Use the new dll injection blocking api of the sandbox to block...

chrome/browser/sandbox_policy.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/sandbox_policy.h"
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/registry.h"
@@ skipping 74 matching lines @@
 
   key += L"\\*";
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY, access,
                            key.c_str());
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
   return true;
 }
 
+// Eviction of injected DLLs is done by the sandbox. An interception on a
+// system call is added such that the blacklisted dll, don't fully load so
+// the injected module does not get a chance to execute any code.
+bool AddDllEvictionPolicy(sandbox::TargetPolicy* policy) {
+  // List of dlls to unmap.
+  const wchar_t* troublesome_dlls[] = {
+      L"smumhook.dll",  // Spyware Doctor version 5 and above.
+      L"GoogleDesktopNetwork3.DLL",  // Google Desktop Search v5.
+      L"npggNT.des",   // GameGuard version 2008. It is a packed dll.
+  };
+
+  for(int ix = 0; ix != arraysize(troublesome_dlls); ++ix) {
+    // To minimize the list we only add an unload policy if the dll is also
+    // loaded in this process. All the injected dlls of interest do this.
+    if (::GetModuleHandleW(troublesome_dlls[ix])) {
+      LOG(WARNING) << "dll to unload found: " << troublesome_dlls[ix];
+      if (sandbox::SBOX_ALL_OK != policy->AddDllToUnload(troublesome_dlls[ix]))
+        return false;
+    }
+  }
+
+  return true;
+}
+
 bool AddGenericPolicy(sandbox::TargetPolicy* policy) {
   sandbox::ResultCode result;
 
   // Add the policy for the pipes
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
                            sandbox::TargetPolicy::FILES_ALLOW_ANY,
                            L"\\??\\pipe\\chrome.*");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
@@ skipping 114 matching lines @@
       return ApplyPolicyForTrustedPlugin(policy);
     case PLUGIN_GROUP_UNTRUSTED:
       return ApplyPolicyForUntrustedPlugin(policy);
     default:
       NOTREACHED();
       break;
   }
 
   return false;
 }