1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "chrome/browser/safe_browsing/binary_feature_extractor.h" 6 7 #include <windows.h> 8 #include <softpub.h> 9 #include <wintrust.h> 10 11 #include "base/files/file_path.h" 12 #include "base/files/memory_mapped_file.h" 13 #include "base/logging.h" 14 #include "chrome/browser/safe_browsing/pe_image_reader_win.h" 15 #include "chrome/common/safe_browsing/csd.pb.h" 16 17 #pragma comment(lib, "wintrust.lib") 18 19 namespace safe_browsing { 20 21 BinaryFeatureExtractor::BinaryFeatureExtractor() {} 22 23 BinaryFeatureExtractor::~BinaryFeatureExtractor() {} 24 25 void BinaryFeatureExtractor::CheckSignature( 26 const base::FilePath& file_path, 27 ClientDownloadRequest_SignatureInfo* signature_info) { 28 VLOG(2) << "Checking signature for " << file_path.value(); 29 30 WINTRUST_FILE_INFO file_info = {0}; 31 file_info.cbStruct = sizeof(file_info); 32 file_info.pcwszFilePath = file_path.value().c_str(); 33 file_info.hFile = NULL; 34 file_info.pgKnownSubject = NULL; 35 36 WINTRUST_DATA wintrust_data = {0}; 37 wintrust_data.cbStruct = sizeof(wintrust_data); 38 wintrust_data.pPolicyCallbackData = NULL; 39 wintrust_data.pSIPClientData = NULL; 40 wintrust_data.dwUIChoice = WTD_UI_NONE; 41 wintrust_data.fdwRevocationChecks = WTD_REVOKE_NONE; 42 wintrust_data.dwUnionChoice = WTD_CHOICE_FILE; 43 wintrust_data.pFile = &file_info; 44 wintrust_data.dwStateAction = WTD_STATEACTION_VERIFY; 45 wintrust_data.hWVTStateData = NULL; 46 wintrust_data.pwszURLReference = NULL; 47 // Disallow revocation checks over the network. 48 wintrust_data.dwProvFlags = WTD_CACHE_ONLY_URL_RETRIEVAL; 49 wintrust_data.dwUIContext = WTD_UICONTEXT_EXECUTE; 50 51 // The WINTRUST_ACTION_GENERIC_VERIFY_V2 policy verifies that the certificate 52 // chains up to a trusted root CA, and that it has appropriate permission to 53 // sign code. 54 GUID policy_guid = WINTRUST_ACTION_GENERIC_VERIFY_V2; 55 56 LONG result = WinVerifyTrust(static_cast<HWND>(INVALID_HANDLE_VALUE), 57 &policy_guid, 58 &wintrust_data); 59 60 CRYPT_PROVIDER_DATA* prov_data = WTHelperProvDataFromStateData( 61 wintrust_data.hWVTStateData); 62 if (prov_data) { 63 if (prov_data->csSigners > 0) { 64 signature_info->set_trusted(result == ERROR_SUCCESS); 65 } 66 for (DWORD i = 0; i < prov_data->csSigners; ++i) { 67 const CERT_CHAIN_CONTEXT* cert_chain_context = 68 prov_data->pasSigners[i].pChainContext; 69 if (!cert_chain_context) 70 break; 71 for (DWORD j = 0; j < cert_chain_context->cChain; ++j) { 72 CERT_SIMPLE_CHAIN* simple_chain = cert_chain_context->rgpChain[j]; 73 ClientDownloadRequest_CertificateChain* chain = 74 signature_info->add_certificate_chain(); 75 if (!simple_chain) 76 break; 77 for (DWORD k = 0; k < simple_chain->cElement; ++k) { 78 CERT_CHAIN_ELEMENT* element = simple_chain->rgpElement[k]; 79 chain->add_element()->set_certificate( 80 element->pCertContext->pbCertEncoded, 81 element->pCertContext->cbCertEncoded); 82 } 83 } 84 } 85 86 // Free the provider data. 87 wintrust_data.dwStateAction = WTD_STATEACTION_CLOSE; 88 WinVerifyTrust(static_cast<HWND>(INVALID_HANDLE_VALUE), 89 &policy_guid, &wintrust_data); 90 } 91 } 92 93 void BinaryFeatureExtractor::ExtractImageHeaders( 94 const base::FilePath& file_path, 95 ClientDownloadRequest_ImageHeaders* image_headers) { 96 // Map the file into memory. 97 base::MemoryMappedFile file; 98 if (!file.Initialize(file_path)) 99 return; 100 101 PeImageReader pe_image; 102 if (!pe_image.Initialize(file.data(), file.length())) 103 return; 104 105 // Copy the headers. 106 ClientDownloadRequest_PEImageHeaders* pe_headers = 107 image_headers->mutable_pe_headers(); 108 pe_headers->set_dos_header(pe_image.GetDosHeader(), sizeof(IMAGE_DOS_HEADER)); 109 pe_headers->set_file_header(pe_image.GetCoffFileHeader(), 110 sizeof(IMAGE_FILE_HEADER)); 111 size_t optional_header_size = 0; 112 const uint8_t* optional_header_data = 113 pe_image.GetOptionalHeaderData(&optional_header_size); 114 if (pe_image.GetWordSize() == PeImageReader::WORD_SIZE_32) { 115 pe_headers->set_optional_headers32(optional_header_data, 116 optional_header_size); 117 } else { 118 pe_headers->set_optional_headers64(optional_header_data, 119 optional_header_size); 120 } 121 const size_t number_of_sections = pe_image.GetNumberOfSections(); 122 for (size_t i = 0; i != number_of_sections; ++i) { 123 pe_headers->add_section_header(pe_image.GetSectionHeaderAt(i), 124 sizeof(IMAGE_SECTION_HEADER)); 125 } 126 size_t export_size = 0; 127 const uint8_t* export_section = pe_image.GetExportSection(&export_size); 128 if (export_section) 129 pe_headers->set_export_section_data(export_section, export_size); 130 size_t number_of_debug_entries = pe_image.GetNumberOfDebugEntries(); 131 for (size_t i = 0; i != number_of_debug_entries; ++i) { 132 const uint8_t* raw_data = NULL; 133 size_t raw_data_size = 0; 134 const IMAGE_DEBUG_DIRECTORY* directory_entry = 135 pe_image.GetDebugEntry(i, &raw_data, &raw_data_size); 136 if (directory_entry) { 137 ClientDownloadRequest_PEImageHeaders_DebugData* debug_data = 138 pe_headers->add_debug_data(); 139 debug_data->set_directory_entry(directory_entry, 140 sizeof(*directory_entry)); 141 if (raw_data) 142 debug_data->set_raw_data(raw_data, raw_data_size); 143 } 144 } 145 } 146 147 } // namespace safe_browsing 148
