win: Add a VSFixedFileInfo test to check all modules

snapshot/win/pe_image_reader_test.cc

 // Copyright 2015 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 #include "snapshot/win/pe_image_reader.h"
 
 #define PSAPI_VERSION 1
 #include <psapi.h>
 
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
 #include "gtest/gtest.h"
 #include "snapshot/win/process_reader_win.h"
 #include "test/errors.h"
 #include "util/win/get_function.h"
 #include "util/win/module_version.h"
+#include "util/win/process_info.h"
 
 extern "C" IMAGE_DOS_HEADER __ImageBase;
 
 namespace crashpad {
 namespace test {
 namespace {
 
 BOOL CrashpadGetModuleInformation(HANDLE process,
                                   HMODULE module,
                                   MODULEINFO* module_info,
@@ skipping 22 matching lines @@
   DWORD age;
   std::string pdbname;
   EXPECT_TRUE(pe_image_reader.DebugDirectoryInformation(&uuid, &age, &pdbname));
   EXPECT_NE(std::string::npos, pdbname.find("crashpad_snapshot_test"));
   const std::string suffix(".pdb");
   EXPECT_EQ(
       0,
       pdbname.compare(pdbname.size() - suffix.size(), suffix.size(), suffix));
 }
 
-TEST(PEImageReader, VSFixedFileInfo) {
+void TestVSFixedFileInfo(ProcessReaderWin* process_reader,
+                         const ProcessInfo::Module& module,
+                         bool known_dll) {
+  PEImageReader pe_image_reader;
+  ASSERT_TRUE(pe_image_reader.Initialize(process_reader,
+                                         module.dll_base,
+                                         module.size,
+                                         base::UTF16ToUTF8(module.name)));
+
+  VS_FIXEDFILEINFO observed;
+  const bool observed_rv = pe_image_reader.VSFixedFileInfo(&observed);
+  ASSERT_TRUE(observed_rv || !known_dll);
+
+  if (observed_rv) {
+    EXPECT_EQ(VS_FFI_SIGNATURE, observed.dwSignature);
+    EXPECT_EQ(VS_FFI_STRUCVERSION, observed.dwStrucVersion);
+    EXPECT_EQ(0, observed.dwFileFlags & ~observed.dwFileFlagsMask);
+    EXPECT_EQ(VOS_NT_WINDOWS32, observed.dwFileOS);
+    if (known_dll) {
+      EXPECT_EQ(VFT_DLL, observed.dwFileType);
+    } else {
+      EXPECT_TRUE(observed.dwFileType == VFT_APP ||
+                  observed.dwFileType == VFT_DLL);
+    }
+  }
+
+  // Use BaseName() to ensure that GetModuleVersionAndType() finds the
+  // already-loaded module with the specified name. Otherwise, it may load a
+  // different file than the one that’s already resident, which may have
+  // different VS_FIXEDFILEINFO information.
+  VS_FIXEDFILEINFO expected;
+  const bool expected_rv = GetModuleVersionAndType(
+      base::FilePath(module.name).BaseName(), &expected);

[Mark Mentovai, 2015/12/01 23:42:54]

This was really weird. Without the BaseName(), I got a bunch of failures of the
form

[ RUN      ] PEImageReader.VSFixedFileInfo_AllModules
c:\chrome\crashpad\crashpad\snapshot\win\pe_image_reader_test.cc(112): error:
Value of: observed.dwFileVersionMS
  Actual: 655360
Expected: expected.dwFileVersionMS
Which is: 393218
Google Test trace:
c:\chrome\crashpad\crashpad\snapshot\win\pe_image_reader_test.cc(158):
C:\WINDOWS\SYSTEM32\ntdll.dll

Actual (in memory) 655360 = 0xa0000 (meaning 10.0), expected (on disk) 393218 =
0x60002 (meaning 6.2). These numbers were the same for every DLL that had this
problem. It was always the file version with a mismatch, the product versions
always matched. It was always only the most-significant DWORD that had a
problem, the least-significant ones were always 0x295a0000 (10586.0). (Yeah, I
updated.)

I thought that this might have been a WinSxS problem, where the loader was
actually loading a side-by-side assembly, but reporting the path of the base
library in c:\windows\system32. But when I do Properties/Details on
c:\windows\system32\ntdll.dll, it shows 10.0.10586.0 for the file version. Among
all of the ntdll.dlls I found, I couldn’t find one that called itself 6.2, so I
don’t really know where that version came from.

Giving just the base name to GetFileVersionInfo() makes everything match up.

If you know more about why this might have happened, it’d at least be a useful
thing to stick in the comment here, or maybe on GetModuleVersionAndType().

[scottmg, 2015/12/01 23:57:38]

I don't know, but because it's reporting 8.0, I would guess that it's related to
GetVersionEx() lying. (The test binaries aren't manifested.)

e.g.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724451(v=vs.85).aspx

But then I'm not sure why BaseName() would resolve that.

+  ASSERT_TRUE(expected_rv || !known_dll);
+
+  EXPECT_EQ(expected_rv, observed_rv);
+
+  if (observed_rv && expected_rv) {
+    EXPECT_EQ(expected.dwSignature, observed.dwSignature);
+    EXPECT_EQ(expected.dwStrucVersion, observed.dwStrucVersion);
+    EXPECT_EQ(expected.dwFileVersionMS, observed.dwFileVersionMS);
+    EXPECT_EQ(expected.dwFileVersionLS, observed.dwFileVersionLS);
+    EXPECT_EQ(expected.dwProductVersionMS, observed.dwProductVersionMS);
+    EXPECT_EQ(expected.dwProductVersionLS, observed.dwProductVersionLS);
+    EXPECT_EQ(expected.dwFileFlagsMask, observed.dwFileFlagsMask);
+    EXPECT_EQ(expected.dwFileFlags, observed.dwFileFlags);
+    EXPECT_EQ(expected.dwFileOS, observed.dwFileOS);
+    EXPECT_EQ(expected.dwFileType, observed.dwFileType);
+    EXPECT_EQ(expected.dwFileSubtype, observed.dwFileSubtype);
+    EXPECT_EQ(expected.dwFileDateMS, observed.dwFileDateMS);
+    EXPECT_EQ(expected.dwFileDateLS, observed.dwFileDateLS);
+  }
+}
+
+TEST(PEImageReader, VSFixedFileInfo_OneModule) {
   ProcessReaderWin process_reader;
   ASSERT_TRUE(process_reader.Initialize(GetCurrentProcess(),
                                         ProcessSuspensionState::kRunning));
 
   const wchar_t kModuleName[] = L"kernel32.dll";
-
-  HMODULE module_handle = GetModuleHandle(kModuleName);
+  const HMODULE module_handle = GetModuleHandle(kModuleName);
   ASSERT_TRUE(module_handle) << ErrorMessage("GetModuleHandle");
 
   MODULEINFO module_info;
   ASSERT_TRUE(CrashpadGetModuleInformation(
       GetCurrentProcess(), module_handle, &module_info, sizeof(module_info)))
       << ErrorMessage("GetModuleInformation");
   EXPECT_EQ(module_handle, module_info.lpBaseOfDll);
 
-  PEImageReader pe_image_reader;
-  ASSERT_TRUE(
-      pe_image_reader.Initialize(&process_reader,
-                                 reinterpret_cast<WinVMAddress>(module_handle),
-                                 module_info.SizeOfImage,
-                                 base::UTF16ToUTF8(kModuleName)));
+  ProcessInfo::Module module;
+  module.name = kModuleName;
+  module.dll_base = reinterpret_cast<WinVMAddress>(module_info.lpBaseOfDll);
+  module.size = module_info.SizeOfImage;
 
-  VS_FIXEDFILEINFO observed;
-  ASSERT_TRUE(pe_image_reader.VSFixedFileInfo(&observed));
+  TestVSFixedFileInfo(&process_reader, module, true);
+}
 
-  EXPECT_EQ(VS_FFI_SIGNATURE, observed.dwSignature);
-  EXPECT_EQ(VS_FFI_STRUCVERSION, observed.dwStrucVersion);
-  EXPECT_EQ(0, observed.dwFileFlags & ~observed.dwFileFlagsMask);
-  EXPECT_EQ(VOS_NT_WINDOWS32, observed.dwFileOS);
-  EXPECT_EQ(VFT_DLL, observed.dwFileType);
+TEST(PEImageReader, VSFixedFileInfo_AllModules) {
+  ProcessReaderWin process_reader;
+  ASSERT_TRUE(process_reader.Initialize(GetCurrentProcess(),
+                                        ProcessSuspensionState::kRunning));
 
-  VS_FIXEDFILEINFO expected;
-  ASSERT_TRUE(GetModuleVersionAndType(base::FilePath(kModuleName), &expected));
+  const std::vector<ProcessInfo::Module>& modules = process_reader.Modules();
+  EXPECT_GT(modules.size(), 2u);
 
-  EXPECT_EQ(expected.dwSignature, observed.dwSignature);
-  EXPECT_EQ(expected.dwStrucVersion, observed.dwStrucVersion);
-  EXPECT_EQ(expected.dwFileVersionMS, observed.dwFileVersionMS);
-  EXPECT_EQ(expected.dwFileVersionLS, observed.dwFileVersionLS);
-  EXPECT_EQ(expected.dwProductVersionMS, observed.dwProductVersionMS);
-  EXPECT_EQ(expected.dwProductVersionLS, observed.dwProductVersionLS);
-  EXPECT_EQ(expected.dwFileFlagsMask, observed.dwFileFlagsMask);
-  EXPECT_EQ(expected.dwFileFlags, observed.dwFileFlags);
-  EXPECT_EQ(expected.dwFileOS, observed.dwFileOS);
-  EXPECT_EQ(expected.dwFileType, observed.dwFileType);
-  EXPECT_EQ(expected.dwFileSubtype, observed.dwFileSubtype);
-  EXPECT_EQ(expected.dwFileDateMS, observed.dwFileDateMS);
-  EXPECT_EQ(expected.dwFileDateLS, observed.dwFileDateLS);
+  for (const auto& module : modules) {
+    SCOPED_TRACE(base::UTF16ToUTF8(module.name));
+    TestVSFixedFileInfo(&process_reader, module, false);
+  }
 }
 
 }  // namespace
 }  // namespace test
 }  // namespace crashpad