| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 // | 4 // |
| 5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. | 5 // Implementation of NtMapViewOfSection intercept for 32 bit builds. |
| 6 // | 6 // |
| 7 // TODO(robertshield): Implement the 64 bit intercept. | 7 // TODO(robertshield): Implement the 64 bit intercept. |
| 8 | 8 |
| 9 #include "chrome_elf/blacklist/blacklist_interceptions.h" | 9 #include "chrome_elf/blacklist/blacklist_interceptions.h" |
| 10 | 10 |
| (...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 84 UNICODE_STRING* section_string = | 84 UNICODE_STRING* section_string = |
| 85 reinterpret_cast<UNICODE_STRING*>(section_name); | 85 reinterpret_cast<UNICODE_STRING*>(section_name); |
| 86 return base::string16(section_string->Buffer, | 86 return base::string16(section_string->Buffer, |
| 87 section_string->Length / sizeof(wchar_t)); | 87 section_string->Length / sizeof(wchar_t)); |
| 88 } | 88 } |
| 89 | 89 |
| 90 return base::string16(); | 90 return base::string16(); |
| 91 } | 91 } |
| 92 | 92 |
| 93 bool IsModuleValidImageSection(HANDLE section, | 93 bool IsModuleValidImageSection(HANDLE section, |
| 94 PVOID *base, | 94 PVOID* base, |
| 95 PLARGE_INTEGER offset, | 95 PLARGE_INTEGER offset, |
| 96 PSIZE_T view_size) { | 96 PSIZE_T view_size) { |
| 97 DCHECK_NT(g_nt_query_section_func); | 97 DCHECK_NT(g_nt_query_section_func); |
| 98 | 98 |
| 99 if (!section || !base || !view_size || offset) | 99 if (!section || !base || !view_size || offset) |
| 100 return false; | 100 return false; |
| 101 | 101 |
| 102 SECTION_BASIC_INFORMATION basic_info; | 102 SECTION_BASIC_INFORMATION basic_info; |
| 103 SIZE_T bytes_returned; | 103 SIZE_T bytes_returned; |
| 104 NTSTATUS ret = g_nt_query_section_func(section, SectionBasicInformation, | 104 NTSTATUS ret = g_nt_query_section_func(section, SectionBasicInformation, |
| 105 &basic_info, sizeof(basic_info), | 105 &basic_info, sizeof(basic_info), |
| 106 &bytes_returned); | 106 &bytes_returned); |
| 107 | 107 |
| 108 if (!NT_SUCCESS(ret) || sizeof(basic_info) != bytes_returned) | 108 if (!NT_SUCCESS(ret) || sizeof(basic_info) != bytes_returned) |
| 109 return false; | 109 return false; |
| 110 | 110 |
| 111 if (!(basic_info.Attributes & SEC_IMAGE)) | 111 if (!(basic_info.Attributes & SEC_IMAGE)) |
| 112 return false; | 112 return false; |
| 113 | 113 |
| 114 return true; | 114 return true; |
| 115 } | 115 } |
| 116 | 116 |
| 117 base::string16 ExtractLoadedModuleName(const base::string16& module_path) { | 117 base::string16 ExtractLoadedModuleName(const base::string16& module_path) { |
| 118 if (module_path.empty() || module_path[module_path.size() - 1] == L'\\') | 118 if (module_path.empty() || module_path.back() == L'\\') |
| 119 return base::string16(); | 119 return base::string16(); |
| 120 | 120 |
| 121 size_t sep = module_path.find_last_of(L'\\'); | 121 size_t sep = module_path.find_last_of(L'\\'); |
| 122 if (sep == base::string16::npos) | 122 if (sep == base::string16::npos) |
| 123 return module_path; | 123 return module_path; |
| 124 else | 124 return module_path.substr(sep + 1); |
| 125 return module_path.substr(sep+1); | |
| 126 } | 125 } |
| 127 | 126 |
| 128 // Fills |out_name| with the image name from the given |pe| image and |flags| | 127 // Fills |out_name| with the image name from the given |pe| image and |flags| |
| 129 // with additional info about the image. | 128 // with additional info about the image. |
| 130 void SafeGetImageInfo(const base::win::PEImage& pe, | 129 void SafeGetImageInfo(const base::win::PEImage& pe, |
| 131 std::string* out_name, | 130 std::string* out_name, |
| 132 uint32_t* flags) { | 131 uint32_t* flags) { |
| 133 out_name->clear(); | 132 out_name->clear(); |
| 134 out_name->reserve(MAX_PATH); | 133 out_name->reserve(MAX_PATH); |
| 135 *flags = 0; | 134 *flags = 0; |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 171 | 170 |
| 172 bool IsSameAsCurrentProcess(HANDLE process) { | 171 bool IsSameAsCurrentProcess(HANDLE process) { |
| 173 return (NtCurrentProcess == process) || | 172 return (NtCurrentProcess == process) || |
| 174 (::GetProcessId(process) == ::GetCurrentProcessId()); | 173 (::GetProcessId(process) == ::GetCurrentProcessId()); |
| 175 } | 174 } |
| 176 | 175 |
| 177 NTSTATUS BlNtMapViewOfSectionImpl( | 176 NTSTATUS BlNtMapViewOfSectionImpl( |
| 178 NtMapViewOfSectionFunction orig_MapViewOfSection, | 177 NtMapViewOfSectionFunction orig_MapViewOfSection, |
| 179 HANDLE section, | 178 HANDLE section, |
| 180 HANDLE process, | 179 HANDLE process, |
| 181 PVOID *base, | 180 PVOID* base, |
| 182 ULONG_PTR zero_bits, | 181 ULONG_PTR zero_bits, |
| 183 SIZE_T commit_size, | 182 SIZE_T commit_size, |
| 184 PLARGE_INTEGER offset, | 183 PLARGE_INTEGER offset, |
| 185 PSIZE_T view_size, | 184 PSIZE_T view_size, |
| 186 SECTION_INHERIT inherit, | 185 SECTION_INHERIT inherit, |
| 187 ULONG allocation_type, | 186 ULONG allocation_type, |
| 188 ULONG protect) { | 187 ULONG protect) { |
| 189 NTSTATUS ret = orig_MapViewOfSection(section, process, base, zero_bits, | 188 NTSTATUS ret = orig_MapViewOfSection(section, process, base, zero_bits, |
| 190 commit_size, offset, view_size, inherit, | 189 commit_size, offset, view_size, inherit, |
| 191 allocation_type, protect); | 190 allocation_type, protect); |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 238 reinterpret_cast<NtQueryVirtualMemoryFunction>( | 237 reinterpret_cast<NtQueryVirtualMemoryFunction>( |
| 239 GetNtDllExportByName("NtQueryVirtualMemory")); | 238 GetNtDllExportByName("NtQueryVirtualMemory")); |
| 240 g_nt_unmap_view_of_section_func = | 239 g_nt_unmap_view_of_section_func = |
| 241 reinterpret_cast<NtUnmapViewOfSectionFunction>( | 240 reinterpret_cast<NtUnmapViewOfSectionFunction>( |
| 242 GetNtDllExportByName("NtUnmapViewOfSection")); | 241 GetNtDllExportByName("NtUnmapViewOfSection")); |
| 243 | 242 |
| 244 return (g_nt_query_section_func && g_nt_query_virtual_memory_func && | 243 return (g_nt_query_section_func && g_nt_query_virtual_memory_func && |
| 245 g_nt_unmap_view_of_section_func); | 244 g_nt_unmap_view_of_section_func); |
| 246 } | 245 } |
| 247 | 246 |
| 248 SANDBOX_INTERCEPT NTSTATUS WINAPI BlNtMapViewOfSection( | 247 SANDBOX_INTERCEPT NTSTATUS WINAPI |
| 249 NtMapViewOfSectionFunction orig_MapViewOfSection, | 248 BlNtMapViewOfSection(NtMapViewOfSectionFunction orig_MapViewOfSection, |
| 250 HANDLE section, | 249 HANDLE section, |
| 251 HANDLE process, | 250 HANDLE process, |
| 252 PVOID *base, | 251 PVOID* base, |
| 253 ULONG_PTR zero_bits, | 252 ULONG_PTR zero_bits, |
| 254 SIZE_T commit_size, | 253 SIZE_T commit_size, |
| 255 PLARGE_INTEGER offset, | 254 PLARGE_INTEGER offset, |
| 256 PSIZE_T view_size, | 255 PSIZE_T view_size, |
| 257 SECTION_INHERIT inherit, | 256 SECTION_INHERIT inherit, |
| 258 ULONG allocation_type, | 257 ULONG allocation_type, |
| 259 ULONG protect) { | 258 ULONG protect) { |
| 260 NTSTATUS ret = STATUS_UNSUCCESSFUL; | 259 NTSTATUS ret = STATUS_UNSUCCESSFUL; |
| 261 | 260 |
| 262 __try { | 261 __try { |
| 263 ret = BlNtMapViewOfSectionImpl(orig_MapViewOfSection, section, process, | 262 ret = BlNtMapViewOfSectionImpl(orig_MapViewOfSection, section, process, |
| 264 base, zero_bits, commit_size, offset, | 263 base, zero_bits, commit_size, offset, |
| 265 view_size, inherit, allocation_type, | 264 view_size, inherit, allocation_type, |
| 266 protect); | 265 protect); |
| 267 } __except(GenerateCrashDump(GetExceptionInformation())) { | 266 } __except(GenerateCrashDump(GetExceptionInformation())) { |
| 268 } | 267 } |
| 269 | 268 |
| 270 return ret; | 269 return ret; |
| 271 } | 270 } |
| 272 | 271 |
| 273 #if defined(_WIN64) | 272 #if defined(_WIN64) |
| 274 NTSTATUS WINAPI BlNtMapViewOfSection64( | 273 NTSTATUS WINAPI BlNtMapViewOfSection64( |
| 275 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, | 274 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, |
| 276 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, | 275 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, |
| 277 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { | 276 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect) { |
| 278 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, | 277 return BlNtMapViewOfSection(g_nt_map_view_of_section_func, section, process, |
| 279 base, zero_bits, commit_size, offset, view_size, | 278 base, zero_bits, commit_size, offset, view_size, |
| 280 inherit, allocation_type, protect); | 279 inherit, allocation_type, protect); |
| 281 } | 280 } |
| 282 #endif | 281 #endif |
| 283 } // namespace blacklist | 282 } // namespace blacklist |
| OLD | NEW |