OLD | NEW |
1 // Copyright (c) 2013 Google Inc. | 1 // Copyright (c) 2013 Google Inc. |
2 // All rights reserved. | 2 // All rights reserved. |
3 // | 3 // |
4 // Redistribution and use in source and binary forms, with or without | 4 // Redistribution and use in source and binary forms, with or without |
5 // modification, are permitted provided that the following conditions are | 5 // modification, are permitted provided that the following conditions are |
6 // met: | 6 // met: |
7 // | 7 // |
8 // * Redistributions of source code must retain the above copyright | 8 // * Redistributions of source code must retain the above copyright |
9 // notice, this list of conditions and the following disclaimer. | 9 // notice, this list of conditions and the following disclaimer. |
10 // * Redistributions in binary form must reproduce the above | 10 // * Redistributions in binary form must reproduce the above |
(...skipping 19 matching lines...) Expand all Loading... |
30 // exploitability_linux.h: Linux specific exploitability engine. | 30 // exploitability_linux.h: Linux specific exploitability engine. |
31 // | 31 // |
32 // Provides a guess at the exploitability of the crash for the Linux | 32 // Provides a guess at the exploitability of the crash for the Linux |
33 // platform given a minidump and process_state. | 33 // platform given a minidump and process_state. |
34 // | 34 // |
35 // Author: Matthew Riley | 35 // Author: Matthew Riley |
36 | 36 |
37 #ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ | 37 #ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ |
38 #define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ | 38 #define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ |
39 | 39 |
40 #include "common/scoped_ptr.h" | |
41 #include "google_breakpad/common/breakpad_types.h" | 40 #include "google_breakpad/common/breakpad_types.h" |
42 #include "google_breakpad/processor/exploitability.h" | 41 #include "google_breakpad/processor/exploitability.h" |
43 | 42 |
44 namespace google_breakpad { | 43 namespace google_breakpad { |
45 | 44 |
46 class ExploitabilityLinux : public Exploitability { | 45 class ExploitabilityLinux : public Exploitability { |
47 public: | 46 public: |
48 ExploitabilityLinux(Minidump *dump, | 47 ExploitabilityLinux(Minidump *dump, |
49 ProcessState *process_state); | 48 ProcessState *process_state); |
50 | 49 |
| 50 ExploitabilityLinux(Minidump *dump, |
| 51 ProcessState *process_state, |
| 52 bool enable_objdump); |
| 53 |
51 virtual ExploitabilityRating CheckPlatformExploitability(); | 54 virtual ExploitabilityRating CheckPlatformExploitability(); |
52 | 55 |
53 private: | 56 private: |
| 57 friend class ExploitabilityLinuxTest; |
| 58 |
54 // Takes the address of the instruction pointer and returns | 59 // Takes the address of the instruction pointer and returns |
55 // whether the instruction pointer lies in a valid instruction region. | 60 // whether the instruction pointer lies in a valid instruction region. |
56 bool InstructionPointerInCode(uint64_t instruction_ptr); | 61 bool InstructionPointerInCode(uint64_t instruction_ptr); |
57 | 62 |
58 // Checks the exception that triggered the creation of the | 63 // Checks the exception that triggered the creation of the |
59 // minidump and reports whether the exception suggests no exploitability. | 64 // minidump and reports whether the exception suggests no exploitability. |
60 bool BenignCrashTrigger(const MDRawExceptionStream *raw_exception_stream); | 65 bool BenignCrashTrigger(const MDRawExceptionStream *raw_exception_stream); |
61 | 66 |
| 67 // This method checks if the crash occurred during a write to read-only or |
| 68 // invalid memory. It does so by checking if the instruction at the |
| 69 // instruction pointer is a write instruction, and if the target of the |
| 70 // instruction is at a spot in memory that prohibits writes. |
| 71 bool EndedOnIllegalWrite(uint64_t instruction_ptr); |
| 72 |
| 73 #ifndef _WIN32 |
| 74 // Disassembles raw bytes via objdump and pipes the output into the provided |
| 75 // buffer, given the desired architecture, the file from which objdump will |
| 76 // read, and the buffer length. The method returns whether the disassembly |
| 77 // was a success, and the caller owns all pointers. |
| 78 static bool DisassembleBytes(const string &architecture, |
| 79 const uint8_t *raw_bytes, |
| 80 const unsigned int MAX_OBJDUMP_BUFFER_LEN, |
| 81 char *objdump_output_buffer); |
| 82 |
| 83 // Tokenizes out the operation and operands from a line of instruction |
| 84 // disassembled by objdump. This method modifies the pointers to match the |
| 85 // tokens of the instruction, and returns if the tokenizing was a success. |
| 86 // The caller owns all pointers. |
| 87 static bool TokenizeObjdumpInstruction(const string &line, |
| 88 string *operation, |
| 89 string *dest, |
| 90 string *src); |
| 91 |
| 92 // Calculates the effective address of an expression in the form reg+a or |
| 93 // reg-a, where 'reg' is a register and 'a' is a constant, and writes the |
| 94 // result in the pointer. The method returns whether the calculation was |
| 95 // a success. The caller owns the pointer. |
| 96 static bool CalculateAddress(const string &address_expression, |
| 97 const DumpContext &context, |
| 98 uint64_t *write_address); |
| 99 #endif // _WIN32 |
| 100 |
62 // Checks if the stack pointer points to a memory mapping that is not | 101 // Checks if the stack pointer points to a memory mapping that is not |
63 // labelled as the stack. | 102 // labelled as the stack. |
64 bool StackPointerOffStack(uint64_t stack_ptr); | 103 bool StackPointerOffStack(uint64_t stack_ptr); |
65 | 104 |
66 // Checks if the stack or heap are marked executable according | 105 // Checks if the stack or heap are marked executable according |
67 // to the memory mappings. | 106 // to the memory mappings. |
68 bool ExecutableStackOrHeap(); | 107 bool ExecutableStackOrHeap(); |
| 108 |
| 109 // Whether this exploitability engine is permitted to shell out to objdump |
| 110 // to disassemble raw bytes. |
| 111 bool enable_objdump_; |
69 }; | 112 }; |
70 | 113 |
71 } // namespace google_breakpad | 114 } // namespace google_breakpad |
72 | 115 |
73 #endif // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ | 116 #endif // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_ |
OLD | NEW |