| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/safe_browsing/incident_reporting/environment_data_colle
ction_win.h" | 5 #include "chrome/browser/safe_browsing/incident_reporting/environment_data_colle
ction_win.h" |
| 6 | 6 |
| 7 #include <windows.h> | 7 #include <windows.h> |
| 8 #include <set> | 8 #include <set> |
| 9 #include <string> | 9 #include <string> |
| 10 | 10 |
| (...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 123 path_sanitizer.StripHomeDirectory(&dll_name); | 123 path_sanitizer.StripHomeDirectory(&dll_name); |
| 124 process->add_blacklisted_dll(dll_name.AsUTF8Unsafe()); | 124 process->add_blacklisted_dll(dll_name.AsUTF8Unsafe()); |
| 125 } | 125 } |
| 126 } | 126 } |
| 127 | 127 |
| 128 void CollectModuleVerificationData( | 128 void CollectModuleVerificationData( |
| 129 const wchar_t* const modules_to_verify[], | 129 const wchar_t* const modules_to_verify[], |
| 130 size_t num_modules_to_verify, | 130 size_t num_modules_to_verify, |
| 131 ClientIncidentReport_EnvironmentData_Process* process) { | 131 ClientIncidentReport_EnvironmentData_Process* process) { |
| 132 #if !defined(_WIN64) | 132 #if !defined(_WIN64) |
| 133 using ModuleState = ClientIncidentReport_EnvironmentData_Process_ModuleState; |
| 134 |
| 133 for (size_t i = 0; i < num_modules_to_verify; ++i) { | 135 for (size_t i = 0; i < num_modules_to_verify; ++i) { |
| 134 scoped_ptr<ClientIncidentReport_EnvironmentData_Process_ModuleState> | 136 scoped_ptr<ModuleState> module_state(new ModuleState()); |
| 135 module_state( | |
| 136 new ClientIncidentReport_EnvironmentData_Process_ModuleState()); | |
| 137 | 137 |
| 138 VerificationResult result = NewVerifyModule(modules_to_verify[i], | 138 int num_bytes_different = 0; |
| 139 module_state.get()); | 139 bool scan_complete = VerifyModule(modules_to_verify[i], |
| 140 module_state.get(), |
| 141 &num_bytes_different); |
| 140 | 142 |
| 141 std::set<std::string> modified_exports; | 143 if (module_state->modified_state() == ModuleState::MODULE_STATE_UNMODIFIED) |
| 142 int num_bytes = 0; | 144 continue; |
| 143 int modified = VerifyModule(modules_to_verify[i], | |
| 144 &modified_exports, | |
| 145 &num_bytes); | |
| 146 | 145 |
| 147 if (result.state == MODULE_STATE_MODIFIED) { | 146 if (module_state->modified_state() == ModuleState::MODULE_STATE_MODIFIED) { |
| 148 UMA_HISTOGRAM_COUNTS_10000( | 147 UMA_HISTOGRAM_COUNTS_10000( |
| 149 "ModuleIntegrityVerification.BytesModified.WithoutByteSet", | 148 "ModuleIntegrityVerification.BytesModified.WithoutByteSet", |
| 150 result.num_bytes_different); | 149 num_bytes_different); |
| 151 } | 150 } |
| 152 | 151 |
| 153 if (modified == MODULE_STATE_MODIFIED) { | 152 if (!scan_complete) { |
| 154 UMA_HISTOGRAM_COUNTS_10000( | |
| 155 "ModuleIntegrityVerification.BytesModified.WithByteSet", | |
| 156 num_bytes); | |
| 157 } | |
| 158 | |
| 159 if (modified == MODULE_STATE_MODIFIED || | |
| 160 result.state == MODULE_STATE_MODIFIED) { | |
| 161 int difference = abs(result.num_bytes_different - num_bytes); | |
| 162 | |
| 163 if (result.num_bytes_different > num_bytes) { | |
| 164 UMA_HISTOGRAM_COUNTS_10000( | |
| 165 "ModuleIntegrityVerification.Difference.WithoutByteSet", | |
| 166 difference); | |
| 167 } else if (num_bytes > result.num_bytes_different) { | |
| 168 UMA_HISTOGRAM_COUNTS_10000( | |
| 169 "ModuleIntegrityVerification.Difference.WithByteSet", | |
| 170 difference); | |
| 171 } | |
| 172 } | |
| 173 | |
| 174 if (!result.verification_completed) { | |
| 175 UMA_HISTOGRAM_ENUMERATION( | 153 UMA_HISTOGRAM_ENUMERATION( |
| 176 "ModuleIntegrityVerification.RelocationsUnordered", i, | 154 "ModuleIntegrityVerification.RelocationsUnordered", i, |
| 177 num_modules_to_verify); | 155 num_modules_to_verify); |
| 178 } | 156 } |
| 179 | 157 |
| 180 if (modified == MODULE_STATE_UNMODIFIED) | |
| 181 continue; | |
| 182 | |
| 183 module_state->set_name(base::WideToUTF8(modules_to_verify[i])); | |
| 184 // Add 1 to the ModuleState enum to get the corresponding value in the | |
| 185 // protobuf's ModuleState enum. | |
| 186 module_state->set_modified_state(static_cast< | |
| 187 ClientIncidentReport_EnvironmentData_Process_ModuleState_ModifiedState>( | |
| 188 modified + 1)); | |
| 189 for (std::set<std::string>::iterator it = modified_exports.begin(); | |
| 190 it != modified_exports.end(); | |
| 191 ++it) { | |
| 192 module_state->add_modified_export(*it); | |
| 193 } | |
| 194 process->mutable_module_state()->AddAllocated(module_state.release()); | 158 process->mutable_module_state()->AddAllocated(module_state.release()); |
| 195 } | 159 } |
| 196 #endif // _WIN64 | 160 #endif // _WIN64 |
| 197 } | 161 } |
| 198 | 162 |
| 199 void CollectPlatformProcessData( | 163 void CollectPlatformProcessData( |
| 200 ClientIncidentReport_EnvironmentData_Process* process) { | 164 ClientIncidentReport_EnvironmentData_Process* process) { |
| 201 CollectDlls(process); | 165 CollectDlls(process); |
| 202 RecordLspFeature(process); | 166 RecordLspFeature(process); |
| 203 CollectDllBlacklistData(process); | 167 CollectDllBlacklistData(process); |
| 204 CollectModuleVerificationData( | 168 CollectModuleVerificationData( |
| 205 kModulesToVerify, arraysize(kModulesToVerify), process); | 169 kModulesToVerify, arraysize(kModulesToVerify), process); |
| 206 } | 170 } |
| 207 | 171 |
| 208 } // namespace safe_browsing | 172 } // namespace safe_browsing |
| OLD | NEW |