Handle LDR literal,SIMD instruction

googleprojectzero · Sep 20, 2023 · e9ef262 · e9ef262
1 parent 4fbe9c8
commit e9ef262
Show file tree

Hide file tree

Showing 4 changed files with 56 additions and 0 deletions.
diff --git a/arch/arm64/arm64_assembler.cpp b/arch/arm64/arm64_assembler.cpp
@@ -469,6 +469,7 @@ static int32_t GetRipRelativeOffset(Instruction &inst) {
 
     case arm64::Opcode::kLdrLiteral:
     case arm64::Opcode::kLdrsLiteral:
+    case arm64::Opcode::kSimdLdrLiteral:
       off64 =
           std::get<arm64::ImmediateOffset>(inst.instr.operands[1]).offset.value;
       break;
@@ -497,6 +498,7 @@ bool Arm64Assembler::IsRipRelative(ModuleInfo *module, Instruction &inst,
   switch (inst.instr.opcode) {
     case arm64::kLdrLiteral:
     case arm64::kLdrsLiteral:
+    case arm64::kSimdLdrLiteral:
     case arm64::kAdr:
       pc_relative = true;
       offset = GetRipRelativeOffset(inst);
@@ -579,6 +581,11 @@ void Arm64Assembler::FixInstructionAndOutput(
       break;
     }
 
+    case arm64::Opcode::kSimdLdrLiteral: {
+      TranslateSimdLdrLiteral(module, inst, input, input_address_remote);
+      break;
+    }
+
     case arm64::Opcode::kLdrsLiteral: {
       FATAL("arm64::kLdrsLiteral");
       break;
@@ -596,6 +603,29 @@ void Arm64Assembler::FixInstructionAndOutput(
   }
 }
 
+void Arm64Assembler::TranslateSimdLdrLiteral(ModuleInfo *module,
+                             Instruction &inst,
+                             const unsigned char *input,
+                             const unsigned char *input_address_remote)
+{
+  // push X0
+  OffsetStack(module, -tinyinst_.sp_offset - 16);
+  WriteRegStack(module, Register::X0, 0);
+
+  //load address into X0;
+  uint64_t addr = (uint64_t)input_address_remote;
+  addr += GetRipRelativeOffset(inst);
+  EmitLoadLit(module, X0, 64, false, addr);
+
+  uint32_t orig_instr = *(uint32_t *)input;
+  uint32_t fixed_instr = ldr_simd_x0_from_ldr_simd_literal(orig_instr);
+  tinyinst_.WriteCode(module, &fixed_instr, sizeof(fixed_instr));
+
+  // pop X0
+  ReadRegStack(module, Register::X0, 0);
+  OffsetStack(module, tinyinst_.sp_offset + 16);
+}
+
 void Arm64Assembler::InstrumentRet(
     const char *address, ModuleInfo *module, std::set<char *> *queue,
     std::list<std::pair<uint32_t, uint32_t>> *offset_fixes, Instruction &inst,

diff --git a/arch/arm64/arm64_assembler.h b/arch/arm64/arm64_assembler.h
@@ -69,6 +69,11 @@ class Arm64Assembler : public Assembler {
   uint8_t GetIndirectTarget(Instruction &inst, uint8_t *is_pac);
   void MovIndirectTarget(ModuleInfo *module, uint8_t target_address_reg, uint8_t is_pac);
 
+  void TranslateSimdLdrLiteral(ModuleInfo *module,
+                               Instruction &inst,
+                               const unsigned char *input,
+                               const unsigned char *input_address_remote);
+
   void ReadStack(ModuleInfo *module, int32_t offset);
   void WriteStack(ModuleInfo *module, int32_t offset);
 

diff --git a/arch/arm64/arm64_helpers.cpp b/arch/arm64/arm64_helpers.cpp
@@ -460,3 +460,23 @@ uint32_t b(size_t instr_address, size_t address) {
 uint32_t bl(size_t instr_address, size_t address) {
   return branch_imm(instr_address, address, true);
 }
+
+uint32_t ldr_simd_x0_from_ldr_simd_literal(uint32_t orig_inst) {
+  uint32_t instr = orig_inst & 0x1F;
+  instr |= 0x3C400000;
+  uint32_t opc = (orig_inst & 0xC0000000) >> 30;
+  if(opc == 0b00) {
+    // 32-bit
+    instr |= bits(31, 30, 0b10);
+    instr |= bits(23, 22, 0b01);
+  } else if (opc == 0b01) {
+    instr |= bits(31, 30, 0b11);
+    instr |= bits(23, 22, 0b01);
+  } else if (opc == 0b10) {
+    instr |= bits(31, 30, 0b00);
+    instr |= bits(23, 22, 0b11);
+  } else {
+    FATAL("Incorrect ldr_simd_literal instruction");
+  }
+  return instr;
+}
diff --git a/arch/arm64/arm64_helpers.h b/arch/arm64/arm64_helpers.h
@@ -57,5 +57,6 @@ uint32_t bl(size_t instr_address, size_t address);
 uint32_t br(Register dst_reg);
 uint32_t b_cond(const std::string &cond, int32_t off);
 
+uint32_t ldr_simd_x0_from_ldr_simd_literal(uint32_t orig_inst);
 
 #endif  // ARCH_ARM64_ARM64_HELPERS_H