Index: chrome/browser/safe_browsing/environment_data_collection_win_unittest.cc |
diff --git a/chrome/browser/safe_browsing/environment_data_collection_win_unittest.cc b/chrome/browser/safe_browsing/environment_data_collection_win_unittest.cc |
deleted file mode 100644 |
index 619498c59f8653065098cba0ec3bcffc1182d7ad..0000000000000000000000000000000000000000 |
--- a/chrome/browser/safe_browsing/environment_data_collection_win_unittest.cc |
+++ /dev/null |
@@ -1,218 +0,0 @@ |
-// Copyright 2014 The Chromium Authors. All rights reserved. |
-// Use of this source code is governed by a BSD-style license that can be |
-// found in the LICENSE file. |
- |
-#include "chrome/browser/safe_browsing/environment_data_collection_win.h" |
- |
-#include <string> |
- |
-#include "base/base_paths.h" |
-#include "base/files/file_path.h" |
-#include "base/path_service.h" |
-#include "base/scoped_native_library.h" |
-#include "base/strings/utf_string_conversions.h" |
-#include "base/test/test_reg_util_win.h" |
-#include "base/win/registry.h" |
-#include "chrome/browser/safe_browsing/module_integrity_unittest_util_win.h" |
-#include "chrome/browser/safe_browsing/module_integrity_verifier_win.h" |
-#include "chrome/browser/safe_browsing/path_sanitizer.h" |
-#include "chrome/common/safe_browsing/csd.pb.h" |
-#include "chrome_elf/chrome_elf_constants.h" |
-#include "net/base/winsock_init.h" |
-#include "testing/gtest/include/gtest/gtest.h" |
- |
-namespace { |
- |
-const wchar_t test_dll[] = L"test_name.dll"; |
- |
-// Helper function that returns true if a dll with filename |dll_name| is |
-// found in |process_report|. |
-bool ProcessReportContainsDll( |
- const safe_browsing::ClientIncidentReport_EnvironmentData_Process& |
- process_report, |
- const base::FilePath& dll_name) { |
- for (int i = 0; i < process_report.dll_size(); ++i) { |
- base::FilePath current_dll = |
- base::FilePath::FromUTF8Unsafe(process_report.dll(i).path()); |
- |
- if (current_dll.BaseName() == dll_name) |
- return true; |
- } |
- |
- return false; |
-} |
- |
-// Look through dll entries and check for the presence of the LSP feature for |
-// |dll|. |
-bool DllEntryContainsLspFeature( |
- const safe_browsing::ClientIncidentReport_EnvironmentData_Process& |
- process_report, |
- const std::string& dll) { |
- for (int i = 0; i < process_report.dll_size(); ++i) { |
- if (process_report.dll(i).path() == dll) { |
- // Verify each feature of |dll|. |
- for (int j = 0; j < process_report.dll(i).feature_size(); ++j) { |
- if (process_report.dll(i).feature(j) == |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process_Dll:: |
- LSP) |
- // LSP feature found. |
- return true; |
- } |
- } |
- } |
- |
- return false; |
-} |
- |
-} // namespace |
- |
-TEST(SafeBrowsingEnvironmentDataCollectionWinTest, CollectDlls) { |
- // This test will check if the CollectDlls method works by loading |
- // a dll and then checking if we can find it within the process report. |
- // Pick msvidc32.dll as it is present from WinXP to Win8 and yet rarely used. |
- // msvidc32.dll exists in both 32 and 64 bit versions. |
- base::FilePath msvdc32_dll(L"msvidc32.dll"); |
- |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report; |
- safe_browsing::CollectDlls(&process_report); |
- |
- ASSERT_FALSE(ProcessReportContainsDll(process_report, msvdc32_dll)); |
- |
- // Redo the same verification after loading a new dll. |
- base::ScopedNativeLibrary library(msvdc32_dll); |
- |
- process_report.clear_dll(); |
- safe_browsing::CollectDlls(&process_report); |
- |
- ASSERT_TRUE(ProcessReportContainsDll(process_report, msvdc32_dll)); |
-} |
- |
-TEST(SafeBrowsingEnvironmentDataCollectionWinTest, RecordLspFeature) { |
- net::EnsureWinsockInit(); |
- |
- // Populate our incident report with loaded modules. |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report; |
- safe_browsing::CollectDlls(&process_report); |
- |
- // We'll test RecordLspFeatures against a real dll registered as a LSP. All |
- // dll paths are expected to be lowercase in the process report. |
- std::string lsp = "c:\\windows\\system32\\mswsock.dll"; |
- int base_address = 0x77770000; |
- int length = 0x180000; |
- |
- safe_browsing::RecordLspFeature(&process_report); |
- |
- // Return successfully if LSP feature is found. |
- if (DllEntryContainsLspFeature(process_report, lsp)) |
- return; |
- |
- // |lsp| was not already loaded into the current process. Manually add it |
- // to the process report so that it will get marked as a LSP. |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process_Dll* dll = |
- process_report.add_dll(); |
- dll->set_path(lsp); |
- dll->set_base_address(base_address); |
- dll->set_length(length); |
- |
- safe_browsing::RecordLspFeature(&process_report); |
- |
- // Return successfully if LSP feature is found. |
- if (DllEntryContainsLspFeature(process_report, lsp)) |
- return; |
- |
- FAIL() << "No LSP feature found for " << lsp; |
-} |
- |
-TEST(SafeBrowsingEnvironmentDataCollectionWinTest, CollectDllBlacklistData) { |
- // Ensure that CollectDllBlacklistData correctly adds the set of sanitized dll |
- // names currently stored in the registry to the report. |
- registry_util::RegistryOverrideManager override_manager; |
- override_manager.OverrideRegistry(HKEY_CURRENT_USER, L"safe_browsing_test"); |
- |
- base::win::RegKey blacklist_registry_key(HKEY_CURRENT_USER, |
- blacklist::kRegistryFinchListPath, |
- KEY_QUERY_VALUE | KEY_SET_VALUE); |
- |
- // Check that with an empty registry the blacklisted dlls field is left empty. |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report; |
- safe_browsing::CollectDllBlacklistData(&process_report); |
- EXPECT_EQ(0, process_report.blacklisted_dll_size()); |
- |
- // Check that after adding exactly one dll to the registry it appears in the |
- // process report. |
- blacklist_registry_key.WriteValue(test_dll, test_dll); |
- safe_browsing::CollectDllBlacklistData(&process_report); |
- ASSERT_EQ(1, process_report.blacklisted_dll_size()); |
- |
- base::string16 process_report_dll = |
- base::UTF8ToWide(process_report.blacklisted_dll(0)); |
- EXPECT_EQ(base::string16(test_dll), process_report_dll); |
- |
- // Check that if the registry contains the full path to a dll it is properly |
- // sanitized before being reported. |
- blacklist_registry_key.DeleteValue(test_dll); |
- process_report.clear_blacklisted_dll(); |
- |
- base::FilePath path; |
- ASSERT_TRUE(PathService::Get(base::DIR_HOME, &path)); |
- base::string16 input_path = |
- path.Append(FILE_PATH_LITERAL("test_path.dll")).value(); |
- |
- std::string path_expected = base::FilePath(FILE_PATH_LITERAL("~")) |
- .Append(FILE_PATH_LITERAL("test_path.dll")) |
- .AsUTF8Unsafe(); |
- |
- blacklist_registry_key.WriteValue(input_path.c_str(), input_path.c_str()); |
- safe_browsing::CollectDllBlacklistData(&process_report); |
- |
- ASSERT_EQ(1, process_report.blacklisted_dll_size()); |
- std::string process_report_path = process_report.blacklisted_dll(0); |
- EXPECT_EQ(path_expected, process_report_path); |
-} |
- |
-TEST(SafeBrowsingEnvironmentDataCollectionWinTest, VerifyLoadedModules) { |
- // Load the test modules. |
- std::vector<base::ScopedNativeLibrary> test_dlls( |
- safe_browsing::kTestDllNamesCount); |
- for (size_t i = 0; i < safe_browsing::kTestDllNamesCount; ++i) { |
- test_dlls[i].Reset(LoadNativeLibrary( |
- base::FilePath(safe_browsing::kTestDllNames[i]), NULL)); |
- } |
- |
- // Edit the first byte of the function exported by the first module. |
- HMODULE module_handle = GetModuleHandle(safe_browsing::kTestDllNames[0]); |
- EXPECT_NE(reinterpret_cast<HANDLE>(NULL), module_handle); |
- uint8_t* export_addr = reinterpret_cast<uint8_t*>( |
- GetProcAddress(module_handle, safe_browsing::kTestExportName)); |
- EXPECT_NE(reinterpret_cast<uint8_t*>(NULL), export_addr); |
- |
- uint8_t new_val = (*export_addr) + 1; |
- SIZE_T bytes_written = 0; |
- WriteProcessMemory(GetCurrentProcess(), |
- export_addr, |
- reinterpret_cast<void*>(&new_val), |
- 1, |
- &bytes_written); |
- EXPECT_EQ(1, bytes_written); |
- |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report; |
- safe_browsing::CollectModuleVerificationData( |
- safe_browsing::kTestDllNames, |
- safe_browsing::kTestDllNamesCount, |
- &process_report); |
- |
- // CollectModuleVerificationData should return the single modified module and |
- // its modified export. The other module, being unmodified, is omitted from |
- // the returned list of modules. |
- EXPECT_EQ(1, process_report.module_state_size()); |
- |
- EXPECT_EQ(base::WideToUTF8(std::wstring(safe_browsing::kTestDllNames[0])), |
- process_report.module_state(0).name()); |
- EXPECT_EQ( |
- safe_browsing::ClientIncidentReport_EnvironmentData_Process_ModuleState:: |
- MODULE_STATE_MODIFIED, |
- process_report.module_state(0).modified_state()); |
- EXPECT_EQ(1, process_report.module_state(0).modified_export_size()); |
- EXPECT_EQ(std::string(safe_browsing::kTestExportName), |
- process_report.module_state(0).modified_export(0)); |
-} |