Date: Mon, 08 Jan 2024 22:53:11 -0300
On Monday, 8 January 2024 17:43:04 -03 Frederick Virchanza Gotham via Std-
Proposals wrote:
> So then the question is how do we identify thunks at runtime? Well we could
> binary-search for the address in a global constexpr array of thunk
> addresses. Or alternatively we could precede every thunk with 8 identifying
> bytes something like:
>
> 't' 'h' 'u' 'n' 'k' '\0' '\0' '\0'
This doesn't apply retroactively to code already compiled.
>
> Or maybe just identify the machine code of a thunk generated from the
> following assembler:
>
> add rdi, 8
> jmp ActualFunction
That's the same as a plain function with a tail-call optimisation (which is
what a thunk really is) so would have false positives.
The compiler or the linker could also decide to inline the actual function's
contents into the thunk (unlikely but it's possible), or if there's a single
thunk to replace the jump with a nop. In either case, you'd have a false
negative.
> I would really like to see a function to retrieve the function pointer from
> the vtable:
>
> class MyClass { . . . };
> MyClass myobj;
> void (*p)(void) = std::devirtualise( &MyClass::SomeMethod, &myobj );
As usual, you have yet to explain why.
Proposals wrote:
> So then the question is how do we identify thunks at runtime? Well we could
> binary-search for the address in a global constexpr array of thunk
> addresses. Or alternatively we could precede every thunk with 8 identifying
> bytes something like:
>
> 't' 'h' 'u' 'n' 'k' '\0' '\0' '\0'
This doesn't apply retroactively to code already compiled.
>
> Or maybe just identify the machine code of a thunk generated from the
> following assembler:
>
> add rdi, 8
> jmp ActualFunction
That's the same as a plain function with a tail-call optimisation (which is
what a thunk really is) so would have false positives.
The compiler or the linker could also decide to inline the actual function's
contents into the thunk (unlikely but it's possible), or if there's a single
thunk to replace the jump with a nop. In either case, you'd have a false
negative.
> I would really like to see a function to retrieve the function pointer from
> the vtable:
>
> class MyClass { . . . };
> MyClass myobj;
> void (*p)(void) = std::devirtualise( &MyClass::SomeMethod, &myobj );
As usual, you have yet to explain why.
-- Thiago Macieira - thiago (AT) macieira.info - thiago (AT) kde.org Software Architect - Intel DCAI Cloud Engineering
Received on 2024-01-09 01:53:14