OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 // | 4 // |
5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. | 5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. |
6 // | 6 // |
7 // TODO(robertshield): Implement the 64 bit intercept. | 7 // TODO(robertshield): Implement the 64 bit intercept. |
8 | 8 |
9 #include "chrome_elf/blacklist/blacklist_interceptions.h" | 9 #include "chrome_elf/blacklist/blacklist_interceptions.h" |
10 | 10 |
11 #include <string> | 11 #include <string> |
12 #include <vector> | 12 #include <vector> |
13 | 13 |
14 // Note that only #includes from base that are either header-only or built into | 14 // Note that only #includes from base that are either header-only or built into |
15 // base_static (see base/base.gyp) are allowed here. | 15 // base_static (see base/base.gyp) are allowed here. |
16 #include "base/basictypes.h" | 16 #include "base/basictypes.h" |
17 #include "base/strings/string16.h" | 17 #include "base/strings/string16.h" |
18 #include "base/win/pe_image.h" | 18 #include "base/win/pe_image.h" |
19 #include "chrome_elf/blacklist/blacklist.h" | 19 #include "chrome_elf/blacklist/blacklist.h" |
| 20 #include "chrome_elf/breakpad.h" |
20 #include "sandbox/win/src/internal_types.h" | 21 #include "sandbox/win/src/internal_types.h" |
21 #include "sandbox/win/src/nt_internals.h" | 22 #include "sandbox/win/src/nt_internals.h" |
22 #include "sandbox/win/src/sandbox_nt_util.h" | 23 #include "sandbox/win/src/sandbox_nt_util.h" |
23 #include "sandbox/win/src/sandbox_types.h" | 24 #include "sandbox/win/src/sandbox_types.h" |
24 | 25 |
25 namespace { | 26 namespace { |
26 | 27 |
27 NtQuerySectionFunction g_nt_query_section_func = NULL; | 28 NtQuerySectionFunction g_nt_query_section_func = NULL; |
28 NtQueryVirtualMemoryFunction g_nt_query_virtual_memory_func = NULL; | 29 NtQueryVirtualMemoryFunction g_nt_query_virtual_memory_func = NULL; |
29 NtUnmapViewOfSectionFunction g_nt_unmap_view_of_section_func = NULL; | 30 NtUnmapViewOfSectionFunction g_nt_unmap_view_of_section_func = NULL; |
(...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
160 base::win::PEImage pe(module); | 161 base::win::PEImage pe(module); |
161 SafeGetImageInfo(pe, &out_name, flags); | 162 SafeGetImageInfo(pe, &out_name, flags); |
162 return base::string16(out_name.begin(), out_name.end()); | 163 return base::string16(out_name.begin(), out_name.end()); |
163 } | 164 } |
164 | 165 |
165 bool IsSameAsCurrentProcess(HANDLE process) { | 166 bool IsSameAsCurrentProcess(HANDLE process) { |
166 return (NtCurrentProcess == process) || | 167 return (NtCurrentProcess == process) || |
167 (::GetProcessId(process) == ::GetCurrentProcessId()); | 168 (::GetProcessId(process) == ::GetCurrentProcessId()); |
168 } | 169 } |
169 | 170 |
170 } // namespace | 171 NTSTATUS BlNtMapViewOfSectionImpl( |
171 | |
172 namespace blacklist { | |
173 | |
174 bool InitializeInterceptImports() { | |
175 g_nt_query_section_func = reinterpret_cast<NtQuerySectionFunction>( | |
176 GetNtDllExportByName("NtQuerySection")); | |
177 g_nt_query_virtual_memory_func = | |
178 reinterpret_cast<NtQueryVirtualMemoryFunction>( | |
179 GetNtDllExportByName("NtQueryVirtualMemory")); | |
180 g_nt_unmap_view_of_section_func = | |
181 reinterpret_cast<NtUnmapViewOfSectionFunction>( | |
182 GetNtDllExportByName("NtUnmapViewOfSection")); | |
183 | |
184 return g_nt_query_section_func && g_nt_query_virtual_memory_func && | |
185 g_nt_unmap_view_of_section_func; | |
186 } | |
187 | |
188 SANDBOX_INTERCEPT NTSTATUS WINAPI BlNtMapViewOfSection( | |
189 NtMapViewOfSectionFunction orig_MapViewOfSection, | 172 NtMapViewOfSectionFunction orig_MapViewOfSection, |
190 HANDLE section, | 173 HANDLE section, |
191 HANDLE process, | 174 HANDLE process, |
192 PVOID *base, | 175 PVOID *base, |
193 ULONG_PTR zero_bits, | 176 ULONG_PTR zero_bits, |
194 SIZE_T commit_size, | 177 SIZE_T commit_size, |
195 PLARGE_INTEGER offset, | 178 PLARGE_INTEGER offset, |
196 PSIZE_T view_size, | 179 PSIZE_T view_size, |
197 SECTION_INHERIT inherit, | 180 SECTION_INHERIT inherit, |
198 ULONG allocation_type, | 181 ULONG allocation_type, |
(...skipping 24 matching lines...) Expand all Loading... |
223 if (!module_name.empty() && DllMatch(module_name)) { | 206 if (!module_name.empty() && DllMatch(module_name)) { |
224 DCHECK_NT(g_nt_unmap_view_of_section_func); | 207 DCHECK_NT(g_nt_unmap_view_of_section_func); |
225 g_nt_unmap_view_of_section_func(process, *base); | 208 g_nt_unmap_view_of_section_func(process, *base); |
226 ret = STATUS_UNSUCCESSFUL; | 209 ret = STATUS_UNSUCCESSFUL; |
227 } | 210 } |
228 } | 211 } |
229 | 212 |
230 return ret; | 213 return ret; |
231 } | 214 } |
232 | 215 |
| 216 } // namespace |
| 217 |
| 218 namespace blacklist { |
| 219 |
| 220 bool InitializeInterceptImports() { |
| 221 g_nt_query_section_func = |
| 222 reinterpret_cast<NtQuerySectionFunction>( |
| 223 GetNtDllExportByName("NtQuerySection")); |
| 224 g_nt_query_virtual_memory_func = |
| 225 reinterpret_cast<NtQueryVirtualMemoryFunction>( |
| 226 GetNtDllExportByName("NtQueryVirtualMemory")); |
| 227 g_nt_unmap_view_of_section_func = |
| 228 reinterpret_cast<NtUnmapViewOfSectionFunction>( |
| 229 GetNtDllExportByName("NtUnmapViewOfSection")); |
| 230 |
| 231 return (g_nt_query_section_func && g_nt_query_virtual_memory_func && |
| 232 g_nt_unmap_view_of_section_func); |
| 233 } |
| 234 |
| 235 SANDBOX_INTERCEPT NTSTATUS WINAPI BlNtMapViewOfSection( |
| 236 NtMapViewOfSectionFunction orig_MapViewOfSection, |
| 237 HANDLE section, |
| 238 HANDLE process, |
| 239 PVOID *base, |
| 240 ULONG_PTR zero_bits, |
| 241 SIZE_T commit_size, |
| 242 PLARGE_INTEGER offset, |
| 243 PSIZE_T view_size, |
| 244 SECTION_INHERIT inherit, |
| 245 ULONG allocation_type, |
| 246 ULONG protect) { |
| 247 NTSTATUS ret = STATUS_UNSUCCESSFUL; |
| 248 |
| 249 __try { |
| 250 ret = BlNtMapViewOfSectionImpl(orig_MapViewOfSection, section, process, |
| 251 base, zero_bits, commit_size, offset, |
| 252 view_size, inherit, allocation_type, |
| 253 protect); |
| 254 } __except(GenerateCrashDump(GetExceptionInformation())) { |
| 255 } |
| 256 |
| 257 return ret; |
| 258 } |
| 259 |
233 #if defined(_WIN64) | 260 #if defined(_WIN64) |
234 NTSTATUS WINAPI BlNtMapViewOfSection64( | 261 NTSTATUS WINAPI BlNtMapViewOfSection64( |
235 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, | 262 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, |
236 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, | 263 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, |
237 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { | 264 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { |
238 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, | 265 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, |
239 base, zero_bits, commit_size, offset, view_size, | 266 base, zero_bits, commit_size, offset, view_size, |
240 inherit, allocation_type, protect); | 267 inherit, allocation_type, protect); |
241 } | 268 } |
242 #endif | 269 #endif |
243 } // namespace blacklist | 270 } // namespace blacklist |
OLD | NEW |