| Index: sandbox/win/tools/finder/finder_kernel.cc
|
| diff --git a/sandbox/win/tools/finder/finder_kernel.cc b/sandbox/win/tools/finder/finder_kernel.cc
|
| deleted file mode 100644
|
| index 430a4c08ab478519590e6275d0298379095a7af5..0000000000000000000000000000000000000000
|
| --- a/sandbox/win/tools/finder/finder_kernel.cc
|
| +++ /dev/null
|
| @@ -1,248 +0,0 @@
|
| -// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
|
| -// Use of this source code is governed by a BSD-style license that can be
|
| -// found in the LICENSE file.
|
| -
|
| -#include "sandbox/win/src/restricted_token.h"
|
| -#include "sandbox/win/src/restricted_token_utils.h"
|
| -#include "sandbox/win/tools/finder/finder.h"
|
| -#include "sandbox/win/tools/finder/ntundoc.h"
|
| -
|
| -#define BUFFER_SIZE 0x800
|
| -#define CHECKPTR(x) if (!x) return ::GetLastError()
|
| -
|
| -// NT API
|
| -NTQUERYDIRECTORYOBJECT NtQueryDirectoryObject;
|
| -NTOPENDIRECTORYOBJECT NtOpenDirectoryObject;
|
| -NTOPENEVENT NtOpenEvent;
|
| -NTOPENJOBOBJECT NtOpenJobObject;
|
| -NTOPENKEYEDEVENT NtOpenKeyedEvent;
|
| -NTOPENMUTANT NtOpenMutant;
|
| -NTOPENSECTION NtOpenSection;
|
| -NTOPENSEMAPHORE NtOpenSemaphore;
|
| -NTOPENSYMBOLICLINKOBJECT NtOpenSymbolicLinkObject;
|
| -NTOPENTIMER NtOpenTimer;
|
| -NTOPENFILE NtOpenFile;
|
| -NTCLOSE NtClose;
|
| -
|
| -DWORD Finder::InitNT() {
|
| - HMODULE ntdll_handle = ::LoadLibrary(L"ntdll.dll");
|
| - CHECKPTR(ntdll_handle);
|
| -
|
| - NtOpenSymbolicLinkObject = (NTOPENSYMBOLICLINKOBJECT) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenSymbolicLinkObject");
|
| - CHECKPTR(NtOpenSymbolicLinkObject);
|
| -
|
| - NtQueryDirectoryObject = (NTQUERYDIRECTORYOBJECT) ::GetProcAddress(
|
| - ntdll_handle, "NtQueryDirectoryObject");
|
| - CHECKPTR(NtQueryDirectoryObject);
|
| -
|
| - NtOpenDirectoryObject = (NTOPENDIRECTORYOBJECT) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenDirectoryObject");
|
| - CHECKPTR(NtOpenDirectoryObject);
|
| -
|
| - NtOpenKeyedEvent = (NTOPENKEYEDEVENT) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenKeyedEvent");
|
| - CHECKPTR(NtOpenKeyedEvent);
|
| -
|
| - NtOpenJobObject = (NTOPENJOBOBJECT) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenJobObject");
|
| - CHECKPTR(NtOpenJobObject);
|
| -
|
| - NtOpenSemaphore = (NTOPENSEMAPHORE) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenSemaphore");
|
| - CHECKPTR(NtOpenSemaphore);
|
| -
|
| - NtOpenSection = (NTOPENSECTION) ::GetProcAddress(
|
| - ntdll_handle, "NtOpenSection");
|
| - CHECKPTR(NtOpenSection);
|
| -
|
| - NtOpenMutant= (NTOPENMUTANT) ::GetProcAddress(ntdll_handle, "NtOpenMutant");
|
| - CHECKPTR(NtOpenMutant);
|
| -
|
| - NtOpenEvent = (NTOPENEVENT) ::GetProcAddress(ntdll_handle, "NtOpenEvent");
|
| - CHECKPTR(NtOpenEvent);
|
| -
|
| - NtOpenTimer = (NTOPENTIMER) ::GetProcAddress(ntdll_handle, "NtOpenTimer");
|
| - CHECKPTR(NtOpenTimer);
|
| -
|
| - NtOpenFile = (NTOPENFILE) ::GetProcAddress(ntdll_handle, "NtOpenFile");
|
| - CHECKPTR(NtOpenFile);
|
| -
|
| - NtClose = (NTCLOSE) ::GetProcAddress(ntdll_handle, "NtClose");
|
| - CHECKPTR(NtClose);
|
| -
|
| - return ERROR_SUCCESS;
|
| -}
|
| -
|
| -DWORD Finder::ParseKernelObjects(ATL::CString path) {
|
| - UNICODE_STRING unicode_str;
|
| - unicode_str.Length = (USHORT)path.GetLength()*2;
|
| - unicode_str.MaximumLength = (USHORT)path.GetLength()*2+2;
|
| - unicode_str.Buffer = path.GetBuffer();
|
| -
|
| - OBJECT_ATTRIBUTES path_attributes;
|
| - InitializeObjectAttributes(&path_attributes,
|
| - &unicode_str,
|
| - 0, // No Attributes
|
| - NULL, // No Root Directory
|
| - NULL); // No Security Descriptor
|
| -
|
| -
|
| - DWORD object_index = 0;
|
| - DWORD data_written = 0;
|
| -
|
| - // TODO(nsylvain): Do not use BUFFER_SIZE. Try to get the size
|
| - // dynamically.
|
| - OBJDIR_INFORMATION *object_directory_info =
|
| - (OBJDIR_INFORMATION*) ::HeapAlloc(GetProcessHeap(),
|
| - 0,
|
| - BUFFER_SIZE);
|
| -
|
| - HANDLE file_handle;
|
| - NTSTATUS status_code = NtOpenDirectoryObject(&file_handle,
|
| - DIRECTORY_QUERY,
|
| - &path_attributes);
|
| - if (status_code != 0)
|
| - return ERROR_UNIDENTIFIED_ERROR;
|
| -
|
| - status_code = NtQueryDirectoryObject(file_handle,
|
| - object_directory_info,
|
| - BUFFER_SIZE,
|
| - TRUE, // Get Next Index
|
| - TRUE, // Ignore Input Index
|
| - &object_index,
|
| - &data_written);
|
| -
|
| - if (status_code != 0)
|
| - return ERROR_UNIDENTIFIED_ERROR;
|
| -
|
| - while (NtQueryDirectoryObject(file_handle, object_directory_info,
|
| - BUFFER_SIZE, TRUE, FALSE, &object_index,
|
| - &data_written) == 0 ) {
|
| - ATL::CString cur_path(object_directory_info->ObjectName.Buffer,
|
| - object_directory_info->ObjectName.Length / sizeof(WCHAR));
|
| -
|
| - ATL::CString cur_type(object_directory_info->ObjectTypeName.Buffer,
|
| - object_directory_info->ObjectTypeName.Length / sizeof(WCHAR));
|
| -
|
| - ATL::CString new_path;
|
| - if (path == L"\\") {
|
| - new_path = path + cur_path;
|
| - } else {
|
| - new_path = path + L"\\" + cur_path;
|
| - }
|
| -
|
| - TestKernelObjectAccess(new_path, cur_type);
|
| -
|
| - // Call the function recursively for all subdirectories
|
| - if (cur_type == L"Directory") {
|
| - ParseKernelObjects(new_path);
|
| - }
|
| - }
|
| -
|
| - NtClose(file_handle);
|
| - return ERROR_SUCCESS;
|
| -}
|
| -
|
| -DWORD Finder::TestKernelObjectAccess(ATL::CString path, ATL::CString type) {
|
| - Impersonater impersonate(token_handle_);
|
| -
|
| - kernel_object_stats_[PARSE]++;
|
| -
|
| - NTGENERICOPEN func = NULL;
|
| - GetFunctionForType(type, &func);
|
| -
|
| - if (!func) {
|
| - kernel_object_stats_[BROKEN]++;
|
| - Output(OBJ_ERR, type + L" Unsupported", path);
|
| - return ERROR_UNSUPPORTED_TYPE;
|
| - }
|
| -
|
| - UNICODE_STRING unicode_str;
|
| - unicode_str.Length = (USHORT)path.GetLength()*2;
|
| - unicode_str.MaximumLength = (USHORT)path.GetLength()*2+2;
|
| - unicode_str.Buffer = path.GetBuffer();
|
| -
|
| - OBJECT_ATTRIBUTES path_attributes;
|
| - InitializeObjectAttributes(&path_attributes,
|
| - &unicode_str,
|
| - 0, // No Attributes
|
| - NULL, // No Root Directory
|
| - NULL); // No Security Descriptor
|
| -
|
| - HANDLE handle;
|
| - NTSTATUS status_code = 0;
|
| -
|
| - if (access_type_ & kTestForAll) {
|
| - status_code = NtGenericOpen(GENERIC_ALL, &path_attributes, func, &handle);
|
| - if (STATUS_SUCCESS == status_code) {
|
| - kernel_object_stats_[ALL]++;
|
| - Output(OBJ, L"R/W", path);
|
| - NtClose(handle);
|
| - return GENERIC_ALL;
|
| - } else if (status_code != EXCEPTION_ACCESS_VIOLATION &&
|
| - status_code != STATUS_ACCESS_DENIED) {
|
| - Output(OBJ_ERR, status_code, path);
|
| - kernel_object_stats_[BROKEN]++;
|
| - }
|
| - }
|
| -
|
| - if (access_type_ & kTestForWrite) {
|
| - status_code = NtGenericOpen(GENERIC_WRITE, &path_attributes, func, &handle);
|
| - if (STATUS_SUCCESS == status_code) {
|
| - kernel_object_stats_[WRITE]++;
|
| - Output(OBJ, L"W", path);
|
| - NtClose(handle);
|
| - return GENERIC_WRITE;
|
| - } else if (status_code != EXCEPTION_ACCESS_VIOLATION &&
|
| - status_code != STATUS_ACCESS_DENIED) {
|
| - Output(OBJ_ERR, status_code, path);
|
| - kernel_object_stats_[BROKEN]++;
|
| - }
|
| - }
|
| -
|
| - if (access_type_ & kTestForRead) {
|
| - status_code = NtGenericOpen(GENERIC_READ, &path_attributes, func, &handle);
|
| - if (STATUS_SUCCESS == status_code) {
|
| - kernel_object_stats_[READ]++;
|
| - Output(OBJ, L"R", path);
|
| - NtClose(handle);
|
| - return GENERIC_READ;
|
| - } else if (status_code != EXCEPTION_ACCESS_VIOLATION &&
|
| - status_code != STATUS_ACCESS_DENIED) {
|
| - Output(OBJ_ERR, status_code, path);
|
| - kernel_object_stats_[BROKEN]++;
|
| - }
|
| - }
|
| -
|
| - return 0;
|
| -}
|
| -
|
| -NTSTATUS Finder::NtGenericOpen(ACCESS_MASK desired_access,
|
| - OBJECT_ATTRIBUTES *object_attributes,
|
| - NTGENERICOPEN func_to_call,
|
| - HANDLE *handle) {
|
| - return func_to_call(handle, desired_access, object_attributes);
|
| -}
|
| -
|
| -bool Finder::GetFunctionForType(ATL::CString type,
|
| - NTGENERICOPEN * func_to_call) {
|
| - NTGENERICOPEN func = NULL;
|
| -
|
| - if (type == L"Event") func = NtOpenEvent;
|
| - else if (type == L"Job") func = NtOpenJobObject;
|
| - else if (type == L"KeyedEvent") func = NtOpenKeyedEvent;
|
| - else if (type == L"Mutant") func = NtOpenMutant;
|
| - else if (type == L"Section") func = NtOpenSection;
|
| - else if (type == L"Semaphore") func = NtOpenSemaphore;
|
| - else if (type == L"Timer") func = NtOpenTimer;
|
| - else if (type == L"SymbolicLink") func = NtOpenSymbolicLinkObject;
|
| - else if (type == L"Directory") func = NtOpenDirectoryObject;
|
| -
|
| - if (func) {
|
| - *func_to_call = func;
|
| - return true;
|
| - }
|
| -
|
| - return false;
|
| -}
|
|
|