| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/win/src/service_resolver.h" | |
| 6 | |
| 7 #include <stddef.h> | |
| 8 | |
| 9 #include "base/memory/scoped_ptr.h" | |
| 10 #include "sandbox/win/src/sandbox_nt_util.h" | |
| 11 #include "sandbox/win/src/win_utils.h" | |
| 12 | |
| 13 namespace { | |
| 14 #pragma pack(push, 1) | |
| 15 | |
| 16 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C; | |
| 17 const USHORT kSyscall = 0x050F; | |
| 18 const BYTE kRetNp = 0xC3; | |
| 19 const ULONG64 kMov1 = 0x54894808244C8948; | |
| 20 const ULONG64 kMov2 = 0x4C182444894C1024; | |
| 21 const ULONG kMov3 = 0x20244C89; | |
| 22 const USHORT kTestByte = 0x04F6; | |
| 23 const BYTE kPtr = 0x25; | |
| 24 const BYTE kRet = 0xC3; | |
| 25 const USHORT kJne = 0x0375; | |
| 26 | |
| 27 // Service code for 64 bit systems. | |
| 28 struct ServiceEntry { | |
| 29 // This struct contains roughly the following code: | |
| 30 // 00 mov r10,rcx | |
| 31 // 03 mov eax,52h | |
| 32 // 08 syscall | |
| 33 // 0a ret | |
| 34 // 0b xchg ax,ax | |
| 35 // 0e xchg ax,ax | |
| 36 | |
| 37 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
| 38 ULONG service_id; | |
| 39 USHORT syscall; // = 0F 05 | |
| 40 BYTE ret; // = C3 | |
| 41 BYTE pad; // = 66 | |
| 42 USHORT xchg_ax_ax1; // = 66 90 | |
| 43 USHORT xchg_ax_ax2; // = 66 90 | |
| 44 }; | |
| 45 | |
| 46 // Service code for 64 bit Windows 8. | |
| 47 struct ServiceEntryW8 { | |
| 48 // This struct contains the following code: | |
| 49 // 00 48894c2408 mov [rsp+8], rcx | |
| 50 // 05 4889542410 mov [rsp+10], rdx | |
| 51 // 0a 4c89442418 mov [rsp+18], r8 | |
| 52 // 0f 4c894c2420 mov [rsp+20], r9 | |
| 53 // 14 4c8bd1 mov r10,rcx | |
| 54 // 17 b825000000 mov eax,25h | |
| 55 // 1c 0f05 syscall | |
| 56 // 1e c3 ret | |
| 57 // 1f 90 nop | |
| 58 | |
| 59 ULONG64 mov_1; // = 48 89 4C 24 08 48 89 54 | |
| 60 ULONG64 mov_2; // = 24 10 4C 89 44 24 18 4C | |
| 61 ULONG mov_3; // = 89 4C 24 20 | |
| 62 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
| 63 ULONG service_id; | |
| 64 USHORT syscall; // = 0F 05 | |
| 65 BYTE ret; // = C3 | |
| 66 BYTE nop; // = 90 | |
| 67 }; | |
| 68 | |
| 69 // Service code for 64 bit systems with int 2e fallback. | |
| 70 struct ServiceEntryWithInt2E { | |
| 71 // This struct contains roughly the following code: | |
| 72 // 00 4c8bd1 mov r10,rcx | |
| 73 // 03 b855000000 mov eax,52h | |
| 74 // 08 f604250803fe7f01 test byte ptr SharedUserData!308, 1 | |
| 75 // 10 7503 jne [over syscall] | |
| 76 // 12 0f05 syscall | |
| 77 // 14 c3 ret | |
| 78 // 15 cd2e int 2e | |
| 79 // 17 c3 ret | |
| 80 | |
| 81 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
| 82 ULONG service_id; | |
| 83 USHORT test_byte; // = F6 04 | |
| 84 BYTE ptr; // = 25 | |
| 85 ULONG user_shared_data_ptr; | |
| 86 BYTE one; // = 01 | |
| 87 USHORT jne_over_syscall; // = 75 03 | |
| 88 USHORT syscall; // = 0F 05 | |
| 89 BYTE ret; // = C3 | |
| 90 USHORT int2e; // = CD 2E | |
| 91 BYTE ret2; // = C3 | |
| 92 }; | |
| 93 | |
| 94 // We don't have an internal thunk for x64. | |
| 95 struct ServiceFullThunk { | |
| 96 union { | |
| 97 ServiceEntry original; | |
| 98 ServiceEntryW8 original_w8; | |
| 99 ServiceEntryWithInt2E original_int2e_fallback; | |
| 100 }; | |
| 101 }; | |
| 102 | |
| 103 #pragma pack(pop) | |
| 104 | |
| 105 bool IsService(const void* source) { | |
| 106 const ServiceEntry* service = | |
| 107 reinterpret_cast<const ServiceEntry*>(source); | |
| 108 | |
| 109 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
| 110 kSyscall == service->syscall && kRetNp == service->ret); | |
| 111 } | |
| 112 | |
| 113 bool IsServiceW8(const void* source) { | |
| 114 const ServiceEntryW8* service = | |
| 115 reinterpret_cast<const ServiceEntryW8*>(source); | |
| 116 | |
| 117 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
| 118 kMov1 == service->mov_1 && kMov2 == service->mov_2 && | |
| 119 kMov3 == service->mov_3); | |
| 120 } | |
| 121 | |
| 122 bool IsServiceWithInt2E(const void* source) { | |
| 123 const ServiceEntryWithInt2E* service = | |
| 124 reinterpret_cast<const ServiceEntryWithInt2E*>(source); | |
| 125 | |
| 126 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
| 127 kTestByte == service->test_byte && kPtr == service->ptr && | |
| 128 kJne == service->jne_over_syscall && kSyscall == service->syscall && | |
| 129 kRet == service->ret && kRet == service->ret2); | |
| 130 } | |
| 131 | |
| 132 }; // namespace | |
| 133 | |
| 134 namespace sandbox { | |
| 135 | |
| 136 NTSTATUS ServiceResolverThunk::Setup(const void* target_module, | |
| 137 const void* interceptor_module, | |
| 138 const char* target_name, | |
| 139 const char* interceptor_name, | |
| 140 const void* interceptor_entry_point, | |
| 141 void* thunk_storage, | |
| 142 size_t storage_bytes, | |
| 143 size_t* storage_used) { | |
| 144 NTSTATUS ret = | |
| 145 Init(target_module, interceptor_module, target_name, interceptor_name, | |
| 146 interceptor_entry_point, thunk_storage, storage_bytes); | |
| 147 if (!NT_SUCCESS(ret)) | |
| 148 return ret; | |
| 149 | |
| 150 size_t thunk_bytes = GetThunkSize(); | |
| 151 scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]); | |
| 152 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>( | |
| 153 thunk_buffer.get()); | |
| 154 | |
| 155 if (!IsFunctionAService(&thunk->original)) | |
| 156 return STATUS_UNSUCCESSFUL; | |
| 157 | |
| 158 ret = PerformPatch(thunk, thunk_storage); | |
| 159 | |
| 160 if (NULL != storage_used) | |
| 161 *storage_used = thunk_bytes; | |
| 162 | |
| 163 return ret; | |
| 164 } | |
| 165 | |
| 166 size_t ServiceResolverThunk::GetThunkSize() const { | |
| 167 return sizeof(ServiceFullThunk); | |
| 168 } | |
| 169 | |
| 170 NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module, | |
| 171 const char* target_name, | |
| 172 BYTE* thunk_storage, | |
| 173 size_t storage_bytes, | |
| 174 size_t* storage_used) { | |
| 175 NTSTATUS ret = ResolveTarget(target_module, target_name, &target_); | |
| 176 if (!NT_SUCCESS(ret)) | |
| 177 return ret; | |
| 178 | |
| 179 size_t thunk_bytes = GetThunkSize(); | |
| 180 if (storage_bytes < thunk_bytes) | |
| 181 return STATUS_UNSUCCESSFUL; | |
| 182 | |
| 183 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage); | |
| 184 | |
| 185 if (!IsFunctionAService(&thunk->original)) | |
| 186 return STATUS_UNSUCCESSFUL; | |
| 187 | |
| 188 if (NULL != storage_used) | |
| 189 *storage_used = thunk_bytes; | |
| 190 | |
| 191 return ret; | |
| 192 } | |
| 193 | |
| 194 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const { | |
| 195 ServiceFullThunk function_code; | |
| 196 SIZE_T read; | |
| 197 if (!::ReadProcessMemory(process_, target_, &function_code, | |
| 198 sizeof(function_code), &read)) | |
| 199 return false; | |
| 200 | |
| 201 if (sizeof(function_code) != read) | |
| 202 return false; | |
| 203 | |
| 204 if (!IsService(&function_code) && !IsServiceW8(&function_code) && | |
| 205 !IsServiceWithInt2E(&function_code)) | |
| 206 return false; | |
| 207 | |
| 208 // Save the verified code. | |
| 209 memcpy(local_thunk, &function_code, sizeof(function_code)); | |
| 210 | |
| 211 return true; | |
| 212 } | |
| 213 | |
| 214 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk, | |
| 215 void* remote_thunk) { | |
| 216 // Patch the original code. | |
| 217 ServiceEntry local_service; | |
| 218 DCHECK_NT(GetInternalThunkSize() <= sizeof(local_service)); | |
| 219 if (!SetInternalThunk(&local_service, sizeof(local_service), NULL, | |
| 220 interceptor_)) | |
| 221 return STATUS_UNSUCCESSFUL; | |
| 222 | |
| 223 // Copy the local thunk buffer to the child. | |
| 224 SIZE_T actual; | |
| 225 if (!::WriteProcessMemory(process_, remote_thunk, local_thunk, | |
| 226 sizeof(ServiceFullThunk), &actual)) | |
| 227 return STATUS_UNSUCCESSFUL; | |
| 228 | |
| 229 if (sizeof(ServiceFullThunk) != actual) | |
| 230 return STATUS_UNSUCCESSFUL; | |
| 231 | |
| 232 // And now change the function to intercept, on the child. | |
| 233 if (NULL != ntdll_base_) { | |
| 234 // Running a unit test. | |
| 235 if (!::WriteProcessMemory(process_, target_, &local_service, | |
| 236 sizeof(local_service), &actual)) | |
| 237 return STATUS_UNSUCCESSFUL; | |
| 238 } else { | |
| 239 if (!WriteProtectedChildMemory(process_, target_, &local_service, | |
| 240 sizeof(local_service))) | |
| 241 return STATUS_UNSUCCESSFUL; | |
| 242 } | |
| 243 | |
| 244 return STATUS_SUCCESS; | |
| 245 } | |
| 246 | |
| 247 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const { | |
| 248 NOTREACHED_NT(); | |
| 249 return false; | |
| 250 } | |
| 251 | |
| 252 } // namespace sandbox | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1851213002:
Remove sandbox on Windows. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master