| Index: sandbox/win/sandbox_poc/pocdll/invasive.cc
|
| diff --git a/sandbox/win/sandbox_poc/pocdll/invasive.cc b/sandbox/win/sandbox_poc/pocdll/invasive.cc
|
| deleted file mode 100644
|
| index 954526daa5614932a4e7014afc777a44400295a3..0000000000000000000000000000000000000000
|
| --- a/sandbox/win/sandbox_poc/pocdll/invasive.cc
|
| +++ /dev/null
|
| @@ -1,194 +0,0 @@
|
| -// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
|
| -// Use of this source code is governed by a BSD-style license that can be
|
| -// found in the LICENSE file.
|
| -
|
| -#include <malloc.h>
|
| -#include "sandbox/win/sandbox_poc/pocdll/exports.h"
|
| -#include "sandbox/win/sandbox_poc/pocdll/utils.h"
|
| -
|
| -// This file contains the tests used to verify if it's possible to DOS or crash
|
| -// the machine. All tests that can impact the stability of the machine should
|
| -// be in this file.
|
| -
|
| -// Sleeps forever. this function is used to be the
|
| -// entry point for the threads created by the thread bombing function.
|
| -// This function never returns.
|
| -DWORD WINAPI MyThreadBombimgFunction(void* param) {
|
| - Sleep(INFINITE);
|
| - return 0;
|
| -}
|
| -
|
| -void POCDLL_API TestThreadBombing(HANDLE log) {
|
| - HandleToFile handle2file;
|
| - FILE* output = handle2file.Translate(log, "w");
|
| -
|
| - // we stop after 5 errors in a row
|
| - int number_errors = 0;
|
| - for (int i = 0; i < 100000; ++i) {
|
| - DWORD tid;
|
| - // Create the thread and leak the handle.
|
| - HANDLE thread = ::CreateThread(NULL, // Default security attributes
|
| - NULL, // Stack size
|
| - MyThreadBombimgFunction,
|
| - NULL, // Parameter
|
| - 0, // No creation flags
|
| - &tid);
|
| - if (thread) {
|
| - fprintf(output, "[GRANTED] Creating thread with tid 0x%lX\r\n", tid);
|
| - ::CloseHandle(thread);
|
| - number_errors = 0;
|
| - } else {
|
| - fprintf(output, "[BLOCKED] Creating thread. Error %ld\r\n",
|
| - ::GetLastError());
|
| - number_errors++;
|
| - }
|
| -
|
| - if (number_errors >= 5) {
|
| - break;
|
| - }
|
| - }
|
| -}
|
| -
|
| -
|
| -// Executes a complex mathematical operation forever in a loop. This function
|
| -// is used as entry point for the threads created by TestTakeAllCpu. It it
|
| -// designed to take all CPU on the processor where the thread is running.
|
| -// The return value is always 0.
|
| -DWORD WINAPI TakeAllCpu(void* param) {
|
| - int cpt = 0;
|
| - for (;;) {
|
| - cpt += 2;
|
| - cpt /= 2;
|
| - cpt *= cpt;
|
| - cpt = cpt % 100;
|
| - cpt = cpt | (cpt * cpt);
|
| - }
|
| -}
|
| -
|
| -void POCDLL_API TestTakeAllCpu(HANDLE log) {
|
| - HandleToFile handle2file;
|
| - FILE* output = handle2file.Translate(log, "w");
|
| -
|
| - DWORD_PTR process_mask = 0;
|
| - DWORD_PTR system_mask = 0;
|
| - if (::GetProcessAffinityMask(::GetCurrentProcess(),
|
| - &process_mask,
|
| - &system_mask)) {
|
| - DWORD_PTR affinity_mask = 1;
|
| -
|
| - while (system_mask) {
|
| - DWORD tid = 0;
|
| -
|
| - HANDLE thread = ::CreateThread(NULL, // Default security attributes.
|
| - NULL, // Stack size.
|
| - TakeAllCpu,
|
| - NULL, // Parameter.
|
| - 0, // No creation flags.
|
| - &tid);
|
| - ::SetThreadAffinityMask(thread, affinity_mask);
|
| -
|
| - if (::SetThreadPriority(thread, REALTIME_PRIORITY_CLASS)) {
|
| - fprintf(output, "[GRANTED] Set thread(%ld) priority to Realtime\r\n",
|
| - tid);
|
| - } else {
|
| - fprintf(output, "[BLOCKED] Set thread(%ld) priority to Realtime\r\n",
|
| - tid);
|
| - }
|
| -
|
| - ::CloseHandle(thread);
|
| -
|
| - affinity_mask = affinity_mask << 1;
|
| - system_mask = system_mask >> 1;
|
| - }
|
| - } else {
|
| - fprintf(output, "[ERROR] Cannot get affinity mask. Error %ld\r\n",
|
| - ::GetLastError());
|
| - }
|
| -}
|
| -
|
| -void POCDLL_API TestUseAllMemory(HANDLE log) {
|
| - HandleToFile handle2file;
|
| - FILE* output = handle2file.Translate(log, "w");
|
| -
|
| - int number_errors = 0;
|
| - unsigned long memory_size = 0;
|
| - for (;;) {
|
| - DWORD* ptr_to_leak = reinterpret_cast<DWORD*>(malloc(1024 * 256));
|
| - if (ptr_to_leak) {
|
| - memory_size += 256;
|
| - number_errors = 0;
|
| - } else {
|
| - number_errors++;
|
| - }
|
| -
|
| - // check if we have more than 5 errors in a row. If so, quit.
|
| - if (number_errors >= 5) {
|
| - fprintf(output, "[INFO] Created %lu kb of memory\r\n", memory_size);
|
| - return;
|
| - }
|
| -
|
| - Sleep(5); // 5ms to be able to see the progression easily with taskmgr.
|
| - }
|
| -}
|
| -
|
| -void POCDLL_API TestCreateObjects(HANDLE log) {
|
| - HandleToFile handle2file;
|
| - FILE* output = handle2file.Translate(log, "w");
|
| -
|
| - int mutexes = 0;
|
| - int jobs = 0;
|
| - int events = 0;
|
| - for (int i = 0; i < 1000000; ++i) {
|
| - if (::CreateMutex(NULL, // Default security attributes.
|
| - TRUE, // We are the initial owner.
|
| - NULL)) { // No name.
|
| - mutexes++;
|
| - }
|
| -
|
| - if (::CreateJobObject(NULL, // Default security attributes.
|
| - NULL)) { // No name.
|
| - jobs++;
|
| - }
|
| -
|
| - if (::CreateEvent(NULL, // Default security attributes.
|
| - TRUE, // Manual Reset.
|
| - TRUE, // Object is signaled.
|
| - NULL)) { // No name.
|
| - events++;
|
| - }
|
| - }
|
| -
|
| - fprintf(output, "[GRANTED] Created %d mutexes, %d jobs and %d events for "
|
| - "a total of %d objects out of 3 000 000\r\n", mutexes, jobs,
|
| - events, mutexes + jobs + events);
|
| -}
|
| -
|
| -BOOL CALLBACK EnumWindowCallback(HWND hwnd, LPARAM output) {
|
| - DWORD pid;
|
| - ::GetWindowThreadProcessId(hwnd, &pid);
|
| - if (pid != ::GetCurrentProcessId()) {
|
| - wchar_t window_title[100 + 1] = {0};
|
| - ::GetWindowText(hwnd, window_title, 100);
|
| - fprintf(reinterpret_cast<FILE*>(output),
|
| - "[GRANTED] Found window 0x%p with title %S\r\n",
|
| - hwnd,
|
| - window_title);
|
| - ::CloseWindow(hwnd);
|
| - }
|
| -
|
| - return TRUE;
|
| -}
|
| -
|
| -// Enumerates all the windows on the system and call the function to try to
|
| -// close them. The goal of this function is to try to kill the system by
|
| -// closing all windows.
|
| -// "output" is the stream used for logging.
|
| -void POCDLL_API TestCloseHWND(HANDLE log) {
|
| - HandleToFile handle2file;
|
| - FILE* output = handle2file.Translate(log, "w");
|
| -
|
| - ::EnumWindows(EnumWindowCallback, PtrToLong(output));
|
| - // TODO(nsylvain): find a way to know when the enum is finished
|
| - // before returning.
|
| - ::Sleep(3000);
|
| -}
|
|
|