security/sandbox/win/src/resolver_32.cc@6474c204b198 (annotated)
security/sandbox/win/src/resolver_32.cc
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved. |
| michael@0 | 2 | // Use of this source code is governed by a BSD-style license that can be |
| michael@0 | 3 | // found in the LICENSE file. |
| michael@0 | 4 | |
| michael@0 | 5 | #include "sandbox/win/src/resolver.h" |
| michael@0 | 6 | |
| michael@0 | 7 | #include "sandbox/win/src/sandbox_nt_util.h" |
| michael@0 | 8 | |
| michael@0 | 9 | namespace { |
| michael@0 | 10 | |
| michael@0 | 11 | #pragma pack(push, 1) |
| michael@0 | 12 | struct InternalThunk { |
| michael@0 | 13 | // This struct contains roughly the following code: |
| michael@0 | 14 | // sub esp, 8 // Create working space |
| michael@0 | 15 | // push edx // Save register |
| michael@0 | 16 | // mov edx, [esp + 0xc] // Get return adddress |
| michael@0 | 17 | // mov [esp + 8], edx // Store return address |
| michael@0 | 18 | // mov dword ptr [esp + 0xc], 0x7c401200 // Store extra argument |
| michael@0 | 19 | // mov dword ptr [esp + 4], 0x40010203 // Store address to jump to |
| michael@0 | 20 | // pop edx // Restore register |
| michael@0 | 21 | // ret // Jump to interceptor |
| michael@0 | 22 | // |
| michael@0 | 23 | // This code only modifies esp and eip so it must work with to normal calling |
| michael@0 | 24 | // convention. It is assembled as: |
| michael@0 | 25 | // |
| michael@0 | 26 | // 00 83ec08 sub esp,8 |
| michael@0 | 27 | // 03 52 push edx |
| michael@0 | 28 | // 04 8b54240c mov edx,dword ptr [esp + 0Ch] |
| michael@0 | 29 | // 08 89542408 mov dword ptr [esp + 8], edx |
| michael@0 | 30 | // 0c c744240c0012407c mov dword ptr [esp + 0Ch], 7C401200h |
| michael@0 | 31 | // 14 c744240403020140 mov dword ptr [esp + 4], 40010203h |
| michael@0 | 32 | // 1c 5a pop edx |
| michael@0 | 33 | // 1d c3 ret |
| michael@0 | 34 | InternalThunk() { |
| michael@0 | 35 | opcodes_1 = 0x5208ec83; |
| michael@0 | 36 | opcodes_2 = 0x0c24548b; |
| michael@0 | 37 | opcodes_3 = 0x08245489; |
| michael@0 | 38 | opcodes_4 = 0x0c2444c7; |
| michael@0 | 39 | opcodes_5 = 0x042444c7; |
| michael@0 | 40 | opcodes_6 = 0xc35a; |
| michael@0 | 41 | extra_argument = 0; |
| michael@0 | 42 | interceptor_function = 0; |
| michael@0 | 43 | }; |
| michael@0 | 44 | ULONG opcodes_1; // = 0x5208ec83 |
| michael@0 | 45 | ULONG opcodes_2; // = 0x0c24548b |
| michael@0 | 46 | ULONG opcodes_3; // = 0x08245489 |
| michael@0 | 47 | ULONG opcodes_4; // = 0x0c2444c7 |
| michael@0 | 48 | ULONG extra_argument; |
| michael@0 | 49 | ULONG opcodes_5; // = 0x042444c7 |
| michael@0 | 50 | ULONG interceptor_function; |
| michael@0 | 51 | USHORT opcodes_6; // = 0xc35a |
| michael@0 | 52 | }; |
| michael@0 | 53 | #pragma pack(pop) |
| michael@0 | 54 | |
| michael@0 | 55 | }; // namespace |
| michael@0 | 56 | |
| michael@0 | 57 | namespace sandbox { |
| michael@0 | 58 | |
| michael@0 | 59 | bool ResolverThunk::SetInternalThunk(void* storage, size_t storage_bytes, |
| michael@0 | 60 | const void* original_function, |
| michael@0 | 61 | const void* interceptor) { |
| michael@0 | 62 | if (storage_bytes < sizeof(InternalThunk)) |
| michael@0 | 63 | return false; |
| michael@0 | 64 | |
| michael@0 | 65 | InternalThunk* thunk = new(storage, NT_PLACE) InternalThunk; |
| michael@0 | 66 | |
| michael@0 | 67 | #pragma warning(push) |
| michael@0 | 68 | #pragma warning(disable: 4311) |
| michael@0 | 69 | // These casts generate warnings because they are 32 bit specific. |
| michael@0 | 70 | thunk->interceptor_function = reinterpret_cast<ULONG>(interceptor); |
| michael@0 | 71 | thunk->extra_argument = reinterpret_cast<ULONG>(original_function); |
| michael@0 | 72 | #pragma warning(pop) |
| michael@0 | 73 | |
| michael@0 | 74 | return true; |
| michael@0 | 75 | } |
| michael@0 | 76 | |
| michael@0 | 77 | size_t ResolverThunk::GetInternalThunkSize() const { |
| michael@0 | 78 | return sizeof(InternalThunk); |
| michael@0 | 79 | } |
| michael@0 | 80 | |
| michael@0 | 81 | NTSTATUS ResolverThunk::ResolveTarget(const void* module, |
| michael@0 | 82 | const char* function_name, |
| michael@0 | 83 | void** address) { |
| michael@0 | 84 | const void** casted = const_cast<const void**>(address); |
| michael@0 | 85 | return ResolverThunk::ResolveInterceptor(module, function_name, casted); |
| michael@0 | 86 | } |
| michael@0 | 87 | |
| michael@0 | 88 | } // namespace sandbox |
