1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/security/sandbox/win/src/resolver_32.cc Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,88 @@
1.4 +// Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
1.5 +// Use of this source code is governed by a BSD-style license that can be
1.6 +// found in the LICENSE file.
1.7 +
1.8 +#include "sandbox/win/src/resolver.h"
1.9 +
1.10 +#include "sandbox/win/src/sandbox_nt_util.h"
1.11 +
1.12 +namespace {
1.13 +
1.14 +#pragma pack(push, 1)
1.15 +struct InternalThunk {
1.16 + // This struct contains roughly the following code:
1.17 + // sub esp, 8 // Create working space
1.18 + // push edx // Save register
1.19 + // mov edx, [esp + 0xc] // Get return adddress
1.20 + // mov [esp + 8], edx // Store return address
1.21 + // mov dword ptr [esp + 0xc], 0x7c401200 // Store extra argument
1.22 + // mov dword ptr [esp + 4], 0x40010203 // Store address to jump to
1.23 + // pop edx // Restore register
1.24 + // ret // Jump to interceptor
1.25 + //
1.26 + // This code only modifies esp and eip so it must work with to normal calling
1.27 + // convention. It is assembled as:
1.28 + //
1.29 + // 00 83ec08 sub esp,8
1.30 + // 03 52 push edx
1.31 + // 04 8b54240c mov edx,dword ptr [esp + 0Ch]
1.32 + // 08 89542408 mov dword ptr [esp + 8], edx
1.33 + // 0c c744240c0012407c mov dword ptr [esp + 0Ch], 7C401200h
1.34 + // 14 c744240403020140 mov dword ptr [esp + 4], 40010203h
1.35 + // 1c 5a pop edx
1.36 + // 1d c3 ret
1.37 + InternalThunk() {
1.38 + opcodes_1 = 0x5208ec83;
1.39 + opcodes_2 = 0x0c24548b;
1.40 + opcodes_3 = 0x08245489;
1.41 + opcodes_4 = 0x0c2444c7;
1.42 + opcodes_5 = 0x042444c7;
1.43 + opcodes_6 = 0xc35a;
1.44 + extra_argument = 0;
1.45 + interceptor_function = 0;
1.46 + };
1.47 + ULONG opcodes_1; // = 0x5208ec83
1.48 + ULONG opcodes_2; // = 0x0c24548b
1.49 + ULONG opcodes_3; // = 0x08245489
1.50 + ULONG opcodes_4; // = 0x0c2444c7
1.51 + ULONG extra_argument;
1.52 + ULONG opcodes_5; // = 0x042444c7
1.53 + ULONG interceptor_function;
1.54 + USHORT opcodes_6; // = 0xc35a
1.55 +};
1.56 +#pragma pack(pop)
1.57 +
1.58 +}; // namespace
1.59 +
1.60 +namespace sandbox {
1.61 +
1.62 +bool ResolverThunk::SetInternalThunk(void* storage, size_t storage_bytes,
1.63 + const void* original_function,
1.64 + const void* interceptor) {
1.65 + if (storage_bytes < sizeof(InternalThunk))
1.66 + return false;
1.67 +
1.68 + InternalThunk* thunk = new(storage, NT_PLACE) InternalThunk;
1.69 +
1.70 +#pragma warning(push)
1.71 +#pragma warning(disable: 4311)
1.72 + // These casts generate warnings because they are 32 bit specific.
1.73 + thunk->interceptor_function = reinterpret_cast<ULONG>(interceptor);
1.74 + thunk->extra_argument = reinterpret_cast<ULONG>(original_function);
1.75 +#pragma warning(pop)
1.76 +
1.77 + return true;
1.78 +}
1.79 +
1.80 +size_t ResolverThunk::GetInternalThunkSize() const {
1.81 + return sizeof(InternalThunk);
1.82 +}
1.83 +
1.84 +NTSTATUS ResolverThunk::ResolveTarget(const void* module,
1.85 + const char* function_name,
1.86 + void** address) {
1.87 + const void** casted = const_cast<const void**>(address);
1.88 + return ResolverThunk::ResolveInterceptor(module, function_name, casted);
1.89 +}
1.90 +
1.91 +} // namespace sandbox
