OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome_elf/ntdll_cache.h" | |
6 | |
7 #include <stdint.h> | 5 #include <stdint.h> |
8 #include <windows.h> | 6 #include <windows.h> |
9 | 7 |
10 #include "base/basictypes.h" | 8 #include "chrome_elf/ntdll_cache.h" |
11 #include "chrome_elf/thunk_getter.h" | |
12 #include "sandbox/win/src/interception_internal.h" | |
13 #include "sandbox/win/src/internal_types.h" | |
14 #include "sandbox/win/src/service_resolver.h" | |
15 | |
16 // Allocate storage for thunks in a page of this module to save on doing | |
17 // an extra allocation at run time. | |
18 #pragma section(".crthunk", read, execute) | |
19 __declspec(allocate(".crthunk")) sandbox::ThunkData g_nt_thunk_storage; | |
20 | 9 |
21 FunctionLookupTable g_ntdll_lookup; | 10 FunctionLookupTable g_ntdll_lookup; |
22 | 11 |
23 void InitCache() { | 12 void InitCache() { |
24 HMODULE ntdll_handle = ::GetModuleHandle(sandbox::kNtdllName); | 13 HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll"); |
25 | 14 |
26 // To find the Export Address Table address, we start from the DOS header. | 15 // To find the Export Address Table address, we start from the DOS header. |
27 // The module handle is actually the address of the header. | 16 // The module handle is actually the address of the header. |
28 IMAGE_DOS_HEADER* dos_header = | 17 IMAGE_DOS_HEADER* dos_header = |
29 reinterpret_cast<IMAGE_DOS_HEADER*>(ntdll_handle); | 18 reinterpret_cast<IMAGE_DOS_HEADER*>(ntdll_handle); |
30 // The e_lfanew is an offset from the DOS header to the NT header. It should | 19 // The e_lfanew is an offset from the DOS header to the NT header. It should |
31 // never be 0. | 20 // never be 0. |
32 IMAGE_NT_HEADERS* nt_headers = reinterpret_cast<IMAGE_NT_HEADERS*>( | 21 IMAGE_NT_HEADERS* nt_headers = reinterpret_cast<IMAGE_NT_HEADERS*>( |
33 ntdll_handle + dos_header->e_lfanew / sizeof(uint32_t)); | 22 ntdll_handle + dos_header->e_lfanew / sizeof(uint32_t)); |
34 // For modules that have an import address table, its offset from the | 23 // For modules that have an import address table, its offset from the |
(...skipping 17 matching lines...) Expand all Loading... |
52 base_addr + exports->AddressOfFunctions); | 41 base_addr + exports->AddressOfFunctions); |
53 int num_entries = exports->NumberOfNames; | 42 int num_entries = exports->NumberOfNames; |
54 | 43 |
55 for (int i = 0; i < num_entries; i++) { | 44 for (int i = 0; i < num_entries; i++) { |
56 char* name = reinterpret_cast<char*>(base_addr + names[i]); | 45 char* name = reinterpret_cast<char*>(base_addr + names[i]); |
57 WORD ord = ordinals[i]; | 46 WORD ord = ordinals[i]; |
58 DWORD func = funcs[ord]; | 47 DWORD func = funcs[ord]; |
59 FARPROC func_addr = reinterpret_cast<FARPROC>(func + base_addr); | 48 FARPROC func_addr = reinterpret_cast<FARPROC>(func + base_addr); |
60 g_ntdll_lookup[std::string(name)] = func_addr; | 49 g_ntdll_lookup[std::string(name)] = func_addr; |
61 } | 50 } |
62 | |
63 const bool kRelaxed = true; | |
64 | |
65 // Create a thunk via the appropriate ServiceResolver instance. | |
66 sandbox::ServiceResolverThunk* thunk = GetThunk(kRelaxed); | |
67 | |
68 if (thunk) { | |
69 BYTE* thunk_storage = reinterpret_cast<BYTE*>(&g_nt_thunk_storage); | |
70 | |
71 // Mark the thunk storage as readable and writeable, since we | |
72 // ready to write to it. | |
73 DWORD old_protect = 0; | |
74 if (!::VirtualProtect(&g_nt_thunk_storage, | |
75 sizeof(g_nt_thunk_storage), | |
76 PAGE_EXECUTE_READWRITE, | |
77 &old_protect)) { | |
78 return; | |
79 } | |
80 | |
81 size_t storage_used = 0; | |
82 NTSTATUS ret = thunk->CopyThunk(::GetModuleHandle(sandbox::kNtdllName), | |
83 "NtCreateFile", | |
84 thunk_storage, | |
85 sizeof(sandbox::ThunkData), | |
86 &storage_used); | |
87 delete thunk; | |
88 | |
89 // Ensure that the pointer to the old function can't be changed. | |
90 ::VirtualProtect(&g_nt_thunk_storage, | |
91 sizeof(g_nt_thunk_storage), | |
92 PAGE_EXECUTE_READ, | |
93 &old_protect); | |
94 | |
95 if (NT_SUCCESS(ret)) { | |
96 // Add an entry in the lookup table for the thunk. | |
97 g_ntdll_lookup["NtCreateFile"] = | |
98 reinterpret_cast<FARPROC>(&g_nt_thunk_storage); | |
99 } | |
100 } | |
101 } | 51 } |
OLD | NEW |