Skip to content

Commit 795dfd6

Browse files
MaschellMaschell
committed
Avoid jump data heap corruption by flushing the whole heap
1 parent 42f3b1e commit 795dfd6

5 files changed

Lines changed: 118 additions & 10 deletions

File tree

‎source/PatchedFunctionData.cpp‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include "PatchedFunctionData.h"
22
#include "utils/KernelFindExport.h"
3+
#include "utils/globals.h"
34
#include "utils/utils.h"
45
#include <coreinit/mcp.h>
56
#include <coreinit/title.h>
@@ -102,16 +103,14 @@ bool PatchedFunctionData::allocateDataForJumps() {
102103
}
103104
if (this->replacementFunctionAddress > 0x01FFFFFC || this->targetProcess != FP_TARGET_PROCESS_ALL) {
104105
this->jumpDataSize = 15; // We could predict the actual size and save some memory, but at the moment we don't need it.
105-
this->jumpData = (uint32_t *) MEMAllocFromExpHeapEx(this->heapHandle, this->jumpDataSize * sizeof(uint32_t), 4);
106+
this->jumpData = (uint32_t *) MEMAllocFromExpHeapEx(this->heapHandle, this->jumpDataSize * sizeof(uint32_t), 0x20);
106107

107108
if (!this->jumpData) {
108109
DEBUG_FUNCTION_LINE_ERR("Failed to alloc jump data");
109110
return false;
110111
}
111112
}
112-
113-
this->jumpToOriginal = (uint32_t *) MEMAllocFromExpHeapEx(this->heapHandle, 0x5 * sizeof(uint32_t), 4);
114-
113+
this->jumpToOriginal = (uint32_t *) MEMAllocFromExpHeapEx(this->heapHandle, 0x5 * sizeof(uint32_t), 0x20);
115114
if (!this->jumpToOriginal) {
116115
DEBUG_FUNCTION_LINE_ERR("Failed to alloc jump data");
117116
return false;
@@ -244,10 +243,11 @@ void PatchedFunctionData::generateJumpToOriginal() {
244243
this->jumpToOriginal[1] = 0x48000002 | (jumpToAddress & 0x01FFFFFC);
245244
}
246245

247-
DCFlushRange((void *) this->jumpToOriginal, sizeof(uint32_t) * 5);
248-
ICInvalidateRange((void *) this->jumpToOriginal, sizeof(uint32_t) * 5);
246+
DCFlushRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
247+
ICInvalidateRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
249248

250249
*(this->realCallFunctionAddressPtr) = (uint32_t) this->jumpToOriginal;
250+
251251
OSMemoryBarrier();
252252
}
253253

@@ -311,8 +311,8 @@ void PatchedFunctionData::generateReplacementJump() {
311311

312312
this->replaceWithInstruction = 0x48000002 | ((uint32_t) this->jumpData & 0x01FFFFFC);
313313

314-
DCFlushRange((void *) this->jumpData, sizeof(uint32_t) * 15);
315-
ICInvalidateRange((void *) this->jumpData, sizeof(uint32_t) * 15);
314+
DCFlushRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
315+
ICInvalidateRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
316316
}
317317

318318
DCFlushRange((void *) &replaceWithInstruction, 4);
@@ -330,6 +330,9 @@ PatchedFunctionData::~PatchedFunctionData() {
330330
MEMFreeToExpHeap(this->heapHandle, this->jumpData);
331331
this->jumpData = nullptr;
332332
}
333+
334+
DCFlushRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
335+
ICInvalidateRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
333336
}
334337

335338
bool PatchedFunctionData::shouldBePatched() const {

‎source/function_patcher.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ bool RestoreFunction(std::shared_ptr<PatchedFunctionData> &patchedFunction) {
101101
return false;
102102
}
103103

104+
DCFlushRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
105+
ICInvalidateRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
106+
104107
auto targetAddrPhys = (uint32_t) patchedFunction->realPhysicalFunctionAddress;
105108

106109
if (patchedFunction->library != LIBRARY_OTHER) {
@@ -137,6 +140,9 @@ bool RestoreFunction(std::shared_ptr<PatchedFunctionData> &patchedFunction) {
137140
ICInvalidateRange((void *) patchedFunction->realEffectiveFunctionAddress, 4);
138141
DCFlushRange((void *) patchedFunction->realEffectiveFunctionAddress, 4);
139142

143+
DCFlushRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
144+
ICInvalidateRange(gJumpHeapData, JUMP_HEAP_DATA_SIZE);
145+
140146
patchedFunction->isPatched = false;
141147
return true;
142148
}

‎source/main.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ WUMS_INITIALIZE() {
113113
}
114114

115115
memset(gJumpHeapData, 0, JUMP_HEAP_DATA_SIZE);
116-
gJumpHeapHandle = MEMCreateExpHeapEx((void *) (gJumpHeapData), JUMP_HEAP_DATA_SIZE, 1);
116+
gJumpHeapHandle = MEMCreateExpHeapEx((void *) (gJumpHeapData), JUMP_HEAP_DATA_SIZE, MEM_HEAP_FLAG_USE_LOCK);
117117
if (gJumpHeapHandle == nullptr) {
118118
DEBUG_FUNCTION_LINE_ERR("Failed to create heap for jump data");
119119
OSFatal("FunctionPatcherModule: Failed to create heap for jump data");
@@ -177,6 +177,8 @@ WUMS_APPLICATION_STARTS() {
177177
OSMemoryBarrier();
178178
OSDynLoad_AddNotifyCallback(notify_callback, nullptr);
179179
}
180+
181+
CheckMemExpHeapJumpData();
180182
}
181183

182184
WUMS_APPLICATION_REQUESTS_EXIT() {

‎source/utils/utils.cpp‎

Lines changed: 96 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
1+
#include "CThread.h"
2+
#include "globals.h"
3+
#include "logger.h"
4+
5+
16
#include <coreinit/cache.h>
7+
#include <coreinit/core.h>
8+
#include <coreinit/memexpheap.h>
29
#include <coreinit/memorymap.h>
310
#include <kernel/kernel.h>
411

@@ -25,4 +32,92 @@ bool ReadFromPhysicalAddress(uint32_t srcPhys, uint32_t *out) {
2532
DCFlushRange((void *) &currentInstruction, 4);
2633
*out = currentInstruction;
2734
return true;
28-
}
35+
}
36+
37+
bool CheckMemExpHeapBlock(MEMExpHeap *heap, MEMExpHeapBlockList *block, uint32_t tag, const char *listName, uint32_t &totalSizeOut) {
38+
MEMExpHeapBlock *prevBlock = nullptr;
39+
for (auto *cur = block->head; cur != nullptr; cur = cur->next) {
40+
if (cur->prev != prevBlock) {
41+
DEBUG_FUNCTION_LINE_ERR("[Exp Heap Check] \"%s\" prev is invalid. expected %p actual %p", listName, prevBlock, cur->prev);
42+
43+
return false;
44+
}
45+
if (cur < heap->header.dataStart || cur > heap->header.dataEnd || ((uint32_t) cur + sizeof(MEMExpHeapBlock) + cur->blockSize) > (uint32_t) heap->header.dataEnd) {
46+
DEBUG_FUNCTION_LINE_ERR("[Exp Heap Check] Block is not inside heap. block: %p size %d; heap start %p heap end %p", cur, sizeof(MEMExpHeapBlock) + cur->blockSize, heap->header.dataStart, heap->header.dataEnd);
47+
48+
return false;
49+
}
50+
if (cur->tag != tag) {
51+
DEBUG_FUNCTION_LINE_ERR("[%p][%d][Exp Heap Check] Invalid block tag expected %04X, actual %04X", &cur->tag, OSGetCoreId(), tag, cur->tag);
52+
53+
return false;
54+
}
55+
56+
totalSizeOut = totalSizeOut + cur->blockSize + (cur->attribs >> 8 & 0x7fffff) + sizeof(MEMExpHeapBlock);
57+
prevBlock = cur;
58+
}
59+
if (prevBlock != block->tail) {
60+
DEBUG_FUNCTION_LINE_ERR("[Exp Heap Check] \"%s\" tail is unexpected! expected %p, actual %p", listName, heap->usedList.tail, prevBlock);
61+
62+
return false;
63+
}
64+
return true;
65+
}
66+
67+
bool CheckMemExpHeapCore(MEMExpHeap *heap) {
68+
uint32_t totalSize = 0;
69+
#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
70+
if (!CheckMemExpHeapBlock(heap, &heap->usedList, 0x5544, "used", totalSize)) {
71+
return false;
72+
}
73+
74+
#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
75+
if (!CheckMemExpHeapBlock(heap, &heap->freeList, 0x4652, "free", totalSize)) {
76+
return false;
77+
}
78+
79+
if (totalSize != (uint32_t) heap->header.dataEnd - (uint32_t) heap->header.dataStart) {
80+
DEBUG_FUNCTION_LINE_ERR("[Exp Heap Check] heap size is unexpected! expected %08X, actual %08X", (uint32_t) heap->header.dataEnd - (uint32_t) heap->header.dataStart, totalSize);
81+
return false;
82+
}
83+
return true;
84+
}
85+
86+
87+
bool CheckMemExpHeap(MEMExpHeap *heap) {
88+
89+
OSMemoryBarrier();
90+
if (heap->header.tag != MEM_EXPANDED_HEAP_TAG) {
91+
DEBUG_FUNCTION_LINE_ERR("[Exp Heap Check] Invalid heap handle. - %08X", heap->header.tag);
92+
return false;
93+
}
94+
95+
if (heap->header.flags & MEM_HEAP_FLAG_USE_LOCK) {
96+
#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
97+
OSUninterruptibleSpinLock_Acquire(&(heap->header).lock);
98+
}
99+
100+
auto result = CheckMemExpHeapCore(heap);
101+
102+
if (heap->header.flags & MEM_HEAP_FLAG_USE_LOCK) {
103+
#pragma GCC diagnostic ignored "-Waddress-of-packed-member"
104+
OSUninterruptibleSpinLock_Release(&(heap->header).lock);
105+
}
106+
107+
return result;
108+
}
109+
110+
111+
static void CheckMemExpHeapJumpDataCallback(CThread *, void *) {
112+
if (gJumpHeapHandle != nullptr) {
113+
if (!CheckMemExpHeap(reinterpret_cast<MEMExpHeap *>(gJumpHeapHandle))) {
114+
OSFatal("FunctionPatcherModule: Corrupted heap");
115+
} else {
116+
DEBUG_FUNCTION_LINE_VERBOSE("JumpData heap has no curruption. Checked on core %d", OSGetCoreId());
117+
}
118+
}
119+
}
120+
121+
void CheckMemExpHeapJumpData() {
122+
CThread::runOnAllCores(CheckMemExpHeapJumpDataCallback, nullptr, 0, 16, 0x1000);
123+
}

‎source/utils/utils.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,5 @@ std::shared_ptr<T> make_shared_nothrow(Args &&...args) noexcept(noexcept(T(std::
1212
}
1313

1414
bool ReadFromPhysicalAddress(uint32_t srcPhys, uint32_t *out);
15+
16+
void CheckMemExpHeapJumpData();

0 commit comments

Comments
 (0)