1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/security/sandbox/win/src/interceptors_64.h Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,169 @@
1.4 +// Copyright (c) 2011 The Chromium Authors. All rights reserved.
1.5 +// Use of this source code is governed by a BSD-style license that can be
1.6 +// found in the LICENSE file.
1.7 +
1.8 +#include "sandbox/win/src/nt_internals.h"
1.9 +#include "sandbox/win/src/sandbox_types.h"
1.10 +
1.11 +#ifndef SANDBOX_SRC_INTERCEPTORS_64_H_
1.12 +#define SANDBOX_SRC_INTERCEPTORS_64_H_
1.13 +
1.14 +namespace sandbox {
1.15 +
1.16 +extern "C" {
1.17 +
1.18 +// Interception of NtMapViewOfSection on the child process.
1.19 +// It should never be called directly. This function provides the means to
1.20 +// detect dlls being loaded, so we can patch them if needed.
1.21 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtMapViewOfSection64(
1.22 + HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits,
1.23 + SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size,
1.24 + SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect);
1.25 +
1.26 +// Interception of NtUnmapViewOfSection on the child process.
1.27 +// It should never be called directly. This function provides the means to
1.28 +// detect dlls being unloaded, so we can clean up our interceptions.
1.29 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtUnmapViewOfSection64(HANDLE process,
1.30 + PVOID base);
1.31 +
1.32 +// -----------------------------------------------------------------------
1.33 +// Interceptors without IPC.
1.34 +
1.35 +// Interception of NtSetInformationThread on the child process.
1.36 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtSetInformationThread64(
1.37 + HANDLE thread, NT_THREAD_INFORMATION_CLASS thread_info_class,
1.38 + PVOID thread_information, ULONG thread_information_bytes);
1.39 +
1.40 +// Interception of NtOpenThreadToken on the child process.
1.41 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThreadToken64(
1.42 + HANDLE thread, ACCESS_MASK desired_access, BOOLEAN open_as_self,
1.43 + PHANDLE token);
1.44 +
1.45 +// Interception of NtOpenThreadTokenEx on the child process.
1.46 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThreadTokenEx64(
1.47 + HANDLE thread, ACCESS_MASK desired_access, BOOLEAN open_as_self,
1.48 + ULONG handle_attributes, PHANDLE token);
1.49 +
1.50 +// Interception of CreateThread on the child process.
1.51 +SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateThread64(
1.52 + LPSECURITY_ATTRIBUTES thread_attributes, SIZE_T stack_size,
1.53 + LPTHREAD_START_ROUTINE start_address, PVOID parameter,
1.54 + DWORD creation_flags, LPDWORD thread_id);
1.55 +
1.56 +// Interception of GetUserDefaultLCID on the child process.
1.57 +SANDBOX_INTERCEPT LCID WINAPI TargetGetUserDefaultLCID64();
1.58 +
1.59 +// -----------------------------------------------------------------------
1.60 +// Interceptors handled by the file system dispatcher.
1.61 +
1.62 +// Interception of NtCreateFile on the child process.
1.63 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateFile64(
1.64 + PHANDLE file, ACCESS_MASK desired_access,
1.65 + POBJECT_ATTRIBUTES object_attributes, PIO_STATUS_BLOCK io_status,
1.66 + PLARGE_INTEGER allocation_size, ULONG file_attributes, ULONG sharing,
1.67 + ULONG disposition, ULONG options, PVOID ea_buffer, ULONG ea_length);
1.68 +
1.69 +// Interception of NtOpenFile on the child process.
1.70 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenFile64(
1.71 + PHANDLE file, ACCESS_MASK desired_access,
1.72 + POBJECT_ATTRIBUTES object_attributes, PIO_STATUS_BLOCK io_status,
1.73 + ULONG sharing, ULONG options);
1.74 +
1.75 +// Interception of NtQueryAtttributesFile on the child process.
1.76 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryAttributesFile64(
1.77 + POBJECT_ATTRIBUTES object_attributes,
1.78 + PFILE_BASIC_INFORMATION file_attributes);
1.79 +
1.80 +// Interception of NtQueryFullAtttributesFile on the child process.
1.81 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryFullAttributesFile64(
1.82 + POBJECT_ATTRIBUTES object_attributes,
1.83 + PFILE_NETWORK_OPEN_INFORMATION file_attributes);
1.84 +
1.85 +// Interception of NtSetInformationFile on the child process.
1.86 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtSetInformationFile64(
1.87 + HANDLE file, PIO_STATUS_BLOCK io_status, PVOID file_information,
1.88 + ULONG length, FILE_INFORMATION_CLASS file_information_class);
1.89 +
1.90 +// -----------------------------------------------------------------------
1.91 +// Interceptors handled by the named pipe dispatcher.
1.92 +
1.93 +// Interception of CreateNamedPipeW in kernel32.dll
1.94 +SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateNamedPipeW64(
1.95 + LPCWSTR pipe_name, DWORD open_mode, DWORD pipe_mode, DWORD max_instance,
1.96 + DWORD out_buffer_size, DWORD in_buffer_size, DWORD default_timeout,
1.97 + LPSECURITY_ATTRIBUTES security_attributes);
1.98 +
1.99 +// -----------------------------------------------------------------------
1.100 +// Interceptors handled by the process-thread dispatcher.
1.101 +
1.102 +// Interception of NtOpenThread on the child process.
1.103 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThread64(
1.104 + PHANDLE thread, ACCESS_MASK desired_access,
1.105 + POBJECT_ATTRIBUTES object_attributes, PCLIENT_ID client_id);
1.106 +
1.107 +// Interception of NtOpenProcess on the child process.
1.108 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcess64(
1.109 + PHANDLE process, ACCESS_MASK desired_access,
1.110 + POBJECT_ATTRIBUTES object_attributes, PCLIENT_ID client_id);
1.111 +
1.112 +// Interception of NtOpenProcessToken on the child process.
1.113 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcessToken64(
1.114 + HANDLE process, ACCESS_MASK desired_access, PHANDLE token);
1.115 +
1.116 +// Interception of NtOpenProcessTokenEx on the child process.
1.117 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcessTokenEx64(
1.118 + HANDLE process, ACCESS_MASK desired_access, ULONG handle_attributes,
1.119 + PHANDLE token);
1.120 +
1.121 +// Interception of CreateProcessW in kernel32.dll.
1.122 +SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessW64(
1.123 + LPCWSTR application_name, LPWSTR command_line,
1.124 + LPSECURITY_ATTRIBUTES process_attributes,
1.125 + LPSECURITY_ATTRIBUTES thread_attributes, BOOL inherit_handles, DWORD flags,
1.126 + LPVOID environment, LPCWSTR current_directory, LPSTARTUPINFOW startup_info,
1.127 + LPPROCESS_INFORMATION process_information);
1.128 +
1.129 +// Interception of CreateProcessA in kernel32.dll.
1.130 +SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessA64(
1.131 + LPCSTR application_name, LPSTR command_line,
1.132 + LPSECURITY_ATTRIBUTES process_attributes,
1.133 + LPSECURITY_ATTRIBUTES thread_attributes, BOOL inherit_handles, DWORD flags,
1.134 + LPVOID environment, LPCSTR current_directory, LPSTARTUPINFOA startup_info,
1.135 + LPPROCESS_INFORMATION process_information);
1.136 +
1.137 +// -----------------------------------------------------------------------
1.138 +// Interceptors handled by the registry dispatcher.
1.139 +
1.140 +// Interception of NtCreateKey on the child process.
1.141 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateKey64(
1.142 + PHANDLE key, ACCESS_MASK desired_access,
1.143 + POBJECT_ATTRIBUTES object_attributes, ULONG title_index,
1.144 + PUNICODE_STRING class_name, ULONG create_options, PULONG disposition);
1.145 +
1.146 +// Interception of NtOpenKey on the child process.
1.147 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenKey64(
1.148 + PHANDLE key, ACCESS_MASK desired_access,
1.149 + POBJECT_ATTRIBUTES object_attributes);
1.150 +
1.151 +// Interception of NtOpenKeyEx on the child process.
1.152 +SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenKeyEx64(
1.153 + PHANDLE key, ACCESS_MASK desired_access,
1.154 + POBJECT_ATTRIBUTES object_attributes, ULONG open_options);
1.155 +
1.156 +// -----------------------------------------------------------------------
1.157 +// Interceptors handled by the sync dispatcher.
1.158 +
1.159 +// Interception of CreateEventW on the child process.
1.160 +SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateEventW64(
1.161 + LPSECURITY_ATTRIBUTES security_attributes, BOOL manual_reset,
1.162 + BOOL initial_state, LPCWSTR name);
1.163 +
1.164 +// Interception of OpenEventW on the child process.
1.165 +SANDBOX_INTERCEPT HANDLE WINAPI TargetOpenEventW64(
1.166 + ACCESS_MASK desired_access, BOOL inherit_handle, LPCWSTR name);
1.167 +
1.168 +} // extern "C"
1.169 +
1.170 +} // namespace sandbox
1.171 +
1.172 +#endif // SANDBOX_SRC_INTERCEPTORS_64_H_
