Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(5928)

Unified Diff: chrome/browser/safe_browsing/verifier.cc

Issue 406043003: Adding the VerifyModule function (and helpers) to safe browsing. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chrome/browser/safe_browsing/verifier.cc
diff --git a/chrome/browser/safe_browsing/verifier.cc b/chrome/browser/safe_browsing/verifier.cc
deleted file mode 100644
index b3416756632344b0b8bd18931750163532b9d75b..0000000000000000000000000000000000000000
--- a/chrome/browser/safe_browsing/verifier.cc
+++ /dev/null
@@ -1,168 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/safe_browsing/verifier.h"
-
-#include <windows.h>
-#include <psapi.h>
-
-#include "base/files/file_path.h"
-#include "base/files/memory_mapped_file.h"
-#include "base/win/pe_image.h"
-
-namespace safe_browsing {
-
-namespace {
-
-// The number of bytes made to agree (between memory and disk) when the
-// relocations are accounted for.
-int bytes_corrected_by_reloc = 0;
-
-// This is true if the relocation table contains a reloc of type we don't
-// currently handle.
-bool unknown_reloc_type = false;
-
-bool AddrIsInCodeSection(void* address, BYTE* code_addr, SIZE_T code_size) {
- return (code_addr <= address && address <= code_addr + code_size);
-}
-
-bool GetCodeAddrsAndSize(const base::win::PEImage mem_peimage,
- base::win::PEImageAsData disk_peimage,
- BYTE*& mem_code_addr,
- BYTE*& disk_code_addr,
- SIZE_T& code_size) {
- DWORD base_of_code = mem_peimage.GetNTHeaders()->OptionalHeader.BaseOfCode;
-
- // Get the address and size of the code section in the loaded module image.
- PIMAGE_SECTION_HEADER mem_code_header =
- mem_peimage.GetImageSectionFromAddr(mem_peimage.RVAToAddr(base_of_code));
- if (mem_code_header == NULL)
- return false;
- mem_code_addr = reinterpret_cast<BYTE*>(
- mem_peimage.RVAToAddr(mem_code_header->VirtualAddress));
- code_size = mem_code_header->Misc.VirtualSize;
-
- // Get the address of the code section in the module mapped as data from disk.
- // Section size will be the same as in the loaded module.
- DWORD disk_code_offset = 0;
- if (!mem_peimage.ImageAddrToOnDiskOffset(
- reinterpret_cast<void*>(mem_code_addr), &disk_code_offset))
- return false;
- disk_code_addr =
- reinterpret_cast<BYTE*>(disk_peimage.module()) + disk_code_offset;
- return true;
-}
-
-int CountBytesDiffInPtr(intptr_t num_a, intptr_t num_b) {
- int num_bytes = 0;
- for (int i = 0; i < sizeof(num_a); ++i) {
- if ((num_a & 0xFF) != (num_b & 0xFF))
- ++num_bytes;
- num_a >>= 8;
- num_b >>= 8;
- }
- return num_bytes;
-}
-
-bool EnumRelocsCallback(const base::win::PEImage& mem_peimage,
- WORD type,
- void* address,
- void* cookie) {
- base::win::PEImageAsData disk_peimage =
- *reinterpret_cast<base::win::PEImageAsData*>(cookie);
- BYTE* mem_code_addr = NULL;
- BYTE* disk_code_addr = NULL;
- SIZE_T code_size = 0;
- if (!GetCodeAddrsAndSize(
- mem_peimage, disk_peimage, mem_code_addr, disk_code_addr, code_size))
- return false;
-
- switch (type) {
- case IMAGE_REL_BASED_HIGHLOW: {
- // If not in the code section return true to continue to the next reloc.
- if (!AddrIsInCodeSection(address, mem_code_addr, code_size))
- return true;
-
- BYTE* preferred_image_base = reinterpret_cast<BYTE*>(
- disk_peimage.GetNTHeaders()->OptionalHeader.ImageBase);
- intptr_t delta =
- preferred_image_base - reinterpret_cast<BYTE*>(mem_peimage.module());
- BYTE* new_value = (*reinterpret_cast<BYTE**>(address)) + delta;
- int bytes_corrected =
- CountBytesDiffInPtr(reinterpret_cast<intptr_t>(new_value),
- *reinterpret_cast<intptr_t*>(address));
-
- // Check that the adding delta did correct the value to agree with disk.
- BYTE** disk_address = reinterpret_cast<BYTE**>(
- reinterpret_cast<BYTE*>(address) - mem_code_addr + disk_code_addr);
- if (new_value == *disk_address) {
- bytes_corrected_by_reloc += bytes_corrected;
- }
- break;
- }
- case IMAGE_REL_BASED_ABSOLUTE:
- break;
- default: {
- // TODO(krstnmnlsn): Find a reliable description of the behaviour of the
- // remaining types of relocation and handle them.
- unknown_reloc_type = true;
- break;
- }
- }
- return true;
-}
-
-int CountBytesDiffInMemory(BYTE* disk_code_start,
- BYTE* memory_code_start,
- SIZE_T code_size) {
- int counter = 0;
- for (int i = 0; i < static_cast<int>(code_size); ++i) {
- if (*(disk_code_start + i) != *(memory_code_start + i))
- ++counter;
- }
- return counter;
-}
-
-} // namespace
-
-ModuleState VerifyModule(wchar_t* module_name) {
- HMODULE module_handle = GetModuleHandle(module_name);
- if (module_handle == NULL)
- return MODULE_STATE_UNKNOWN;
-
- WCHAR module_path[MAX_PATH] = {0};
- if (GetModuleFileNameEx(
- GetCurrentProcess(), module_handle, module_path, MAX_PATH) == 0)
- return MODULE_STATE_UNKNOWN;
-
- base::MemoryMappedFile mapped_module;
- mapped_module.Initialize(base::FilePath(module_path));
- base::win::PEImageAsData disk_peimage(
- reinterpret_cast<HMODULE>(const_cast<uint8*>(mapped_module.data())));
-
- base::win::PEImage mem_peimage(module_handle);
- if (!mem_peimage.VerifyMagic() || !disk_peimage.VerifyMagic())
- return MODULE_STATE_UNKNOWN;
-
- BYTE* mem_code_addr = NULL;
- BYTE* disk_code_addr = NULL;
- SIZE_T code_size = 0;
- if (!GetCodeAddrsAndSize(
- mem_peimage, disk_peimage, mem_code_addr, disk_code_addr, code_size))
- return MODULE_STATE_UNKNOWN;
-
- int num_bytes_different =
- CountBytesDiffInMemory(disk_code_addr, mem_code_addr, code_size);
- mem_peimage.EnumRelocs(
- (base::win::PEImage::EnumRelocsFunction) & EnumRelocsCallback,
- &disk_peimage);
- if (unknown_reloc_type)
- return MODULE_STATE_UNKNOWN;
-
- if (num_bytes_different - bytes_corrected_by_reloc == 0)
- return MODULE_STATE_UNMODIFIED;
- return MODULE_STATE_MODIFIED;
-}
-
-} // namespace safe_browsing

Powered by Google App Engine
This is Rietveld 408576698