OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/safe_browsing/incident_reporting/module_integrity_verif
ier_win.h" | 5 #include "chrome/browser/safe_browsing/incident_reporting/module_integrity_verif
ier_win.h" |
6 | 6 |
7 #include "base/containers/hash_tables.h" | 7 #include "base/containers/hash_tables.h" |
8 #include "base/files/file_path.h" | 8 #include "base/files/file_path.h" |
9 #include "base/files/memory_mapped_file.h" | 9 #include "base/files/memory_mapped_file.h" |
10 #include "base/metrics/sparse_histogram.h" | 10 #include "base/metrics/sparse_histogram.h" |
(...skipping 146 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
157 state->disk_peimage, | 157 state->disk_peimage, |
158 &mem_code_addr, | 158 &mem_code_addr, |
159 &disk_code_addr, | 159 &disk_code_addr, |
160 &code_size)) | 160 &code_size)) |
161 return false; | 161 return false; |
162 | 162 |
163 // If not in the code section return true to continue to the next reloc. | 163 // If not in the code section return true to continue to the next reloc. |
164 if (!AddrIsInCodeSection(address, mem_code_addr, code_size)) | 164 if (!AddrIsInCodeSection(address, mem_code_addr, code_size)) |
165 return true; | 165 return true; |
166 | 166 |
167 UMA_HISTOGRAM_SPARSE_SLOWLY("SafeBrowsing.ModuleBaseRelocation", type); | |
168 | |
169 switch (type) { | 167 switch (type) { |
170 case IMAGE_REL_BASED_HIGHLOW: { | 168 case IMAGE_REL_BASED_ABSOLUTE: // 0 |
171 AddBytesCorrectedByReloc(reinterpret_cast<uintptr_t>(address), state); | |
172 break; | |
173 } | |
174 case IMAGE_REL_BASED_ABSOLUTE: | |
175 // Absolute type relocations are a noop, sometimes used to pad a section | 169 // Absolute type relocations are a noop, sometimes used to pad a section |
176 // of relocations. | 170 // of relocations. |
177 break; | 171 break; |
178 default: { | 172 case IMAGE_REL_BASED_HIGHLOW: // 3 |
| 173 // The base relocation applies all 32 bits of the difference to the 32-bit |
| 174 // field at offset. |
| 175 AddBytesCorrectedByReloc(reinterpret_cast<uintptr_t>(address), state); |
| 176 break; |
| 177 case IMAGE_REL_BASED_DIR64: // 10 |
| 178 // The base relocation applies the difference to the 64-bit field at |
| 179 // offset. |
| 180 // TODO(robertshield): Handle this type of reloc. |
| 181 break; |
| 182 default: |
179 // TODO(robertshield): Find a reliable description of the behaviour of the | 183 // TODO(robertshield): Find a reliable description of the behaviour of the |
180 // remaining types of relocation and handle them. | 184 // remaining types of relocation and handle them. |
| 185 UMA_HISTOGRAM_SPARSE_SLOWLY("SafeBrowsing.ModuleBaseRelocation", type); |
181 state->unknown_reloc_type = true; | 186 state->unknown_reloc_type = true; |
182 break; | 187 break; |
183 } | |
184 } | 188 } |
185 return true; | 189 return true; |
186 } | 190 } |
187 | 191 |
188 bool EnumExportsCallback(const base::win::PEImage& mem_peimage, | 192 bool EnumExportsCallback(const base::win::PEImage& mem_peimage, |
189 DWORD ordinal, | 193 DWORD ordinal, |
190 DWORD hint, | 194 DWORD hint, |
191 LPCSTR name, | 195 LPCSTR name, |
192 PVOID function_addr, | 196 PVOID function_addr, |
193 LPCSTR forward, | 197 LPCSTR forward, |
(...skipping 95 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
289 mem_code_addr, | 293 mem_code_addr, |
290 code_size, | 294 code_size, |
291 exports, | 295 exports, |
292 state, | 296 state, |
293 modified_exports); | 297 modified_exports); |
294 | 298 |
295 return num_bytes_different ? MODULE_STATE_MODIFIED : MODULE_STATE_UNMODIFIED; | 299 return num_bytes_different ? MODULE_STATE_MODIFIED : MODULE_STATE_UNMODIFIED; |
296 } | 300 } |
297 | 301 |
298 } // namespace safe_browsing | 302 } // namespace safe_browsing |
OLD | NEW |