Dobby使用#

1
#ifndef dobby_h
2
#define dobby_h
3

4
#ifdef __cplusplus
5
extern "C" {
6
#endif
7

8
#include <stdbool.h>
9
#include <stdint.h>
10

11
typedef uintptr_t addr_t;
12
typedef uint32_t addr32_t;
13
typedef uint64_t addr64_t;
14

15
typedef void *dobby_dummy_func_t;
16
typedef void *asm_func_t;
17

18
#if defined(__arm__)
19
typedef struct {
20
  uint32_t dummy_0;
21
  uint32_t dummy_1;
22

23
  uint32_t dummy_2;
24
  uint32_t sp;
25

26
  union {
27
    uint32_t r[13];
28
    struct {
29
      uint32_t r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, r12;
30
    } regs;
31
  } general;
32

33
  uint32_t lr;
34
} DobbyRegisterContext;
35
#elif defined(__arm64__) || defined(__aarch64__)
36
#define ARM64_TMP_REG_NDX_0 17
37

38
typedef union _FPReg {
39
  __int128_t q;
40
  struct {
41
    double d1;
42
    double d2;
43
  } d;
44
  struct {
45
    float f1;
46
    float f2;
47
    float f3;
48
    float f4;
49
  } f;
50
} FPReg;
51

52
// register context
53
typedef struct {
54
  uint64_t dmmpy_0; // dummy placeholder
55
  uint64_t sp;
56

57
  uint64_t dmmpy_1; // dummy placeholder
58
  union {
59
    uint64_t x[29];
60
    struct {
61
      uint64_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15, x16, x17, x18, x19, x20, x21, x22,
62
          x23, x24, x25, x26, x27, x28;
63
    } regs;
64
  } general;
65

66
  uint64_t fp;
67
  uint64_t lr;
68

69
  union {
70
    FPReg q[32];
71
    struct {
72
      FPReg q0, q1, q2, q3, q4, q5, q6, q7;
73
      // [!!! READ ME !!!]
74
      // for Arm64, can't access q8 - q31, unless you enable full floating-point register pack
75
      FPReg q8, q9, q10, q11, q12, q13, q14, q15, q16, q17, q18, q19, q20, q21, q22, q23, q24, q25, q26, q27, q28, q29,
76
          q30, q31;
77
    } regs;
78
  } floating;
79
} DobbyRegisterContext;
80
#elif defined(_M_IX86) || defined(__i386__)
81
typedef struct _RegisterContext {
82
  uint32_t dummy_0;
83
  uint32_t esp;
84

85
  uint32_t dummy_1;
86
  uint32_t flags;
87

88
  union {
89
    struct {
90
      uint32_t eax, ebx, ecx, edx, ebp, esp, edi, esi;
91
    } regs;
92
  } general;
93

94
} DobbyRegisterContext;
95
#elif defined(_M_X64) || defined(__x86_64__)
96
typedef struct {
97
  uint64_t dummy_0;
98
  uint64_t rsp;
99

100
  union {
101
    struct {
102
      uint64_t rax, rbx, rcx, rdx, rbp, rsp, rdi, rsi, r8, r9, r10, r11, r12, r13, r14, r15;
103
    } regs;
104
  } general;
105

106
  uint64_t dummy_1;
107
  uint64_t flags;
108
} DobbyRegisterContext;
109
#endif
110

111
#define install_hook_name(name, fn_ret_t, fn_args_t...)                                                                \
112
  static fn_ret_t fake_##name(fn_args_t);                                                                              \
113
  static fn_ret_t (*orig_##name)(fn_args_t);                                                                           \
114
  /* __attribute__((constructor)) */ static void install_hook_##name(void *sym_addr) {                                 \
115
    DobbyHook(sym_addr, (dobby_dummy_func_t)fake_##name, (dobby_dummy_func_t *)&orig_##name);                          \
116
    return;                                                                                                            \
117
  }                                                                                                                    \
118
  fn_ret_t fake_##name(fn_args_t)
119

120
// memory code patch
121
int DobbyCodePatch(void *address, uint8_t *buffer, uint32_t buffer_size);
122

123
// function inline hook
124
int DobbyHook(void *address, dobby_dummy_func_t replace_func, dobby_dummy_func_t *origin_func);
125

126
// dynamic binary instruction instrument
127
// for Arm64, can't access q8 - q31, unless enable full floating-point register pack
128
typedef void (*dobby_instrument_callback_t)(void *address, DobbyRegisterContext *ctx);
129
int DobbyInstrument(void *address, dobby_instrument_callback_t pre_handler);
130

131
// destroy and restore code patch
132
int DobbyDestroy(void *address);
133

134
const char *DobbyGetVersion();
135

136
// symbol resolver
137
void *DobbySymbolResolver(const char *image_name, const char *symbol_name);
138

139
// import table replace
140
int DobbyImportTableReplace(char *image_name, char *symbol_name, dobby_dummy_func_t fake_func,
141
                            dobby_dummy_func_t *orig_func);
142

143
// for arm, Arm64, try use b xxx instead of ldr absolute indirect branch
144
// for x86, x64, always use absolute indirect jump
145
void dobby_enable_near_branch_trampoline();
146
void dobby_disable_near_branch_trampoline();
147

148
#ifdef __cplusplus
149
}
150
#endif
151

152
#endif