[PATCH] D19908: [X86] Support the "ms-hotpatch" attribute.

Charles Davis via llvm-commits llvm-commits at lists.llvm.org
Wed May 4 01:47:38 PDT 2016


cdavis5x created this revision.
cdavis5x added reviewers: rnk, majnemer.
cdavis5x added a subscriber: llvm-commits.

Based on two patches by Michael Mueller.

This is a target attribute that causes a function marked with it to be
emitted as "hotpatchable". This particular mechanism was originally
devised by Microsoft for patching their binaries (which they are
constantly updating to stay ahead of crackers, script kiddies, and other
ne'er-do-wells on the Internet), but is now commonly abused by Windows
programs to hook API functions.

This mechanism is target-specific. For x86, a two-byte no-op instruction
is emitted at the function's entry point; the entry point must be
immediately preceded by 64 (32-bit) or 128 (64-bit) bytes of padding.
This padding is where the patch code is written. The two byte no-op is
then overwritten with a short jump into this code. The no-op is usually
a `movl %edi, %edi` instruction; this is used as a magic value
indicating that this is a hotpatchable function.

http://reviews.llvm.org/D19908

Files:
  lib/Target/X86/X86AsmPrinter.cpp
  lib/Target/X86/X86AsmPrinter.h
  lib/Target/X86/X86FrameLowering.cpp
  lib/Target/X86/X86ISelLowering.cpp
  test/CodeGen/X86/ms-hotpatch-attr.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D19908.56107.patch
Type: text/x-patch
Size: 4933 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20160504/264e0d94/attachment.bin>


More information about the llvm-commits mailing list