CreateThread interception, to use CreateRemoteThread

sandbox/win/src/policy_broker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include <map>
 
 #include "sandbox/win/src/policy_broker.h"
 
@@ skipping 78 matching lines @@
   // Verify that the structure is fully initialized.
   for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++)
     DCHECK(reinterpret_cast<char**>(&g_nt)[i]);
 #endif
   return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt)));
 }
 
 #undef INIT_GLOBAL_NT
 #undef INIT_GLOBAL_RTL
 
-bool SetupBasicInterceptions(InterceptionManager* manager) {
+bool SetupBasicInterceptions(InterceptionManager* manager,
+                             bool is_csrss_connected) {
   // Interceptions provided by process_thread_policy, without actual policy.
   if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_THREAD_ID, 20) ||
       !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) ||
       !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16))
     return false;
 
   // Interceptions with neither policy nor IPC.
   if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID,
                     20) ||
       !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
     return false;
 
   if (base::win::GetVersion() >= base::win::VERSION_XP) {
     // Bug 27218: We don't have dispatch for some x64 syscalls.
     // This one is also provided by process_thread_policy.
     if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID,
                       20))
       return false;
 
-    return INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID,
-                        24);
+    if (!INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID,
+                      24))
+      return false;
+  }
+
+  if (!is_csrss_connected) {
+    if (!INTERCEPT_EAT(manager, kKerneldllName, CreateThread, CREATE_THREAD_ID,
+                       28))
+      return false;
   }
 
   return true;
 }
 
 }  // namespace sandbox