| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sandbox/wow_helper/service64_resolver.h" | |
| 6 | |
| 7 #include "base/memory/scoped_ptr.h" | |
| 8 #include "sandbox/wow_helper/target_code.h" | |
| 9 | |
| 10 namespace { | |
| 11 #pragma pack(push, 1) | |
| 12 | |
| 13 const BYTE kMovEax = 0xB8; | |
| 14 const BYTE kMovEdx = 0xBA; | |
| 15 const USHORT kCallPtrEdx = 0x12FF; | |
| 16 const BYTE kRet = 0xC2; | |
| 17 const BYTE kNop = 0x90; | |
| 18 const USHORT kJmpEdx = 0xE2FF; | |
| 19 const USHORT kXorEcx = 0xC933; | |
| 20 const ULONG kLeaEdx = 0x0424548D; | |
| 21 const ULONG kCallFs1 = 0xC015FF64; | |
| 22 const ULONG kCallFs2Ret = 0xC2000000; | |
| 23 const BYTE kPopEdx = 0x5A; | |
| 24 const BYTE kPushEdx = 0x52; | |
| 25 const BYTE kPush32 = 0x68; | |
| 26 | |
| 27 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C; | |
| 28 const USHORT kSyscall = 0x050F; | |
| 29 const BYTE kRetNp = 0xC3; | |
| 30 const BYTE kPad = 0x66; | |
| 31 const USHORT kNop16 = 0x9066; | |
| 32 const BYTE kRelJmp = 0xE9; | |
| 33 | |
| 34 const ULONG kXorRaxMovEax = 0xB8C03148; | |
| 35 const ULONG kSaveRcx = 0x10488948; | |
| 36 const ULONG kMovRcxRaxJmp = 0xE9C88B48; | |
| 37 | |
| 38 // Service code for 64 bit systems. | |
| 39 struct ServiceEntry { | |
| 40 // this struct contains roughly the following code: | |
| 41 // mov r10,rcx | |
| 42 // mov eax,52h | |
| 43 // syscall | |
| 44 // ret | |
| 45 // xchg ax,ax | |
| 46 // xchg ax,ax | |
| 47 | |
| 48 ULONG mov_r10_ecx_mov_eax; // = 4C 8B D1 B8 | |
| 49 ULONG service_id; | |
| 50 USHORT syscall; // = 0F 05 | |
| 51 BYTE ret; // = C3 | |
| 52 BYTE pad; // = 66 | |
| 53 USHORT xchg_ax_ax1; // = 66 90 | |
| 54 USHORT xchg_ax_ax2; // = 66 90 | |
| 55 }; | |
| 56 | |
| 57 struct Redirected { | |
| 58 // this struct contains roughly the following code: | |
| 59 // jmp relative_32 | |
| 60 // xchg ax,ax // 3 byte nop | |
| 61 | |
| 62 Redirected() { | |
| 63 jmp = kRelJmp; | |
| 64 relative = 0; | |
| 65 pad = kPad; | |
| 66 xchg_ax_ax = kNop16; | |
| 67 }; | |
| 68 BYTE jmp; // = E9 | |
| 69 ULONG relative; | |
| 70 BYTE pad; // = 66 | |
| 71 USHORT xchg_ax_ax; // = 66 90 | |
| 72 }; | |
| 73 | |
| 74 struct InternalThunk { | |
| 75 // this struct contains roughly the following code: | |
| 76 // xor rax,rax | |
| 77 // mov eax, 0x00080000 // Thunk storage. | |
| 78 // mov [rax]PatchInfo.service, rcx // Save first argument. | |
| 79 // mov rcx, rax | |
| 80 // jmp relative_to_interceptor | |
| 81 | |
| 82 InternalThunk() { | |
| 83 xor_rax_mov_eax = kXorRaxMovEax; | |
| 84 patch_info = 0; | |
| 85 save_rcx = kSaveRcx; | |
| 86 mov_rcx_rax_jmp = kMovRcxRaxJmp; | |
| 87 relative = 0; | |
| 88 }; | |
| 89 ULONG xor_rax_mov_eax; // = 48 31 C0 B8 | |
| 90 ULONG patch_info; | |
| 91 ULONG save_rcx; // = 48 89 48 10 | |
| 92 ULONG mov_rcx_rax_jmp; // = 48 8b c8 e9 | |
| 93 ULONG relative; | |
| 94 }; | |
| 95 | |
| 96 struct ServiceFullThunk { | |
| 97 sandbox::PatchInfo patch_info; | |
| 98 ServiceEntry original; | |
| 99 InternalThunk internal_thunk; | |
| 100 }; | |
| 101 | |
| 102 #pragma pack(pop) | |
| 103 | |
| 104 // Simple utility function to write to a buffer on the child, if the memery has | |
| 105 // write protection attributes. | |
| 106 // Arguments: | |
| 107 // child_process (in): process to write to. | |
| 108 // address (out): memory position on the child to write to. | |
| 109 // buffer (in): local buffer with the data to write . | |
| 110 // length (in): number of bytes to write. | |
| 111 // Returns true on success. | |
| 112 bool WriteProtectedChildMemory(HANDLE child_process, | |
| 113 void* address, | |
| 114 const void* buffer, | |
| 115 size_t length) { | |
| 116 // first, remove the protections | |
| 117 DWORD old_protection; | |
| 118 if (!::VirtualProtectEx(child_process, address, length, | |
| 119 PAGE_WRITECOPY, &old_protection)) | |
| 120 return false; | |
| 121 | |
| 122 SIZE_T written; | |
| 123 bool ok = ::WriteProcessMemory(child_process, address, buffer, length, | |
| 124 &written) && (length == written); | |
| 125 | |
| 126 // always attempt to restore the original protection | |
| 127 if (!::VirtualProtectEx(child_process, address, length, | |
| 128 old_protection, &old_protection)) | |
| 129 return false; | |
| 130 | |
| 131 return ok; | |
| 132 } | |
| 133 | |
| 134 // Get pointers to the functions that we need from ntdll.dll. | |
| 135 NTSTATUS ResolveNtdll(sandbox::PatchInfo* patch_info) { | |
| 136 wchar_t* ntdll_name = L"ntdll.dll"; | |
| 137 HMODULE ntdll = ::GetModuleHandle(ntdll_name); | |
| 138 if (!ntdll) | |
| 139 return STATUS_PROCEDURE_NOT_FOUND; | |
| 140 | |
| 141 void* signal = ::GetProcAddress(ntdll, "NtSignalAndWaitForSingleObject"); | |
| 142 if (!signal) | |
| 143 return STATUS_PROCEDURE_NOT_FOUND; | |
| 144 | |
| 145 patch_info->signal_and_wait = | |
| 146 reinterpret_cast<NtSignalAndWaitForSingleObjectFunction>(signal); | |
| 147 | |
| 148 return STATUS_SUCCESS; | |
| 149 } | |
| 150 | |
| 151 }; // namespace | |
| 152 | |
| 153 namespace sandbox { | |
| 154 | |
| 155 NTSTATUS ResolverThunk::Init(const void* target_module, | |
| 156 const void* interceptor_module, | |
| 157 const char* target_name, | |
| 158 const char* interceptor_name, | |
| 159 const void* interceptor_entry_point, | |
| 160 void* thunk_storage, | |
| 161 size_t storage_bytes) { | |
| 162 if (NULL == thunk_storage || 0 == storage_bytes || | |
| 163 NULL == target_module || NULL == target_name) | |
| 164 return STATUS_INVALID_PARAMETER; | |
| 165 | |
| 166 if (storage_bytes < GetThunkSize()) | |
| 167 return STATUS_BUFFER_TOO_SMALL; | |
| 168 | |
| 169 NTSTATUS ret = STATUS_SUCCESS; | |
| 170 if (NULL == interceptor_entry_point) { | |
| 171 ret = ResolveInterceptor(interceptor_module, interceptor_name, | |
| 172 &interceptor_entry_point); | |
| 173 if (!NT_SUCCESS(ret)) | |
| 174 return ret; | |
| 175 } | |
| 176 | |
| 177 ret = ResolveTarget(target_module, target_name, &target_); | |
| 178 if (!NT_SUCCESS(ret)) | |
| 179 return ret; | |
| 180 | |
| 181 interceptor_ = interceptor_entry_point; | |
| 182 | |
| 183 return ret; | |
| 184 } | |
| 185 | |
| 186 NTSTATUS ResolverThunk::ResolveInterceptor(const void* interceptor_module, | |
| 187 const char* interceptor_name, | |
| 188 const void** address) { | |
| 189 return STATUS_NOT_IMPLEMENTED; | |
| 190 } | |
| 191 | |
| 192 NTSTATUS ResolverThunk::ResolveTarget(const void* module, | |
| 193 const char* function_name, | |
| 194 void** address) { | |
| 195 return STATUS_NOT_IMPLEMENTED; | |
| 196 } | |
| 197 | |
| 198 NTSTATUS Service64ResolverThunk::Setup(const void* target_module, | |
| 199 const void* interceptor_module, | |
| 200 const char* target_name, | |
| 201 const char* interceptor_name, | |
| 202 const void* interceptor_entry_point, | |
| 203 void* thunk_storage, | |
| 204 size_t storage_bytes, | |
| 205 size_t* storage_used) { | |
| 206 NTSTATUS ret = Init(target_module, interceptor_module, target_name, | |
| 207 interceptor_name, interceptor_entry_point, | |
| 208 thunk_storage, storage_bytes); | |
| 209 if (!NT_SUCCESS(ret)) | |
| 210 return ret; | |
| 211 | |
| 212 size_t thunk_bytes = GetThunkSize(); | |
| 213 scoped_array<char> thunk_buffer(new char[thunk_bytes]); | |
| 214 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>( | |
| 215 thunk_buffer.get()); | |
| 216 | |
| 217 if (!IsFunctionAService(&thunk->original)) | |
| 218 return STATUS_UNSUCCESSFUL; | |
| 219 | |
| 220 ret = PerformPatch(thunk, thunk_storage); | |
| 221 | |
| 222 if (NULL != storage_used) | |
| 223 *storage_used = thunk_bytes; | |
| 224 | |
| 225 return ret; | |
| 226 } | |
| 227 | |
| 228 NTSTATUS Service64ResolverThunk::ResolveInterceptor( | |
| 229 const void* interceptor_module, | |
| 230 const char* interceptor_name, | |
| 231 const void** address) { | |
| 232 // After all, we are using a locally mapped version of the exe, so the | |
| 233 // action is the same as for a target function. | |
| 234 return ResolveTarget(interceptor_module, interceptor_name, | |
| 235 const_cast<void**>(address)); | |
| 236 } | |
| 237 | |
| 238 // In this case all the work is done from the parent, so resolve is | |
| 239 // just a simple GetProcAddress. | |
| 240 NTSTATUS Service64ResolverThunk::ResolveTarget(const void* module, | |
| 241 const char* function_name, | |
| 242 void** address) { | |
| 243 if (NULL == module) | |
| 244 return STATUS_UNSUCCESSFUL; | |
| 245 | |
| 246 *address = ::GetProcAddress(bit_cast<HMODULE>(module), function_name); | |
| 247 | |
| 248 if (NULL == *address) | |
| 249 return STATUS_UNSUCCESSFUL; | |
| 250 | |
| 251 return STATUS_SUCCESS; | |
| 252 } | |
| 253 | |
| 254 size_t Service64ResolverThunk::GetThunkSize() const { | |
| 255 return sizeof(ServiceFullThunk); | |
| 256 } | |
| 257 | |
| 258 bool Service64ResolverThunk::IsFunctionAService(void* local_thunk) const { | |
| 259 ServiceEntry function_code; | |
| 260 SIZE_T read; | |
| 261 if (!::ReadProcessMemory(process_, target_, &function_code, | |
| 262 sizeof(function_code), &read)) | |
| 263 return false; | |
| 264 | |
| 265 if (sizeof(function_code) != read) | |
| 266 return false; | |
| 267 | |
| 268 if (kMmovR10EcxMovEax != function_code.mov_r10_ecx_mov_eax || | |
| 269 kSyscall != function_code.syscall || kRetNp != function_code.ret) | |
| 270 return false; | |
| 271 | |
| 272 // Save the verified code | |
| 273 memcpy(local_thunk, &function_code, sizeof(function_code)); | |
| 274 | |
| 275 return true; | |
| 276 } | |
| 277 | |
| 278 NTSTATUS Service64ResolverThunk::PerformPatch(void* local_thunk, | |
| 279 void* remote_thunk) { | |
| 280 ServiceFullThunk* full_local_thunk = reinterpret_cast<ServiceFullThunk*>( | |
| 281 local_thunk); | |
| 282 ServiceFullThunk* full_remote_thunk = reinterpret_cast<ServiceFullThunk*>( | |
| 283 remote_thunk); | |
| 284 | |
| 285 // If the source or target are above 4GB we cannot do this relative jump. | |
| 286 if (reinterpret_cast<ULONG_PTR>(full_remote_thunk) > | |
| 287 static_cast<ULONG_PTR>(ULONG_MAX)) | |
| 288 return STATUS_CONFLICTING_ADDRESSES; | |
| 289 | |
| 290 if (reinterpret_cast<ULONG_PTR>(target_) > static_cast<ULONG_PTR>(ULONG_MAX)) | |
| 291 return STATUS_CONFLICTING_ADDRESSES; | |
| 292 | |
| 293 // Patch the original code. | |
| 294 Redirected local_service; | |
| 295 Redirected* remote_service = reinterpret_cast<Redirected*>(target_); | |
| 296 ULONG_PTR diff = reinterpret_cast<BYTE*>(&full_remote_thunk->internal_thunk) - | |
| 297 &remote_service->pad; | |
| 298 local_service.relative = static_cast<ULONG>(diff); | |
| 299 | |
| 300 // Setup the PatchInfo structure. | |
| 301 SIZE_T actual; | |
| 302 if (!::ReadProcessMemory(process_, remote_thunk, local_thunk, | |
| 303 sizeof(PatchInfo), &actual)) | |
| 304 return STATUS_UNSUCCESSFUL; | |
| 305 if (sizeof(PatchInfo) != actual) | |
| 306 return STATUS_UNSUCCESSFUL; | |
| 307 | |
| 308 full_local_thunk->patch_info.orig_MapViewOfSection = reinterpret_cast< | |
| 309 NtMapViewOfSectionFunction>(&full_remote_thunk->original); | |
| 310 full_local_thunk->patch_info.patch_location = target_; | |
| 311 NTSTATUS ret = ResolveNtdll(&full_local_thunk->patch_info); | |
| 312 if (!NT_SUCCESS(ret)) | |
| 313 return ret; | |
| 314 | |
| 315 // Setup the thunk. The jump out is performed from right after the end of the | |
| 316 // thunk (full_remote_thunk + 1). | |
| 317 InternalThunk my_thunk; | |
| 318 ULONG_PTR patch_info = reinterpret_cast<ULONG_PTR>(remote_thunk); | |
| 319 my_thunk.patch_info = static_cast<ULONG>(patch_info); | |
| 320 diff = reinterpret_cast<const BYTE*>(interceptor_) - | |
| 321 reinterpret_cast<BYTE*>(full_remote_thunk + 1); | |
| 322 my_thunk.relative = static_cast<ULONG>(diff); | |
| 323 | |
| 324 memcpy(&full_local_thunk->internal_thunk, &my_thunk, sizeof(my_thunk)); | |
| 325 | |
| 326 // copy the local thunk buffer to the child | |
| 327 if (!::WriteProcessMemory(process_, remote_thunk, local_thunk, | |
| 328 sizeof(ServiceFullThunk), &actual)) | |
| 329 return STATUS_UNSUCCESSFUL; | |
| 330 | |
| 331 if (sizeof(ServiceFullThunk) != actual) | |
| 332 return STATUS_UNSUCCESSFUL; | |
| 333 | |
| 334 // and now change the function to intercept, on the child | |
| 335 if (!::WriteProtectedChildMemory(process_, target_, &local_service, | |
| 336 sizeof(local_service))) | |
| 337 return STATUS_UNSUCCESSFUL; | |
| 338 | |
| 339 return STATUS_SUCCESS; | |
| 340 } | |
| 341 | |
| 342 } // namespace sandbox | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 10689170:
Move the Windows sandbox to sandbox/win (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src