feat(PE): parse TLS directory

Author: Dax89

mz/CMakeLists.txt

@@ -35,6 +35,7 @@ target_sources(${PROJECT_NAME}
         pe/dirs/exports.c
         pe/dirs/imports.c
         pe/dirs/resources.c
+        pe/dirs/tls.c
         pe/classifier.c
         pe/format.c
         pe/pe.c

mz/pe/dirs/tls.c

@@ -0,0 +1,116 @@
+#include "tls.h"
+#include <inttypes.h>
+
+// Sanity cap on the callback array walk: real binaries have a handful of
+// callbacks at most.
+// This only exists to keep a corrupted/malicious
+// AddressOfCallBacks from spinning far past anything plausible before the
+// reader's own EOF handling would eventually stop it.
+#define PE_TLS_MAX_CALLBACKS 256
+
+static bool _pe_read_tls_dir32(RDReader* r, PETlsDirectory32* v) {
+    rd_reader_read_le32(r, &v->StartAddressOfRawData);
+    rd_reader_read_le32(r, &v->EndAddressOfRawData);
+    rd_reader_read_le32(r, &v->AddressOfIndex);
+    rd_reader_read_le32(r, &v->AddressOfCallBacks);
+    rd_reader_read_le32(r, &v->SizeOfZeroFill);
+    rd_reader_read_le32(r, &v->Characteristics);
+    return !rd_reader_has_error(r);
+}
+
+static bool _pe_read_tls_dir64(RDReader* r, PETlsDirectory64* v) {
+    rd_reader_read_le64(r, &v->StartAddressOfRawData);
+    rd_reader_read_le64(r, &v->EndAddressOfRawData);
+    rd_reader_read_le64(r, &v->AddressOfIndex);
+    rd_reader_read_le64(r, &v->AddressOfCallBacks);
+    rd_reader_read_le32(r, &v->SizeOfZeroFill);
+    rd_reader_read_le32(r, &v->Characteristics);
+    return !rd_reader_has_error(r);
+}
+
+static void _pe_read_tls_callbacks(RDContext* ctx, PEFormat* pe, RDReader* r,
+                                   RDAddress callbacks_va) {
+    if(!callbacks_va) return; // directory present, no callbacks: not an error
+
+    rd_reader_seek(r, callbacks_va);
+    u32 index = 0;
+
+    while(index < PE_TLS_MAX_CALLBACKS) {
+        RDAddress slot_va = (RDAddress)rd_reader_tell(r);
+        RDAddress cb_va;
+        bool ok;
+
+        // pe->thunk_size/thunk_type already encode this module's natural
+        // pointer width (set in pe_set_bits, accounting for the ARM64
+        // special case)
+        if(pe->thunk_size == sizeof(u64)) {
+            u64 v = 0;
+            ok = rd_reader_read_le64(r, &v);
+            cb_va = (RDAddress)v;
+        }
+        else {
+            u32 v = 0;
+            ok = rd_reader_read_le32(r, &v);
+            cb_va = (RDAddress)v;
+        }
+
+        if(!ok || !cb_va)
+            break; // read failure or null terminator: done either way
+
+        rd_library_type(ctx, slot_va, pe->thunk_type, 0, RD_TYPE_PTR);
+
+        // cb_va is already a raw VA (see the note in tls.h)
+        // pe_norm only, never pe_from_rva.
+        RDAddress fn_va = pe_norm(ctx, pe, cb_va);
+        rd_set_function(ctx, fn_va);
+        rd_placeholder_name(ctx, fn_va,
+                            rd_format("tls_callback_%" PRIu32, index));
+
+        index++;
+    }
+}
+
+bool pe_read_tls_dir(RDContext* ctx, PEFormat* pe) {
+    PEDataDirectory d = pe->data_dirs[PE_DIRECTORY_ENTRY_TLS];
+
+    RDAddress va;
+    if(!pe_from_rva(pe, d.VirtualAddress, &va)) return false;
+
+    RDReader* r = rd_get_reader(ctx);
+    rd_reader_seek(r, va);
+
+    RDAddress callbacks_va;
+
+    if(pe->bits == 32) {
+        PETlsDirectory32 tlsdir;
+        if(!_pe_read_tls_dir32(r, &tlsdir)) return false;
+
+        rd_library_type(ctx, va, "PE_TLS_DIRECTORY32", 0, RD_TYPE_NONE);
+
+        if(tlsdir.AddressOfIndex) {
+            rd_library_type(ctx, tlsdir.AddressOfIndex, "u32", 0, RD_TYPE_NONE);
+            rd_library_name(ctx, tlsdir.AddressOfIndex, "_tls_index");
+        }
+
+        callbacks_va = tlsdir.AddressOfCallBacks;
+    }
+    else {
+        PETlsDirectory64 tlsdir;
+        if(!_pe_read_tls_dir64(r, &tlsdir)) return false;
+
+        rd_library_type(ctx, va, "PE_TLS_DIRECTORY64", 0, RD_TYPE_NONE);
+
+        if(tlsdir.AddressOfIndex) {
+            // The TLS slot index itself is always a 32-bit value, even in
+            // the 64-bit directory -- that's the OS's per-module TLS
+            // array index, not a pointer-width quantity.
+            rd_library_type(ctx, tlsdir.AddressOfIndex, "u32", 0, RD_TYPE_NONE);
+            rd_library_name(ctx, tlsdir.AddressOfIndex, "_tls_index");
+        }
+
+        callbacks_va = tlsdir.AddressOfCallBacks;
+    }
+
+    _pe_read_tls_callbacks(ctx, pe, r, callbacks_va);
+    return true;
+}

mz/pe/dirs/tls.h

@@ -0,0 +1,23 @@
+#pragma once
+
+#include "pe/format.h"
+
+typedef struct PETlsDirectory32 {
+    u32 StartAddressOfRawData;
+    u32 EndAddressOfRawData;
+    u32 AddressOfIndex;
+    u32 AddressOfCallBacks;
+    u32 SizeOfZeroFill;
+    u32 Characteristics;
+} PETlsDirectory32;
+
+typedef struct PETlsDirectory64 {
+    u64 StartAddressOfRawData;
+    u64 EndAddressOfRawData;
+    u64 AddressOfIndex;
+    u64 AddressOfCallBacks;
+    u32 SizeOfZeroFill;
+    u32 Characteristics;
+} PETlsDirectory64;
+
+bool pe_read_tls_dir(RDContext* ctx, PEFormat* pe);

mz/pe/pe.c

@@ -7,6 +7,7 @@
 #include "pe/dirs/exports.h"
 #include "pe/dirs/imports.h"
 #include "pe/dirs/resources.h"
+#include "pe/dirs/tls.h"
 #include <inttypes.h>
 #include <string.h>
 
@@ -163,6 +164,7 @@ static bool pe_load(RDLoader* ldr, RDContext* ctx) {
     pe_read_resources_dir(ctx, pe);
     pe_read_exceptions_dir(ctx, pe);
     pe_read_debug_dir(ctx, pe);
+    pe_read_tls_dir(ctx, pe);
     pe_read_config_dir(ctx, pe);
 
     if(pe->fileheader.PointerToSymbolTable && pe->fileheader.NumberOfSymbols) {
@@ -189,7 +191,8 @@ static bool pe_load(RDLoader* ldr, RDContext* ctx) {
             break;
 
         case PE_CLASS_VISUAL_STUDIO:
-            rd_analyzer_enable(ctx, "compiler_rtti_msvc");
+            rd_analyzer_enable(ctx, "compiler_msvc_rtti");
+            rd_analyzer_enable(ctx, "compiler_msvc_eh");
             break;
 
         default: break;