CreateThread interception, to use CreateRemoteThread

sandbox/win/src/process_thread_dispatcher.cc

Index: sandbox/win/src/process_thread_dispatcher.cc
diff --git a/sandbox/win/src/process_thread_dispatcher.cc b/sandbox/win/src/process_thread_dispatcher.cc
index 90cad6365f927d2f1aed9fadc3e0d9195ce8c01a..82c4675508c1748a2b43dfec44ac901d759ba45e 100644
--- a/sandbox/win/src/process_thread_dispatcher.cc
+++ b/sandbox/win/src/process_thread_dispatcher.cc
@@ -122,11 +122,19 @@ ThreadProcessDispatcher::ThreadProcessDispatcher(PolicyBase* policy_base)
       reinterpret_cast<CallbackGeneric>(
           &ThreadProcessDispatcher::CreateProcessW)};
 
+  static const IPCCall create_thread_params = {
+      {IPC_CREATETHREAD_TAG,
+       // NOTE(liamjm): 2nd param in size_t: Using VOIDPTR_TYPE as a hack.

[Will Harris, 2015/12/03 06:41:50]

I think this is fine, we only need to support Windows and we know sizeof(size_t)
always matches sizeof(void*) on that platform.

You could put a compile time assert to verify this is always true.

[liamjm (20p), 2015/12/03 21:53:29]

Done.

+       {VOIDPTR_TYPE, VOIDPTR_TYPE, VOIDPTR_TYPE, VOIDPTR_TYPE, UINT32_TYPE}},
+      reinterpret_cast<CallbackGeneric>(
+          &ThreadProcessDispatcher::CreateThread)};
+
   ipc_calls_.push_back(open_thread);
   ipc_calls_.push_back(open_process);
   ipc_calls_.push_back(process_token);
   ipc_calls_.push_back(process_tokenex);
   ipc_calls_.push_back(create_params);
+  ipc_calls_.push_back(create_thread_params);
 }
 
 bool ThreadProcessDispatcher::SetupService(InterceptionManager* manager,
@@ -146,6 +154,10 @@ bool ThreadProcessDispatcher::SetupService(InterceptionManager* manager,
              INTERCEPT_EAT(manager, L"kernel32.dll", CreateProcessA,
                            CREATE_PROCESSA_ID, 44);
 
+    case IPC_CREATETHREAD_TAG:
+      return INTERCEPT_EAT(manager, kKerneldllName, CreateThread,
+                           CREATE_THREAD_ID, 28);
+
     default:
       return false;
   }
@@ -242,4 +254,25 @@ bool ThreadProcessDispatcher::CreateProcessW(IPCInfo* ipc, base::string16* name,
   return true;
 }
 
+bool ThreadProcessDispatcher::CreateThread(
+    IPCInfo* ipc,
+    LPSECURITY_ATTRIBUTES thread_attributes,
+    SIZE_T stack_size,

[Will Harris, 2015/12/03 06:41:51]

surprised something (maybe clang?) doesn't complain about the void* to size_t
conversion happening here?

[liamjm (20p), 2015/12/03 21:53:29]

Acknowledged.

+    LPTHREAD_START_ROUTINE start_address,
+    PVOID parameter,
+    DWORD creation_flags) {
+  if (!start_address) {
+    return false;
+  }
+
+  HANDLE handle;
+  DWORD ret = ProcessPolicy::CreateThreadAction(
+      GIVE_ALLACCESS, *ipc->client_info, thread_attributes, stack_size,
+      start_address, parameter, creation_flags, NULL, &handle);
+
+  ipc->return_info.nt_status = ret;
+  ipc->return_info.handle = handle;
+  return true;
+}
+
 }  // namespace sandbox