[chrome_elf] Big ELF cleanup. Part 1.

chrome_elf/hook_util/hook_util.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_ELF_HOOK_UTIL_THUNK_GETTER_H_
+#define CHROME_ELF_HOOK_UTIL_THUNK_GETTER_H_
+
+#include <windows.h>
+
+#include "base/macros.h"
+
+namespace sandbox {
+class ServiceResolverThunk;
+}
+
+namespace elf_hook {
+
+//------------------------------------------------------------------------------
+// Systen Service hooking support

[robertshield, 2016/08/03 04:52:45]

s/Systen/System/

[penny, 2016/08/04 18:55:35]

Done.

+//------------------------------------------------------------------------------
+
+// Creates a |ServiceResolverThunk| based on the OS version. Ownership of the
+// resulting thunk is passed to the caller.
+sandbox::ServiceResolverThunk* HookSystemService(bool relaxed);
+
+//------------------------------------------------------------------------------
+// Import Address Table hooking support
+//------------------------------------------------------------------------------
+class IATHook {

[robertshield, 2016/08/03 04:52:45]

It would be pretty cool (and not too much work I think) to have a unit test for
this class.

A test that:
1) Loads a stub dll that has the exports Foo() { g_call_count++; } and
NumberOFTimesFooWasCalled() { return g_call_count; }
2) calls Foo(), EXPECTs NumberOFTimesFooWasCalled() == 1
3) Hooks Foo(), redirects to a no-op function, same as we do for the unhandled
exception handler.
4) calls Foo(), EXPECTs NumberOFTimesFooWasCalled() == 1
5) Unhooks Foo()
6) calls Foo(), EXPECTs NumberOFTimesFooWasCalled() == 2

would do the trick. Some of the other elf tests already have small test dlls
they build and load, could copy their approach to generate another one, this
link has the places to look to duplicate:
https://codesearch.chromium.org/search/?q=blacklist_test_dll_2&sq=package:chr....

What do you think, worth it?

[penny, 2016/08/04 18:55:35]

Done.
Was going to leave this until I finish removing deps from hook_util... but mine
as well add the tests now, so it's obviously with this CL.  DONE.  I'll be
making system-service hooking local in one of the next couple CLs, so will add
more tests then.

+ public:
+  IATHook();
+  ~IATHook();
+
+  // Intercept a function in an import table of a specific
+  // module. Saves everything needed to Unhook.
+  //
+  // Arguments:
+  // module                 Module to be intercepted
+  // imported_from_module   Module that exports the 'function_name'
+  // function_name          Name of the API to be intercepted

[robertshield, 2016/08/03 04:52:45]

new_function should be added here for completeness

[penny, 2016/08/04 18:55:35]

Done.

+  //
+  // Returns: Windows error code (winerror.h). NO_ERROR if successful.
+  DWORD Hook(HMODULE module,

[robertshield, 2016/08/03 04:52:45]

From the implementation, it looks like Hook should only be called once for a
given instance of an IATHook, if that's the case, please document here.

[penny, 2016/08/04 18:55:35]

Done.

+             const char* imported_from_module,
+             const char* function_name,
+             void* new_function);
+
+  // Unhook the IAT entry.
+  //
+  // Returns: Windows error code (winerror.h). NO_ERROR if successful.
+  DWORD Unhook();
+
+ private:
+  HMODULE module_handle_;
+  void* intercept_function_;
+  void* original_function_;
+  IMAGE_THUNK_DATA* iat_thunk_;
+
+  DISALLOW_COPY_AND_ASSIGN(elf_hook::IATHook);
+};
+}
+
+#endif  // CHROME_ELF_HOOK_UTIL_THUNK_GETTER_H_