security/sandbox/win/src/resolver.h

Wed, 31 Dec 2014 06:09:35 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Wed, 31 Dec 2014 06:09:35 +0100
changeset 0
6474c204b198
permissions
-rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

michael@0 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
michael@0 2 // Use of this source code is governed by a BSD-style license that can be
michael@0 3 // found in the LICENSE file.
michael@0 4
michael@0 5 // Defines ResolverThunk, the interface for classes that perform interceptions.
michael@0 6 // For more details see
michael@0 7 // http://dev.chromium.org/developers/design-documents/sandbox .
michael@0 8
michael@0 9 #include "base/basictypes.h"
michael@0 10 #include "sandbox/win/src/nt_internals.h"
michael@0 11
michael@0 12 #ifndef SANDBOX_SRC_RESOLVER_H__
michael@0 13 #define SANDBOX_SRC_RESOLVER_H__
michael@0 14
michael@0 15 namespace sandbox {
michael@0 16
michael@0 17 // A resolver is the object in charge of performing the actual interception of
michael@0 18 // a function. There should be a concrete implementation of a resolver roughly
michael@0 19 // per type of interception.
michael@0 20 class ResolverThunk {
michael@0 21 public:
michael@0 22 ResolverThunk() {}
michael@0 23 virtual ~ResolverThunk() {}
michael@0 24
michael@0 25 // Performs the actual interception of a function.
michael@0 26 // target_name is an exported function from the module loaded at
michael@0 27 // target_module, and must be replaced by interceptor_name, exported from
michael@0 28 // interceptor_module. interceptor_entry_point can be provided instead of
michael@0 29 // interceptor_name / interceptor_module.
michael@0 30 // thunk_storage must point to a buffer on the child's address space, to hold
michael@0 31 // the patch thunk, and related data. If provided, storage_used will receive
michael@0 32 // the number of bytes used from thunk_storage.
michael@0 33 //
michael@0 34 // Example: (without error checking)
michael@0 35 //
michael@0 36 // size_t size = resolver.GetThunkSize();
michael@0 37 // char* buffer = ::VirtualAllocEx(child_process, NULL, size,
michael@0 38 // MEM_COMMIT, PAGE_READWRITE);
michael@0 39 // resolver.Setup(ntdll_module, NULL, L"NtCreateFile", NULL,
michael@0 40 // &MyReplacementFunction, buffer, size, NULL);
michael@0 41 //
michael@0 42 // In general, the idea is to allocate a single big buffer for all
michael@0 43 // interceptions on the same dll, and call Setup n times.
michael@0 44 // WARNING: This means that any data member that is specific to a single
michael@0 45 // interception must be reset within this method.
michael@0 46 virtual NTSTATUS Setup(const void* target_module,
michael@0 47 const void* interceptor_module,
michael@0 48 const char* target_name,
michael@0 49 const char* interceptor_name,
michael@0 50 const void* interceptor_entry_point,
michael@0 51 void* thunk_storage,
michael@0 52 size_t storage_bytes,
michael@0 53 size_t* storage_used) = 0;
michael@0 54
michael@0 55 // Gets the address of function_name inside module (main exe).
michael@0 56 virtual NTSTATUS ResolveInterceptor(const void* module,
michael@0 57 const char* function_name,
michael@0 58 const void** address);
michael@0 59
michael@0 60 // Gets the address of an exported function_name inside module.
michael@0 61 virtual NTSTATUS ResolveTarget(const void* module,
michael@0 62 const char* function_name,
michael@0 63 void** address);
michael@0 64
michael@0 65 // Gets the required buffer size for this type of thunk.
michael@0 66 virtual size_t GetThunkSize() const = 0;
michael@0 67
michael@0 68 protected:
michael@0 69 // Performs basic initialization on behalf of a concrete instance of a
michael@0 70 // resolver. That is, parameter validation and resolution of the target
michael@0 71 // and the interceptor into the member variables.
michael@0 72 //
michael@0 73 // target_name is an exported function from the module loaded at
michael@0 74 // target_module, and must be replaced by interceptor_name, exported from
michael@0 75 // interceptor_module. interceptor_entry_point can be provided instead of
michael@0 76 // interceptor_name / interceptor_module.
michael@0 77 // thunk_storage must point to a buffer on the child's address space, to hold
michael@0 78 // the patch thunk, and related data.
michael@0 79 virtual NTSTATUS Init(const void* target_module,
michael@0 80 const void* interceptor_module,
michael@0 81 const char* target_name,
michael@0 82 const char* interceptor_name,
michael@0 83 const void* interceptor_entry_point,
michael@0 84 void* thunk_storage,
michael@0 85 size_t storage_bytes);
michael@0 86
michael@0 87 // Gets the required buffer size for the internal part of the thunk.
michael@0 88 size_t GetInternalThunkSize() const;
michael@0 89
michael@0 90 // Initializes the internal part of the thunk.
michael@0 91 // interceptor is the function to be called instead of original_function.
michael@0 92 bool SetInternalThunk(void* storage, size_t storage_bytes,
michael@0 93 const void* original_function, const void* interceptor);
michael@0 94
michael@0 95 // Holds the resolved interception target.
michael@0 96 void* target_;
michael@0 97 // Holds the resolved interception interceptor.
michael@0 98 const void* interceptor_;
michael@0 99
michael@0 100 DISALLOW_COPY_AND_ASSIGN(ResolverThunk);
michael@0 101 };
michael@0 102
michael@0 103 } // namespace sandbox
michael@0 104
michael@0 105 #endif // SANDBOX_SRC_RESOLVER_H__

mercurial