Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(39)

Side by Side Diff: chrome/browser/safe_browsing/module_integrity_verifier_win_unittest.cc

Issue 440753002: The incident reporting service now calls VerifyModule. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2014 The Chromium Authors. All rights reserved. 1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h" 5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h"
6 6
7 #include "base/files/file_path.h" 7 #include "base/files/file_path.h"
8 #include "base/files/memory_mapped_file.h" 8 #include "base/files/memory_mapped_file.h"
9 #include "base/native_library.h" 9 #include "base/native_library.h"
10 #include "base/path_service.h" 10 #include "base/path_service.h"
11 #include "base/scoped_native_library.h" 11 #include "base/scoped_native_library.h"
12 #include "base/win/pe_image.h" 12 #include "base/win/pe_image.h"
13 #include "chrome/browser/safe_browsing/module_integrity_unittest_util_win.h"
13 #include "testing/gtest/include/gtest/gtest.h" 14 #include "testing/gtest/include/gtest/gtest.h"
14 15
15 namespace safe_browsing { 16 namespace safe_browsing {
16 17
17 namespace {
18
19 const wchar_t kTestDllName[] = L"verifier_test_dll.dll";
20 const char kTestExportName[] = "DummyExport";
21
22 } // namespace
23
24 class SafeBrowsingModuleVerifierWinTest : public testing::Test { 18 class SafeBrowsingModuleVerifierWinTest : public testing::Test {
25 protected: 19 protected:
26 void SetUpTestDllAndPEImages() { 20 void SetUpTestDllAndPEImages() {
27 LoadModule(); 21 LoadModule();
28 HMODULE mem_handle; 22 HMODULE mem_handle;
29 GetMemModuleHandle(&mem_handle); 23 GetMemModuleHandle(&mem_handle);
30 mem_peimage_ptr_.reset(new base::win::PEImage(mem_handle)); 24 mem_peimage_ptr_.reset(new base::win::PEImage(mem_handle));
31 ASSERT_TRUE(mem_peimage_ptr_->VerifyMagic()); 25 ASSERT_TRUE(mem_peimage_ptr_->VerifyMagic());
32 26
33 LoadDLLAsFile(); 27 LoadDLLAsFile();
34 HMODULE disk_handle; 28 HMODULE disk_handle;
35 GetDiskModuleHandle(&disk_handle); 29 GetDiskModuleHandle(&disk_handle);
36 disk_peimage_ptr_.reset(new base::win::PEImageAsData(disk_handle)); 30 disk_peimage_ptr_.reset(new base::win::PEImageAsData(disk_handle));
37 ASSERT_TRUE(disk_peimage_ptr_->VerifyMagic()); 31 ASSERT_TRUE(disk_peimage_ptr_->VerifyMagic());
38 } 32 }
39 33
40 void LoadModule() { 34 void LoadModule() {
41 HMODULE mem_dll_handle = 35 HMODULE mem_dll_handle =
42 LoadNativeLibrary(base::FilePath(kTestDllName), NULL); 36 LoadNativeLibrary(base::FilePath(kTestDllNames[0]), NULL);
43 ASSERT_NE(static_cast<HMODULE>(NULL), mem_dll_handle) 37 ASSERT_NE(static_cast<HMODULE>(NULL), mem_dll_handle)
44 << "GLE=" << GetLastError(); 38 << "GLE=" << GetLastError();
45 mem_dll_handle_.Reset(mem_dll_handle); 39 mem_dll_handle_.Reset(mem_dll_handle);
46 ASSERT_TRUE(mem_dll_handle_.is_valid()); 40 ASSERT_TRUE(mem_dll_handle_.is_valid());
47 } 41 }
48 42
49 void GetMemModuleHandle(HMODULE* mem_handle) { 43 void GetMemModuleHandle(HMODULE* mem_handle) {
50 *mem_handle = GetModuleHandle(kTestDllName); 44 *mem_handle = GetModuleHandle(kTestDllNames[0]);
51 ASSERT_NE(static_cast<HMODULE>(NULL), *mem_handle); 45 ASSERT_NE(static_cast<HMODULE>(NULL), *mem_handle);
52 } 46 }
53 47
54 void LoadDLLAsFile() { 48 void LoadDLLAsFile() {
55 // Use the module handle to find the it on disk, then load as a file. 49 // Use the module handle to find the it on disk, then load as a file.
56 HMODULE module_handle; 50 HMODULE module_handle;
57 GetMemModuleHandle(&module_handle); 51 GetMemModuleHandle(&module_handle);
58 52
59 WCHAR module_path[MAX_PATH] = {}; 53 WCHAR module_path[MAX_PATH] = {};
60 DWORD length = 54 DWORD length =
(...skipping 29 matching lines...) Expand all
90 base::ScopedNativeLibrary mem_dll_handle_; 84 base::ScopedNativeLibrary mem_dll_handle_;
91 base::MemoryMappedFile disk_dll_handle_; 85 base::MemoryMappedFile disk_dll_handle_;
92 scoped_ptr<base::win::PEImageAsData> disk_peimage_ptr_; 86 scoped_ptr<base::win::PEImageAsData> disk_peimage_ptr_;
93 scoped_ptr<base::win::PEImage> mem_peimage_ptr_; 87 scoped_ptr<base::win::PEImage> mem_peimage_ptr_;
94 }; 88 };
95 89
96 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleUnmodified) { 90 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleUnmodified) {
97 std::set<std::string> modified_exports; 91 std::set<std::string> modified_exports;
98 // Call VerifyModule before the module has been loaded, should fail. 92 // Call VerifyModule before the module has been loaded, should fail.
99 EXPECT_EQ(MODULE_STATE_UNKNOWN, 93 EXPECT_EQ(MODULE_STATE_UNKNOWN,
100 VerifyModule(kTestDllName, &modified_exports)); 94 VerifyModule(kTestDllNames[0], &modified_exports));
101 EXPECT_EQ(0, modified_exports.size()); 95 EXPECT_EQ(0, modified_exports.size());
102 96
103 // On loading, the module should be identical (up to relocations) in memory as 97 // On loading, the module should be identical (up to relocations) in memory as
104 // on disk. 98 // on disk.
105 SetUpTestDllAndPEImages(); 99 SetUpTestDllAndPEImages();
106 EXPECT_EQ(MODULE_STATE_UNMODIFIED, 100 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
107 VerifyModule(kTestDllName, &modified_exports)); 101 VerifyModule(kTestDllNames[0], &modified_exports));
108 EXPECT_EQ(0, modified_exports.size()); 102 EXPECT_EQ(0, modified_exports.size());
109 } 103 }
110 104
111 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleModified) { 105 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleModified) {
112 std::set<std::string> modified_exports; 106 std::set<std::string> modified_exports;
113 // Confirm the module is identical in memory as on disk before we begin. 107 // Confirm the module is identical in memory as on disk before we begin.
114 SetUpTestDllAndPEImages(); 108 SetUpTestDllAndPEImages();
115 EXPECT_EQ(MODULE_STATE_UNMODIFIED, 109 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
116 VerifyModule(kTestDllName, &modified_exports)); 110 VerifyModule(kTestDllNames[0], &modified_exports));
117 111
118 uint8_t* mem_code_addr = NULL; 112 uint8_t* mem_code_addr = NULL;
119 uint8_t* disk_code_addr = NULL; 113 uint8_t* disk_code_addr = NULL;
120 uint32_t code_size = 0; 114 uint32_t code_size = 0;
121 EXPECT_TRUE(GetCodeAddrsAndSize(*mem_peimage_ptr_, 115 EXPECT_TRUE(GetCodeAddrsAndSize(*mem_peimage_ptr_,
122 *disk_peimage_ptr_, 116 *disk_peimage_ptr_,
123 &mem_code_addr, 117 &mem_code_addr,
124 &disk_code_addr, 118 &disk_code_addr,
125 &code_size)); 119 &code_size));
126 120
127 // Edit the first byte of the code section of the module (this may be before 121 // Edit the first byte of the code section of the module (this may be before
128 // the address of any export). 122 // the address of any export).
129 uint8_t new_val = (*mem_code_addr) + 1; 123 uint8_t new_val = (*mem_code_addr) + 1;
130 SIZE_T bytes_written = 0; 124 SIZE_T bytes_written = 0;
131 WriteProcessMemory(GetCurrentProcess(), 125 WriteProcessMemory(GetCurrentProcess(),
132 mem_code_addr, 126 mem_code_addr,
133 reinterpret_cast<void*>(&new_val), 127 reinterpret_cast<void*>(&new_val),
134 1, 128 1,
135 &bytes_written); 129 &bytes_written);
136 EXPECT_EQ(1, bytes_written); 130 EXPECT_EQ(1, bytes_written);
137 131
138 // VerifyModule should detect the change. 132 // VerifyModule should detect the change.
139 EXPECT_EQ(MODULE_STATE_MODIFIED, 133 EXPECT_EQ(MODULE_STATE_MODIFIED,
140 VerifyModule(kTestDllName, &modified_exports)); 134 VerifyModule(kTestDllNames[0], &modified_exports));
141 } 135 }
142 136
143 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleExportModified) { 137 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleExportModified) {
144 std::set<std::string> modified_exports; 138 std::set<std::string> modified_exports;
145 // Confirm the module is identical in memory as on disk before we begin. 139 // Confirm the module is identical in memory as on disk before we begin.
146 SetUpTestDllAndPEImages(); 140 SetUpTestDllAndPEImages();
147 EXPECT_EQ(MODULE_STATE_UNMODIFIED, 141 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
148 VerifyModule(kTestDllName, &modified_exports)); 142 VerifyModule(kTestDllNames[0], &modified_exports));
149 modified_exports.clear(); 143 modified_exports.clear();
150 144
151 // Edit the exported function, VerifyModule should now return the function 145 // Edit the exported function, VerifyModule should now return the function
152 // name in modified_exports. 146 // name in modified_exports.
153 EditExport(); 147 EditExport();
154 EXPECT_EQ(MODULE_STATE_MODIFIED, 148 EXPECT_EQ(MODULE_STATE_MODIFIED,
155 VerifyModule(kTestDllName, &modified_exports)); 149 VerifyModule(kTestDllNames[0], &modified_exports));
156 EXPECT_EQ(1, modified_exports.size()); 150 EXPECT_EQ(1, modified_exports.size());
157 EXPECT_EQ(0, std::string(kTestExportName).compare(*modified_exports.begin())); 151 EXPECT_EQ(0, std::string(kTestExportName).compare(*modified_exports.begin()));
158 } 152 }
159 153
160 } // namespace safe_browsing 154 } // namespace safe_browsing
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698