authorgravatar for kubkon@jakubkonka.comJakub Konka <kubkon@jakubkonka.com> 2020-11-20 15:48:44+01:00
committergravatar for kubkon@jakubkonka.comJakub Konka <kubkon@jakubkonka.com> 2020-11-26 11:50:09+01:00
loga6e93da717334b6ee354d162107e00080807ce7c
tree512649225eefdeb8cd4322e18b5e24d047d7dc76
parent9dcf7ee9c904b25fbffd264cabeb6638e9d9e2d6

stage2 macho: generate a code sig (not valid yet)

3 files changed, 82 insertions(+), 26 deletions(-)

lib/std/macho.zig+4-4
...@@ -1384,10 +1384,10 @@ pub const CSTYPE_INDEX_REQUIREMENTS: u32 = 0x00000002;...@@ -1384,10 +1384,10 @@ pub const CSTYPE_INDEX_REQUIREMENTS: u32 = 0x00000002;
1384/// Compat with amfi1384/// Compat with amfi
1385pub const CSTYPE_INDEX_ENTITLEMENTS: u32 = 0x00000005;1385pub const CSTYPE_INDEX_ENTITLEMENTS: u32 = 0x00000005;
13861386
1387pub const CS_HASHTYPE_SHA1: u32 = 1;1387pub const CS_HASHTYPE_SHA1: u8 = 1;
1388pub const CS_HASHTYPE_SHA256: u32 = 2;1388pub const CS_HASHTYPE_SHA256: u8 = 2;
1389pub const CS_HASHTYPE_SHA256_TRUNCATED: u32 = 3;1389pub const CS_HASHTYPE_SHA256_TRUNCATED: u8 = 3;
1390pub const CS_HASHTYPE_SHA384: u32 = 4;1390pub const CS_HASHTYPE_SHA384: u8 = 4;
13911391
1392pub const CS_SHA1_LEN: u32 = 20;1392pub const CS_SHA1_LEN: u32 = 20;
1393pub const CS_SHA256_LEN: u32 = 32;1393pub const CS_SHA256_LEN: u32 = 32;
src/link/MachO.zig+10-4
...@@ -385,8 +385,6 @@ pub fn flushModule(self: *MachO, comp: *Compilation) !void {...@@ -385,8 +385,6 @@ pub fn flushModule(self: *MachO, comp: *Compilation) !void {
385 try self.base.file.?.pwriteAll(mem.spanZ(LIB_SYSTEM_PATH), off);385 try self.base.file.?.pwriteAll(mem.spanZ(LIB_SYSTEM_PATH), off);
386 self.libsystem_cmd_dirty = false;386 self.libsystem_cmd_dirty = false;
387 }387 }
388
389 try self.writecodeSignature();
390 },388 },
391 .Obj => {},389 .Obj => {},
392 .Lib => return error.TODOImplementWritingLibFiles,390 .Lib => return error.TODOImplementWritingLibFiles,
...@@ -430,6 +428,11 @@ pub fn flushModule(self: *MachO, comp: *Compilation) !void {...@@ -430,6 +428,11 @@ pub fn flushModule(self: *MachO, comp: *Compilation) !void {
430 assert(!self.cmd_table_dirty);428 assert(!self.cmd_table_dirty);
431 assert(!self.dylinker_cmd_dirty);429 assert(!self.dylinker_cmd_dirty);
432 assert(!self.libsystem_cmd_dirty);430 assert(!self.libsystem_cmd_dirty);
431
432 switch (self.base.options.output_mode) {
433 .Exe, .Lib => try self.writeCodeSignature(), // code signing always comes last
434 else => {},
435 }
433}436}
434437
435fn linkWithLLD(self: *MachO, comp: *Compilation) !void {438fn linkWithLLD(self: *MachO, comp: *Compilation) !void {
...@@ -1486,6 +1489,9 @@ pub fn populateMissingMetadata(self: *MachO) !void {...@@ -1486,6 +1489,9 @@ pub fn populateMissingMetadata(self: *MachO) !void {
1486 log.debug("found code signature free space 0x{x} to 0x{x}\n", .{ off, off + file_size });1489 log.debug("found code signature free space 0x{x} to 0x{x}\n", .{ off, off + file_size });
1487 code_sig.dataoff = off;1490 code_sig.dataoff = off;
1488 code_sig.datasize = file_size;1491 code_sig.datasize = file_size;
1492
1493 const segment_size = mem.alignForwardGeneric(u64, file_size, self.page_size);
1494 linkedit.vmsize += segment_size;
1489 }1495 }
1490 }1496 }
1491 if (self.dyld_stub_binder_index == null) {1497 if (self.dyld_stub_binder_index == null) {
...@@ -1752,7 +1758,7 @@ fn writeAllUndefSymbols(self: *MachO) !void {...@@ -1752,7 +1758,7 @@ fn writeAllUndefSymbols(self: *MachO) !void {
1752 try self.base.file.?.pwriteAll(mem.sliceAsBytes(self.undef_symbols.items), off);1758 try self.base.file.?.pwriteAll(mem.sliceAsBytes(self.undef_symbols.items), off);
1753}1759}
17541760
1755fn writecodeSignature(self: *MachO) !void {1761fn writeCodeSignature(self: *MachO) !void {
1756 const code_sig_cmd = &self.load_commands.items[self.code_signature_cmd_index.?].LinkeditData;1762 const code_sig_cmd = &self.load_commands.items[self.code_signature_cmd_index.?].LinkeditData;
17571763
1758 var code_sig = CodeSignature.init(self.base.allocator);1764 var code_sig = CodeSignature.init(self.base.allocator);
...@@ -1766,7 +1772,7 @@ fn writecodeSignature(self: *MachO) !void {...@@ -1766,7 +1772,7 @@ fn writecodeSignature(self: *MachO) !void {
1766 code_sig.write(buffer);1772 code_sig.write(buffer);
17671773
1768 try self.base.file.?.pwriteAll(buffer, code_sig_cmd.dataoff);1774 try self.base.file.?.pwriteAll(buffer, code_sig_cmd.dataoff);
1769 try self.base.file.?.pwriteAll(&[_]u8{ 0 }, code_sig_cmd.dataoff + code_sig_cmd.datasize - 1);1775 try self.base.file.?.pwriteAll(&[_]u8{0}, code_sig_cmd.dataoff + code_sig_cmd.datasize - 1);
1770}1776}
17711777
1772fn writeExportTrie(self: *MachO) !void {1778fn writeExportTrie(self: *MachO) !void {
src/link/MachO/CodeSignature.zig+68-18
...@@ -7,19 +7,24 @@ const macho = std.macho;...@@ -7,19 +7,24 @@ const macho = std.macho;
7const mem = std.mem;7const mem = std.mem;
8const testing = std.testing;8const testing = std.testing;
9const Allocator = mem.Allocator;9const Allocator = mem.Allocator;
10const Sha256 = std.crypto.hash.sha2.Sha256;
1011
11const MachO = @import("../MachO.zig");12const MachO = @import("../MachO.zig");
1213
13const Blob = struct {14const hash_size: u8 = 32;
15const page_size: u16 = 0x1000;
16
17const CodeDirectory = struct {
14 inner: macho.CodeDirectory,18 inner: macho.CodeDirectory,
15 data: std.ArrayListUnmanaged(u8) = .{},19 data: std.ArrayListUnmanaged(u8) = .{},
1620
17 fn size(self: Blob) u32 {21 fn size(self: CodeDirectory) u32 {
18 return self.inner.length;22 return self.inner.length;
19 }23 }
2024
21 fn write(self: Blob, buffer: []u8) void {25 fn write(self: CodeDirectory, buffer: []u8) void {
22 assert(buffer.len >= self.inner.length);26 assert(buffer.len >= self.inner.length);
27
23 mem.writeIntBig(u32, buffer[0..4], self.inner.magic);28 mem.writeIntBig(u32, buffer[0..4], self.inner.magic);
24 mem.writeIntBig(u32, buffer[4..8], self.inner.length);29 mem.writeIntBig(u32, buffer[4..8], self.inner.length);
25 mem.writeIntBig(u32, buffer[8..12], self.inner.version);30 mem.writeIntBig(u32, buffer[8..12], self.inner.version);
...@@ -29,10 +34,10 @@ const Blob = struct {...@@ -29,10 +34,10 @@ const Blob = struct {
29 mem.writeIntBig(u32, buffer[24..28], self.inner.nSpecialSlots);34 mem.writeIntBig(u32, buffer[24..28], self.inner.nSpecialSlots);
30 mem.writeIntBig(u32, buffer[28..32], self.inner.nCodeSlots);35 mem.writeIntBig(u32, buffer[28..32], self.inner.nCodeSlots);
31 mem.writeIntBig(u32, buffer[32..36], self.inner.codeLimit);36 mem.writeIntBig(u32, buffer[32..36], self.inner.codeLimit);
32 mem.writeIntBig(u8, buffer[36..37], self.inner.hashSize);37 buffer[36] = self.inner.hashSize;
33 mem.writeIntBig(u8, buffer[37..38], self.inner.hashType);38 buffer[37] = self.inner.hashType;
34 mem.writeIntBig(u8, buffer[38..39], self.inner.platform);39 buffer[38] = self.inner.platform;
35 mem.writeIntBig(u8, buffer[39..40], self.inner.pageSize);40 buffer[39] = self.inner.pageSize;
36 mem.writeIntBig(u32, buffer[40..44], self.inner.spare2);41 mem.writeIntBig(u32, buffer[40..44], self.inner.spare2);
37 mem.writeIntBig(u32, buffer[44..48], self.inner.scatterOffset);42 mem.writeIntBig(u32, buffer[44..48], self.inner.scatterOffset);
38 mem.writeIntBig(u32, buffer[48..52], self.inner.teamOffset);43 mem.writeIntBig(u32, buffer[48..52], self.inner.teamOffset);
...@@ -41,6 +46,8 @@ const Blob = struct {...@@ -41,6 +46,8 @@ const Blob = struct {
41 mem.writeIntBig(u64, buffer[64..72], self.inner.execSegBase);46 mem.writeIntBig(u64, buffer[64..72], self.inner.execSegBase);
42 mem.writeIntBig(u64, buffer[72..80], self.inner.execSegLimit);47 mem.writeIntBig(u64, buffer[72..80], self.inner.execSegLimit);
43 mem.writeIntBig(u64, buffer[80..88], self.inner.execSegFlags);48 mem.writeIntBig(u64, buffer[80..88], self.inner.execSegFlags);
49
50 mem.copy(u8, buffer[88..], self.data.items);
44 }51 }
45};52};
4653
...@@ -50,7 +57,7 @@ inner: macho.SuperBlob = .{...@@ -50,7 +57,7 @@ inner: macho.SuperBlob = .{
50 .length = @sizeOf(macho.SuperBlob),57 .length = @sizeOf(macho.SuperBlob),
51 .count = 0,58 .count = 0,
52},59},
53blob: ?Blob = null,60cdir: ?CodeDirectory = null,
5461
55pub fn init(alloc: *Allocator) CodeSignature {62pub fn init(alloc: *Allocator) CodeSignature {
56 return .{63 return .{
...@@ -60,10 +67,14 @@ pub fn init(alloc: *Allocator) CodeSignature {...@@ -60,10 +67,14 @@ pub fn init(alloc: *Allocator) CodeSignature {
6067
61pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {68pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {
62 const text_segment = bin_file.load_commands.items[bin_file.text_segment_cmd_index.?].Segment;69 const text_segment = bin_file.load_commands.items[bin_file.text_segment_cmd_index.?].Segment;
70 const data_segment = bin_file.load_commands.items[bin_file.data_segment_cmd_index.?].Segment;
71 const linkedit_segment = bin_file.load_commands.items[bin_file.linkedit_segment_cmd_index.?].Segment;
72 const symtab = bin_file.load_commands.items[bin_file.symtab_cmd_index.?].Symtab;
73
63 const execSegBase: u64 = text_segment.fileoff;74 const execSegBase: u64 = text_segment.fileoff;
64 const execSegLimit: u64 = text_segment.filesize;75 const execSegLimit: u64 = text_segment.filesize;
65 const execSegFlags: u64 = text_segment.flags;76 const execSegFlags: u64 = if (bin_file.base.options.output_mode == .Exe) macho.CS_EXECSEG_MAIN_BINARY else 0;
66 var blob = Blob{77 var cdir = CodeDirectory{
67 .inner = .{78 .inner = .{
68 .magic = macho.CSMAGIC_CODEDIRECTORY,79 .magic = macho.CSMAGIC_CODEDIRECTORY,
69 .length = @sizeOf(macho.CodeDirectory),80 .length = @sizeOf(macho.CodeDirectory),
...@@ -74,10 +85,10 @@ pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {...@@ -74,10 +85,10 @@ pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {
74 .nSpecialSlots = 0,85 .nSpecialSlots = 0,
75 .nCodeSlots = 0,86 .nCodeSlots = 0,
76 .codeLimit = 0,87 .codeLimit = 0,
77 .hashSize = 0,88 .hashSize = hash_size,
78 .hashType = 0,89 .hashType = macho.CS_HASHTYPE_SHA256,
79 .platform = 0,90 .platform = 0,
80 .pageSize = 0,91 .pageSize = @truncate(u8, std.math.log2(page_size)),
81 .spare2 = 0,92 .spare2 = 0,
82 .scatterOffset = 0,93 .scatterOffset = 0,
83 .teamOffset = 0,94 .teamOffset = 0,
...@@ -88,9 +99,48 @@ pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {...@@ -88,9 +99,48 @@ pub fn calcAdhocSignature(self: *CodeSignature, bin_file: *const MachO) !void {
88 .execSegFlags = execSegFlags,99 .execSegFlags = execSegFlags,
89 },100 },
90 };101 };
91 self.inner.length += @sizeOf(macho.BlobIndex) + blob.size();102
103 const file_size = symtab.stroff + symtab.strsize;
104 const total_pages = mem.alignForward(file_size, page_size) / page_size;
105 log.debug("Total file size: {}; total number of pages: {}\n", .{ file_size, total_pages });
106
107 var hash: [hash_size]u8 = undefined;
108 var buffer = try bin_file.base.allocator.alloc(u8, page_size);
109 defer bin_file.base.allocator.free(buffer);
110 const macho_file = bin_file.base.file.?;
111
112 const id = bin_file.base.options.emit.?.sub_path;
113 try cdir.data.ensureCapacity(self.alloc, total_pages * hash_size + id.len + 1);
114
115 // 1. Save the identifier and update offsets
116 cdir.inner.identOffset = cdir.inner.length;
117 cdir.data.appendSliceAssumeCapacity(id);
118 cdir.data.appendAssumeCapacity(0);
119
120 // 2. Calculate hash for each page (in file) and write it to the buffer
121 // TODO figure out how we can cache several hashes since we won't update
122 // every page during incremental linking
123 cdir.inner.hashOffset = cdir.inner.identOffset + @intCast(u32, id.len) + 1;
124 var i: usize = 0;
125 while (i < total_pages) : (i += 1) {
126 const fstart = i * page_size;
127 const fsize = if (fstart + page_size > file_size) file_size - fstart else page_size;
128 const len = try macho_file.preadAll(buffer, fstart);
129 assert(fsize <= len);
130
131 Sha256.hash(buffer[0..fsize], &hash, .{});
132 log.debug("Calculated hash for page 0x{x}-0x{x}: 0x{x}\n", .{ fstart, fstart + fsize, hash[0..] });
133
134 cdir.data.appendSliceAssumeCapacity(hash[0..]);
135 cdir.inner.nCodeSlots += 1;
136 }
137
138 // 3. Update CodeDirectory length
139 cdir.inner.length += @intCast(u32, cdir.data.items.len);
140
141 self.inner.length += @sizeOf(macho.BlobIndex) + cdir.size();
92 self.inner.count = 1;142 self.inner.count = 1;
93 self.blob = blob;143 self.cdir = cdir;
94}144}
95145
96pub fn size(self: CodeSignature) u32 {146pub fn size(self: CodeSignature) u32 {
...@@ -102,12 +152,12 @@ pub fn write(self: CodeSignature, buffer: []u8) void {...@@ -102,12 +152,12 @@ pub fn write(self: CodeSignature, buffer: []u8) void {
102 self.writeHeader(buffer);152 self.writeHeader(buffer);
103 const offset: u32 = @sizeOf(macho.SuperBlob) + @sizeOf(macho.BlobIndex);153 const offset: u32 = @sizeOf(macho.SuperBlob) + @sizeOf(macho.BlobIndex);
104 writeBlobIndex(macho.CSSLOT_CODEDIRECTORY, offset, buffer[@sizeOf(macho.SuperBlob)..]);154 writeBlobIndex(macho.CSSLOT_CODEDIRECTORY, offset, buffer[@sizeOf(macho.SuperBlob)..]);
105 self.blob.?.write(buffer[offset..]);155 self.cdir.?.write(buffer[offset..]);
106}156}
107157
108pub fn deinit(self: *CodeSignature) void {158pub fn deinit(self: *CodeSignature) void {
109 if (self.blob) |*b| {159 if (self.cdir) |*cdir| {
110 b.data.deinit(self.alloc);160 cdir.data.deinit(self.alloc);
111 }161 }
112}162}
113163