| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/safe_browsing/module_integrity_verifier_win.h" | |
| 6 | |
| 7 #include "base/containers/hash_tables.h" | |
| 8 #include "base/files/file_path.h" | |
| 9 #include "base/files/memory_mapped_file.h" | |
| 10 #include "base/metrics/sparse_histogram.h" | |
| 11 #include "base/scoped_native_library.h" | |
| 12 #include "base/win/pe_image.h" | |
| 13 #include "build/build_config.h" | |
| 14 | |
| 15 namespace safe_browsing { | |
| 16 | |
| 17 struct ModuleVerificationState { | |
| 18 explicit ModuleVerificationState(HMODULE hModule); | |
| 19 ~ModuleVerificationState(); | |
| 20 | |
| 21 base::win::PEImageAsData disk_peimage; | |
| 22 | |
| 23 // The module's preferred base address minus the base address it actually | |
| 24 // loaded at. | |
| 25 intptr_t image_base_delta; | |
| 26 | |
| 27 // The location of the disk_peimage module's code section minus that of the | |
| 28 // mem_peimage module's code section. | |
| 29 intptr_t code_section_delta; | |
| 30 | |
| 31 // The bytes corrected by relocs. | |
| 32 base::hash_set<uintptr_t> reloc_addr; | |
| 33 | |
| 34 // Set true if the relocation table contains a reloc of type that we don't | |
| 35 // currently handle. | |
| 36 bool unknown_reloc_type; | |
| 37 | |
| 38 private: | |
| 39 DISALLOW_COPY_AND_ASSIGN(ModuleVerificationState); | |
| 40 }; | |
| 41 | |
| 42 ModuleVerificationState::ModuleVerificationState(HMODULE hModule) | |
| 43 : disk_peimage(hModule), | |
| 44 image_base_delta(0), | |
| 45 code_section_delta(0), | |
| 46 reloc_addr(), | |
| 47 unknown_reloc_type(false) { | |
| 48 } | |
| 49 | |
| 50 ModuleVerificationState::~ModuleVerificationState() { | |
| 51 } | |
| 52 | |
| 53 namespace { | |
| 54 | |
| 55 struct Export { | |
| 56 Export(void* addr, const std::string& name); | |
| 57 ~Export(); | |
| 58 | |
| 59 bool operator<(const Export& other) const; | |
| 60 | |
| 61 void* addr; | |
| 62 std::string name; | |
| 63 }; | |
| 64 | |
| 65 Export::Export(void* addr, const std::string& name) : addr(addr), name(name) { | |
| 66 } | |
| 67 | |
| 68 Export::~Export() { | |
| 69 } | |
| 70 | |
| 71 bool Export::operator<(const Export& other) const { | |
| 72 return addr < other.addr; | |
| 73 } | |
| 74 | |
| 75 bool ByteAccountedForByReloc(uint8_t* byte_addr, | |
| 76 const ModuleVerificationState& state) { | |
| 77 return ((state.reloc_addr.count(reinterpret_cast<uintptr_t>(byte_addr))) > 0); | |
| 78 } | |
| 79 | |
| 80 // Checks each byte in the module's code section again the corresponding byte on | |
| 81 // disk, returning the number of bytes differing between the two. Also adds the | |
| 82 // names of any modfied functions exported by name to |modified_exports|. | |
| 83 // |exports| must be sorted. | |
| 84 int ExamineBytesDiffInMemory(uint8_t* disk_code_start, | |
| 85 uint8_t* mem_code_start, | |
| 86 uint32_t code_size, | |
| 87 const std::vector<Export>& exports, | |
| 88 const ModuleVerificationState& state, | |
| 89 std::set<std::string>* modified_exports) { | |
| 90 int bytes_different = 0; | |
| 91 std::vector<Export>::const_iterator export_it = exports.begin(); | |
| 92 | |
| 93 for (uint8_t* end = mem_code_start + code_size; mem_code_start != end; | |
| 94 ++mem_code_start) { | |
| 95 if ((*disk_code_start++ != *mem_code_start) && | |
| 96 !ByteAccountedForByReloc(mem_code_start, state)) { | |
| 97 // We get the largest export address still smaller than |addr|. It is | |
| 98 // possible that |addr| belongs to some nonexported function located | |
| 99 // between this export and the following one. | |
| 100 Export addr(reinterpret_cast<void*>(mem_code_start), std::string()); | |
| 101 std::vector<Export>::const_iterator modified_export_it = | |
| 102 std::upper_bound(export_it, exports.end(), addr); | |
| 103 | |
| 104 if (modified_export_it != exports.begin()) | |
| 105 modified_exports->insert((modified_export_it - 1)->name); | |
| 106 ++bytes_different; | |
| 107 | |
| 108 // No later byte can belong to an earlier export. | |
| 109 export_it = modified_export_it; | |
| 110 } | |
| 111 } | |
| 112 return bytes_different; | |
| 113 } | |
| 114 | |
| 115 // Adds to |state->reloc_addr| the bytes of the pointer at |address| that are | |
| 116 // corrected by adding |image_base_delta|. | |
| 117 void AddBytesCorrectedByReloc(uintptr_t address, | |
| 118 ModuleVerificationState* state) { | |
| 119 #if defined(ARCH_CPU_LITTLE_ENDIAN) | |
| 120 # define OFFSET(i) i | |
| 121 #else | |
| 122 # define OFFSET(i) (sizeof(uintptr_t) - i) | |
| 123 #endif | |
| 124 | |
| 125 uintptr_t orig_mem_value = *reinterpret_cast<uintptr_t*>(address); | |
| 126 uintptr_t fixed_mem_value = orig_mem_value + state->image_base_delta; | |
| 127 uintptr_t disk_value = | |
| 128 *reinterpret_cast<uintptr_t*>(address + state->code_section_delta); | |
| 129 | |
| 130 uintptr_t diff_before = orig_mem_value ^ disk_value; | |
| 131 uintptr_t shared_after = ~(fixed_mem_value ^ disk_value); | |
| 132 int i = 0; | |
| 133 for (uintptr_t fixed = diff_before & shared_after; fixed; fixed >>= 8, ++i) { | |
| 134 if (fixed & 0xFF) | |
| 135 state->reloc_addr.insert(address + OFFSET(i)); | |
| 136 } | |
| 137 #undef OFFSET | |
| 138 } | |
| 139 | |
| 140 bool AddrIsInCodeSection(void* address, | |
| 141 uint8_t* code_addr, | |
| 142 uint32_t code_size) { | |
| 143 return (code_addr <= address && address < code_addr + code_size); | |
| 144 } | |
| 145 | |
| 146 bool EnumRelocsCallback(const base::win::PEImage& mem_peimage, | |
| 147 WORD type, | |
| 148 void* address, | |
| 149 void* cookie) { | |
| 150 ModuleVerificationState* state = | |
| 151 reinterpret_cast<ModuleVerificationState*>(cookie); | |
| 152 | |
| 153 uint8_t* mem_code_addr = NULL; | |
| 154 uint8_t* disk_code_addr = NULL; | |
| 155 uint32_t code_size = 0; | |
| 156 if (!GetCodeAddrsAndSize(mem_peimage, | |
| 157 state->disk_peimage, | |
| 158 &mem_code_addr, | |
| 159 &disk_code_addr, | |
| 160 &code_size)) | |
| 161 return false; | |
| 162 | |
| 163 // If not in the code section return true to continue to the next reloc. | |
| 164 if (!AddrIsInCodeSection(address, mem_code_addr, code_size)) | |
| 165 return true; | |
| 166 | |
| 167 UMA_HISTOGRAM_SPARSE_SLOWLY("SafeBrowsing.ModuleBaseRelocation", type); | |
| 168 | |
| 169 switch (type) { | |
| 170 case IMAGE_REL_BASED_HIGHLOW: { | |
| 171 AddBytesCorrectedByReloc(reinterpret_cast<uintptr_t>(address), state); | |
| 172 break; | |
| 173 } | |
| 174 case IMAGE_REL_BASED_ABSOLUTE: | |
| 175 // Absolute type relocations are a noop, sometimes used to pad a section | |
| 176 // of relocations. | |
| 177 break; | |
| 178 default: { | |
| 179 // TODO(robertshield): Find a reliable description of the behaviour of the | |
| 180 // remaining types of relocation and handle them. | |
| 181 state->unknown_reloc_type = true; | |
| 182 break; | |
| 183 } | |
| 184 } | |
| 185 return true; | |
| 186 } | |
| 187 | |
| 188 bool EnumExportsCallback(const base::win::PEImage& mem_peimage, | |
| 189 DWORD ordinal, | |
| 190 DWORD hint, | |
| 191 LPCSTR name, | |
| 192 PVOID function_addr, | |
| 193 LPCSTR forward, | |
| 194 PVOID cookie) { | |
| 195 std::vector<Export>* exports = reinterpret_cast<std::vector<Export>*>(cookie); | |
| 196 if (name) | |
| 197 exports->push_back(Export(function_addr, std::string(name))); | |
| 198 return true; | |
| 199 } | |
| 200 | |
| 201 } // namespace | |
| 202 | |
| 203 bool GetCodeAddrsAndSize(const base::win::PEImage& mem_peimage, | |
| 204 const base::win::PEImageAsData& disk_peimage, | |
| 205 uint8_t** mem_code_addr, | |
| 206 uint8_t** disk_code_addr, | |
| 207 uint32_t* code_size) { | |
| 208 DWORD base_of_code = mem_peimage.GetNTHeaders()->OptionalHeader.BaseOfCode; | |
| 209 | |
| 210 // Get the address and size of the code section in the loaded module image. | |
| 211 PIMAGE_SECTION_HEADER mem_code_header = | |
| 212 mem_peimage.GetImageSectionFromAddr(mem_peimage.RVAToAddr(base_of_code)); | |
| 213 if (mem_code_header == NULL) | |
| 214 return false; | |
| 215 *mem_code_addr = reinterpret_cast<uint8_t*>( | |
| 216 mem_peimage.RVAToAddr(mem_code_header->VirtualAddress)); | |
| 217 // If the section is padded with zeros when mapped then |VirtualSize| can be | |
| 218 // larger. Alternatively, |SizeOfRawData| can be rounded up to align | |
| 219 // according to OptionalHeader.FileAlignment. | |
| 220 *code_size = std::min(mem_code_header->Misc.VirtualSize, | |
| 221 mem_code_header->SizeOfRawData); | |
| 222 | |
| 223 // Get the address of the code section in the module mapped as data from disk. | |
| 224 DWORD disk_code_offset = 0; | |
| 225 if (!mem_peimage.ImageAddrToOnDiskOffset( | |
| 226 reinterpret_cast<void*>(*mem_code_addr), &disk_code_offset)) | |
| 227 return false; | |
| 228 *disk_code_addr = | |
| 229 reinterpret_cast<uint8_t*>(disk_peimage.module()) + disk_code_offset; | |
| 230 return true; | |
| 231 } | |
| 232 | |
| 233 ModuleState VerifyModule(const wchar_t* module_name, | |
| 234 std::set<std::string>* modified_exports) { | |
| 235 // Get module handle, load a copy from disk as data and create PEImages. | |
| 236 HMODULE module_handle = NULL; | |
| 237 if (!GetModuleHandleEx(0, module_name, &module_handle)) | |
| 238 return MODULE_STATE_UNKNOWN; | |
| 239 base::ScopedNativeLibrary native_library(module_handle); | |
| 240 | |
| 241 WCHAR module_path[MAX_PATH] = {}; | |
| 242 DWORD length = | |
| 243 GetModuleFileName(module_handle, module_path, arraysize(module_path)); | |
| 244 if (!length || length == arraysize(module_path)) | |
| 245 return MODULE_STATE_UNKNOWN; | |
| 246 | |
| 247 base::MemoryMappedFile mapped_module; | |
| 248 if (!mapped_module.Initialize(base::FilePath(module_path))) | |
| 249 return MODULE_STATE_UNKNOWN; | |
| 250 ModuleVerificationState state( | |
| 251 reinterpret_cast<HMODULE>(const_cast<uint8*>(mapped_module.data()))); | |
| 252 | |
| 253 base::win::PEImage mem_peimage(module_handle); | |
| 254 if (!mem_peimage.VerifyMagic() || !state.disk_peimage.VerifyMagic()) | |
| 255 return MODULE_STATE_UNKNOWN; | |
| 256 | |
| 257 // Get the list of exports. | |
| 258 std::vector<Export> exports; | |
| 259 mem_peimage.EnumExports(EnumExportsCallback, &exports); | |
| 260 std::sort(exports.begin(), exports.end()); | |
| 261 | |
| 262 // Get the addresses of the code sections then calculate |code_section_delta| | |
| 263 // and |image_base_delta|. | |
| 264 uint8_t* mem_code_addr = NULL; | |
| 265 uint8_t* disk_code_addr = NULL; | |
| 266 uint32_t code_size = 0; | |
| 267 if (!GetCodeAddrsAndSize(mem_peimage, | |
| 268 state.disk_peimage, | |
| 269 &mem_code_addr, | |
| 270 &disk_code_addr, | |
| 271 &code_size)) | |
| 272 return MODULE_STATE_UNKNOWN; | |
| 273 | |
| 274 state.code_section_delta = disk_code_addr - mem_code_addr; | |
| 275 | |
| 276 uint8_t* preferred_image_base = reinterpret_cast<uint8_t*>( | |
| 277 state.disk_peimage.GetNTHeaders()->OptionalHeader.ImageBase); | |
| 278 state.image_base_delta = | |
| 279 preferred_image_base - reinterpret_cast<uint8_t*>(mem_peimage.module()); | |
| 280 | |
| 281 // Get the relocations. | |
| 282 mem_peimage.EnumRelocs(EnumRelocsCallback, &state); | |
| 283 if (state.unknown_reloc_type) | |
| 284 return MODULE_STATE_UNKNOWN; | |
| 285 | |
| 286 // Count the modified bytes (after accounting for relocs) and get the set of | |
| 287 // modified functions. | |
| 288 int num_bytes_different = ExamineBytesDiffInMemory(disk_code_addr, | |
| 289 mem_code_addr, | |
| 290 code_size, | |
| 291 exports, | |
| 292 state, | |
| 293 modified_exports); | |
| 294 | |
| 295 return num_bytes_different ? MODULE_STATE_MODIFIED : MODULE_STATE_UNMODIFIED; | |
| 296 } | |
| 297 | |
| 298 } // namespace safe_browsing | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 470213002:
Moving all the incident reporting stuff to a common folder (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@binsign