在移动平台上执行自行生成的机器代码

Question

There are a couple of questions already on SO assessing the possibility of executing self generated code. The generic answer is that it's possible, it's being done in JIT compilers and with dynamic library loading.

The application is in optimisation of sparse convolutions where the sparse structure should be embedded in the code, since skipping multiplication by zeros conditionally is slower than multiplying by zeros. Neither it's feasible in terms of performance to encode the structure in data:

 do { // actually: don't do this
     auto offset = *encoded_offset++;
     auto coeff = *encoded_coefficient++;
     accum += data[offset] * coeff;
 } while (end_of_data);   // e.g. offset < 0, or offset == previous offset

Vs.

...
ldr     q5, [x1], 16   ; load data
fmla    v0.4s, v5.4s, v8.s[0]
fmla    v1.4s, v5.4s, v8.s[1]
fmla    v2.4s, v5.4s, v8.s[2]
// fmla    v3.4s, v5.4s, v8.s[3]   ; omitted, when |weight| < threshold
fmla    v4.4s, v5.4s, v8.s[3]      ; we reuse the v8.s[3] with a weight that matters
ldr     q5, [x1], 16
// fmla    v0.4s, v5.4s, v9.s[0] ; omitted, when |weight| < threshold
// fmla    v1.4s, v5.4s, v9.s[0] ; omitted
fmla    v2.4s, v5.4s, v9.s[0]    
fmla    v3.4s, v5.4s, v9.s[1]
fmla    v4.4s, v5.4s, v9.s[2]

; + several kilobytes of instructions

It's possible to generate the code by templates, but it would be far more efficient (and marginally more secure reverse engineering in mind) if the code was generated on the fly.

Now the question is, how to exactly call the generated function in some of the most important mobile ecosystems: Ios, android and possibly webassembly (using off course WASM (SIMD) bytecode).

What exact system calls need to be issued to be able to execute the block of memory filled with the code -- legally?

Answer 1

The only problem you will stumble upon is that "normal" memory is usually protected against execution. You just need to set on that memory the execute permission.

After that you can set any sort of instructions you want. See for example the top fizzbuzz bandwidth winner, who uses a simple JIT machine.

https://codegolf.stackexchange.com/a/236630/108147

But the basic code is this:

#include <string>
#include <iostream>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <string.h>

uint8_t code[] = { 0x89, 0xf8,       // mov eax, edi
                   0x0f, 0xaf, 0xc6, // imul eax, esi
                   0xc3 };           // ret

int main() {
    using multifn = int( int a, int b);
    size_t pagesize = getpagesize();
    size_t codesize = ((sizeof(code)-1)/pagesize+1)*pagesize;
    uint64_t codeaddr = uint64_t(code);
    codeaddr -= codeaddr % pagesize;
    mprotect((void*)codeaddr, codesize, PROT_READ | PROT_WRITE |PROT_EXEC);   
    multifn* m = reinterpret_cast<multifn*>(code);
    std::cout << "Result:" << m(2,3) << std::endl;
    return 0;
}

I just ran it in my Linux box as a regular user and the result is:

Program stdout
Result:6

I assume that as Android is basically Linux, the result will be the same. As per IOS I have to speculate here.

Also Godbolt: https://godbolt.org/z/hsMKWsjM9

If you are really picky about not messing up with regular memory, you can create a separate page for your generated code

#include <string>
#include <iostream>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <string.h>

void* createExecPage( size_t size ) {
    size_t pagesize = getpagesize();
    size = ((size-1)/pagesize+1)*pagesize;
    std::cout << "Pagesize:" << pagesize << " size:" << size << std::endl;
    void* temp = nullptr;
    int res = posix_memalign(&temp, pagesize, size );
    if ( res!=0 ) {
        perror("posix_memalign");
    }
    res = mprotect(temp, size, PROT_READ | PROT_WRITE |PROT_EXEC);
    if ( res!=0 ) {
        perror( "mprotect" );
    }
    return temp;
}

uint8_t code[] = { 0x89, 0xf8,       // mov eax, edi
                   0x0f, 0xaf, 0xc6, // imul eax, esi
                   0xc3 };           // ret

int main()
{
    using multifn = int( int a, int b);
    void* xpage = createExecPage(sizeof(code));
    memcpy( xpage, code, sizeof(code));
    multifn* m = reinterpret_cast<multifn*>(xpage);
    std::cout << "Result:" << m(2,3) << std::endl;
    return 0;
}

https://godbolt.org/z/ebW76o1KP