CreateThread interception, to use CreateRemoteThread

sandbox/win/src/process_thread_interception.cc

Index: sandbox/win/src/process_thread_interception.cc
diff --git a/sandbox/win/src/process_thread_interception.cc b/sandbox/win/src/process_thread_interception.cc
index e6c8c2e9180c91b96164791b67de1081998b2be4..de004136ab8599517bd917cdc6c00efc7b521b3d 100644
--- a/sandbox/win/src/process_thread_interception.cc
+++ b/sandbox/win/src/process_thread_interception.cc
@@ -401,4 +401,65 @@ BOOL WINAPI TargetCreateProcessA(CreateProcessAFunction orig_CreateProcessA,
   return FALSE;
 }
 
+HANDLE WINAPI TargetCreateThread(CreateThreadFunction orig_CreateThread,
+  LPSECURITY_ATTRIBUTES thread_attributes, SIZE_T stack_size,
+  LPTHREAD_START_ROUTINE start_address, PVOID parameter,
+  DWORD creation_flags, LPDWORD thread_id) {
+  HANDLE hThread = NULL;
+
+  TargetServices* target_services = SandboxFactory::GetTargetServices();
+  if (NULL == target_services ||
+    target_services->GetState()->IsCsrssConnected()) {
+    hThread = orig_CreateThread(thread_attributes, stack_size,
+      start_address, parameter, creation_flags, thread_id);
+    if (hThread) {
+      return hThread;
+    }
+  }
+
+  if (NULL == target_services)
+    return NULL;
+
+  // We don't trust that the IPC can work this early.
+  if (!target_services->GetState()->InitCalled())
+    return NULL;
+
+  DWORD original_error = ::GetLastError();
+
+  do {
+    if (NULL != thread_id &&
+        !ValidParameter(thread_id, sizeof(*thread_id), WRITE))
+      break;
+
+    void* memory = GetGlobalIPCMemory();
+    if (NULL == memory)
+      break;
+
+    SharedMemIPCClient ipc(memory);
+    CrossCallReturn answer = { 0 };
+
+    ResultCode code = CrossCall(ipc, IPC_CREATETHREAD_TAG,
+        (LPVOID)thread_attributes, (LPVOID)stack_size,
+        (LPVOID)start_address, (LPVOID)parameter,
+        (DWORD)creation_flags, &answer);
+
+    if (SBOX_ALL_OK != code)
+      break;
+
+    if (ERROR_SUCCESS != answer.win32_result) {
+      return NULL;
+    }
+
+    if (thread_id != NULL) {
+      *thread_id = GetThreadId(answer.handle);
+    }
+
+    ::SetLastError(answer.win32_result);
+    return answer.handle;
+  } while (false);
+
+  ::SetLastError(original_error);
+  return NULL;
+}
+
 }  // namespace sandbox