[win] Enable ModuleDatabase behind a flag.

chrome/browser/chrome_browser_main_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_browser_main_win.h"
 
 #include <shellapi.h>
 #include <stddef.h>
 #include <windows.h>
 
@@ skipping 11 matching lines @@
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/path_service.h"
 #include "base/scoped_native_library.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/win/registry.h"
 #include "base/win/win_util.h"
 #include "base/win/windows_version.h"
 #include "base/win/wrapped_window_proc.h"
+#include "chrome/browser/conflicts/module_database_win.h"
+#include "chrome/browser/conflicts/module_event_sink_impl_win.h"
 #include "chrome/browser/first_run/first_run.h"
 #include "chrome/browser/install_verification/win/install_verification.h"
 #include "chrome/browser/profiles/profile_shortcut_manager.h"
 #include "chrome/browser/shell_integration.h"
 #include "chrome/browser/ui/simple_message_box.h"
 #include "chrome/browser/ui/uninstall_browser_prompt.h"
 #include "chrome/browser/win/browser_util.h"
 #include "chrome/browser/win/chrome_elf_init.h"
 #include "chrome/chrome_watcher/chrome_watcher_main_api.h"
 #include "chrome/common/chrome_constants.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_result_codes.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/chrome_utility_messages.h"
 #include "chrome/common/crash_keys.h"
 #include "chrome/common/env_vars.h"
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/helper.h"
@@ skipping 143 matching lines @@
 
   // Look for the DLLs used to implement the FTH and other compat hacks.
   if (GetModuleHandleW(L"AcLayers.dll") != NULL)
     detected = static_cast<FTHFlags>(detected | FTH_ACLAYERS_LOADED);
   if (GetModuleHandleW(L"AcXtrnal.dll") != NULL)
     detected = static_cast<FTHFlags>(detected | FTH_ACXTRNAL_LOADED);
 
   UMA_HISTOGRAM_ENUMERATION("FaultTolerantHeap", detected, FTH_FLAGS_COUNT);
 }
 
+// Helper function for getting the time date stamp associated with a module in
+// this process. Similar to implementation in ModuleEventSinkImpl, but doesn't
+// use remote process reads.
+uint32_t GetModuleTimeDateStamp(const void* module_load_address) {
+  auto* base = reinterpret_cast<const uint8_t*>(module_load_address);

[grt (UTC plus 2), 2017/01/06 09:44:57]

can you use base::win::PEImage for this?

[chrisha, 2017/01/10 21:01:45]

Yeah, should be fine. I forget that thing exists.

+  auto* dos_header = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
+  auto* nt_headers =
+      reinterpret_cast<const IMAGE_NT_HEADERS*>(base + dos_header->e_lfanew);
+  return nt_headers->FileHeader.TimeDateStamp;
+}
+
+// Used as the callback for ModuleWatcher events in this process. Dispatches
+// them to the ModuleDatabase.
+void OnModuleEvent(uint32_t process_id,
+                   uint64_t creation_time,
+                   const ModuleWatcher::ModuleEvent& event) {
+  auto* module_database = ModuleDatabase::GetInstance();
+  uintptr_t load_address =
+      reinterpret_cast<uintptr_t>(event.module_load_address);
+
+  switch (event.event_type) {
+    case mojom::ModuleEventType::MODULE_ALREADY_LOADED:
+    case mojom::ModuleEventType::MODULE_LOADED: {
+      module_database->OnModuleLoad(
+          process_id, creation_time, event.module_path, event.module_size,
+          GetModuleTimeDateStamp(event.module_load_address), load_address);
+      return;
+    }
+
+    case mojom::ModuleEventType::MODULE_UNLOADED: {
+      module_database->OnModuleUnload(process_id, creation_time, load_address);
+      return;
+    }
+  }
+}
+
 }  // namespace
 
 void ShowCloseBrowserFirstMessageBox() {
   int message_id = IDS_UNINSTALL_CLOSE_APP;
   if (base::win::GetVersion() >= base::win::VERSION_WIN8 &&
       (shell_integration::GetDefaultBrowser() ==
        shell_integration::IS_DEFAULT)) {
     message_id = IDS_UNINSTALL_CLOSE_APP_IMMERSIVE;
   }
   chrome::ShowWarningMessageBox(NULL,
@@ skipping 104 matching lines @@
   ChromeBrowserMainParts::PostProfileInit();
 
   // TODO(kulshin): remove this cleanup code in 2017. http://crbug.com/603718
   // Attempt to delete the font cache and ignore any errors.
   base::FilePath path(
       profile()->GetPath().AppendASCII("ChromeDWriteFontCache"));
   content::BrowserThread::PostAfterStartupTask(
       FROM_HERE, content::BrowserThread::GetTaskRunnerForThread(
                      content::BrowserThread::FILE),
       base::Bind(base::IgnoreResult(&base::DeleteFile), path, false));
+
+  // Create the module database and hook up the in-process module watcher. This
+  // needs to be done before any child processes are initialized as the
+  // ModuleDatabase is an endpoint for IPC from child processes.
+  if (base::FeatureList::IsEnabled(features::kModuleDatabase)) {

[grt (UTC plus 2), 2017/01/06 09:44:57]

nit: pull this out into a function in the unnamed namespace just before
GetModuleTimeDateStamp so that it's next to the related code. it's then a bit
easier to see why it makes sense for the call to OnProcessStarted be here rather
than hidden in ModuleDatabase

[chrisha, 2017/01/10 21:01:45]

Done.

+    uint64_t creation_time = 0;

[grt (UTC plus 2), 2017/01/06 09:44:58]

#include <stdint.h>

[chrisha, 2017/01/10 21:01:46]

Done.

+    ModuleEventSinkImpl::GetProcessCreationTime(::GetCurrentProcess(),

[grt (UTC plus 2), 2017/01/06 09:44:57]

TIL: base::CurrentProcessInfo::CreationTime()!

[chrisha, 2017/01/10 21:01:45]

Is there any guarantee that base::Time is lossless wrt FILETIME, and will always
be? The intent of the creation time here is to use it as a key to uniquely
identify a process. If base::Time is at all "lossy" wrt FILETIME then that will
no longer work.

(Looking at the implementation, it's not. FILETIME is in 100 ns increments, but
base::Time uses microseconds. So there's a miniature possibility of PID reuse
within the window of a base::Time-backed creation time.)

https://cs.chromium.org/chromium/src/base/time/time_win.cc?q=FileTimeToMicros...

+                                                &creation_time);
+
+    ModuleDatabase::SetInstance(base::MakeUnique<ModuleDatabase>(
+        content::BrowserThread::GetTaskRunnerForThread(
+            content::BrowserThread::UI)));
+    auto* module_database = ModuleDatabase::GetInstance();
+    uint32_t process_id = ::GetCurrentProcessId();
+    module_database->OnProcessStarted(process_id, creation_time,
+                                      content::PROCESS_TYPE_BROWSER);
+    module_watcher_ = ModuleWatcher::Create(
+        base::Bind(&OnModuleEvent, process_id, creation_time));
+  }
 }
 
 void ChromeBrowserMainPartsWin::PostBrowserStart() {
   ChromeBrowserMainParts::PostBrowserStart();
 
   UMA_HISTOGRAM_BOOLEAN("Windows.Tablet", base::win::IsTabletDevice(nullptr));
 
   // Set up a task to verify installed modules in the current process.
   content::BrowserThread::PostAfterStartupTask(
       FROM_HERE, content::BrowserThread::GetBlockingPool(),
@@ skipping 186 matching lines @@
   if (resource_id)
     return l10n_util::GetStringUTF16(resource_id);
   return base::string16();
 }
 
 // static
 void ChromeBrowserMainPartsWin::SetupInstallerUtilStrings() {
   CR_DEFINE_STATIC_LOCAL(TranslationDelegate, delegate, ());
   installer::SetTranslationDelegate(&delegate);
 }