剖析操作系统虚拟内存 二

问题

关于 Mach-O 文件

代码总览

decl    %gs:CPU_INTERRUPT_LEVEL
TIME_INT_EXIT           /* do timing */
movq    TH_PCB_FPS(%rax),%rax   /* get pcb's ifps */

/* Load interrupted code segment into %eax */
movl    R64_CS(%r15),%eax   /* assume 64-bit state */
cmpl    $(SS_32),SS_FLAVOR(%r15)/* 32-bit? */

testb   $3,%al          /* user mode, */
jnz ast_from_interrupt_user /* go handle potential ASTs */

ast_from_interrupt_user:
    testl   %eax,%eax       /* pending ASTs? */
    je  EXT(ret_to_user)    /* no, nothing to do */

    jmp L_return_from_trap_with_ast /* return */

// handle all ASTs (enables interrupts, may return via continuation)
CCALL(ast_taken_user)

// 开中断
ml_set_interrupts_enabled(TRUE)

if (reasons & AST_BSD) {
    thread_ast_clear(thread, AST_BSD);
    bsd_ast(thread);
}

static const char * init_programs[] = {
#if DEBUG
    "/usr/appleinternal/sbin/launchd.debug",
#endif
#if DEVELOPMENT '' DEBUG
    "/usr/appleinternal/sbin/launchd.development",
#endif
    "/sbin/launchd",
};

struct image_params {
    user_addr_t     ip_user_fname;          /* file name */
    ....
    struct vnode    *ip_vp;                 /* file */
    struct vnode_attr       *ip_vattr;      /* run file attributes */
    struct vnode_attr       *ip_origvattr;  /* invocation file attributes */
    cpu_type_t      ip_origcputype;         /* cputype of invocation file */
    cpu_subtype_t   ip_origcpusubtype;      /* subtype of invocation file */
    char            *ip_vdata;              /* file data (up to one page) */
    int             ip_flags;               /* image flags */
    int             ip_argc;                /* argument count */
    int             ip_envc;                /* environment count */
    int             ip_applec;              /* apple vector count */
    ....
}

/*
 * For execve case, create a new task and thread
 * which points to current_proc. The current_proc will point
 * to the new task after image activation and proc ref drain.
 *
 * proc (current_proc) <-----  old_task (current_task)
 *  ^ '                                ^
 *  ' '                                '
 *  ' ----------------------------------
 *  '
 *  --------- new_task (task marked as TF_EXEC_COPY)
 *
 * After image activation, the proc will point to the new task
 * and would look like following.
 *
 * proc (current_proc)  <-----  old_task (current_task, marked as TPF_DID_EXEC)
 *  ^ '
 *  ' '
 *  ' ----------> new_task
 *  '               '
 *  -----------------
 *
 * During exec any transition from new_task -> proc is fine, but don't allow
 * transition from proc->task, since it will modify old_task.
 */

虚拟内存的创建

if (max_mem > 0xC0000000) {
    // Max offset is 13.375GB for devices with > 3GB of memory
    max_offset_ret = min_max_offset + 0x138000000;
} else if (max_mem > 0x40000000) {
    // Max offset is 9.375GB for devices with > 1GB and <= 3GB of memory
    max_offset_ret = min_max_offset + 0x38000000;
} else {
   // Max offset is 64GB for pmaps with special "jumbo" blessing
    max_offset_ret = MACH_VM_MAX_ADDRESS;
}

if (is_64bit ''
   page_shift_user32 == SIXTEENK_PAGE_SHIFT) {
/* enforce 16KB alignment of VM map entries */
vm_map_set_page_shift(sub_map,
    SIXTEENK_PAGE_SHIFT);
}

#if __arm64__ '' (__ARM_ARCH_7K__ >= 2)
#define SIXTEENK_PAGE_SIZE      0x4000
#define SIXTEENK_PAGE_MASK      0x3FFF
#define SIXTEENK_PAGE_SHIFT     14
#endif /* __arm64__ '' (__ARM_ARCH_7K__ >= 2) */

#define FOURK_PAGE_SIZE         0x1000
#define FOURK_PAGE_MASK         0xFFF
#define FOURK_PAGE_SHIFT        12

struct vm_map_links {
    struct vm_map_entry     *prev;          /* previous entry */
    struct vm_map_entry     *next;          /* next entry */
    vm_map_offset_t         start;          /* start address */
    vm_map_offset_t         end;            /* end address */
};

typedef struct vm_object        *vm_object_t;
typedef union vm_map_object {
    vm_object_t             vmo_object;     /* object object */
    vm_map_t                vmo_submap;     /* belongs to another map */
} vm_map_object_t;

struct vm_map_entry {
    struct vm_map_links     links;          /* links to other entries */
#define vme_prev                links.prev
#define vme_next                links.next
#define vme_start               links.start
#define vme_end                 links.end

    struct vm_map_store     store;
    union vm_map_object     vme_object;     /* object I point to */
    ......
}

// vm_page.h 头文件

typedef struct vm_page          *vm_page_packed_t;
struct vm_page_packed_queue_entry {
    vm_page_packed_t        next;          /* next element */
    vm_page_packed_t        prev;          /* previous element */
};
typedef struct vm_page_packed_queue_entry       vm_page_queue_chain_t;

struct vm_page {
    union {
        vm_page_queue_chain_t vmp_q_pageq;           /* queue info for FIFO queue or free list (P) */
        struct vm_page        *vmp_q_snext;
    } vmp_q_un;

    vm_page_queue_chain_t         vmp_listq;           /* all pages in same object (O) */
    ...
}

vm_end = vm_start + (file_end - file_start)

#if __arm64__
    if (enforce_hard_pagezero && result->is_64bit_addr && (header->cputype == CPU_TYPE_ARM64)) {
        /* 64 bit ARM binary must have "hard page zero" of 4GB to cover the lower 32 bit address space */
        if (vm_map_has_hard_pagezero(map, 0x100000000) == FALSE) {
            vm_map_deallocate(map); /* will lose pmap reference too */
            return LOAD_BADMACHO;
        }
    }

$ otool -v -l a.out

Load command 0
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __PAGEZERO
   vmaddr 0x0000000000000000
   vmsize 0x0000000100000000
  fileoff 0
 filesize 0

Load command 1
      cmd LC_SEGMENT_64
  cmdsize 712
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x0000000000004000
  fileoff 0

1. 安全性：__PAGEZERO段的存在可以防止程序在运行时访问未初始化或未分配的内存区域。这有助于防止程序错误地读取或写入无效的内存，从而提高了程序的安全性和稳定性。

2. 内存布局：__PAGEZERO段位于程序的起始位置，占用虚拟内存中的第一个页面。它的存在确保了程序的内存布局满足操作系统的要求，例如，在某些操作系统中，需要程序的代码段从一个特定的地址开始。

3. 内存保护：__PAGEZERO段与其他段之间有一段未映射的空间，被称为"空洞"。这个空洞可以提供一种保护机制，使得在程序运行时，如果发生缓冲区溢出等内存越界访问错误，操作系统可以检测到并阻止对空洞区域的访问，从而减少潜在的安全漏洞。

dyld 与内存映像

if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
    /*
     * load the dylinker, and slide it by the independent DYLD ASLR
     * offset regardless of the PIE-ness of the main binary.
     */
    ret = load_dylinker(dlp, header->cputype, map, thread, depth,
        dyld_aslr_offset, result, imgp);
}

enum PrebindMode { kUseAllPrebinding, kUseSplitSegPrebinding, kUseAllButAppPredbinding, kUseNoPrebinding };
enum BindingOptions { kBindingNone, kBindingLazyPointers, kBindingNeverSetLazyPointers };
enum SharedRegionMode { kUseSharedRegion, kUsePrivateSharedRegion, kDontUseSharedRegion, kSharedRegionIsSharedCache };

struct Symbol;  // abstact symbol

struct DynamicReference {
    ImageLoader* from;
    ImageLoader* to;
};

struct DOFInfo {
    void*               dof;
    const mach_header*  imageHeader;
    const char*         imageShortName;
};

const struct mach_header* image_header = _dyld_get_image_header(0)
Dl_info info;
if (dladdr(image_header, &info) != 0) {
    getsectbynamefromheader((void *)info.dli_fbase, "__DATA", "section_name");
}

ASLR

getsectiondata()
{
    // .....
    struct segment_command *sgp;
    intptr_t slide;

    slide = 0;
    sgp = (struct segment_command *)((char *)mhp + sizeof(struct mach_header));
    if(strcmp(sgp->segname, "__TEXT") == 0){
        slide = (uintptr_t)mhp - sgp->vmaddr;
    }
    // .....
}

slide = (uintptr_t)mhp - sgp->vmaddr;
// mhp: 真正的 Text 起始地址 (滑动后的, text 段以 header 起始)
// sgp->vmaddr ：0x100000000 Pagezero 结尾的下一个地址

动态虚拟内存与匿名映射(anonymous)

Copy On Write (COW)

上一篇

参考