Index: sandbox/win/sandbox_poc/pocdll/handles.cc |
diff --git a/sandbox/win/sandbox_poc/pocdll/handles.cc b/sandbox/win/sandbox_poc/pocdll/handles.cc |
deleted file mode 100644 |
index 1c6116ec6c786adb65a586fbb6992c69fd997f96..0000000000000000000000000000000000000000 |
--- a/sandbox/win/sandbox_poc/pocdll/handles.cc |
+++ /dev/null |
@@ -1,186 +0,0 @@ |
-// Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. |
-// Use of this source code is governed by a BSD-style license that can be |
-// found in the LICENSE file. |
- |
-#include "sandbox/win/sandbox_poc/pocdll/exports.h" |
-#include "sandbox/win/sandbox_poc/pocdll/utils.h" |
-#include "sandbox/win/tools/finder/ntundoc.h" |
- |
-// This file contains the tests used to verify the security of handles in |
-// the process |
- |
-NTQUERYOBJECT NtQueryObject; |
-NTQUERYINFORMATIONFILE NtQueryInformationFile; |
-NTQUERYSYSTEMINFORMATION NtQuerySystemInformation; |
- |
-void POCDLL_API TestGetHandle(HANDLE log) { |
- HandleToFile handle2file; |
- FILE *output = handle2file.Translate(log, "w"); |
- |
- // Initialize the NTAPI functions we need |
- HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll"); |
- if (!ntdll_handle) { |
- fprintf(output, "[ERROR] Cannot load ntdll.dll. Error %ld\r\n", |
- ::GetLastError()); |
- return; |
- } |
- |
- NtQueryObject = reinterpret_cast<NTQUERYOBJECT>( |
- GetProcAddress(ntdll_handle, "NtQueryObject")); |
- NtQueryInformationFile = reinterpret_cast<NTQUERYINFORMATIONFILE>( |
- GetProcAddress(ntdll_handle, "NtQueryInformationFile")); |
- NtQuerySystemInformation = reinterpret_cast<NTQUERYSYSTEMINFORMATION>( |
- GetProcAddress(ntdll_handle, "NtQuerySystemInformation")); |
- |
- if (!NtQueryObject || !NtQueryInformationFile || !NtQuerySystemInformation) { |
- fprintf(output, "[ERROR] Cannot load all NT functions. Error %ld\r\n", |
- ::GetLastError()); |
- return; |
- } |
- |
- // Get the number of handles on the system |
- DWORD buffer_size = 0; |
- SYSTEM_HANDLE_INFORMATION_EX temp_info; |
- NTSTATUS status = NtQuerySystemInformation( |
- SystemHandleInformation, &temp_info, sizeof(temp_info), |
- &buffer_size); |
- if (!buffer_size) { |
- fprintf(output, "[ERROR] Get the number of handles. Error 0x%lX\r\n", |
- status); |
- return; |
- } |
- |
- SYSTEM_HANDLE_INFORMATION_EX *system_handles = |
- reinterpret_cast<SYSTEM_HANDLE_INFORMATION_EX*>(new BYTE[buffer_size]); |
- |
- status = NtQuerySystemInformation(SystemHandleInformation, system_handles, |
- buffer_size, &buffer_size); |
- if (STATUS_SUCCESS != status) { |
- fprintf(output, "[ERROR] Failed to get the handle list. Error 0x%lX\r\n", |
- status); |
- delete [] system_handles; |
- return; |
- } |
- |
- for (ULONG i = 0; i < system_handles->NumberOfHandles; ++i) { |
- USHORT h = system_handles->Information[i].Handle; |
- if (system_handles->Information[i].ProcessId != ::GetCurrentProcessId()) |
- continue; |
- |
- OBJECT_NAME_INFORMATION *name = NULL; |
- ULONG name_size = 0; |
- // Query the name information a first time to get the size of the name. |
- status = NtQueryObject(reinterpret_cast<HANDLE>(h), |
- ObjectNameInformation, |
- name, |
- name_size, |
- &name_size); |
- |
- if (name_size) { |
- name = reinterpret_cast<OBJECT_NAME_INFORMATION *>(new BYTE[name_size]); |
- |
- // Query the name information a second time to get the name of the |
- // object referenced by the handle. |
- status = NtQueryObject(reinterpret_cast<HANDLE>(h), |
- ObjectNameInformation, |
- name, |
- name_size, |
- &name_size); |
- } |
- |
- PUBLIC_OBJECT_TYPE_INFORMATION *type = NULL; |
- ULONG type_size = 0; |
- |
- // Query the object to get the size of the object type name. |
- status = NtQueryObject(reinterpret_cast<HANDLE>(h), |
- ObjectTypeInformation, |
- type, |
- type_size, |
- &type_size); |
- if (type_size) { |
- type = reinterpret_cast<PUBLIC_OBJECT_TYPE_INFORMATION *>( |
- new BYTE[type_size]); |
- |
- // Query the type information a second time to get the object type |
- // name. |
- status = NtQueryObject(reinterpret_cast<HANDLE>(h), |
- ObjectTypeInformation, |
- type, |
- type_size, |
- &type_size); |
- } |
- |
- // NtQueryObject cannot return the name for a file. In this case we |
- // need to ask NtQueryInformationFile |
- FILE_NAME_INFORMATION *file_name = NULL; |
- if (type && wcsncmp(L"File", type->TypeName.Buffer, |
- (type->TypeName.Length / |
- sizeof(type->TypeName.Buffer[0]))) == 0) { |
- // This function does not return the size of the buffer. We need to |
- // iterate and always increase the buffer size until the function |
- // succeeds. (Or at least does not fail with STATUS_BUFFER_OVERFLOW) |
- ULONG size_file = MAX_PATH; |
- IO_STATUS_BLOCK status_block = {}; |
- do { |
- // Delete the previous buffer create. The buffer was too small |
- if (file_name) { |
- delete[] reinterpret_cast<BYTE*>(file_name); |
- file_name = NULL; |
- } |
- |
- // Increase the buffer and do the call agan |
- size_file += MAX_PATH; |
- file_name = reinterpret_cast<FILE_NAME_INFORMATION *>( |
- new BYTE[size_file]); |
- status = NtQueryInformationFile(reinterpret_cast<HANDLE>(h), |
- &status_block, |
- file_name, |
- size_file, |
- FileNameInformation); |
- } while (status == STATUS_BUFFER_OVERFLOW); |
- |
- if (STATUS_SUCCESS != status) { |
- if (file_name) { |
- delete[] file_name; |
- file_name = NULL; |
- } |
- } |
- } |
- |
- if (file_name) { |
- UNICODE_STRING file_name_string; |
- file_name_string.Buffer = file_name->FileName; |
- file_name_string.Length = (USHORT)file_name->FileNameLength; |
- file_name_string.MaximumLength = (USHORT)file_name->FileNameLength; |
- fprintf(output, "[GRANTED] Handle 0x%4.4X Access: 0x%8.8lX " |
- "Type: %-13wZ Path: %wZ\r\n", |
- h, |
- system_handles->Information[i].GrantedAccess, |
- type ? &type->TypeName : NULL, |
- &file_name_string); |
- } else { |
- fprintf(output, "[GRANTED] Handle 0x%4.4X Access: 0x%8.8lX " |
- "Type: %-13wZ Path: %wZ\r\n", |
- h, |
- system_handles->Information[i].GrantedAccess, |
- type ? &type->TypeName : NULL, |
- name ? &name->ObjectName : NULL); |
- } |
- |
- if (type) { |
- delete[] type; |
- } |
- |
- if (file_name) { |
- delete[] file_name; |
- } |
- |
- if (name) { |
- delete [] name; |
- } |
- } |
- |
- if (system_handles) { |
- delete [] system_handles; |
- } |
-} |