CreateThread interception, to use CreateRemoteThread

sandbox/win/src/sandbox_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 30 matching lines @@
     FILES_ALLOW_DIR_ANY,   // Allows open or create with directory semantics
                            // only.
     HANDLES_DUP_ANY,       // Allows duplicating handles opened with any
                            // access permissions.
     HANDLES_DUP_BROKER,    // Allows duplicating handles to the broker process.
     NAMEDPIPES_ALLOW_ANY,  // Allows creation of a named pipe.
     PROCESS_MIN_EXEC,      // Allows to create a process with minimal rights
                            // over the resulting process and thread handles.
                            // No other parameters besides the command line are
                            // passed to the child process.
-    PROCESS_ALL_EXEC,      // Allows the creation of a process and return fill
+    PROCESS_ALL_EXEC,      // Allows the creation of a process and return full
                            // access on the returned handles.
                            // This flag can be used only when the main token of
                            // the sandboxed application is at least INTERACTIVE.
     EVENTS_ALLOW_ANY,      // Allows the creation of an event with full access.
-    EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access.
-    REG_ALLOW_READONLY,    // Allows readonly access to a registry key.
-    REG_ALLOW_ANY,         // Allows read and write access to a registry key.
-    FAKE_USER_GDI_INIT     // Fakes user32 and gdi32 initialization. This can
-                           // be used to allow the DLLs to load and initialize
-                           // even if the process cannot access that subsystem.
+    EVENTS_ALLOW_READONLY,  // Allows opening an even with synchronize access.
+    REG_ALLOW_READONLY,     // Allows readonly access to a registry key.
+    REG_ALLOW_ANY,          // Allows read and write access to a registry key.
+    FAKE_USER_GDI_INIT      // Fakes user32 and gdi32 initialization. This can
+                            // be used to allow the DLLs to load and initialize
+                            // even if the process cannot access that subsystem.
   };
 
   // Increments the reference count of this object. The reference count must
   // be incremented if this interface is given to another component.
   virtual void AddRef() = 0;
 
   // Decrements the reference count of this object. When the reference count
   // is zero the object is automatically destroyed.
   // Indicates that the caller is done with this interface. After calling
   // release no other method should be called.
@@ skipping 130 matching lines @@
   // Returns the currently set mitigation flags.
   virtual MitigationFlags GetProcessMitigations() = 0;
 
   // Sets process mitigation flags that don't take effect before the call to
   // LowerToken().
   virtual ResultCode SetDelayedProcessMitigations(MitigationFlags flags) = 0;
 
   // Returns the currently set delayed mitigation flags.
   virtual MitigationFlags GetDelayedProcessMitigations() const = 0;
 
+  // Disconnect the target from CSRSS.

[Will Harris, 2016/02/05 23:27:00]

// Disconnect the target from CSRSS when TargetServices::LowerToken() is called
inside the target.

[liamjm (20p), 2016/02/05 23:51:21]

Done.

+  virtual void DisconnectCsrss() = 0;

[Will Harris, 2016/02/05 23:27:00]

nit: I think using SetDisconnectCsrss() more fits with the other function names.

[liamjm (20p), 2016/02/05 23:51:21]

Done.

+
   // Sets the interceptions to operate in strict mode. By default, interceptions
   // are performed in "relaxed" mode, where if something inside NTDLL.DLL is
   // already patched we attempt to intercept it anyway. Setting interceptions
   // to strict mode means that when we detect that the function is patched we'll
   // refuse to perform the interception.
   virtual void SetStrictInterceptions() = 0;
 
   // Set the handles the target process should inherit for stdout and
   // stderr.  The handles the caller passes must remain valid for the
   // lifetime of the policy object.  This only has an effect on
@@ skipping 31 matching lines @@
   // Returns the handle which was actually shared with the target. This is
   // achieved by duplicating the handle to ensure that it is inheritable by
   // the target. The caller should treat this as an opaque value.
   virtual void* AddHandleToShare(HANDLE handle) = 0;
 };
 
 }  // namespace sandbox
 
 
 #endif  // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_