//
+// SPDX-FileCopyrightText: 2024 Matthew Wozniak <me@woz.blue>
+
+#include <string.h>
+
+#include "3p/sst/x86.h"
+
+#include "intdef.h"
+#include "log.h"
+#include "os.h"
+
+#ifdef _WIN32
+// try to avoid pulling in all of Windows.h for this... (redundant dllimport
+// avoids warnings in hook.test.c where Windows.h is included via test.h)
+__declspec(dllimport) int __stdcall FlushInstructionCache(
+		void *, const void *, usize);
+#endif
+
+// Warning: half-arsed hacky implementation (because that's all we really need)
+// Almost certainly breaks in some weird cases. Oh well! Most of the time,
+// vtable hooking is more reliable, this is only for, uh, emergencies.
+
+__attribute__((aligned(4096))) static uchar trampolines[4096];
+static uchar *nexttrampoline = trampolines;
+
+bool hook_init(void) {
+	return os_mprot(trampolines, sizeof(trampolines), PAGE_EXECUTE_READWRITE);
+}
+
+static inline void iflush(void *p, int len) {
+#if defined(_WIN32)
+	// -1 is the current process, and it's a constant in the WDK, so it's
+	// assumed we can safely avoid the useless GetCurrentProcess call
+	FlushInstructionCache((void *)-1, p, len);
+#elif defined(__GNUC__)
+	__builtin___clear_cache((char *)p, (char *)p + len);
+#else
+	warn("no way to clear instruction cache!");
+#endif
+}
+
+void *hook_inline(void *func_, void *target) {
+	uchar *func = func_;
+	// dumb hack: if we hit some thunk that immediately jumps elsewhere (which
+	// seems common for win32 API functions), hook the underlying thing instead.
+	while (*func == X86_JMPIW) func += *(i32 *)(func + 1) + 5;
+	if (!os_mprot(func, 5, PAGE_EXECUTE_READWRITE)) return 0;
+	int len = 0;
+	for (;;) {
+		// FIXME: these cases may result in somewhat dodgy error messaging. They
+		// shouldn't happen anyway though. Maybe if we're confident we just
+		// compile 'em out of release builds some day, but that sounds a little
+		// scary. For now preferring confusing messages over crashes, I guess.
+		if (func[len] == X86_CALL) {
+			warn("can't trampoline call instructions\n");
+			return 0;
+		}
+		int ilen = x86_len(func + len);
+		if (ilen == -1) {
+			warn("unknown or invalid instruction\n");
+			return 0;
+		}
+		len += ilen;
+		if (len >= 5) break;
+		if (func[len] == X86_JMPIW) {
+			warn("can't trampoline jmp instructions\n");
+			return 0;
+		}
+	}
+	// for simplicity, just bump alloc the trampoline. no need to free anyway
+	if (nexttrampoline - trampolines > sizeof(trampolines) - len - 6) {
+		warn("out of trampoline space\n");
+		return 0;
+	}
+	uchar *trampoline = nexttrampoline;
+	nexttrampoline += len + 6; // NOT thread-safe. we don't need that anyway!
+	*trampoline++ = len; // stick length in front for quicker unhooking
+	memcpy(trampoline, func, len);
+	trampoline[len] = X86_JMPIW;
+	u32 diff = func - (trampoline + 5); // goto the continuation
+	memcpy(trampoline + len + 1, &diff, 4);
+	diff = (uchar *)target - (func + 5); // goto the hook target
+	func[0] = X86_JMPIW;
+	memcpy(func + 1, &diff, 4);
+	iflush(func, 5);
+	return trampoline;
+}
+
+void unhook_inline(void *orig) {
+	uchar *p = orig;
+	int len = p[-1];
+	int off = *(i32 *)(p + len + 1);
+	uchar *q = p + off + 5;
+	memcpy(q, p, 5); // XXX: not atomic atm! (does any of it even need to be?)
+	iflush(q, 5);
+}
+
+void *hook_dllapi(const char *module, const char *name, void *target) {
+	void *func = os_dlsym(os_dlopen(module), name);
+	if (!func) warn("couldn't find function %s in %s", name, module);
+	else return hook_inline(func, target);
+	return NULL;
+}
+
+// vi: sw=4 ts=4 noet tw=80 cc=80
-- 
cgit v1.2.3-54-g00ecf