| //------------------------------------------------------------------------------------------------------- |
| // Copyright (C) Microsoft. All rights reserved. |
| // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information. |
| //------------------------------------------------------------------------------------------------------- |
| #include "Backend.h" |
| |
| void |
| Security::EncodeLargeConstants() |
| { |
| #pragma prefast(suppress:6236 6285, "logical-or of constants is by design") |
| if (PHASE_OFF(Js::EncodeConstantsPhase, this->func) || CONFIG_ISENABLED(Js::DebugFlag) || !MD_ENCODE_LG_CONSTS) |
| { |
| return; |
| } |
| |
| uint prevInstrConstSize = 0; |
| FOREACH_INSTR_IN_FUNC_EDITING(instr, instrNext, this->func) |
| { |
| if (!instr->IsRealInstr()) |
| { |
| if (instr->IsLabelInstr()) |
| { |
| IR::LabelInstr * label = instr->AsLabelInstr(); |
| |
| if (label->labelRefs.Count() > 1 || (label->labelRefs.Count() == 1 && label->labelRefs.Head() != label->m_prev)) |
| { |
| if (this->cookieOpnd != nullptr) |
| { |
| this->cookieOpnd->Free(this->func); |
| } |
| this->baseOpnd = nullptr; |
| this->cookieOpnd = nullptr; |
| this->basePlusCookieOpnd = nullptr; |
| } |
| } |
| continue; |
| } |
| |
| IR::Opnd *src1 = instr->GetSrc1(); |
| IR::Opnd *src2 = instr->GetSrc2(); |
| IR::Opnd *dst = instr->GetDst(); |
| |
| if (dst && this->baseOpnd && dst->IsEqual(this->baseOpnd)) |
| { |
| if (this->cookieOpnd != nullptr) |
| { |
| this->cookieOpnd->Free(this->func); |
| } |
| this->baseOpnd = nullptr; |
| this->cookieOpnd = nullptr; |
| this->basePlusCookieOpnd = nullptr; |
| } |
| |
| uint currInstrConstSize = 0; |
| uint dstSize = dst ? CalculateConstSize(dst) : 0; |
| uint src1Size = 0; |
| uint src2Size = 0; |
| if (src1) |
| { |
| src1Size = CalculateConstSize(src1); |
| if (src2) |
| { |
| src2Size = CalculateConstSize(src2); |
| } |
| } |
| |
| prevInstrConstSize = currInstrConstSize; |
| currInstrConstSize = dstSize + src1Size + src2Size; |
| |
| // we don't need to blind constants if user controlled byte size < 3 |
| if (currInstrConstSize + prevInstrConstSize <= 2 && !PHASE_FORCE1(Js::EncodeConstantsPhase)) |
| { |
| continue; |
| } |
| |
| bool isSrc1EqualDst = false; |
| if (dstSize >= 2) |
| { |
| // don't count instrs where dst == src1 against size |
| if (src1 && dstSize == src1Size && src1->IsEqual(dst)) |
| { |
| currInstrConstSize -= dstSize; |
| isSrc1EqualDst = true; |
| |
| if (currInstrConstSize + prevInstrConstSize <= 2 && !PHASE_FORCE1(Js::EncodeConstantsPhase)) |
| { |
| continue; |
| } |
| } |
| |
| this->EncodeOpnd(instr, dst); |
| if (isSrc1EqualDst) |
| { |
| instr->ReplaceSrc1(dst); |
| } |
| currInstrConstSize -= dstSize; |
| if (currInstrConstSize + prevInstrConstSize <= 2 && !PHASE_FORCE1(Js::EncodeConstantsPhase)) |
| { |
| continue; |
| } |
| } |
| if (src1Size >= 2 && !isSrc1EqualDst) |
| { |
| this->EncodeOpnd(instr, src1); |
| currInstrConstSize -= src1Size; |
| if (currInstrConstSize + prevInstrConstSize <= 2 && !PHASE_FORCE1(Js::EncodeConstantsPhase)) |
| { |
| continue; |
| } |
| } |
| if (src2Size >= 2) |
| { |
| this->EncodeOpnd(instr, src2); |
| currInstrConstSize -= src2Size; |
| } |
| } NEXT_INSTR_IN_FUNC_EDITING; |
| |
| } |
| |
| int |
| Security::GetNextNOPInsertPoint() |
| { |
| uint frequency = (1 << CONFIG_FLAG(NopFrequency)) - 1; |
| return (Math::Rand() & frequency) + 1; |
| } |
| |
| void |
| Security::InsertRandomFunctionPad(IR::Instr * instrBeforeInstr) |
| { |
| if (PHASE_OFF(Js::InsertNOPsPhase, instrBeforeInstr->m_func->GetTopFunc()) |
| || CONFIG_ISENABLED(Js::DebugFlag) || CONFIG_ISENABLED(Js::BenchmarkFlag)) |
| { |
| return; |
| } |
| DWORD randomPad = Math::Rand() & ((0 - INSTR_ALIGNMENT) & 0xF); |
| #ifndef _M_ARM |
| if (randomPad == 1) |
| { |
| InsertSmallNOP(instrBeforeInstr, 1); |
| return; |
| } |
| if (randomPad & 1) |
| { |
| InsertSmallNOP(instrBeforeInstr, 3); |
| randomPad -= 3; |
| } |
| #endif |
| Assert((randomPad & 1) == 0); |
| while (randomPad >= 4) |
| { |
| InsertSmallNOP(instrBeforeInstr, 4); |
| randomPad -= 4; |
| } |
| Assert(randomPad == 2 || randomPad == 0); |
| if (randomPad == 2) |
| { |
| InsertSmallNOP(instrBeforeInstr, 2); |
| } |
| } |
| |
| |
| void |
| Security::InsertNOPs() |
| { |
| if (PHASE_OFF(Js::InsertNOPsPhase, this->func) || CONFIG_ISENABLED(Js::DebugFlag) || CONFIG_ISENABLED(Js::BenchmarkFlag)) |
| { |
| return; |
| } |
| |
| int count = 0; |
| IR::Instr *instr = this->func->m_headInstr; |
| |
| while (true) |
| { |
| count = this->GetNextNOPInsertPoint(); |
| while (instr && count--) |
| { |
| instr = instr->GetNextRealInstr(); |
| } |
| if (instr == nullptr) |
| { |
| break; |
| } |
| this->InsertNOPBefore(instr); |
| }; |
| } |
| |
| void |
| Security::InsertNOPBefore(IR::Instr *instr) |
| { |
| InsertSmallNOP(instr, (Math::Rand() & 0x3) + 1); |
| } |
| |
| void |
| Security::InsertSmallNOP(IR::Instr * instr, DWORD nopSize) |
| { |
| #if defined(_M_IX86) || defined(_M_X64) |
| #ifdef _M_IX86 |
| if (AutoSystemInfo::Data.SSE2Available()) |
| { // on x86 system that has SSE2, encode fast NOPs as x64 does |
| #endif |
| Assert(nopSize >= 1 || nopSize <= 4); |
| IR::Instr *nop = IR::Instr::New(Js::OpCode::NOP, instr->m_func); |
| |
| // Let the encoder know what the size of the NOP needs to be. |
| if (nopSize > 1) |
| { |
| // 2, 3 or 4 byte NOP. |
| IR::IntConstOpnd *nopSizeOpnd = IR::IntConstOpnd::New(nopSize, TyInt8, instr->m_func); |
| nop->SetSrc1(nopSizeOpnd); |
| } |
| |
| instr->InsertBefore(nop); |
| #ifdef _M_IX86 |
| } |
| else |
| { |
| IR::Instr *nopInstr = nullptr; |
| IR::RegOpnd *regOpnd; |
| IR::IndirOpnd *indirOpnd; |
| switch (nopSize) |
| { |
| case 1: |
| // nop |
| nopInstr = IR::Instr::New(Js::OpCode::NOP, instr->m_func); |
| break; |
| case 2: |
| // mov edi, edi ; 2 bytes |
| regOpnd = IR::RegOpnd::New(nullptr, RegEDI, TyInt32, instr->m_func); |
| nopInstr = IR::Instr::New(Js::OpCode::MOV, regOpnd, regOpnd, instr->m_func); |
| break; |
| case 3: |
| // lea ecx, [ecx+00] ; 3 bytes |
| regOpnd = IR::RegOpnd::New(nullptr, RegECX, TyInt32, instr->m_func); |
| indirOpnd = IR::IndirOpnd::New(regOpnd, (int32)0, TyInt32, instr->m_func); |
| nopInstr = IR::Instr::New(Js::OpCode::LEA, regOpnd, indirOpnd, instr->m_func); |
| break; |
| case 4: |
| // lea esp, [esp+00] ; 4 bytes |
| regOpnd = IR::RegOpnd::New(nullptr, RegESP, TyInt32, instr->m_func); |
| indirOpnd = IR::IndirOpnd::New(regOpnd, (int32)0, TyInt32, instr->m_func); |
| nopInstr = IR::Instr::New(Js::OpCode::LEA, regOpnd, indirOpnd, instr->m_func); |
| break; |
| default: |
| Assert(false); |
| break; |
| } |
| instr->InsertBefore(nopInstr); |
| } |
| #endif |
| #elif defined(_M_ARM) |
| // Can't insert 3 bytes, must choose between 2 and 4. |
| |
| IR::Instr *nopInstr = nullptr; |
| |
| switch (nopSize) |
| { |
| case 1: |
| case 2: |
| nopInstr = IR::Instr::New(Js::OpCode::NOP, instr->m_func); |
| break; |
| case 3: |
| case 4: |
| nopInstr = IR::Instr::New(Js::OpCode::NOP_W, instr->m_func); |
| break; |
| default: |
| Assert(false); |
| break; |
| } |
| |
| instr->InsertBefore(nopInstr); |
| #elif defined(_M_ARM64) |
| |
| // All ARM64 instructions are 4 bytes. |
| IR::Instr *nopInstr = IR::Instr::New(Js::OpCode::NOP, instr->m_func); |
| instr->InsertBefore(nopInstr); |
| |
| #endif |
| } |
| |
| bool |
| Security::DontEncode(IR::Opnd *opnd) |
| { |
| switch (opnd->GetKind()) |
| { |
| case IR::OpndKindIntConst: |
| { |
| IR::IntConstOpnd *intConstOpnd = opnd->AsIntConstOpnd(); |
| return intConstOpnd->m_dontEncode; |
| } |
| |
| case IR::OpndKindAddr: |
| { |
| IR::AddrOpnd *addrOpnd = opnd->AsAddrOpnd(); |
| return (addrOpnd->m_dontEncode || |
| !addrOpnd->IsVar() || |
| addrOpnd->m_address == nullptr || |
| !Js::TaggedNumber::Is(addrOpnd->m_address)); |
| } |
| case IR::OpndKindIndir: |
| { |
| IR::IndirOpnd *indirOpnd = opnd->AsIndirOpnd(); |
| return indirOpnd->m_dontEncode || indirOpnd->GetOffset() == 0; |
| } |
| case IR::OpndKindInt64Const: |
| return false; |
| case IR::OpndKindList: |
| { |
| // We should only have RegOpnd in the ListOpnd therefore, we don't need to encode anything |
| Assert(opnd->AsListOpnd()->All([](IR::ListOpndType* opnd) { return DontEncode(opnd); })); |
| return true; |
| } |
| default: |
| return true; |
| } |
| } |
| |
| uint |
| Security::CalculateConstSize(IR::Opnd *opnd) |
| { |
| if (DontEncode(opnd)) |
| { |
| return 0; |
| } |
| switch (opnd->GetKind()) |
| { |
| #if TARGET_64 |
| case IR::OpndKindInt64Const: |
| { |
| IR::Int64ConstOpnd *intConstOpnd = opnd->AsInt64ConstOpnd(); |
| return GetByteCount(intConstOpnd->GetValue()); |
| } |
| #endif |
| case IR::OpndKindIntConst: |
| { |
| IR::IntConstOpnd *intConstOpnd = opnd->AsIntConstOpnd(); |
| return GetByteCount(intConstOpnd->GetValue()); |
| } |
| case IR::OpndKindAddr: |
| { |
| IR::AddrOpnd *addrOpnd = opnd->AsAddrOpnd(); |
| return Js::TaggedInt::Is(addrOpnd->m_address) ? GetByteCount(Js::TaggedInt::ToInt32(addrOpnd->m_address)) : GetByteCount((intptr_t)addrOpnd->m_address); |
| } |
| case IR::OpndKindIndir: |
| { |
| IR::IndirOpnd * indirOpnd = opnd->AsIndirOpnd(); |
| return GetByteCount(indirOpnd->GetOffset()); |
| } |
| default: |
| Assume(UNREACHED); |
| } |
| return 0; |
| } |
| bool |
| Security::EncodeOpnd(IR::Instr * instr, IR::Opnd *opnd) |
| { |
| IR::RegOpnd *newOpnd; |
| bool isSrc2 = false; |
| |
| const auto unlinkSrc = [&]() { |
| if (opnd != instr->GetSrc1()) |
| { |
| Assert(opnd == instr->GetSrc2()); |
| isSrc2 = true; |
| instr->UnlinkSrc2(); |
| } |
| else |
| { |
| instr->UnlinkSrc1(); |
| } |
| }; |
| |
| switch (opnd->GetKind()) |
| { |
| case IR::OpndKindIntConst: |
| { |
| IR::IntConstOpnd *intConstOpnd = opnd->AsIntConstOpnd(); |
| |
| unlinkSrc(); |
| |
| intConstOpnd->SetEncodedValue(EncodeValue(instr, intConstOpnd, intConstOpnd->GetValue(), &newOpnd)); |
| } |
| break; |
| |
| case IR::OpndKindAddr: |
| { |
| IR::AddrOpnd *addrOpnd = opnd->AsAddrOpnd(); |
| |
| unlinkSrc(); |
| |
| addrOpnd->SetEncodedValue((Js::Var)this->EncodeValue(instr, addrOpnd, (IntConstType)addrOpnd->m_address, &newOpnd), addrOpnd->GetAddrOpndKind()); |
| } |
| break; |
| |
| case IR::OpndKindIndir: |
| { |
| IR::IndirOpnd *indirOpnd = opnd->AsIndirOpnd(); |
| |
| // Using 32 bit cookie causes major perf loss on the subsequent indirs, so only support this path for 16 bit offset |
| // It's relatively rare for base to be null or to have index + offset, so fall back to the more generic xor method for these |
| if (indirOpnd->GetBaseOpnd() && indirOpnd->GetIndexOpnd() == nullptr && Math::FitsInWord(indirOpnd->GetOffset())) |
| { |
| if (!this->baseOpnd || !this->baseOpnd->IsEqual(indirOpnd->GetBaseOpnd())) |
| { |
| if (this->cookieOpnd != nullptr) |
| { |
| this->cookieOpnd->Free(this->func); |
| } |
| this->cookieOpnd = BuildCookieOpnd(TyInt16, instr->m_func); |
| this->basePlusCookieOpnd = IR::RegOpnd::New(TyMachReg, instr->m_func); |
| this->baseOpnd = indirOpnd->GetBaseOpnd(); |
| IR::IndirOpnd * indir = IR::IndirOpnd::New(this->baseOpnd, this->cookieOpnd->AsInt32(), TyMachReg, instr->m_func); |
| Lowerer::InsertLea(this->basePlusCookieOpnd, indir, instr); |
| } |
| int32 diff = indirOpnd->GetOffset() - this->cookieOpnd->AsInt32(); |
| indirOpnd->SetOffset((int32)diff); |
| indirOpnd->SetBaseOpnd(this->basePlusCookieOpnd); |
| return true; |
| } |
| |
| IR::IntConstOpnd *indexOpnd = IR::IntConstOpnd::New(indirOpnd->GetOffset(), TyMachReg, instr->m_func); |
| |
| indexOpnd->SetValue(EncodeValue(instr, indexOpnd, indexOpnd->GetValue(), &newOpnd)); |
| |
| indirOpnd->SetOffset(0); |
| if (indirOpnd->GetIndexOpnd() != nullptr) |
| { |
| // update the base rather than the index, because index might have scale |
| if (indirOpnd->GetBaseOpnd() != nullptr) |
| { |
| IR::RegOpnd * newBaseOpnd = IR::RegOpnd::New(TyMachReg, instr->m_func); |
| Lowerer::InsertAdd(false, newBaseOpnd, newOpnd, indirOpnd->GetBaseOpnd(), instr); |
| indirOpnd->ReplaceBaseOpnd(newBaseOpnd); |
| } |
| else |
| { |
| indirOpnd->SetBaseOpnd(newOpnd); |
| } |
| } |
| else |
| { |
| indirOpnd->SetIndexOpnd(newOpnd); |
| } |
| } |
| return true; |
| |
| default: |
| return false; |
| } |
| |
| IR::Opnd *dst = instr->GetDst(); |
| |
| if (dst) |
| { |
| #if TARGET_64 |
| // Ensure the left and right operand has the same type (that might not be true for constants on x64) |
| newOpnd = (IR::RegOpnd *)newOpnd->UseWithNewType(dst->GetType(), instr->m_func); |
| #endif |
| if (dst->IsRegOpnd()) |
| { |
| IR::RegOpnd *dstRegOpnd = dst->AsRegOpnd(); |
| StackSym *dstSym = dstRegOpnd->m_sym; |
| |
| if (dstSym) |
| { |
| dstSym->m_isConst = false; |
| dstSym->m_isIntConst = false; |
| dstSym->m_isInt64Const = false; |
| dstSym->m_isTaggableIntConst = false; |
| dstSym->m_isFltConst = false; |
| } |
| } |
| } |
| |
| LowererMD::ImmedSrcToReg(instr, newOpnd, isSrc2 ? 2 : 1); |
| return true; |
| } |
| |
| IR::IntConstOpnd * |
| Security::BuildCookieOpnd(IRType type, Func * func) |
| { |
| IntConstType cookie = 0; |
| switch (type) |
| { |
| case TyInt8: |
| cookie = (int8)Math::Rand(); |
| break; |
| case TyUint8: |
| cookie = (uint8)Math::Rand(); |
| break; |
| case TyInt16: |
| cookie = (int16)Math::Rand(); |
| break; |
| case TyUint16: |
| cookie = (uint16)Math::Rand(); |
| break; |
| #if TARGET_32 |
| case TyVar: |
| #endif |
| case TyInt32: |
| cookie = (int32)Math::Rand(); |
| break; |
| case TyUint32: |
| cookie = (uint32)Math::Rand(); |
| break; |
| #if TARGET_64 |
| case TyVar: |
| case TyInt64: |
| case TyUint64: |
| cookie = Math::Rand(); |
| break; |
| #endif |
| default: |
| Assume(UNREACHED); |
| } |
| IR::IntConstOpnd * cookieOpnd = IR::IntConstOpnd::New(cookie, type, func); |
| |
| #if DBG_DUMP |
| cookieOpnd->SetName(_u("cookie")); |
| #endif |
| return cookieOpnd; |
| } |
| |
| IntConstType |
| Security::EncodeValue(IR::Instr * instr, IR::Opnd *opnd, IntConstType constValue, _Out_ IR::RegOpnd **pNewOpnd) |
| { |
| if (opnd->GetType() == TyInt32 || opnd->GetType() == TyInt16 || opnd->GetType() == TyInt8 |
| #if TARGET_32 |
| || opnd->GetType() == TyVar |
| #endif |
| ) |
| { |
| IR::RegOpnd *regOpnd = IR::RegOpnd::New(StackSym::New(opnd->GetType(), instr->m_func), opnd->GetType(), instr->m_func); |
| IR::Instr * instrNew = Lowerer::InsertMove(regOpnd, opnd, instr); |
| IR::IntConstOpnd * cookieOpnd = BuildCookieOpnd(opnd->GetType(), instr->m_func); |
| instrNew = IR::Instr::New(LowererMD::MDXorOpcode, regOpnd, regOpnd, cookieOpnd, instr->m_func); |
| instr->InsertBefore(instrNew); |
| LowererMD::Legalize(instrNew); |
| |
| StackSym * stackSym = regOpnd->m_sym; |
| Assert(!stackSym->m_isSingleDef); |
| Assert(stackSym->m_instrDef == nullptr); |
| stackSym->m_isEncodedConstant = true; |
| stackSym->constantValue = (int32)constValue; |
| |
| *pNewOpnd = regOpnd; |
| |
| int32 value = (int32)constValue; |
| value = value ^ cookieOpnd->AsInt32(); |
| return value; |
| } |
| else if (opnd->GetType() == TyUint32 || opnd->GetType() == TyUint16 || opnd->GetType() == TyUint8) |
| { |
| IR::RegOpnd *regOpnd = IR::RegOpnd::New(StackSym::New(opnd->GetType(), instr->m_func), opnd->GetType(), instr->m_func); |
| IR::Instr * instrNew = Lowerer::InsertMove(regOpnd, opnd, instr); |
| |
| IR::IntConstOpnd * cookieOpnd = BuildCookieOpnd(opnd->GetType(), instr->m_func); |
| |
| instrNew = IR::Instr::New(LowererMD::MDXorOpcode, regOpnd, regOpnd, cookieOpnd, instr->m_func); |
| instr->InsertBefore(instrNew); |
| LowererMD::Legalize(instrNew); |
| |
| StackSym * stackSym = regOpnd->m_sym; |
| Assert(!stackSym->m_isSingleDef); |
| Assert(stackSym->m_instrDef == nullptr); |
| stackSym->m_isEncodedConstant = true; |
| stackSym->constantValue = (uint32)constValue; |
| |
| *pNewOpnd = regOpnd; |
| |
| uint32 value = (uint32)constValue; |
| value = value ^ cookieOpnd->AsUint32(); |
| return (IntConstType)value; |
| } |
| else |
| { |
| #if TARGET_64 |
| return this->EncodeAddress(instr, opnd, constValue, pNewOpnd); |
| #else |
| Assert(false); |
| // (Prefast warning on failure to assign *pNewOpnd.) |
| *pNewOpnd = nullptr; |
| return 0; |
| #endif |
| } |
| } |
| |
| #if TARGET_64 |
| size_t |
| Security::EncodeAddress(IR::Instr * instr, IR::Opnd *opnd, size_t value, _Out_ IR::RegOpnd **pNewOpnd) |
| { |
| IR::Instr *instrNew = nullptr; |
| IR::RegOpnd *regOpnd = IR::RegOpnd::New(TyMachReg, instr->m_func); |
| |
| instrNew = Lowerer::InsertMove(regOpnd, opnd, instr); |
| |
| IR::IntConstOpnd *cookieOpnd = BuildCookieOpnd(TyMachReg, instr->m_func); |
| instrNew = IR::Instr::New(LowererMD::MDXorOpcode, regOpnd, regOpnd, cookieOpnd, instr->m_func); |
| instr->InsertBefore(instrNew); |
| LowererMD::Legalize(instrNew); |
| |
| StackSym * stackSym = regOpnd->m_sym; |
| Assert(!stackSym->m_isSingleDef); |
| Assert(stackSym->m_instrDef == nullptr); |
| stackSym->m_isEncodedConstant = true; |
| stackSym->constantValue = value; |
| |
| *pNewOpnd = regOpnd; |
| return value ^ cookieOpnd->GetValue(); |
| } |
| #endif |
