OLD | NEW |
| (Empty) |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "sandbox/src/nt_internals.h" | |
6 #include "sandbox/src/sandbox_types.h" | |
7 | |
8 #ifndef SANDBOX_SRC_INTERCEPTORS_64_H_ | |
9 #define SANDBOX_SRC_INTERCEPTORS_64_H_ | |
10 | |
11 namespace sandbox { | |
12 | |
13 extern "C" { | |
14 | |
15 // Interception of NtMapViewOfSection on the child process. | |
16 // It should never be called directly. This function provides the means to | |
17 // detect dlls being loaded, so we can patch them if needed. | |
18 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtMapViewOfSection64( | |
19 HANDLE section, HANDLE process, PVOID *base, ULONG_PTR zero_bits, | |
20 SIZE_T commit_size, PLARGE_INTEGER offset, PSIZE_T view_size, | |
21 SECTION_INHERIT inherit, ULONG allocation_type, ULONG protect); | |
22 | |
23 // Interception of NtUnmapViewOfSection on the child process. | |
24 // It should never be called directly. This function provides the means to | |
25 // detect dlls being unloaded, so we can clean up our interceptions. | |
26 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtUnmapViewOfSection64(HANDLE process, | |
27 PVOID base); | |
28 | |
29 // ----------------------------------------------------------------------- | |
30 // Interceptors without IPC. | |
31 | |
32 // Interception of NtSetInformationThread on the child process. | |
33 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtSetInformationThread64( | |
34 HANDLE thread, NT_THREAD_INFORMATION_CLASS thread_info_class, | |
35 PVOID thread_information, ULONG thread_information_bytes); | |
36 | |
37 // Interception of NtOpenThreadToken on the child process. | |
38 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThreadToken64( | |
39 HANDLE thread, ACCESS_MASK desired_access, BOOLEAN open_as_self, | |
40 PHANDLE token); | |
41 | |
42 // Interception of NtOpenThreadTokenEx on the child process. | |
43 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThreadTokenEx64( | |
44 HANDLE thread, ACCESS_MASK desired_access, BOOLEAN open_as_self, | |
45 ULONG handle_attributes, PHANDLE token); | |
46 | |
47 // Interception of CreateThread on the child process. | |
48 SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateThread64( | |
49 LPSECURITY_ATTRIBUTES thread_attributes, SIZE_T stack_size, | |
50 LPTHREAD_START_ROUTINE start_address, PVOID parameter, | |
51 DWORD creation_flags, LPDWORD thread_id); | |
52 | |
53 // Interception of GetUserDefaultLCID on the child process. | |
54 SANDBOX_INTERCEPT LCID WINAPI TargetGetUserDefaultLCID64(); | |
55 | |
56 // ----------------------------------------------------------------------- | |
57 // Interceptors handled by the file system dispatcher. | |
58 | |
59 // Interception of NtCreateFile on the child process. | |
60 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateFile64( | |
61 PHANDLE file, ACCESS_MASK desired_access, | |
62 POBJECT_ATTRIBUTES object_attributes, PIO_STATUS_BLOCK io_status, | |
63 PLARGE_INTEGER allocation_size, ULONG file_attributes, ULONG sharing, | |
64 ULONG disposition, ULONG options, PVOID ea_buffer, ULONG ea_length); | |
65 | |
66 // Interception of NtOpenFile on the child process. | |
67 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenFile64( | |
68 PHANDLE file, ACCESS_MASK desired_access, | |
69 POBJECT_ATTRIBUTES object_attributes, PIO_STATUS_BLOCK io_status, | |
70 ULONG sharing, ULONG options); | |
71 | |
72 // Interception of NtQueryAtttributesFile on the child process. | |
73 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryAttributesFile64( | |
74 POBJECT_ATTRIBUTES object_attributes, | |
75 PFILE_BASIC_INFORMATION file_attributes); | |
76 | |
77 // Interception of NtQueryFullAtttributesFile on the child process. | |
78 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryFullAttributesFile64( | |
79 POBJECT_ATTRIBUTES object_attributes, | |
80 PFILE_NETWORK_OPEN_INFORMATION file_attributes); | |
81 | |
82 // Interception of NtSetInformationFile on the child process. | |
83 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtSetInformationFile64( | |
84 HANDLE file, PIO_STATUS_BLOCK io_status, PVOID file_information, | |
85 ULONG length, FILE_INFORMATION_CLASS file_information_class); | |
86 | |
87 // ----------------------------------------------------------------------- | |
88 // Interceptors handled by the named pipe dispatcher. | |
89 | |
90 // Interception of CreateNamedPipeW in kernel32.dll | |
91 SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateNamedPipeW64( | |
92 LPCWSTR pipe_name, DWORD open_mode, DWORD pipe_mode, DWORD max_instance, | |
93 DWORD out_buffer_size, DWORD in_buffer_size, DWORD default_timeout, | |
94 LPSECURITY_ATTRIBUTES security_attributes); | |
95 | |
96 // ----------------------------------------------------------------------- | |
97 // Interceptors handled by the process-thread dispatcher. | |
98 | |
99 // Interception of NtOpenThread on the child process. | |
100 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenThread64( | |
101 PHANDLE thread, ACCESS_MASK desired_access, | |
102 POBJECT_ATTRIBUTES object_attributes, PCLIENT_ID client_id); | |
103 | |
104 // Interception of NtOpenProcess on the child process. | |
105 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcess64( | |
106 PHANDLE process, ACCESS_MASK desired_access, | |
107 POBJECT_ATTRIBUTES object_attributes, PCLIENT_ID client_id); | |
108 | |
109 // Interception of NtOpenProcessToken on the child process. | |
110 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcessToken64( | |
111 HANDLE process, ACCESS_MASK desired_access, PHANDLE token); | |
112 | |
113 // Interception of NtOpenProcessTokenEx on the child process. | |
114 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenProcessTokenEx64( | |
115 HANDLE process, ACCESS_MASK desired_access, ULONG handle_attributes, | |
116 PHANDLE token); | |
117 | |
118 // Interception of CreateProcessW in kernel32.dll. | |
119 SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessW64( | |
120 LPCWSTR application_name, LPWSTR command_line, | |
121 LPSECURITY_ATTRIBUTES process_attributes, | |
122 LPSECURITY_ATTRIBUTES thread_attributes, BOOL inherit_handles, DWORD flags, | |
123 LPVOID environment, LPCWSTR current_directory, LPSTARTUPINFOW startup_info, | |
124 LPPROCESS_INFORMATION process_information); | |
125 | |
126 // Interception of CreateProcessA in kernel32.dll. | |
127 SANDBOX_INTERCEPT BOOL WINAPI TargetCreateProcessA64( | |
128 LPCSTR application_name, LPSTR command_line, | |
129 LPSECURITY_ATTRIBUTES process_attributes, | |
130 LPSECURITY_ATTRIBUTES thread_attributes, BOOL inherit_handles, DWORD flags, | |
131 LPVOID environment, LPCSTR current_directory, LPSTARTUPINFOA startup_info, | |
132 LPPROCESS_INFORMATION process_information); | |
133 | |
134 // ----------------------------------------------------------------------- | |
135 // Interceptors handled by the registry dispatcher. | |
136 | |
137 // Interception of NtCreateKey on the child process. | |
138 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateKey64( | |
139 PHANDLE key, ACCESS_MASK desired_access, | |
140 POBJECT_ATTRIBUTES object_attributes, ULONG title_index, | |
141 PUNICODE_STRING class_name, ULONG create_options, PULONG disposition); | |
142 | |
143 // Interception of NtOpenKey on the child process. | |
144 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenKey64( | |
145 PHANDLE key, ACCESS_MASK desired_access, | |
146 POBJECT_ATTRIBUTES object_attributes); | |
147 | |
148 // Interception of NtOpenKeyEx on the child process. | |
149 SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenKeyEx64( | |
150 PHANDLE key, ACCESS_MASK desired_access, | |
151 POBJECT_ATTRIBUTES object_attributes, ULONG open_options); | |
152 | |
153 // ----------------------------------------------------------------------- | |
154 // Interceptors handled by the sync dispatcher. | |
155 | |
156 // Interception of CreateEventW on the child process. | |
157 SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateEventW64( | |
158 LPSECURITY_ATTRIBUTES security_attributes, BOOL manual_reset, | |
159 BOOL initial_state, LPCWSTR name); | |
160 | |
161 // Interception of OpenEventW on the child process. | |
162 SANDBOX_INTERCEPT HANDLE WINAPI TargetOpenEventW64( | |
163 ACCESS_MASK desired_access, BOOL inherit_handle, LPCWSTR name); | |
164 | |
165 } // extern "C" | |
166 | |
167 } // namespace sandbox | |
168 | |
169 #endif // SANDBOX_SRC_INTERCEPTORS_64_H_ | |
OLD | NEW |