1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stddef.h>
#include <map>
#include "sandbox/win/src/policy_broker.h"
#include "base/logging.h"
#include "base/win/pe_image.h"
#include "base/win/windows_version.h"
#include "sandbox/win/src/interception.h"
#include "sandbox/win/src/interceptors.h"
#include "sandbox/win/src/policy_target.h"
#include "sandbox/win/src/process_thread_interception.h"
#include "sandbox/win/src/sandbox.h"
#include "sandbox/win/src/sandbox_nt_types.h"
#include "sandbox/win/src/sandbox_types.h"
#include "sandbox/win/src/target_process.h"
// This code executes on the broker side, as a callback from the policy on the
// target side (the child).
namespace sandbox {
// This is the list of all imported symbols from ntdll.dll.
SANDBOX_INTERCEPT NtExports g_nt;
#define INIT_GLOBAL_NT(member) \
g_nt.member = reinterpret_cast<Nt##member##Function>( \
ntdll_image.GetProcAddress("Nt" #member)); \
if (NULL == g_nt.member) \
return false
#define INIT_GLOBAL_RTL(member) \
g_nt.member = reinterpret_cast<member##Function>( \
ntdll_image.GetProcAddress(#member)); \
if (NULL == g_nt.member) \
return false
bool InitGlobalNt() {
HMODULE ntdll = ::GetModuleHandle(kNtdllName);
base::win::PEImage ntdll_image(ntdll);
// Bypass purify's interception.
wchar_t* loader_get = reinterpret_cast<wchar_t*>(
ntdll_image.GetProcAddress("LdrGetDllHandle"));
if (loader_get) {
GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
loader_get, &ntdll);
}
INIT_GLOBAL_NT(AllocateVirtualMemory);
INIT_GLOBAL_NT(Close);
INIT_GLOBAL_NT(DuplicateObject);
INIT_GLOBAL_NT(FreeVirtualMemory);
INIT_GLOBAL_NT(MapViewOfSection);
INIT_GLOBAL_NT(ProtectVirtualMemory);
INIT_GLOBAL_NT(QueryInformationProcess);
INIT_GLOBAL_NT(QueryObject);
INIT_GLOBAL_NT(QuerySection);
INIT_GLOBAL_NT(QueryVirtualMemory);
INIT_GLOBAL_NT(UnmapViewOfSection);
INIT_GLOBAL_RTL(RtlAllocateHeap);
INIT_GLOBAL_RTL(RtlAnsiStringToUnicodeString);
INIT_GLOBAL_RTL(RtlCompareUnicodeString);
INIT_GLOBAL_RTL(RtlCreateHeap);
INIT_GLOBAL_RTL(RtlCreateUserThread);
INIT_GLOBAL_RTL(RtlDestroyHeap);
INIT_GLOBAL_RTL(RtlFreeHeap);
INIT_GLOBAL_RTL(_strnicmp);
INIT_GLOBAL_RTL(strlen);
INIT_GLOBAL_RTL(wcslen);
INIT_GLOBAL_RTL(memcpy);
return true;
}
bool SetupNtdllImports(TargetProcess *child) {
if (!InitGlobalNt()) {
return false;
}
#ifndef NDEBUG
// Verify that the structure is fully initialized.
for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++)
DCHECK(reinterpret_cast<char**>(&g_nt)[i]);
#endif
return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt)));
}
#undef INIT_GLOBAL_NT
#undef INIT_GLOBAL_RTL
bool SetupBasicInterceptions(InterceptionManager* manager) {
// Interceptions provided by process_thread_policy, without actual policy.
if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_TREAD_ID, 20) ||
!INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) ||
!INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16))
return false;
// Interceptions with neither policy nor IPC.
if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID,
20) ||
!INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
return false;
if (base::win::GetVersion() >= base::win::VERSION_XP) {
// Bug 27218: We don't have dispatch for some x64 syscalls.
// This one is also provided by process_thread_policy.
if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID,
20))
return false;
return INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID,
24);
}
return true;
}
} // namespace sandbox
|
