| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/win/src/Wow64.h" | |
| 6 | |
| 7 #include <stddef.h> | |
| 8 | |
| 9 #include <sstream> | |
| 10 | |
| 11 #include "base/bit_cast.h" | |
| 12 #include "base/logging.h" | |
| 13 #include "base/memory/scoped_ptr.h" | |
| 14 #include "base/win/scoped_process_information.h" | |
| 15 #include "base/win/windows_version.h" | |
| 16 #include "sandbox/win/src/target_process.h" | |
| 17 | |
| 18 namespace { | |
| 19 | |
| 20 // Holds the information needed for the interception of NtMapViewOfSection on | |
| 21 // 64 bits. | |
| 22 // Warning: do not modify this definition without changing also the code on the | |
| 23 // 64 bit helper process. | |
| 24 struct PatchInfo32 { | |
| 25 HANDLE dll_load; // Event to signal the broker. | |
| 26 ULONG pad1; | |
| 27 HANDLE continue_load; // Event to wait for the broker. | |
| 28 ULONG pad2; | |
| 29 HANDLE section; // First argument of the call. | |
| 30 ULONG pad3; | |
| 31 void* orig_MapViewOfSection; | |
| 32 ULONG original_high; | |
| 33 void* signal_and_wait; | |
| 34 ULONG pad4; | |
| 35 void* patch_location; | |
| 36 ULONG patch_high; | |
| 37 }; | |
| 38 | |
| 39 // Size of the 64 bit service entry. | |
| 40 const SIZE_T kServiceEntry64Size = 0x10; | |
| 41 | |
| 42 // Removes the interception of ntdll64. | |
| 43 bool Restore64Code(HANDLE child, PatchInfo32* patch_info) { | |
| 44 PatchInfo32 local_patch_info; | |
| 45 SIZE_T actual; | |
| 46 if (!::ReadProcessMemory(child, patch_info, &local_patch_info, | |
| 47 sizeof(local_patch_info), &actual)) | |
| 48 return false; | |
| 49 if (sizeof(local_patch_info) != actual) | |
| 50 return false; | |
| 51 | |
| 52 if (local_patch_info.original_high) | |
| 53 return false; | |
| 54 if (local_patch_info.patch_high) | |
| 55 return false; | |
| 56 | |
| 57 char buffer[kServiceEntry64Size]; | |
| 58 | |
| 59 if (!::ReadProcessMemory(child, local_patch_info.orig_MapViewOfSection, | |
| 60 &buffer, kServiceEntry64Size, &actual)) | |
| 61 return false; | |
| 62 if (kServiceEntry64Size != actual) | |
| 63 return false; | |
| 64 | |
| 65 if (!::WriteProcessMemory(child, local_patch_info.patch_location, &buffer, | |
| 66 kServiceEntry64Size, &actual)) | |
| 67 return false; | |
| 68 if (kServiceEntry64Size != actual) | |
| 69 return false; | |
| 70 return true; | |
| 71 } | |
| 72 | |
| 73 typedef BOOL (WINAPI* IsWow64ProcessFunction)(HANDLE process, BOOL* wow64); | |
| 74 | |
| 75 } // namespace | |
| 76 | |
| 77 namespace sandbox { | |
| 78 | |
| 79 Wow64::Wow64(TargetProcess* child, HMODULE ntdll) | |
| 80 : child_(child), ntdll_(ntdll), dll_load_(NULL), continue_load_(NULL) { | |
| 81 } | |
| 82 | |
| 83 Wow64::~Wow64() { | |
| 84 } | |
| 85 | |
| 86 // The basic idea is to allocate one page of memory on the child, and initialize | |
| 87 // the first part of it with our version of PatchInfo32. Then launch the helper | |
| 88 // process passing it that address on the child. The helper process will patch | |
| 89 // the 64 bit version of NtMapViewOfFile, and the interception will signal the | |
| 90 // first event on the buffer. We'll be waiting on that event and after the 32 | |
| 91 // bit version of ntdll is loaded, we'll remove the interception and return to | |
| 92 // our caller. | |
| 93 bool Wow64::WaitForNtdll() { | |
| 94 if (base::win::OSInfo::GetInstance()->wow64_status() != | |
| 95 base::win::OSInfo::WOW64_ENABLED) | |
| 96 return true; | |
| 97 | |
| 98 const size_t page_size = 4096; | |
| 99 | |
| 100 // Create some default manual reset un-named events, not signaled. | |
| 101 dll_load_.Set(::CreateEvent(NULL, TRUE, FALSE, NULL)); | |
| 102 continue_load_.Set(::CreateEvent(NULL, TRUE, FALSE, NULL)); | |
| 103 HANDLE current_process = ::GetCurrentProcess(); | |
| 104 HANDLE remote_load, remote_continue; | |
| 105 DWORD access = EVENT_MODIFY_STATE | SYNCHRONIZE; | |
| 106 if (!::DuplicateHandle(current_process, dll_load_.Get(), child_->Process(), | |
| 107 &remote_load, access, FALSE, 0)) { | |
| 108 return false; | |
| 109 } | |
| 110 if (!::DuplicateHandle(current_process, continue_load_.Get(), | |
| 111 child_->Process(), &remote_continue, access, FALSE, | |
| 112 0)) { | |
| 113 return false; | |
| 114 } | |
| 115 | |
| 116 void* buffer = ::VirtualAllocEx(child_->Process(), NULL, page_size, | |
| 117 MEM_COMMIT, PAGE_EXECUTE_READWRITE); | |
| 118 DCHECK(buffer); | |
| 119 if (!buffer) | |
| 120 return false; | |
| 121 | |
| 122 PatchInfo32* patch_info = reinterpret_cast<PatchInfo32*>(buffer); | |
| 123 PatchInfo32 local_patch_info = {0}; | |
| 124 local_patch_info.dll_load = remote_load; | |
| 125 local_patch_info.continue_load = remote_continue; | |
| 126 SIZE_T written; | |
| 127 if (!::WriteProcessMemory(child_->Process(), patch_info, &local_patch_info, | |
| 128 offsetof(PatchInfo32, section), &written)) | |
| 129 return false; | |
| 130 if (offsetof(PatchInfo32, section) != written) | |
| 131 return false; | |
| 132 | |
| 133 if (!RunWowHelper(buffer)) | |
| 134 return false; | |
| 135 | |
| 136 // The child is intercepted on 64 bit, go on and wait for our event. | |
| 137 if (!DllMapped()) | |
| 138 return false; | |
| 139 | |
| 140 // The 32 bit version is available, cleanup the child. | |
| 141 return Restore64Code(child_->Process(), patch_info); | |
| 142 } | |
| 143 | |
| 144 bool Wow64::RunWowHelper(void* buffer) { | |
| 145 static_assert(sizeof(buffer) <= sizeof(DWORD), "unsupported 64 bits"); | |
| 146 | |
| 147 // Get the path to the helper (beside the exe). | |
| 148 wchar_t prog_name[MAX_PATH]; | |
| 149 GetModuleFileNameW(NULL, prog_name, MAX_PATH); | |
| 150 base::string16 path(prog_name); | |
| 151 size_t name_pos = path.find_last_of(L"\\"); | |
| 152 if (base::string16::npos == name_pos) | |
| 153 return false; | |
| 154 path.resize(name_pos + 1); | |
| 155 | |
| 156 std::basic_stringstream<base::char16> command; | |
| 157 command << std::hex << std::showbase << L"\"" << path << | |
| 158 L"wow_helper.exe\" " << child_->ProcessId() << " " << | |
| 159 bit_cast<ULONG>(buffer); | |
| 160 | |
| 161 scoped_ptr<wchar_t, base::FreeDeleter> | |
| 162 writable_command(_wcsdup(command.str().c_str())); | |
| 163 | |
| 164 STARTUPINFO startup_info = {0}; | |
| 165 startup_info.cb = sizeof(startup_info); | |
| 166 PROCESS_INFORMATION temp_process_info = {}; | |
| 167 if (!::CreateProcess(NULL, writable_command.get(), NULL, NULL, FALSE, 0, NULL, | |
| 168 NULL, &startup_info, &temp_process_info)) | |
| 169 return false; | |
| 170 base::win::ScopedProcessInformation process_info(temp_process_info); | |
| 171 | |
| 172 DWORD reason = ::WaitForSingleObject(process_info.process_handle(), INFINITE); | |
| 173 | |
| 174 DWORD code; | |
| 175 bool ok = | |
| 176 ::GetExitCodeProcess(process_info.process_handle(), &code) ? true : false; | |
| 177 | |
| 178 if (WAIT_TIMEOUT == reason) | |
| 179 return false; | |
| 180 | |
| 181 return ok && (0 == code); | |
| 182 } | |
| 183 | |
| 184 // First we must wake up the child, then wait for dll loads on the child until | |
| 185 // the one we care is loaded; at that point we must suspend the child again. | |
| 186 bool Wow64::DllMapped() { | |
| 187 if (1 != ::ResumeThread(child_->MainThread())) { | |
| 188 NOTREACHED(); | |
| 189 return false; | |
| 190 } | |
| 191 | |
| 192 for (;;) { | |
| 193 DWORD reason = ::WaitForSingleObject(dll_load_.Get(), INFINITE); | |
| 194 if (WAIT_TIMEOUT == reason || WAIT_ABANDONED == reason) | |
| 195 return false; | |
| 196 | |
| 197 if (!::ResetEvent(dll_load_.Get())) | |
| 198 return false; | |
| 199 | |
| 200 bool found = NtdllPresent(); | |
| 201 if (found) { | |
| 202 if (::SuspendThread(child_->MainThread())) | |
| 203 return false; | |
| 204 } | |
| 205 | |
| 206 if (!::SetEvent(continue_load_.Get())) | |
| 207 return false; | |
| 208 | |
| 209 if (found) | |
| 210 return true; | |
| 211 } | |
| 212 } | |
| 213 | |
| 214 bool Wow64::NtdllPresent() { | |
| 215 const size_t kBufferSize = 512; | |
| 216 char buffer[kBufferSize]; | |
| 217 SIZE_T read; | |
| 218 if (!::ReadProcessMemory(child_->Process(), ntdll_, &buffer, kBufferSize, | |
| 219 &read)) | |
| 220 return false; | |
| 221 if (kBufferSize != read) | |
| 222 return false; | |
| 223 return true; | |
| 224 } | |
| 225 | |
| 226 } // namespace sandbox | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1814863004:
Cleanup/Remove Windows XP/Vista version checks from Windows sandbox code (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master