| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef SANDBOX_SRC_SERVICE_RESOLVER_H__ | |
| 6 #define SANDBOX_SRC_SERVICE_RESOLVER_H__ | |
| 7 | |
| 8 #include <stddef.h> | |
| 9 | |
| 10 #include "base/macros.h" | |
| 11 #include "sandbox/win/src/nt_internals.h" | |
| 12 #include "sandbox/win/src/resolver.h" | |
| 13 | |
| 14 namespace sandbox { | |
| 15 | |
| 16 // This is the concrete resolver used to perform service-call type functions | |
| 17 // inside ntdll.dll. | |
| 18 class ServiceResolverThunk : public ResolverThunk { | |
| 19 public: | |
| 20 // The service resolver needs a child process to write to. | |
| 21 ServiceResolverThunk(HANDLE process, bool relaxed) | |
| 22 : ntdll_base_(NULL), | |
| 23 process_(process), | |
| 24 relaxed_(relaxed), | |
| 25 relative_jump_(0) {} | |
| 26 ~ServiceResolverThunk() override {} | |
| 27 | |
| 28 // Implementation of Resolver::Setup. | |
| 29 NTSTATUS Setup(const void* target_module, | |
| 30 const void* interceptor_module, | |
| 31 const char* target_name, | |
| 32 const char* interceptor_name, | |
| 33 const void* interceptor_entry_point, | |
| 34 void* thunk_storage, | |
| 35 size_t storage_bytes, | |
| 36 size_t* storage_used) override; | |
| 37 | |
| 38 // Implementation of Resolver::ResolveInterceptor. | |
| 39 NTSTATUS ResolveInterceptor(const void* module, | |
| 40 const char* function_name, | |
| 41 const void** address) override; | |
| 42 | |
| 43 // Implementation of Resolver::ResolveTarget. | |
| 44 NTSTATUS ResolveTarget(const void* module, | |
| 45 const char* function_name, | |
| 46 void** address) override; | |
| 47 | |
| 48 // Implementation of Resolver::GetThunkSize. | |
| 49 size_t GetThunkSize() const override; | |
| 50 | |
| 51 // Call this to set up ntdll_base_ which will allow for local patches. | |
| 52 virtual void AllowLocalPatches(); | |
| 53 | |
| 54 // Verifies that the function specified by |target_name| in |target_module| is | |
| 55 // a service and copies the data from that function into |thunk_storage|. If | |
| 56 // |storage_bytes| is too small, then the method fails. | |
| 57 virtual NTSTATUS CopyThunk(const void* target_module, | |
| 58 const char* target_name, | |
| 59 BYTE* thunk_storage, | |
| 60 size_t storage_bytes, | |
| 61 size_t* storage_used); | |
| 62 | |
| 63 protected: | |
| 64 // The unit test will use this member to allow local patch on a buffer. | |
| 65 HMODULE ntdll_base_; | |
| 66 | |
| 67 // Handle of the child process. | |
| 68 HANDLE process_; | |
| 69 | |
| 70 private: | |
| 71 // Returns true if the code pointer by target_ corresponds to the expected | |
| 72 // type of function. Saves that code on the first part of the thunk pointed | |
| 73 // by local_thunk (should be directly accessible from the parent). | |
| 74 virtual bool IsFunctionAService(void* local_thunk) const; | |
| 75 | |
| 76 // Performs the actual patch of target_. | |
| 77 // local_thunk must be already fully initialized, and the first part must | |
| 78 // contain the original code. The real type of this buffer is ServiceFullThunk | |
| 79 // (yes, private). remote_thunk (real type ServiceFullThunk), must be | |
| 80 // allocated on the child, and will contain the thunk data, after this call. | |
| 81 // Returns the apropriate status code. | |
| 82 virtual NTSTATUS PerformPatch(void* local_thunk, void* remote_thunk); | |
| 83 | |
| 84 // Provides basically the same functionality as IsFunctionAService but it | |
| 85 // continues even if it does not recognize the function code. remote_thunk | |
| 86 // is the address of our memory on the child. | |
| 87 bool SaveOriginalFunction(void* local_thunk, void* remote_thunk); | |
| 88 | |
| 89 // true if we are allowed to patch already-patched functions. | |
| 90 bool relaxed_; | |
| 91 ULONG relative_jump_; | |
| 92 | |
| 93 DISALLOW_COPY_AND_ASSIGN(ServiceResolverThunk); | |
| 94 }; | |
| 95 | |
| 96 // This is the concrete resolver used to perform service-call type functions | |
| 97 // inside ntdll.dll on WOW64 (32 bit ntdll on 64 bit Vista). | |
| 98 class Wow64ResolverThunk : public ServiceResolverThunk { | |
| 99 public: | |
| 100 // The service resolver needs a child process to write to. | |
| 101 Wow64ResolverThunk(HANDLE process, bool relaxed) | |
| 102 : ServiceResolverThunk(process, relaxed) {} | |
| 103 ~Wow64ResolverThunk() override {} | |
| 104 | |
| 105 private: | |
| 106 bool IsFunctionAService(void* local_thunk) const override; | |
| 107 | |
| 108 DISALLOW_COPY_AND_ASSIGN(Wow64ResolverThunk); | |
| 109 }; | |
| 110 | |
| 111 // This is the concrete resolver used to perform service-call type functions | |
| 112 // inside ntdll.dll on WOW64 for Windows 8. | |
| 113 class Wow64W8ResolverThunk : public ServiceResolverThunk { | |
| 114 public: | |
| 115 // The service resolver needs a child process to write to. | |
| 116 Wow64W8ResolverThunk(HANDLE process, bool relaxed) | |
| 117 : ServiceResolverThunk(process, relaxed) {} | |
| 118 ~Wow64W8ResolverThunk() override {} | |
| 119 | |
| 120 private: | |
| 121 bool IsFunctionAService(void* local_thunk) const override; | |
| 122 | |
| 123 DISALLOW_COPY_AND_ASSIGN(Wow64W8ResolverThunk); | |
| 124 }; | |
| 125 | |
| 126 // This is the concrete resolver used to perform service-call type functions | |
| 127 // inside ntdll.dll on Windows 8. | |
| 128 class Win8ResolverThunk : public ServiceResolverThunk { | |
| 129 public: | |
| 130 // The service resolver needs a child process to write to. | |
| 131 Win8ResolverThunk(HANDLE process, bool relaxed) | |
| 132 : ServiceResolverThunk(process, relaxed) {} | |
| 133 ~Win8ResolverThunk() override {} | |
| 134 | |
| 135 private: | |
| 136 bool IsFunctionAService(void* local_thunk) const override; | |
| 137 | |
| 138 DISALLOW_COPY_AND_ASSIGN(Win8ResolverThunk); | |
| 139 }; | |
| 140 | |
| 141 // This is the concrete resolver used to perform service-call type functions | |
| 142 // inside ntdll.dll on WOW64 for Windows 10. | |
| 143 class Wow64W10ResolverThunk : public ServiceResolverThunk { | |
| 144 public: | |
| 145 // The service resolver needs a child process to write to. | |
| 146 Wow64W10ResolverThunk(HANDLE process, bool relaxed) | |
| 147 : ServiceResolverThunk(process, relaxed) {} | |
| 148 ~Wow64W10ResolverThunk() override {} | |
| 149 | |
| 150 private: | |
| 151 bool IsFunctionAService(void* local_thunk) const override; | |
| 152 | |
| 153 DISALLOW_COPY_AND_ASSIGN(Wow64W10ResolverThunk); | |
| 154 }; | |
| 155 | |
| 156 } // namespace sandbox | |
| 157 | |
| 158 | |
| 159 #endif // SANDBOX_SRC_SERVICE_RESOLVER_H__ | |
| OLD | NEW |