CreateThread interception, to use CreateRemoteThread

sandbox/win/src/sandbox_policy_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/sandbox_policy_base.h"
 
 #include <sddl.h>
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 115 matching lines @@
       use_alternate_desktop_(false),
       use_alternate_winstation_(false),
       file_system_init_(false),
       relaxed_interceptions_(true),
       stdout_handle_(INVALID_HANDLE_VALUE),
       stderr_handle_(INVALID_HANDLE_VALUE),
       integrity_level_(INTEGRITY_LEVEL_LAST),
       delayed_integrity_level_(INTEGRITY_LEVEL_LAST),
       mitigations_(0),
       delayed_mitigations_(0),
+      is_csrss_connected_(false),

[cpu_(ooo_6.6-7.5), 2016/02/05 20:49:37]

true ?

[liamjm (20p), 2016/02/05 21:53:08]

Yikes! Good catch.

Fixed.

       policy_maker_(NULL),
       policy_(NULL),
       lowbox_sid_(NULL) {
   ::InitializeCriticalSection(&lock_);
   dispatcher_.reset(new TopLevelDispatcher(this));
 }
 
 PolicyBase::~PolicyBase() {
   ClearSharedHandles();
 
@@ skipping 472 matching lines @@
   }
   if (it == targets_.end()) {
     return false;
   }
   TargetProcess* target = *it;
   targets_.erase(it);
   delete target;
   return true;
 }
 
+void PolicyBase::DisconnectCsrss() {
+  if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
+    is_csrss_connected_ = false;
+    AddKernelObjectToClose(L"ALPC Port", NULL);
+  }
+}
+
 EvalResult PolicyBase::EvalPolicy(int service,
                                   CountedParameterSetBase* params) {
   if (NULL != policy_) {
     if (NULL == policy_->entry[service]) {
       // There is no policy for this particular service. This is not a big
       // deal.
       return DENY_ACCESS;
     }
     for (int i = 0; i < params->count; i++) {
       if (!params->parameters[i].IsValid()) {
@@ skipping 32 matching lines @@
     }
   }
 
   if (!blacklisted_dlls_.empty()) {
     std::vector<base::string16>::iterator it = blacklisted_dlls_.begin();
     for (; it != blacklisted_dlls_.end(); ++it) {
       manager.AddToUnloadModules(it->c_str());
     }
   }
 
-  if (!SetupBasicInterceptions(&manager))
+  if (!SetupBasicInterceptions(&manager, is_csrss_connected_))
     return false;
 
   if (!manager.InitializeInterceptions())
     return false;
 
   // Finally, setup imports on the target so the interceptions can work.
   return SetupNtdllImports(target);
 }
 
 bool PolicyBase::SetupHandleCloser(TargetProcess* target) {
@@ skipping 74 matching lines @@
       break;
     }
 
     default: { return SBOX_ERROR_UNSUPPORTED; }
   }
 
   return SBOX_ALL_OK;
 }
 
 }  // namespace sandbox