The Tor Browser / file comparison

comparison: security/sandbox/win/src/interception_agent.cc

security/sandbox/win/src/interception_agent.cc

changeset 0
6474c204b198
equal deleted inserted replaced
-1:000000000000 0:3cd5923ddfb0
1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // For information about interceptions as a whole see
6 // http://dev.chromium.org/developers/design-documents/sandbox .
7
8 #include "sandbox/win/src/interception_agent.h"
9
10 #include "sandbox/win/src/interception_internal.h"
11 #include "sandbox/win/src/interceptors.h"
12 #include "sandbox/win/src/eat_resolver.h"
13 #include "sandbox/win/src/sidestep_resolver.h"
14 #include "sandbox/win/src/sandbox_nt_util.h"
15
16 namespace {
17
18 // Returns true if target lies between base and base + range.
19 bool IsWithinRange(const void* base, size_t range, const void* target) {
20 const char* end = reinterpret_cast<const char*>(base) + range;
21 return reinterpret_cast<const char*>(target) < end;
22 }
23
24 } // namespace
25
26 namespace sandbox {
27
28 // This is the list of all imported symbols from ntdll.dll.
29 SANDBOX_INTERCEPT NtExports g_nt;
30
31 // The list of intercepted functions back-pointers.
32 SANDBOX_INTERCEPT OriginalFunctions g_originals;
33
34 // Memory buffer mapped from the parent, with the list of interceptions.
35 SANDBOX_INTERCEPT SharedMemory* g_interceptions = NULL;
36
37 InterceptionAgent* InterceptionAgent::GetInterceptionAgent() {
38 static InterceptionAgent* s_singleton = NULL;
39 if (!s_singleton) {
40 if (!g_interceptions)
41 return NULL;
42
43 size_t array_bytes = g_interceptions->num_intercepted_dlls * sizeof(void*);
44 s_singleton = reinterpret_cast<InterceptionAgent*>(
45 new(NT_ALLOC) char[array_bytes + sizeof(InterceptionAgent)]);
46
47 bool success = s_singleton->Init(g_interceptions);
48 if (!success) {
49 operator delete(s_singleton, NT_ALLOC);
50 s_singleton = NULL;
51 }
52 }
53 return s_singleton;
54 }
55
56 bool InterceptionAgent::Init(SharedMemory* shared_memory) {
57 interceptions_ = shared_memory;
58 for (int i = 0 ; i < shared_memory->num_intercepted_dlls; i++)
59 dlls_[i] = NULL;
60 return true;
61 }
62
63 bool InterceptionAgent::DllMatch(const UNICODE_STRING* full_path,
64 const UNICODE_STRING* name,
65 const DllPatchInfo* dll_info) {
66 UNICODE_STRING current_name;
67 current_name.Length = static_cast<USHORT>(g_nt.wcslen(dll_info->dll_name) *
68 sizeof(wchar_t));
69 current_name.MaximumLength = current_name.Length;
70 current_name.Buffer = const_cast<wchar_t*>(dll_info->dll_name);
71
72 BOOLEAN case_insensitive = TRUE;
73 if (full_path &&
74 !g_nt.RtlCompareUnicodeString(&current_name, full_path, case_insensitive))
75 return true;
76
77 if (name &&
78 !g_nt.RtlCompareUnicodeString(&current_name, name, case_insensitive))
79 return true;
80
81 return false;
82 }
83
84 bool InterceptionAgent::OnDllLoad(const UNICODE_STRING* full_path,
85 const UNICODE_STRING* name,
86 void* base_address) {
87 DllPatchInfo* dll_info = interceptions_->dll_list;
88 int i = 0;
89 for (; i < interceptions_->num_intercepted_dlls; i++) {
90 if (DllMatch(full_path, name, dll_info))
91 break;
92
93 dll_info = reinterpret_cast<DllPatchInfo*>(
94 reinterpret_cast<char*>(dll_info) + dll_info->record_bytes);
95 }
96
97 // Return now if the dll is not in our list of interest.
98 if (i == interceptions_->num_intercepted_dlls)
99 return true;
100
101 // The dll must be unloaded.
102 if (dll_info->unload_module)
103 return false;
104
105 // Purify causes this condition to trigger.
106 if (dlls_[i])
107 return true;
108
109 size_t buffer_bytes = offsetof(DllInterceptionData, thunks) +
110 dll_info->num_functions * sizeof(ThunkData);
111 dlls_[i] = reinterpret_cast<DllInterceptionData*>(
112 new(NT_PAGE, base_address) char[buffer_bytes]);
113
114 DCHECK_NT(dlls_[i]);
115 if (!dlls_[i])
116 return true;
117
118 dlls_[i]->data_bytes = buffer_bytes;
119 dlls_[i]->num_thunks = 0;
120 dlls_[i]->base = base_address;
121 dlls_[i]->used_bytes = offsetof(DllInterceptionData, thunks);
122
123 VERIFY(PatchDll(dll_info, dlls_[i]));
124
125 ULONG old_protect;
126 SIZE_T real_size = buffer_bytes;
127 void* to_protect = dlls_[i];
128 VERIFY_SUCCESS(g_nt.ProtectVirtualMemory(NtCurrentProcess, &to_protect,
129 &real_size, PAGE_EXECUTE_READ,
130 &old_protect));
131 return true;
132 }
133
134 void InterceptionAgent::OnDllUnload(void* base_address) {
135 for (int i = 0; i < interceptions_->num_intercepted_dlls; i++) {
136 if (dlls_[i] && dlls_[i]->base == base_address) {
137 operator delete(dlls_[i], NT_PAGE);
138 dlls_[i] = NULL;
139 break;
140 }
141 }
142 }
143
144 // TODO(rvargas): We have to deal with prebinded dlls. I see two options: change
145 // the timestamp of the patched dll, or modify the info on the prebinded dll.
146 // the first approach messes matching of debug symbols, the second one is more
147 // complicated.
148 bool InterceptionAgent::PatchDll(const DllPatchInfo* dll_info,
149 DllInterceptionData* thunks) {
150 DCHECK_NT(NULL != thunks);
151 DCHECK_NT(NULL != dll_info);
152
153 const FunctionInfo* function = reinterpret_cast<const FunctionInfo*>(
154 reinterpret_cast<const char*>(dll_info) + dll_info->offset_to_functions);
155
156 for (int i = 0; i < dll_info->num_functions; i++) {
157 if (!IsWithinRange(dll_info, dll_info->record_bytes, function->function)) {
158 NOTREACHED_NT();
159 return false;
160 }
161
162 ResolverThunk* resolver = GetResolver(function->type);
163 if (!resolver)
164 return false;
165
166 const char* interceptor = function->function +
167 g_nt.strlen(function->function) + 1;
168
169 if (!IsWithinRange(function, function->record_bytes, interceptor) ||
170 !IsWithinRange(dll_info, dll_info->record_bytes, interceptor)) {
171 NOTREACHED_NT();
172 return false;
173 }
174
175 NTSTATUS ret = resolver->Setup(thunks->base,
176 interceptions_->interceptor_base,
177 function->function,
178 interceptor,
179 function->interceptor_address,
180 &thunks->thunks[i],
181 sizeof(ThunkData),
182 NULL);
183 if (!NT_SUCCESS(ret)) {
184 NOTREACHED_NT();
185 return false;
186 }
187
188 DCHECK_NT(!g_originals[function->id]);
189 g_originals[function->id] = &thunks->thunks[i];
190
191 thunks->num_thunks++;
192 thunks->used_bytes += sizeof(ThunkData);
193
194 function = reinterpret_cast<const FunctionInfo*>(
195 reinterpret_cast<const char*>(function) + function->record_bytes);
196 }
197
198 return true;
199 }
200
201 // This method is called from within the loader lock
202 ResolverThunk* InterceptionAgent::GetResolver(InterceptionType type) {
203 static EatResolverThunk* eat_resolver = NULL;
204 static SidestepResolverThunk* sidestep_resolver = NULL;
205 static SmartSidestepResolverThunk* smart_sidestep_resolver = NULL;
206
207 if (!eat_resolver)
208 eat_resolver = new(NT_ALLOC) EatResolverThunk;
209
210 #if !defined(_WIN64)
211 // Sidestep is not supported for x64.
212 if (!sidestep_resolver)
213 sidestep_resolver = new(NT_ALLOC) SidestepResolverThunk;
214
215 if (!smart_sidestep_resolver)
216 smart_sidestep_resolver = new(NT_ALLOC) SmartSidestepResolverThunk;
217 #endif
218
219 switch (type) {
220 case INTERCEPTION_EAT:
221 return eat_resolver;
222 case INTERCEPTION_SIDESTEP:
223 return sidestep_resolver;
224 case INTERCEPTION_SMART_SIDESTEP:
225 return smart_sidestep_resolver;
226 default:
227 NOTREACHED_NT();
228 }
229
230 return NULL;
231 }
232
233 } // namespace sandbox

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial