Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(496)

Unified Diff: sandbox/win/src/service_resolver_64.cc

Issue 1308563005: Merge M45: Add support for int 2e fallback system call stub in Win10. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@2454
Patch Set: Created 5 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: sandbox/win/src/service_resolver_64.cc
diff --git a/sandbox/win/src/service_resolver_64.cc b/sandbox/win/src/service_resolver_64.cc
index 8c0ae96e916f3429726884349f6cfe5303b2cd78..c0e684c795b25a67a2b49bc673d35b0d5678a103 100644
--- a/sandbox/win/src/service_resolver_64.cc
+++ b/sandbox/win/src/service_resolver_64.cc
@@ -17,6 +17,10 @@ const BYTE kRetNp = 0xC3;
const ULONG64 kMov1 = 0x54894808244C8948;
const ULONG64 kMov2 = 0x4C182444894C1024;
const ULONG kMov3 = 0x20244C89;
+const USHORT kTestByte = 0x04F6;
+const BYTE kPtr = 0x25;
+const BYTE kRet = 0xC3;
+const USHORT kJne = 0x0375;
// Service code for 64 bit systems.
struct ServiceEntry {
@@ -60,11 +64,37 @@ struct ServiceEntryW8 {
BYTE nop; // = 90
};
+// Service code for 64 bit systems with int 2e fallback.
+struct ServiceEntryWithInt2E {
+ // This struct contains roughly the following code:
+ // 00 4c8bd1 mov r10,rcx
+ // 03 b855000000 mov eax,52h
+ // 08 f604250803fe7f01 test byte ptr SharedUserData!308, 1
+ // 10 7503 jne [over syscall]
+ // 12 0f05 syscall
+ // 14 c3 ret
+ // 15 cd2e int 2e
+ // 17 c3 ret
+
+ ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
+ ULONG service_id;
+ USHORT test_byte; // = F6 04
+ BYTE ptr; // = 25
+ ULONG user_shared_data_ptr;
+ BYTE one; // = 01
+ USHORT jne_over_syscall; // = 75 03
+ USHORT syscall; // = 0F 05
+ BYTE ret; // = C3
+ USHORT int2e; // = CD 2E
+ BYTE ret2; // = C3
+};
+
// We don't have an internal thunk for x64.
struct ServiceFullThunk {
union {
ServiceEntry original;
ServiceEntryW8 original_w8;
+ ServiceEntryWithInt2E original_int2e_fallback;
};
};
@@ -78,6 +108,25 @@ bool IsService(const void* source) {
kSyscall == service->syscall && kRetNp == service->ret);
}
+bool IsServiceW8(const void* source) {
+ const ServiceEntryW8* service =
+ reinterpret_cast<const ServiceEntryW8*>(source);
+
+ return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
+ kMov1 == service->mov_1 && kMov2 == service->mov_2 &&
+ kMov3 == service->mov_3);
+}
+
+bool IsServiceWithInt2E(const void* source) {
+ const ServiceEntryWithInt2E* service =
+ reinterpret_cast<const ServiceEntryWithInt2E*>(source);
+
+ return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
+ kTestByte == service->test_byte && kPtr == service->ptr &&
+ kJne == service->jne_over_syscall && kSyscall == service->syscall &&
+ kRet == service->ret && kRet == service->ret2);
+}
+
}; // namespace
namespace sandbox {
@@ -150,15 +199,9 @@ bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const {
if (sizeof(function_code) != read)
return false;
- if (!IsService(&function_code)) {
- // See if it's the Win8 signature.
- ServiceEntryW8* w8_service = &function_code.original_w8;
- if (!IsService(&w8_service->mov_r10_rcx_mov_eax) ||
- w8_service->mov_1 != kMov1 || w8_service->mov_2 != kMov2 ||
- w8_service->mov_3 != kMov3) {
- return false;
- }
- }
+ if (!IsService(&function_code) && !IsServiceW8(&function_code) &&
+ !IsServiceWithInt2E(&function_code))
+ return false;
// Save the verified code.
memcpy(local_thunk, &function_code, sizeof(function_code));
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698