Add 64-bit support to browser blacklisting

sandbox/win/src/service_resolver_64.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/service_resolver.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/win_utils.h"
 
@@ skipping 38 matching lines @@
   // 1c 0f05            syscall
   // 1e c3              ret
   // 1f 90              nop
 
   ULONG64 mov_1;              // = 48 89 4C 24 08 48 89 54
   ULONG64 mov_2;              // = 24 10 4C 89 44 24 18 4C
   ULONG mov_3;                // = 89 4C 24 20
   ULONG mov_r10_rcx_mov_eax;  // = 4C 8B D1 B8
   ULONG service_id;
   USHORT syscall;             // = 0F 05
-  BYTE ret;                   // = C2
+  BYTE ret;                   // = C3
   BYTE nop;                   // = 90
 };
 
 // We don't have an internal thunk for x64.
 struct ServiceFullThunk {
   union {
     ServiceEntry original;
     ServiceEntryW8 original_w8;
   };
 };
@@ skipping 113 matching lines @@
 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
   NOTREACHED_NT();
   return false;
 }
 
 bool Win2kResolverThunk::IsFunctionAService(void* local_thunk) const {
   NOTREACHED_NT();
   return false;
 }
 
+bool Win8ResolverThunk::IsFunctionAService(void* local_thunk) const {

[robertshield, 2014/01/07 18:30:47]

The ServiceResolverThunk::IsFunctionAService method above looks like it does
some Win8 checking. Do we need this method as well?

[csharp, 2014/01/07 20:43:07]

Yes it does. I've removed the win8 specific code from ServiceResolverThunk
(since we generally seem to have a separate function for each), but rvargas can
probably tell us what the correct action here is.

+  ServiceEntryW8 function_code;
+  SIZE_T read;
+  if (!::ReadProcessMemory(process_, target_, &function_code,
+                           sizeof(function_code), &read))
+    return false;
+
+  if (sizeof(function_code) != read)
+    return false;
+
+  if (kMov1 != function_code.mov_1 || kMov2 != function_code.mov_2 ||
+      kMov3 != function_code.mov_3 ||
+      kMmovR10EcxMovEax != function_code.mov_r10_rcx_mov_eax ||
+      kSyscall != function_code.syscall ||
+      kRetNp != function_code.ret) {
+    return false;
+  }
+
+  // Save the verified code
+  memcpy(local_thunk, &function_code, sizeof(function_code));
+
+  return true;
+}
+
 }  // namespace sandbox