1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "sandbox/win/src/sidestep_resolver.h" 6 7 #include "base/win/pe_image.h" 8 #include "sandbox/win/src/sandbox_nt_util.h" 9 #include "sandbox/win/src/sidestep/preamble_patcher.h" 10 11 namespace { 12 13 const size_t kSizeOfSidestepStub = sidestep::kMaxPreambleStubSize; 14 15 struct SidestepThunk { 16 char sidestep[kSizeOfSidestepStub]; // Storage for the sidestep stub. 17 int internal_thunk; // Dummy member to the beginning of the internal thunk. 18 }; 19 20 struct SmartThunk { 21 const void* module_base; // Target module's base. 22 const void* interceptor; // Real interceptor. 23 SidestepThunk sidestep; // Standard sidestep thunk. 24 }; 25 26 } // namespace 27 28 namespace sandbox { 29 30 NTSTATUS SidestepResolverThunk::Setup(const void* target_module, 31 const void* interceptor_module, 32 const char* target_name, 33 const char* interceptor_name, 34 const void* interceptor_entry_point, 35 void* thunk_storage, 36 size_t storage_bytes, 37 size_t* storage_used) { 38 NTSTATUS ret = Init(target_module, interceptor_module, target_name, 39 interceptor_name, interceptor_entry_point, 40 thunk_storage, storage_bytes); 41 if (!NT_SUCCESS(ret)) 42 return ret; 43 44 SidestepThunk* thunk = reinterpret_cast<SidestepThunk*>(thunk_storage); 45 46 size_t internal_bytes = storage_bytes - kSizeOfSidestepStub; 47 if (!SetInternalThunk(&thunk->internal_thunk, internal_bytes, thunk_storage, 48 interceptor_)) 49 return STATUS_BUFFER_TOO_SMALL; 50 51 AutoProtectMemory memory; 52 ret = memory.ChangeProtection(target_, kSizeOfSidestepStub, PAGE_READWRITE); 53 if (!NT_SUCCESS(ret)) 54 return ret; 55 56 sidestep::SideStepError rv = sidestep::PreamblePatcher::Patch( 57 target_, reinterpret_cast<void*>(&thunk->internal_thunk), thunk_storage, 58 kSizeOfSidestepStub); 59 60 if (sidestep::SIDESTEP_INSUFFICIENT_BUFFER == rv) 61 return STATUS_BUFFER_TOO_SMALL; 62 63 if (sidestep::SIDESTEP_SUCCESS != rv) 64 return STATUS_UNSUCCESSFUL; 65 66 if (storage_used) 67 *storage_used = GetThunkSize(); 68 69 return ret; 70 } 71 72 size_t SidestepResolverThunk::GetThunkSize() const { 73 return GetInternalThunkSize() + kSizeOfSidestepStub; 74 } 75 76 // This is basically a wrapper around the normal sidestep patch that extends 77 // the thunk to use a chained interceptor. It uses the fact that 78 // SetInternalThunk generates the code to pass as the first parameter whatever 79 // it receives as original_function; we let SidestepResolverThunk set this value 80 // to its saved code, and then we change it to our thunk data. 81 NTSTATUS SmartSidestepResolverThunk::Setup(const void* target_module, 82 const void* interceptor_module, 83 const char* target_name, 84 const char* interceptor_name, 85 const void* interceptor_entry_point, 86 void* thunk_storage, 87 size_t storage_bytes, 88 size_t* storage_used) { 89 if (storage_bytes < GetThunkSize()) 90 return STATUS_BUFFER_TOO_SMALL; 91 92 SmartThunk* thunk = reinterpret_cast<SmartThunk*>(thunk_storage); 93 thunk->module_base = target_module; 94 95 NTSTATUS ret; 96 if (interceptor_entry_point) { 97 thunk->interceptor = interceptor_entry_point; 98 } else { 99 ret = ResolveInterceptor(interceptor_module, interceptor_name, 100 &thunk->interceptor); 101 if (!NT_SUCCESS(ret)) 102 return ret; 103 } 104 105 // Perform a standard sidestep patch on the last part of the thunk, but point 106 // to our internal smart interceptor. 107 size_t standard_bytes = storage_bytes - offsetof(SmartThunk, sidestep); 108 ret = SidestepResolverThunk::Setup(target_module, interceptor_module, 109 target_name, NULL, &SmartStub, 110 &thunk->sidestep, standard_bytes, NULL); 111 if (!NT_SUCCESS(ret)) 112 return ret; 113 114 // Fix the internal thunk to pass the whole buffer to the interceptor. 115 SetInternalThunk(&thunk->sidestep.internal_thunk, GetInternalThunkSize(), 116 thunk_storage, &SmartStub); 117 118 if (storage_used) 119 *storage_used = GetThunkSize(); 120 121 return ret; 122 } 123 124 size_t SmartSidestepResolverThunk::GetThunkSize() const { 125 return GetInternalThunkSize() + kSizeOfSidestepStub + 126 offsetof(SmartThunk, sidestep); 127 } 128 129 // This code must basically either call the intended interceptor or skip the 130 // call and invoke instead the original function. In any case, we are saving 131 // the registers that may be trashed by our c++ code. 132 // 133 // This function is called with a first parameter inserted by us, that points 134 // to our SmartThunk. When we call the interceptor we have to replace this 135 // parameter with the one expected by that function (stored inside our 136 // structure); on the other hand, when we skip the interceptor we have to remove 137 // that extra argument before calling the original function. 138 // 139 // When we skip the interceptor, the transformation of the stack looks like: 140 // On Entry: On Use: On Exit: 141 // [param 2] = first real argument [param 2] (esp+1c) [param 2] 142 // [param 1] = our SmartThunk [param 1] (esp+18) [ret address] 143 // [ret address] = real caller [ret address] (esp+14) [xxx] 144 // [xxx] [addr to jump to] (esp+10) [xxx] 145 // [xxx] [saved eax] [xxx] 146 // [xxx] [saved ebx] [xxx] 147 // [xxx] [saved ecx] [xxx] 148 // [xxx] [saved edx] [xxx] 149 __declspec(naked) 150 void SmartSidestepResolverThunk::SmartStub() { 151 __asm { 152 push eax // Space for the jump. 153 push eax // Save registers. 154 push ebx 155 push ecx 156 push edx 157 mov ebx, [esp + 0x18] // First parameter = SmartThunk. 158 mov edx, [esp + 0x14] // Get the return address. 159 mov eax, [ebx]SmartThunk.module_base 160 push edx 161 push eax 162 call SmartSidestepResolverThunk::IsInternalCall 163 add esp, 8 164 165 test eax, eax 166 lea edx, [ebx]SmartThunk.sidestep // The original function. 167 jz call_interceptor 168 169 // Skip this call 170 mov ecx, [esp + 0x14] // Return address. 171 mov [esp + 0x18], ecx // Remove first parameter. 172 mov [esp + 0x10], edx 173 pop edx // Restore registers. 174 pop ecx 175 pop ebx 176 pop eax 177 ret 4 // Jump to original function. 178 179 call_interceptor: 180 mov ecx, [ebx]SmartThunk.interceptor 181 mov [esp + 0x18], edx // Replace first parameter. 182 mov [esp + 0x10], ecx 183 pop edx // Restore registers. 184 pop ecx 185 pop ebx 186 pop eax 187 ret // Jump to original function. 188 } 189 } 190 191 bool SmartSidestepResolverThunk::IsInternalCall(const void* base, 192 void* return_address) { 193 DCHECK_NT(base); 194 DCHECK_NT(return_address); 195 196 base::win::PEImage pe(base); 197 if (pe.GetImageSectionFromAddr(return_address)) 198 return true; 199 return false; 200 } 201 202 } // namespace sandbox 203
