Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(308)

Side by Side Diff: trunk/src/chrome/browser/safe_browsing/module_integrity_verifier_win_unittest.cc

Issue 458483003: Revert 288319 "Adding the VerifyModule function (and helpers) to..." (Closed) Base URL: svn://svn.chromium.org/chrome/
Patch Set: Created 6 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
(Empty)
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h"
6
7 #include "base/files/file_path.h"
8 #include "base/files/memory_mapped_file.h"
9 #include "base/native_library.h"
10 #include "base/path_service.h"
11 #include "base/scoped_native_library.h"
12 #include "base/win/pe_image.h"
13 #include "testing/gtest/include/gtest/gtest.h"
14
15 namespace safe_browsing {
16
17 namespace {
18
19 const wchar_t kTestDllName[] = L"verifier_test_dll.dll";
20 const char kTestExportName[] = "DummyExport";
21
22 } // namespace
23
24 class SafeBrowsingModuleVerifierWinTest : public testing::Test {
25 protected:
26 void SetUpTestDllAndPEImages() {
27 LoadModule();
28 HMODULE mem_handle;
29 GetMemModuleHandle(&mem_handle);
30 mem_peimage_ptr_.reset(new base::win::PEImage(mem_handle));
31 ASSERT_TRUE(mem_peimage_ptr_->VerifyMagic());
32
33 LoadDLLAsFile();
34 HMODULE disk_handle;
35 GetDiskModuleHandle(&disk_handle);
36 disk_peimage_ptr_.reset(new base::win::PEImageAsData(disk_handle));
37 ASSERT_TRUE(disk_peimage_ptr_->VerifyMagic());
38 }
39
40 void LoadModule() {
41 mem_dll_handle_.Reset(
42 LoadNativeLibrary(base::FilePath(kTestDllName), NULL));
43 ASSERT_TRUE(mem_dll_handle_.is_valid());
44 }
45
46 void GetMemModuleHandle(HMODULE* mem_handle) {
47 *mem_handle = GetModuleHandle(kTestDllName);
48 ASSERT_NE(static_cast<HMODULE>(NULL), *mem_handle);
49 }
50
51 void LoadDLLAsFile() {
52 // Use the module handle to find the it on disk, then load as a file.
53 HMODULE module_handle;
54 GetMemModuleHandle(&module_handle);
55
56 WCHAR module_path[MAX_PATH] = {};
57 DWORD length =
58 GetModuleFileName(module_handle, module_path, arraysize(module_path));
59 ASSERT_NE(arraysize(module_path), length);
60 ASSERT_TRUE(disk_dll_handle_.Initialize(base::FilePath(module_path)));
61 }
62
63 void GetDiskModuleHandle(HMODULE* disk_handle) {
64 *disk_handle =
65 reinterpret_cast<HMODULE>(const_cast<uint8*>(disk_dll_handle_.data()));
66 }
67
68 // Edits the first byte of the single function exported by the test dll.
69 void EditExport() {
70 HMODULE mem_handle;
71 GetMemModuleHandle(&mem_handle);
72 uint8_t* export_addr =
73 reinterpret_cast<uint8_t*>(GetProcAddress(mem_handle, kTestExportName));
74 EXPECT_NE(reinterpret_cast<uint8_t*>(NULL), export_addr);
75
76 // Edit the first byte of the function.
77 uint8_t new_val = (*export_addr) + 1;
78 SIZE_T bytes_written = 0;
79 WriteProcessMemory(GetCurrentProcess(),
80 export_addr,
81 reinterpret_cast<void*>(&new_val),
82 1,
83 &bytes_written);
84 EXPECT_EQ(1, bytes_written);
85 }
86
87 base::ScopedNativeLibrary mem_dll_handle_;
88 base::MemoryMappedFile disk_dll_handle_;
89 scoped_ptr<base::win::PEImageAsData> disk_peimage_ptr_;
90 scoped_ptr<base::win::PEImage> mem_peimage_ptr_;
91 };
92
93 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleUnmodified) {
94 std::set<std::string> modified_exports;
95 // Call VerifyModule before the module has been loaded, should fail.
96 EXPECT_EQ(MODULE_STATE_UNKNOWN,
97 VerifyModule(kTestDllName, &modified_exports));
98 EXPECT_EQ(0, modified_exports.size());
99
100 // On loading, the module should be identical (up to relocations) in memory as
101 // on disk.
102 SetUpTestDllAndPEImages();
103 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
104 VerifyModule(kTestDllName, &modified_exports));
105 EXPECT_EQ(0, modified_exports.size());
106 }
107
108 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleModified) {
109 std::set<std::string> modified_exports;
110 // Confirm the module is identical in memory as on disk before we begin.
111 SetUpTestDllAndPEImages();
112 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
113 VerifyModule(kTestDllName, &modified_exports));
114
115 uint8_t* mem_code_addr = NULL;
116 uint8_t* disk_code_addr = NULL;
117 uint32_t code_size = 0;
118 EXPECT_TRUE(GetCodeAddrsAndSize(*mem_peimage_ptr_,
119 *disk_peimage_ptr_,
120 &mem_code_addr,
121 &disk_code_addr,
122 &code_size));
123
124 // Edit the first byte of the code section of the module (this may be before
125 // the address of any export).
126 uint8_t new_val = (*mem_code_addr) + 1;
127 SIZE_T bytes_written = 0;
128 WriteProcessMemory(GetCurrentProcess(),
129 mem_code_addr,
130 reinterpret_cast<void*>(&new_val),
131 1,
132 &bytes_written);
133 EXPECT_EQ(1, bytes_written);
134
135 // VerifyModule should detect the change.
136 EXPECT_EQ(MODULE_STATE_MODIFIED,
137 VerifyModule(kTestDllName, &modified_exports));
138 }
139
140 TEST_F(SafeBrowsingModuleVerifierWinTest, VerifyModuleExportModified) {
141 std::set<std::string> modified_exports;
142 // Confirm the module is identical in memory as on disk before we begin.
143 SetUpTestDllAndPEImages();
144 EXPECT_EQ(MODULE_STATE_UNMODIFIED,
145 VerifyModule(kTestDllName, &modified_exports));
146 modified_exports.clear();
147
148 // Edit the exported function, VerifyModule should now return the function
149 // name in modified_exports.
150 EditExport();
151 EXPECT_EQ(MODULE_STATE_MODIFIED,
152 VerifyModule(kTestDllName, &modified_exports));
153 EXPECT_EQ(1, modified_exports.size());
154 EXPECT_EQ(0, std::string(kTestExportName).compare(*modified_exports.begin()));
155 }
156
157 } // namespace safe_browsing
OLDNEW
« no previous file with comments | « trunk/src/chrome/browser/safe_browsing/module_integrity_verifier_win.cc ('k') | trunk/src/chrome/chrome_browser.gypi » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698