Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(147)

Side by Side Diff: chrome/browser/safe_browsing/binary_feature_extractor_win.cc

Issue 1015363003: Move BinaryFeatureExtractor and PEImageReader to common. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@zip2
Patch Set: sync to position 321353 Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome/browser/safe_browsing/binary_feature_extractor.h"
6
7 #include <windows.h>
8 #include <softpub.h>
9 #include <wintrust.h>
10
11 #include "base/files/file_path.h"
12 #include "base/files/memory_mapped_file.h"
13 #include "base/logging.h"
14 #include "chrome/browser/safe_browsing/pe_image_reader_win.h"
15 #include "chrome/common/safe_browsing/csd.pb.h"
16
17 #pragma comment(lib, "wintrust.lib")
18
19 namespace safe_browsing {
20
21 BinaryFeatureExtractor::BinaryFeatureExtractor() {}
22
23 BinaryFeatureExtractor::~BinaryFeatureExtractor() {}
24
25 void BinaryFeatureExtractor::CheckSignature(
26 const base::FilePath& file_path,
27 ClientDownloadRequest_SignatureInfo* signature_info) {
28 DVLOG(2) << "Checking signature for " << file_path.value();
29
30 WINTRUST_FILE_INFO file_info = {0};
31 file_info.cbStruct = sizeof(file_info);
32 file_info.pcwszFilePath = file_path.value().c_str();
33 file_info.hFile = NULL;
34 file_info.pgKnownSubject = NULL;
35
36 WINTRUST_DATA wintrust_data = {0};
37 wintrust_data.cbStruct = sizeof(wintrust_data);
38 wintrust_data.pPolicyCallbackData = NULL;
39 wintrust_data.pSIPClientData = NULL;
40 wintrust_data.dwUIChoice = WTD_UI_NONE;
41 wintrust_data.fdwRevocationChecks = WTD_REVOKE_NONE;
42 wintrust_data.dwUnionChoice = WTD_CHOICE_FILE;
43 wintrust_data.pFile = &file_info;
44 wintrust_data.dwStateAction = WTD_STATEACTION_VERIFY;
45 wintrust_data.hWVTStateData = NULL;
46 wintrust_data.pwszURLReference = NULL;
47 // Disallow revocation checks over the network.
48 wintrust_data.dwProvFlags = WTD_CACHE_ONLY_URL_RETRIEVAL;
49 wintrust_data.dwUIContext = WTD_UICONTEXT_EXECUTE;
50
51 // The WINTRUST_ACTION_GENERIC_VERIFY_V2 policy verifies that the certificate
52 // chains up to a trusted root CA, and that it has appropriate permission to
53 // sign code.
54 GUID policy_guid = WINTRUST_ACTION_GENERIC_VERIFY_V2;
55
56 LONG result = WinVerifyTrust(static_cast<HWND>(INVALID_HANDLE_VALUE),
57 &policy_guid,
58 &wintrust_data);
59
60 CRYPT_PROVIDER_DATA* prov_data = WTHelperProvDataFromStateData(
61 wintrust_data.hWVTStateData);
62 if (prov_data) {
63 if (prov_data->csSigners > 0) {
64 signature_info->set_trusted(result == ERROR_SUCCESS);
65 }
66 for (DWORD i = 0; i < prov_data->csSigners; ++i) {
67 const CERT_CHAIN_CONTEXT* cert_chain_context =
68 prov_data->pasSigners[i].pChainContext;
69 if (!cert_chain_context)
70 break;
71 for (DWORD j = 0; j < cert_chain_context->cChain; ++j) {
72 CERT_SIMPLE_CHAIN* simple_chain = cert_chain_context->rgpChain[j];
73 ClientDownloadRequest_CertificateChain* chain =
74 signature_info->add_certificate_chain();
75 if (!simple_chain)
76 break;
77 for (DWORD k = 0; k < simple_chain->cElement; ++k) {
78 CERT_CHAIN_ELEMENT* element = simple_chain->rgpElement[k];
79 chain->add_element()->set_certificate(
80 element->pCertContext->pbCertEncoded,
81 element->pCertContext->cbCertEncoded);
82 }
83 }
84 }
85
86 // Free the provider data.
87 wintrust_data.dwStateAction = WTD_STATEACTION_CLOSE;
88 WinVerifyTrust(static_cast<HWND>(INVALID_HANDLE_VALUE),
89 &policy_guid, &wintrust_data);
90 }
91 }
92
93 bool BinaryFeatureExtractor::ExtractImageHeaders(
94 const base::FilePath& file_path,
95 ExtractHeadersOption options,
96 ClientDownloadRequest_ImageHeaders* image_headers) {
97 // Map the file into memory.
98 base::MemoryMappedFile file;
99 if (!file.Initialize(file_path))
100 return false;
101
102 PeImageReader pe_image;
103 if (!pe_image.Initialize(file.data(), file.length()))
104 return false;
105
106 // Copy the headers.
107 ClientDownloadRequest_PEImageHeaders* pe_headers =
108 image_headers->mutable_pe_headers();
109 pe_headers->set_dos_header(pe_image.GetDosHeader(), sizeof(IMAGE_DOS_HEADER));
110 pe_headers->set_file_header(pe_image.GetCoffFileHeader(),
111 sizeof(IMAGE_FILE_HEADER));
112 size_t optional_header_size = 0;
113 const uint8_t* optional_header_data =
114 pe_image.GetOptionalHeaderData(&optional_header_size);
115 if (pe_image.GetWordSize() == PeImageReader::WORD_SIZE_32) {
116 pe_headers->set_optional_headers32(optional_header_data,
117 optional_header_size);
118 } else {
119 pe_headers->set_optional_headers64(optional_header_data,
120 optional_header_size);
121 }
122 const size_t number_of_sections = pe_image.GetNumberOfSections();
123 for (size_t i = 0; i != number_of_sections; ++i) {
124 pe_headers->add_section_header(pe_image.GetSectionHeaderAt(i),
125 sizeof(IMAGE_SECTION_HEADER));
126 }
127 if (!(options & kOmitExports)) {
128 size_t export_size = 0;
129 const uint8_t* export_section = pe_image.GetExportSection(&export_size);
130 if (export_section)
131 pe_headers->set_export_section_data(export_section, export_size);
132 }
133 size_t number_of_debug_entries = pe_image.GetNumberOfDebugEntries();
134 for (size_t i = 0; i != number_of_debug_entries; ++i) {
135 const uint8_t* raw_data = NULL;
136 size_t raw_data_size = 0;
137 const IMAGE_DEBUG_DIRECTORY* directory_entry =
138 pe_image.GetDebugEntry(i, &raw_data, &raw_data_size);
139 if (directory_entry) {
140 ClientDownloadRequest_PEImageHeaders_DebugData* debug_data =
141 pe_headers->add_debug_data();
142 debug_data->set_directory_entry(directory_entry,
143 sizeof(*directory_entry));
144 if (raw_data)
145 debug_data->set_raw_data(raw_data, raw_data_size);
146 }
147 }
148
149 return true;
150 }
151
152 } // namespace safe_browsing
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698