Finch Blacklist is now added to the Hardcoded blacklist.

chrome_elf/blacklist/blacklist.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_elf/blacklist/blacklist.h"
 
 #include <assert.h>
 #include <string.h>
 
+#include <vector>
+
 #include "base/basictypes.h"
 #include "chrome_elf/blacklist/blacklist_interceptions.h"
 #include "chrome_elf/chrome_elf_constants.h"
 #include "chrome_elf/chrome_elf_util.h"
 #include "chrome_elf/thunk_getter.h"
 #include "sandbox/win/src/interception_internal.h"
 #include "sandbox/win/src/internal_types.h"
 #include "sandbox/win/src/service_resolver.h"
 
 // http://blogs.msdn.com/oldnewthing/archive/2004/10/25/247180.aspx
@@ skipping 315 matching lines @@
   g_blacklist_initialized = NT_SUCCESS(ret);
 
   // Mark the thunk storage as executable and prevent any future writes to it.
   page_executable = page_executable && VirtualProtect(&g_thunk_storage,
                                                       sizeof(g_thunk_storage),
                                                       PAGE_EXECUTE_READ,
                                                       &old_protect);
 
   RecordSuccessfulThunkSetup(&key);
 
+  AddDllsFromRegistryToBlacklist();
+
   return NT_SUCCESS(ret) && page_executable;
 }
 
+bool AddDllsFromRegistryToBlacklist() {
+  HKEY key = NULL;
+  LONG result = ::RegOpenKeyEx(HKEY_CURRENT_USER,
+                               kRegistryFinchListPath,
+                               0,
+                               KEY_QUERY_VALUE | KEY_SET_VALUE,
+                               &key);
+
+  if (result != ERROR_SUCCESS)
+    return false;
+
+  int num_dlls;

[robertshield, 2014/05/30 21:07:08]

= 0

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+  int longest_name;

[robertshield, 2014/05/30 21:07:08]

= 0

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+  ::RegQueryInfoKey(key,
+                    NULL, NULL, NULL, NULL, NULL, NULL,
+                    reinterpret_cast<DWORD*>(&num_dlls),
+                    reinterpret_cast<DWORD*>(&longest_name),
+                    NULL, NULL, NULL);
+
+  // Collect dlls so that we can delete them after the enumeration.
+  std::vector<wchar_t*> dll_names(num_dlls);

[robertshield, 2014/05/30 21:07:08]

using a std::vector<std::wstring> would save a bunch of the manual memory
management below.

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+
+  for (int i = 0; i < num_dlls; ++i) {
+    DWORD name_len(longest_name + 1);

[robertshield, 2014/05/30 21:07:08]

prefer = syntax for POD types

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+    DWORD value_len;

[robertshield, 2014/05/30 21:07:08]

= 0

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+    wchar_t* name_buffer = new wchar_t[name_len];

[robertshield, 2014/05/30 21:07:08]

it looks like name_buffer is leaked on every iteration? consider using a
vector<wchar_t> and reserve()ing it first, that way you don't need to worry
about cleanup. 

[krstnmnlsn, 2014/06/02 14:00:37]

In my defense, I don't actually think this was leaking, I was collecting the
names and then deleting them in the second loop after using them.  But even if
I'm right about that it's probably not good to have your code looking like a
memory leak so switched to vectors now.

[robertshield, 2014/06/03 03:03:00]

Indeed, not leaking! Sorry for misreading :( still vectors much better :)

+    result = ::RegEnumValue(
+        key, i, name_buffer, &name_len, NULL, NULL, NULL, &value_len);
+    name_len = name_len + 1;
+    wchar_t* value_buffer = new wchar_t[value_len + 1];
+    result = ::RegEnumValue(key, i, name_buffer, &name_len, NULL, NULL,
+                            reinterpret_cast<BYTE*>(value_buffer), &value_len);
+    value_buffer[value_len] = L'\0';
+
+    if (result == ERROR_SUCCESS) {
+      AddDllToBlacklist(value_buffer);
+    }
+
+    dll_names[i] = name_buffer;

[robertshield, 2014/05/30 21:07:08]

use push_back() instead

[krstnmnlsn, 2014/06/02 14:00:37]

Done.

+
+    delete[] value_buffer;
+  }
+
+  for (int i = 0; i < num_dlls; ++i) {
+    ::RegDeleteValue(key, dll_names[i]);

[robertshield, 2014/05/30 21:07:08]

Why do we delete the values from the registry here?

[krstnmnlsn, 2014/06/02 14:00:37]

I thought that deleting values from the registry while looping over values in
the registry would cause problems.  Is there a simpler way of getting around
that?

[robertshield, 2014/06/03 03:03:00]

I actually meant, why do we delete them at all? Does deleting them mean that
these dlls are not blacklisted on next startup? (This is more of an "I don't
know how this works" comment :-))

+    delete[] dll_names[i];
+  }
+
+  ::RegCloseKey(key);
+  return true;
+}
+
 }  // namespace blacklist