OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 // | 4 // |
5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. | 5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. |
6 // | 6 // |
7 // TODO(robertshield): Implement the 64 bit intercept. | 7 // TODO(robertshield): Implement the 64 bit intercept. |
8 | 8 |
9 #include "chrome_elf/blacklist/blacklist_interceptions.h" | 9 #include "chrome_elf/blacklist/blacklist_interceptions.h" |
10 | 10 |
(...skipping 17 matching lines...) Expand all Loading... |
28 NtQuerySectionFunction g_nt_query_section_func = NULL; | 28 NtQuerySectionFunction g_nt_query_section_func = NULL; |
29 NtQueryVirtualMemoryFunction g_nt_query_virtual_memory_func = NULL; | 29 NtQueryVirtualMemoryFunction g_nt_query_virtual_memory_func = NULL; |
30 NtUnmapViewOfSectionFunction g_nt_unmap_view_of_section_func = NULL; | 30 NtUnmapViewOfSectionFunction g_nt_unmap_view_of_section_func = NULL; |
31 | 31 |
32 // TODO(robertshield): Merge with ntdll exports cache. | 32 // TODO(robertshield): Merge with ntdll exports cache. |
33 FARPROC GetNtDllExportByName(const char* export_name) { | 33 FARPROC GetNtDllExportByName(const char* export_name) { |
34 HMODULE ntdll = ::GetModuleHandle(sandbox::kNtdllName); | 34 HMODULE ntdll = ::GetModuleHandle(sandbox::kNtdllName); |
35 return ::GetProcAddress(ntdll, export_name); | 35 return ::GetProcAddress(ntdll, export_name); |
36 } | 36 } |
37 | 37 |
38 bool DllMatch(const base::string16& module_name) { | 38 int DllMatch(const base::string16& module_name) { |
39 for (int i = 0; blacklist::g_troublesome_dlls[i] != NULL; ++i) { | 39 for (int i = 0; blacklist::g_troublesome_dlls[i] != NULL; ++i) { |
40 if (_wcsicmp(module_name.c_str(), blacklist::g_troublesome_dlls[i]) == 0) | 40 if (_wcsicmp(module_name.c_str(), blacklist::g_troublesome_dlls[i]) == 0) |
41 return true; | 41 return i; |
42 } | 42 } |
43 return false; | 43 return -1; |
44 } | 44 } |
45 | 45 |
46 // TODO(robertshield): Some of the helper functions below overlap somewhat with | 46 // TODO(robertshield): Some of the helper functions below overlap somewhat with |
47 // code in sandbox_nt_util.cc. See if they can be unified. | 47 // code in sandbox_nt_util.cc. See if they can be unified. |
48 | 48 |
49 // Native reimplementation of PSAPIs GetMappedFileName. | 49 // Native reimplementation of PSAPIs GetMappedFileName. |
50 base::string16 GetBackingModuleFilePath(PVOID address) { | 50 base::string16 GetBackingModuleFilePath(PVOID address) { |
51 DCHECK_NT(g_nt_query_virtual_memory_func); | 51 DCHECK_NT(g_nt_query_virtual_memory_func); |
52 | 52 |
53 // We'll start with something close to max_path characters for the name. | 53 // We'll start with something close to max_path characters for the name. |
(...skipping 142 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
196 base::string16 module_name(GetImageInfoFromLoadedModule( | 196 base::string16 module_name(GetImageInfoFromLoadedModule( |
197 reinterpret_cast<HMODULE>(*base), &image_flags)); | 197 reinterpret_cast<HMODULE>(*base), &image_flags)); |
198 base::string16 file_name(GetBackingModuleFilePath(*base)); | 198 base::string16 file_name(GetBackingModuleFilePath(*base)); |
199 | 199 |
200 if (module_name.empty() && (image_flags & sandbox::MODULE_HAS_CODE)) { | 200 if (module_name.empty() && (image_flags & sandbox::MODULE_HAS_CODE)) { |
201 // If the module has no exports we retrieve the module name from the | 201 // If the module has no exports we retrieve the module name from the |
202 // full path of the mapped section. | 202 // full path of the mapped section. |
203 module_name = ExtractLoadedModuleName(file_name); | 203 module_name = ExtractLoadedModuleName(file_name); |
204 } | 204 } |
205 | 205 |
206 if (!module_name.empty() && DllMatch(module_name)) { | 206 if (!module_name.empty()) { |
207 DCHECK_NT(g_nt_unmap_view_of_section_func); | 207 int blocked_index = DllMatch(module_name); |
208 g_nt_unmap_view_of_section_func(process, *base); | 208 if (blocked_index != -1) { |
209 ret = STATUS_UNSUCCESSFUL; | 209 DCHECK_NT(g_nt_unmap_view_of_section_func); |
| 210 g_nt_unmap_view_of_section_func(process, *base); |
| 211 ret = STATUS_UNSUCCESSFUL; |
| 212 |
| 213 blacklist::BlockedDll(blocked_index); |
| 214 } |
210 } | 215 } |
211 } | 216 } |
212 | 217 |
213 return ret; | 218 return ret; |
214 } | 219 } |
215 | 220 |
216 } // namespace | 221 } // namespace |
217 | 222 |
218 namespace blacklist { | 223 namespace blacklist { |
219 | 224 |
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
261 NTSTATUS WINAPI BlNtMapViewOfSection64( | 266 NTSTATUS WINAPI BlNtMapViewOfSection64( |
262 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, | 267 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, |
263 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, | 268 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, |
264 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { | 269 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { |
265 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, | 270 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, |
266 base, zero_bits, commit_size, offset, view_size, | 271 base, zero_bits, commit_size, offset, view_size, |
267 inherit, allocation_type, protect); | 272 inherit, allocation_type, protect); |
268 } | 273 } |
269 #endif | 274 #endif |
270 } // namespace blacklist | 275 } // namespace blacklist |
OLD | NEW |