OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "sandbox/win/src/service_resolver.h" | |
6 | |
7 #include <stddef.h> | |
8 | |
9 #include "base/memory/scoped_ptr.h" | |
10 #include "sandbox/win/src/sandbox_nt_util.h" | |
11 #include "sandbox/win/src/win_utils.h" | |
12 | |
13 namespace { | |
14 #pragma pack(push, 1) | |
15 | |
16 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C; | |
17 const USHORT kSyscall = 0x050F; | |
18 const BYTE kRetNp = 0xC3; | |
19 const ULONG64 kMov1 = 0x54894808244C8948; | |
20 const ULONG64 kMov2 = 0x4C182444894C1024; | |
21 const ULONG kMov3 = 0x20244C89; | |
22 const USHORT kTestByte = 0x04F6; | |
23 const BYTE kPtr = 0x25; | |
24 const BYTE kRet = 0xC3; | |
25 const USHORT kJne = 0x0375; | |
26 | |
27 // Service code for 64 bit systems. | |
28 struct ServiceEntry { | |
29 // This struct contains roughly the following code: | |
30 // 00 mov r10,rcx | |
31 // 03 mov eax,52h | |
32 // 08 syscall | |
33 // 0a ret | |
34 // 0b xchg ax,ax | |
35 // 0e xchg ax,ax | |
36 | |
37 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
38 ULONG service_id; | |
39 USHORT syscall; // = 0F 05 | |
40 BYTE ret; // = C3 | |
41 BYTE pad; // = 66 | |
42 USHORT xchg_ax_ax1; // = 66 90 | |
43 USHORT xchg_ax_ax2; // = 66 90 | |
44 }; | |
45 | |
46 // Service code for 64 bit Windows 8. | |
47 struct ServiceEntryW8 { | |
48 // This struct contains the following code: | |
49 // 00 48894c2408 mov [rsp+8], rcx | |
50 // 05 4889542410 mov [rsp+10], rdx | |
51 // 0a 4c89442418 mov [rsp+18], r8 | |
52 // 0f 4c894c2420 mov [rsp+20], r9 | |
53 // 14 4c8bd1 mov r10,rcx | |
54 // 17 b825000000 mov eax,25h | |
55 // 1c 0f05 syscall | |
56 // 1e c3 ret | |
57 // 1f 90 nop | |
58 | |
59 ULONG64 mov_1; // = 48 89 4C 24 08 48 89 54 | |
60 ULONG64 mov_2; // = 24 10 4C 89 44 24 18 4C | |
61 ULONG mov_3; // = 89 4C 24 20 | |
62 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
63 ULONG service_id; | |
64 USHORT syscall; // = 0F 05 | |
65 BYTE ret; // = C3 | |
66 BYTE nop; // = 90 | |
67 }; | |
68 | |
69 // Service code for 64 bit systems with int 2e fallback. | |
70 struct ServiceEntryWithInt2E { | |
71 // This struct contains roughly the following code: | |
72 // 00 4c8bd1 mov r10,rcx | |
73 // 03 b855000000 mov eax,52h | |
74 // 08 f604250803fe7f01 test byte ptr SharedUserData!308, 1 | |
75 // 10 7503 jne [over syscall] | |
76 // 12 0f05 syscall | |
77 // 14 c3 ret | |
78 // 15 cd2e int 2e | |
79 // 17 c3 ret | |
80 | |
81 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 | |
82 ULONG service_id; | |
83 USHORT test_byte; // = F6 04 | |
84 BYTE ptr; // = 25 | |
85 ULONG user_shared_data_ptr; | |
86 BYTE one; // = 01 | |
87 USHORT jne_over_syscall; // = 75 03 | |
88 USHORT syscall; // = 0F 05 | |
89 BYTE ret; // = C3 | |
90 USHORT int2e; // = CD 2E | |
91 BYTE ret2; // = C3 | |
92 }; | |
93 | |
94 // We don't have an internal thunk for x64. | |
95 struct ServiceFullThunk { | |
96 union { | |
97 ServiceEntry original; | |
98 ServiceEntryW8 original_w8; | |
99 ServiceEntryWithInt2E original_int2e_fallback; | |
100 }; | |
101 }; | |
102 | |
103 #pragma pack(pop) | |
104 | |
105 bool IsService(const void* source) { | |
106 const ServiceEntry* service = | |
107 reinterpret_cast<const ServiceEntry*>(source); | |
108 | |
109 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
110 kSyscall == service->syscall && kRetNp == service->ret); | |
111 } | |
112 | |
113 bool IsServiceW8(const void* source) { | |
114 const ServiceEntryW8* service = | |
115 reinterpret_cast<const ServiceEntryW8*>(source); | |
116 | |
117 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
118 kMov1 == service->mov_1 && kMov2 == service->mov_2 && | |
119 kMov3 == service->mov_3); | |
120 } | |
121 | |
122 bool IsServiceWithInt2E(const void* source) { | |
123 const ServiceEntryWithInt2E* service = | |
124 reinterpret_cast<const ServiceEntryWithInt2E*>(source); | |
125 | |
126 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && | |
127 kTestByte == service->test_byte && kPtr == service->ptr && | |
128 kJne == service->jne_over_syscall && kSyscall == service->syscall && | |
129 kRet == service->ret && kRet == service->ret2); | |
130 } | |
131 | |
132 }; // namespace | |
133 | |
134 namespace sandbox { | |
135 | |
136 NTSTATUS ServiceResolverThunk::Setup(const void* target_module, | |
137 const void* interceptor_module, | |
138 const char* target_name, | |
139 const char* interceptor_name, | |
140 const void* interceptor_entry_point, | |
141 void* thunk_storage, | |
142 size_t storage_bytes, | |
143 size_t* storage_used) { | |
144 NTSTATUS ret = | |
145 Init(target_module, interceptor_module, target_name, interceptor_name, | |
146 interceptor_entry_point, thunk_storage, storage_bytes); | |
147 if (!NT_SUCCESS(ret)) | |
148 return ret; | |
149 | |
150 size_t thunk_bytes = GetThunkSize(); | |
151 scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]); | |
152 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>( | |
153 thunk_buffer.get()); | |
154 | |
155 if (!IsFunctionAService(&thunk->original)) | |
156 return STATUS_UNSUCCESSFUL; | |
157 | |
158 ret = PerformPatch(thunk, thunk_storage); | |
159 | |
160 if (NULL != storage_used) | |
161 *storage_used = thunk_bytes; | |
162 | |
163 return ret; | |
164 } | |
165 | |
166 size_t ServiceResolverThunk::GetThunkSize() const { | |
167 return sizeof(ServiceFullThunk); | |
168 } | |
169 | |
170 NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module, | |
171 const char* target_name, | |
172 BYTE* thunk_storage, | |
173 size_t storage_bytes, | |
174 size_t* storage_used) { | |
175 NTSTATUS ret = ResolveTarget(target_module, target_name, &target_); | |
176 if (!NT_SUCCESS(ret)) | |
177 return ret; | |
178 | |
179 size_t thunk_bytes = GetThunkSize(); | |
180 if (storage_bytes < thunk_bytes) | |
181 return STATUS_UNSUCCESSFUL; | |
182 | |
183 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage); | |
184 | |
185 if (!IsFunctionAService(&thunk->original)) | |
186 return STATUS_UNSUCCESSFUL; | |
187 | |
188 if (NULL != storage_used) | |
189 *storage_used = thunk_bytes; | |
190 | |
191 return ret; | |
192 } | |
193 | |
194 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const { | |
195 ServiceFullThunk function_code; | |
196 SIZE_T read; | |
197 if (!::ReadProcessMemory(process_, target_, &function_code, | |
198 sizeof(function_code), &read)) | |
199 return false; | |
200 | |
201 if (sizeof(function_code) != read) | |
202 return false; | |
203 | |
204 if (!IsService(&function_code) && !IsServiceW8(&function_code) && | |
205 !IsServiceWithInt2E(&function_code)) | |
206 return false; | |
207 | |
208 // Save the verified code. | |
209 memcpy(local_thunk, &function_code, sizeof(function_code)); | |
210 | |
211 return true; | |
212 } | |
213 | |
214 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk, | |
215 void* remote_thunk) { | |
216 // Patch the original code. | |
217 ServiceEntry local_service; | |
218 DCHECK_NT(GetInternalThunkSize() <= sizeof(local_service)); | |
219 if (!SetInternalThunk(&local_service, sizeof(local_service), NULL, | |
220 interceptor_)) | |
221 return STATUS_UNSUCCESSFUL; | |
222 | |
223 // Copy the local thunk buffer to the child. | |
224 SIZE_T actual; | |
225 if (!::WriteProcessMemory(process_, remote_thunk, local_thunk, | |
226 sizeof(ServiceFullThunk), &actual)) | |
227 return STATUS_UNSUCCESSFUL; | |
228 | |
229 if (sizeof(ServiceFullThunk) != actual) | |
230 return STATUS_UNSUCCESSFUL; | |
231 | |
232 // And now change the function to intercept, on the child. | |
233 if (NULL != ntdll_base_) { | |
234 // Running a unit test. | |
235 if (!::WriteProcessMemory(process_, target_, &local_service, | |
236 sizeof(local_service), &actual)) | |
237 return STATUS_UNSUCCESSFUL; | |
238 } else { | |
239 if (!WriteProtectedChildMemory(process_, target_, &local_service, | |
240 sizeof(local_service))) | |
241 return STATUS_UNSUCCESSFUL; | |
242 } | |
243 | |
244 return STATUS_SUCCESS; | |
245 } | |
246 | |
247 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const { | |
248 NOTREACHED_NT(); | |
249 return false; | |
250 } | |
251 | |
252 } // namespace sandbox | |
OLD | NEW |