| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h" | 5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h" |
| 6 | 6 |
| 7 #include "base/files/file_path.h" | 7 #include "base/files/file_path.h" |
| 8 #include "base/files/memory_mapped_file.h" | 8 #include "base/files/memory_mapped_file.h" |
| 9 #include "base/native_library.h" | 9 #include "base/native_library.h" |
| 10 #include "base/path_service.h" | 10 #include "base/path_service.h" |
| 11 #include "base/scoped_native_library.h" | 11 #include "base/scoped_native_library.h" |
| 12 #include "base/win/pe_image.h" | 12 #include "base/win/pe_image.h" |
| 13 #include "chrome/browser/safe_browsing/module_integrity_unittest_util_win.h" |
| 13 #include "testing/gtest/include/gtest/gtest.h" | 14 #include "testing/gtest/include/gtest/gtest.h" |
| 14 | 15 |
| 15 namespace safe_browsing { | 16 namespace safe_browsing { |
| 16 | 17 |
| 17 namespace { | |
| 18 | |
| 19 const wchar_t kTestDllName[] = L"verifier_test_dll.dll"; | |
| 20 const char kTestExportName[] = "DummyExport"; | |
| 21 | |
| 22 } // namespace | |
| 23 | |
| 24 class SafeBrowsingModuleVerifierWinTest : public testing::Test { | 18 class SafeBrowsingModuleVerifierWinTest : public testing::Test { |
| 25 protected: | 19 protected: |
| 26 void SetUpTestDllAndPEImages() { | 20 void SetUpTestDllAndPEImages() { |
| 27 LoadModule(); | 21 LoadModule(); |
| 28 HMODULE mem_handle; | 22 HMODULE mem_handle; |
| 29 GetMemModuleHandle(&mem_handle); | 23 GetMemModuleHandle(&mem_handle); |
| 30 mem_peimage_ptr_.reset(new base::win::PEImage(mem_handle)); | 24 mem_peimage_ptr_.reset(new base::win::PEImage(mem_handle)); |
| 31 ASSERT_TRUE(mem_peimage_ptr_->VerifyMagic()); | 25 ASSERT_TRUE(mem_peimage_ptr_->VerifyMagic()); |
| 32 | 26 |
| 33 LoadDLLAsFile(); | 27 LoadDLLAsFile(); |
| 34 HMODULE disk_handle; | 28 HMODULE disk_handle; |
| 35 GetDiskModuleHandle(&disk_handle); | 29 GetDiskModuleHandle(&disk_handle); |
| 36 disk_peimage_ptr_.reset(new base::win::PEImageAsData(disk_handle)); | 30 disk_peimage_ptr_.reset(new base::win::PEImageAsData(disk_handle)); |
| 37 ASSERT_TRUE(disk_peimage_ptr_->VerifyMagic()); | 31 ASSERT_TRUE(disk_peimage_ptr_->VerifyMagic()); |
| 38 } | 32 } |
| 39 | 33 |
| 40 void LoadModule() { | 34 void LoadModule() { |
| 41 HMODULE mem_dll_handle = | 35 HMODULE mem_dll_handle = |
| 42 LoadNativeLibrary(base::FilePath(kTestDllName), NULL); | 36 LoadNativeLibrary(base::FilePath(kTestDllNames[0]), NULL); |
| 43 ASSERT_NE(static_cast<HMODULE>(NULL), mem_dll_handle) | 37 ASSERT_NE(static_cast<HMODULE>(NULL), mem_dll_handle) |
| 44 << "GLE=" << GetLastError(); | 38 << "GLE=" << GetLastError(); |
| 45 mem_dll_handle_.Reset(mem_dll_handle); | 39 mem_dll_handle_.Reset(mem_dll_handle); |
| 46 ASSERT_TRUE(mem_dll_handle_.is_valid()); | 40 ASSERT_TRUE(mem_dll_handle_.is_valid()); |
| 47 } | 41 } |
| 48 | 42 |
| 49 void GetMemModuleHandle(HMODULE* mem_handle) { | 43 void GetMemModuleHandle(HMODULE* mem_handle) { |
| 50 *mem_handle = GetModuleHandle(kTestDllName); | 44 *mem_handle = GetModuleHandle(kTestDllNames[0]); |
| 51 ASSERT_NE(static_cast<HMODULE>(NULL), *mem_handle); | 45 ASSERT_NE(static_cast<HMODULE>(NULL), *mem_handle); |
| 52 } | 46 } |
| 53 | 47 |
| 54 void LoadDLLAsFile() { | 48 void LoadDLLAsFile() { |
| 55 // Use the module handle to find the it on disk, then load as a file. | 49 // Use the module handle to find the it on disk, then load as a file. |
| 56 HMODULE module_handle; | 50 HMODULE module_handle; |
| 57 GetMemModuleHandle(&module_handle); | 51 GetMemModuleHandle(&module_handle); |
| 58 | 52 |
| 59 WCHAR module_path[MAX_PATH] = {}; | 53 WCHAR module_path[MAX_PATH] = {}; |
| 60 DWORD length = | 54 DWORD length = |
| (...skipping 29 matching lines...) Expand all Loading... |
| 90 base::ScopedNativeLibrary mem_dll_handle_; | 84 base::ScopedNativeLibrary mem_dll_handle_; |
| 91 base::MemoryMappedFile disk_dll_handle_; | 85 base::MemoryMappedFile disk_dll_handle_; |
| 92 scoped_ptr<base::win::PEImageAsData> disk_peimage_ptr_; | 86 scoped_ptr<base::win::PEImageAsData> disk_peimage_ptr_; |
| 93 scoped_ptr<base::win::PEImage> mem_peimage_ptr_; | 87 scoped_ptr<base::win::PEImage> mem_peimage_ptr_; |
| 94 }; | 88 }; |
| 95 | 89 |
| 96 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleUnmodified) { | 90 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleUnmodified) { |
| 97 std::set<std::string> modified_exports; | 91 std::set<std::string> modified_exports; |
| 98 // Call VerifyModule before the module has been loaded, should fail. | 92 // Call VerifyModule before the module has been loaded, should fail. |
| 99 EXPECT_EQ(MODULE_STATE_UNKNOWN, | 93 EXPECT_EQ(MODULE_STATE_UNKNOWN, |
| 100 VerifyModule(kTestDllName, &modified_exports)); | 94 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 101 EXPECT_EQ(0, modified_exports.size()); | 95 EXPECT_EQ(0, modified_exports.size()); |
| 102 | 96 |
| 103 // On loading, the module should be identical (up to relocations) in memory as | 97 // On loading, the module should be identical (up to relocations) in memory as |
| 104 // on disk. | 98 // on disk. |
| 105 SetUpTestDllAndPEImages(); | 99 SetUpTestDllAndPEImages(); |
| 106 EXPECT_EQ(MODULE_STATE_UNMODIFIED, | 100 EXPECT_EQ(MODULE_STATE_UNMODIFIED, |
| 107 VerifyModule(kTestDllName, &modified_exports)); | 101 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 108 EXPECT_EQ(0, modified_exports.size()); | 102 EXPECT_EQ(0, modified_exports.size()); |
| 109 } | 103 } |
| 110 | 104 |
| 111 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleModified) { | 105 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleModified) { |
| 112 std::set<std::string> modified_exports; | 106 std::set<std::string> modified_exports; |
| 113 // Confirm the module is identical in memory as on disk before we begin. | 107 // Confirm the module is identical in memory as on disk before we begin. |
| 114 SetUpTestDllAndPEImages(); | 108 SetUpTestDllAndPEImages(); |
| 115 EXPECT_EQ(MODULE_STATE_UNMODIFIED, | 109 EXPECT_EQ(MODULE_STATE_UNMODIFIED, |
| 116 VerifyModule(kTestDllName, &modified_exports)); | 110 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 117 | 111 |
| 118 uint8_t* mem_code_addr = NULL; | 112 uint8_t* mem_code_addr = NULL; |
| 119 uint8_t* disk_code_addr = NULL; | 113 uint8_t* disk_code_addr = NULL; |
| 120 uint32_t code_size = 0; | 114 uint32_t code_size = 0; |
| 121 EXPECT_TRUE(GetCodeAddrsAndSize(*mem_peimage_ptr_, | 115 EXPECT_TRUE(GetCodeAddrsAndSize(*mem_peimage_ptr_, |
| 122 *disk_peimage_ptr_, | 116 *disk_peimage_ptr_, |
| 123 &mem_code_addr, | 117 &mem_code_addr, |
| 124 &disk_code_addr, | 118 &disk_code_addr, |
| 125 &code_size)); | 119 &code_size)); |
| 126 | 120 |
| 127 // Edit the first byte of the code section of the module (this may be before | 121 // Edit the first byte of the code section of the module (this may be before |
| 128 // the address of any export). | 122 // the address of any export). |
| 129 uint8_t new_val = (*mem_code_addr) + 1; | 123 uint8_t new_val = (*mem_code_addr) + 1; |
| 130 SIZE_T bytes_written = 0; | 124 SIZE_T bytes_written = 0; |
| 131 WriteProcessMemory(GetCurrentProcess(), | 125 WriteProcessMemory(GetCurrentProcess(), |
| 132 mem_code_addr, | 126 mem_code_addr, |
| 133 reinterpret_cast<void*>(&new_val), | 127 reinterpret_cast<void*>(&new_val), |
| 134 1, | 128 1, |
| 135 &bytes_written); | 129 &bytes_written); |
| 136 EXPECT_EQ(1, bytes_written); | 130 EXPECT_EQ(1, bytes_written); |
| 137 | 131 |
| 138 // VerifyModule should detect the change. | 132 // VerifyModule should detect the change. |
| 139 EXPECT_EQ(MODULE_STATE_MODIFIED, | 133 EXPECT_EQ(MODULE_STATE_MODIFIED, |
| 140 VerifyModule(kTestDllName, &modified_exports)); | 134 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 141 } | 135 } |
| 142 | 136 |
| 143 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleExportModified) { | 137 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleExportModified) { |
| 144 std::set<std::string> modified_exports; | 138 std::set<std::string> modified_exports; |
| 145 // Confirm the module is identical in memory as on disk before we begin. | 139 // Confirm the module is identical in memory as on disk before we begin. |
| 146 SetUpTestDllAndPEImages(); | 140 SetUpTestDllAndPEImages(); |
| 147 EXPECT_EQ(MODULE_STATE_UNMODIFIED, | 141 EXPECT_EQ(MODULE_STATE_UNMODIFIED, |
| 148 VerifyModule(kTestDllName, &modified_exports)); | 142 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 149 modified_exports.clear(); | 143 modified_exports.clear(); |
| 150 | 144 |
| 151 // Edit the exported function, VerifyModule should now return the function | 145 // Edit the exported function, VerifyModule should now return the function |
| 152 // name in modified_exports. | 146 // name in modified_exports. |
| 153 EditExport(); | 147 EditExport(); |
| 154 EXPECT_EQ(MODULE_STATE_MODIFIED, | 148 EXPECT_EQ(MODULE_STATE_MODIFIED, |
| 155 VerifyModule(kTestDllName, &modified_exports)); | 149 VerifyModule(kTestDllNames[0], &modified_exports)); |
| 156 EXPECT_EQ(1, modified_exports.size()); | 150 EXPECT_EQ(1, modified_exports.size()); |
| 157 EXPECT_EQ(0, std::string(kTestExportName).compare(*modified_exports.begin())); | 151 EXPECT_EQ(0, std::string(kTestExportName).compare(*modified_exports.begin())); |
| 158 } | 152 } |
| 159 | 153 |
| 160 } // namespace safe_browsing | 154 } // namespace safe_browsing |
| OLD | NEW |