1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "chrome_elf/create_file/chrome_create_file.h" 6 7 #include <windows.h> 8 9 #include <bitset> 10 #include <string> 11 12 #include "base/base_paths_win.h" 13 #include "base/files/file_path.h" 14 #include "base/files/file_util.h" 15 #include "base/files/scoped_temp_dir.h" 16 #include "base/path_service.h" 17 #include "base/threading/platform_thread.h" 18 #include "base/win/iat_patch_function.h" 19 #include "base/win/scoped_handle.h" 20 #include "base/win/windows_version.h" 21 #include "chrome_elf/chrome_elf_constants.h" 22 #include "chrome_elf/ntdll_cache.h" 23 #include "sandbox/win/src/interception_internal.h" 24 #include "sandbox/win/src/nt_internals.h" 25 #include "testing/gtest/include/gtest/gtest.h" 26 #include "testing/platform_test.h" 27 28 29 namespace { 30 31 // Test fixtures ------------------------------------------------------------- 32 33 class ChromeCreateFileTest : public PlatformTest { 34 protected: 35 struct NtCreateFileParams { 36 ACCESS_MASK desired_access; 37 OBJECT_ATTRIBUTES object_attributes; 38 PLARGE_INTEGER allocation_size; 39 ULONG file_attributes; 40 ULONG share_access; 41 ULONG create_disposition; 42 ULONG create_options; 43 PVOID ea_buffer; 44 ULONG ea_length; 45 }; 46 47 enum CallPath { 48 ELF, 49 KERNEL 50 }; 51 52 template<CallPath path> 53 static NTSTATUS WINAPI FakeNtCreateFile( 54 PHANDLE file_handle, 55 ACCESS_MASK desired_access, 56 POBJECT_ATTRIBUTES object_attributes, 57 PIO_STATUS_BLOCK io_status_block, 58 PLARGE_INTEGER allocation_size, 59 ULONG file_attributes, 60 ULONG share_access, 61 ULONG create_disposition, 62 ULONG create_options, 63 PVOID ea_buffer, 64 ULONG ea_length) { 65 return self_->HandleCreateFileCall(file_handle, 66 desired_access, 67 object_attributes, 68 io_status_block, 69 allocation_size, 70 file_attributes, 71 share_access, 72 create_disposition, 73 create_options, 74 ea_buffer, 75 ea_length, 76 path); 77 } 78 79 virtual void SetUp() OVERRIDE { 80 original_thread_ = base::PlatformThread::CurrentId(); 81 InitCache(); 82 PlatformTest::SetUp(); 83 84 base::FilePath user_data_dir; 85 PathService::Get(base::DIR_LOCAL_APP_DATA, &user_data_dir); 86 ASSERT_TRUE(temp_dir_.CreateUniqueTempDirUnderPath(user_data_dir)); 87 ASSERT_TRUE(temp_dir2_.CreateUniqueTempDir()); 88 self_ = this; 89 } 90 91 void UnsetThunkStorage() { 92 DWORD old_protect = 0; 93 EXPECT_TRUE(::VirtualProtect(&g_nt_thunk_storage, 94 sizeof(g_nt_thunk_storage), 95 PAGE_EXECUTE_READWRITE, 96 &old_protect)); 97 memset(&g_nt_thunk_storage, 0, sizeof(g_nt_thunk_storage)); 98 99 EXPECT_TRUE(::VirtualProtect(&g_nt_thunk_storage, 100 sizeof(g_nt_thunk_storage), 101 PAGE_EXECUTE_READ, 102 &old_protect)); 103 } 104 105 void RedirectNtCreateFileCalls() { 106 UnsetThunkStorage(); 107 old_func_ptr_ = 108 reinterpret_cast<NtCreateFileFunction>(g_ntdll_lookup["NtCreateFile"]); 109 110 // KernelBase.dll only exists for Win7 and later, prior to that, kernel32 111 // imports from ntdll directly. 112 if (base::win::GetVersion() < base::win::VERSION_WIN7) { 113 patcher_.Patch(L"kernel32.dll", "ntdll.dll", "NtCreateFile", 114 reinterpret_cast<void(*)()>(&FakeNtCreateFile<KERNEL>)); 115 } else { 116 patcher_.Patch(L"kernelbase.dll", "ntdll.dll", "NtCreateFile", 117 reinterpret_cast<void(*)()>(&FakeNtCreateFile<KERNEL>)); 118 } 119 120 g_ntdll_lookup["NtCreateFile"] = reinterpret_cast<void(*)()>( 121 &ChromeCreateFileTest::FakeNtCreateFile<ELF>); 122 } 123 124 void ResetNtCreateFileCalls() { 125 g_ntdll_lookup["NtCreateFile"] = reinterpret_cast<void*>(old_func_ptr_); 126 patcher_.Unpatch(); 127 } 128 129 NTSTATUS HandleCreateFileCall(PHANDLE file_handle, 130 ACCESS_MASK desired_access, 131 POBJECT_ATTRIBUTES object_attributes, 132 PIO_STATUS_BLOCK io_status_block, 133 PLARGE_INTEGER allocation_size, 134 ULONG file_attributes, 135 ULONG share_access, 136 ULONG create_disposition, 137 ULONG create_options, 138 PVOID ea_buffer, 139 ULONG ea_length, 140 CallPath call_path) { 141 if (original_thread_ == base::PlatformThread::CurrentId()) { 142 SetParams(desired_access, 143 object_attributes, 144 allocation_size, 145 file_attributes, 146 share_access, 147 create_disposition, 148 create_options, 149 ea_buffer, 150 ea_length, 151 call_path == ELF ? &elf_params_ : &kernel_params_); 152 } 153 154 // Forward the call to the real NTCreateFile. 155 return old_func_ptr_(file_handle, 156 desired_access, 157 object_attributes, 158 io_status_block, 159 allocation_size, 160 file_attributes, 161 share_access, 162 create_disposition, 163 create_options, 164 ea_buffer, 165 ea_length); 166 } 167 168 void SetParams(ACCESS_MASK desired_access, 169 POBJECT_ATTRIBUTES object_attributes, 170 PLARGE_INTEGER allocation_size, 171 ULONG file_attributes, 172 ULONG share_access, 173 ULONG create_disposition, 174 ULONG create_options, 175 PVOID ea_buffer, 176 ULONG ea_length, 177 NtCreateFileParams* params) { 178 params->desired_access = desired_access; 179 params->object_attributes.Length = object_attributes->Length; 180 params->object_attributes.ObjectName = object_attributes->ObjectName; 181 params->object_attributes.RootDirectory = object_attributes->RootDirectory; 182 params->object_attributes.Attributes = object_attributes->Attributes; 183 params->object_attributes.SecurityDescriptor = 184 object_attributes->SecurityDescriptor; 185 params->object_attributes.SecurityQualityOfService = 186 object_attributes->SecurityQualityOfService; 187 params->allocation_size = allocation_size; 188 params->file_attributes = file_attributes; 189 params->share_access = share_access; 190 params->create_disposition = create_disposition; 191 params->create_options = create_options; 192 params->ea_buffer = ea_buffer; 193 params->ea_length = ea_length; 194 } 195 196 void CheckParams() { 197 std::bitset<32> elf((int) elf_params_.desired_access); 198 std::bitset<32> ker((int) kernel_params_.desired_access); 199 200 EXPECT_EQ(kernel_params_.desired_access, elf_params_.desired_access) 201 << elf << "\n" << ker; 202 EXPECT_EQ(kernel_params_.object_attributes.Length, 203 elf_params_.object_attributes.Length); 204 EXPECT_EQ(kernel_params_.object_attributes.RootDirectory, 205 elf_params_.object_attributes.RootDirectory); 206 EXPECT_EQ(kernel_params_.object_attributes.Attributes, 207 elf_params_.object_attributes.Attributes); 208 EXPECT_EQ(kernel_params_.object_attributes.SecurityDescriptor, 209 elf_params_.object_attributes.SecurityDescriptor); 210 EXPECT_EQ(kernel_params_.allocation_size, elf_params_.allocation_size); 211 EXPECT_EQ(kernel_params_.file_attributes, elf_params_.file_attributes); 212 EXPECT_EQ(kernel_params_.share_access, elf_params_.share_access); 213 EXPECT_EQ(kernel_params_.create_disposition, 214 elf_params_.create_disposition); 215 EXPECT_EQ(kernel_params_.create_options, elf_params_.create_options); 216 EXPECT_EQ(kernel_params_.ea_buffer, elf_params_.ea_buffer); 217 EXPECT_EQ(kernel_params_.ea_length, elf_params_.ea_length); 218 } 219 220 void DoWriteCheck(const base::FilePath& path, DWORD flag, bool is_system) { 221 base::win::ScopedHandle file_handle; 222 const char kTestData[] = "0123456789"; 223 int buffer_size = sizeof(kTestData) - 1; 224 DWORD bytes_written; 225 226 if (is_system) { 227 file_handle.Set(::CreateFileW(path.value().c_str(), 228 GENERIC_WRITE, 229 FILE_SHARE_READ, 230 NULL, 231 CREATE_ALWAYS, 232 FILE_ATTRIBUTE_NORMAL | flag, 233 NULL)); 234 } else { 235 file_handle.Set(CreateFileNTDLL(path.value().c_str(), 236 GENERIC_WRITE, 237 FILE_SHARE_READ, 238 NULL, 239 CREATE_ALWAYS, 240 FILE_ATTRIBUTE_NORMAL | flag, 241 NULL)); 242 } 243 244 245 EXPECT_TRUE(file_handle.IsValid()); 246 ::WriteFile(file_handle.Get(), kTestData, buffer_size, &bytes_written, 247 NULL); 248 EXPECT_EQ(buffer_size, bytes_written); 249 } 250 251 void DoReadCheck(const base::FilePath& path, DWORD flag, bool is_system) { 252 base::win::ScopedHandle file_handle; 253 const char kTestData[] = "0123456789"; 254 int buffer_size = sizeof(kTestData) - 1; 255 DWORD bytes_read; 256 char read_buffer[10]; 257 258 if (is_system) { 259 file_handle.Set(::CreateFileW(path.value().c_str(), 260 GENERIC_READ, 261 0, 262 NULL, 263 OPEN_ALWAYS, 264 FILE_ATTRIBUTE_NORMAL | flag, 265 NULL)); 266 } else { 267 file_handle.Set(CreateFileNTDLL(path.value().c_str(), 268 GENERIC_READ, 269 0, 270 NULL, 271 OPEN_ALWAYS, 272 FILE_ATTRIBUTE_NORMAL | flag, 273 NULL)); 274 } 275 276 EXPECT_TRUE(file_handle.IsValid()); 277 ::ReadFile(file_handle.Get(), read_buffer, buffer_size, &bytes_read, NULL); 278 EXPECT_EQ(buffer_size, bytes_read); 279 EXPECT_EQ(0, memcmp(kTestData, read_buffer, bytes_read)); 280 } 281 282 void RunChecks(DWORD flag, bool check_reads) { 283 // Make sure we can write to this file handle when called via the system. 284 base::FilePath junk_path_1 = temp_dir_.path().Append(L"junk_1.txt"); 285 base::FilePath junk_path_2 = temp_dir_.path().Append(L"junk_2.txt"); 286 DoWriteCheck(junk_path_1, flag, true); 287 DoWriteCheck(junk_path_2, flag, false); 288 CheckParams(); 289 290 if (check_reads) { 291 // Make sure we can read from this file handle when called via the system. 292 DoReadCheck(junk_path_1, flag, true); 293 DoReadCheck(junk_path_2, flag, false); 294 CheckParams(); 295 } 296 base::DeleteFile(junk_path_1, false); 297 base::DeleteFile(junk_path_2, false); 298 299 } 300 301 static ChromeCreateFileTest* self_; 302 303 NtCreateFileFunction old_func_ptr_; 304 base::ScopedTempDir temp_dir_; 305 base::ScopedTempDir temp_dir2_; 306 base::win::IATPatchFunction patcher_; 307 NtCreateFileParams kernel_params_; 308 NtCreateFileParams elf_params_; 309 base::PlatformThreadId original_thread_; 310 }; 311 312 ChromeCreateFileTest* ChromeCreateFileTest::self_ = NULL; 313 314 // Tests --------------------------------------------------------------------- 315 TEST_F(ChromeCreateFileTest, CheckParams_FILE_ATTRIBUTE_NORMAL) { 316 RedirectNtCreateFileCalls(); 317 RunChecks(FILE_ATTRIBUTE_NORMAL, true); 318 ResetNtCreateFileCalls(); 319 } 320 321 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_WRITE_THROUGH) { 322 RedirectNtCreateFileCalls(); 323 RunChecks(FILE_FLAG_WRITE_THROUGH, true); 324 ResetNtCreateFileCalls(); 325 } 326 327 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_RANDOM_ACCESS) { 328 RedirectNtCreateFileCalls(); 329 RunChecks(FILE_FLAG_RANDOM_ACCESS, true); 330 ResetNtCreateFileCalls(); 331 } 332 333 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_SEQUENTIAL_SCAN) { 334 RedirectNtCreateFileCalls(); 335 RunChecks(FILE_FLAG_SEQUENTIAL_SCAN, true); 336 ResetNtCreateFileCalls(); 337 } 338 339 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_DELETE_ON_CLOSE) { 340 RedirectNtCreateFileCalls(); 341 RunChecks(FILE_FLAG_DELETE_ON_CLOSE, false); 342 ResetNtCreateFileCalls(); 343 } 344 345 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_BACKUP_SEMANTICS) { 346 RedirectNtCreateFileCalls(); 347 RunChecks(FILE_FLAG_BACKUP_SEMANTICS, true); 348 ResetNtCreateFileCalls(); 349 } 350 351 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_OPEN_REPARSE_POINT) { 352 RedirectNtCreateFileCalls(); 353 RunChecks(FILE_FLAG_OPEN_REPARSE_POINT, true); 354 ResetNtCreateFileCalls(); 355 } 356 357 TEST_F(ChromeCreateFileTest, CheckParams_FILE_FLAG_OPEN_NO_RECALL) { 358 RedirectNtCreateFileCalls(); 359 RunChecks(FILE_FLAG_OPEN_NO_RECALL, true); 360 ResetNtCreateFileCalls(); 361 } 362 363 TEST_F(ChromeCreateFileTest, BypassTest) { 364 std::wstring UNC_filepath_file(L"\\\\.\\some_file.txt"); 365 366 base::FilePath local_path; 367 PathService::Get(base::DIR_LOCAL_APP_DATA, &local_path); 368 369 base::FilePath local_prefs_path = local_path.Append(kAppDataDirName).Append( 370 kUserDataDirName).Append(L"default\\Preferences"); 371 base::FilePath local_state_path = local_path.Append(kAppDataDirName).Append( 372 kUserDataDirName).Append(L"ninja\\Local State"); 373 base::FilePath local_junk_path = local_path.Append(kAppDataDirName).Append( 374 kUserDataDirName).Append(L"default\\Junk"); 375 376 base::FilePath desktop_path; 377 PathService::Get(base::DIR_USER_DESKTOP, &desktop_path); 378 base::FilePath desktop_junk_path = 379 desktop_path.Append(L"Downloads\\junk.txt"); 380 base::FilePath desktop_prefs_path = 381 desktop_path.Append(L"Downloads\\Preferences"); 382 383 // Don't redirect UNC files. 384 EXPECT_FALSE(ShouldBypass(UNC_filepath_file.c_str())); 385 386 // Don't redirect if file is not in UserData directory. 387 EXPECT_FALSE(ShouldBypass(desktop_junk_path.value().c_str())); 388 EXPECT_FALSE(ShouldBypass(desktop_prefs_path.value().c_str())); 389 390 // Only redirect "Preferences" and "Local State" files. 391 EXPECT_TRUE(ShouldBypass(local_prefs_path.value().c_str())); 392 EXPECT_TRUE(ShouldBypass(local_state_path.value().c_str())); 393 EXPECT_FALSE(ShouldBypass(local_junk_path.value().c_str())); 394 } 395 396 TEST_F(ChromeCreateFileTest, ReadWriteFromNtDll) { 397 UnsetThunkStorage(); 398 base::FilePath file_name = temp_dir_.path().Append(L"some_file.txt"); 399 DoWriteCheck(file_name, FILE_ATTRIBUTE_NORMAL, false); 400 DoReadCheck(file_name, FILE_ATTRIBUTE_NORMAL, false); 401 } 402 403 TEST_F(ChromeCreateFileTest, ReadWriteFromThunk) { 404 base::FilePath file_name = temp_dir_.path().Append(L"some_file.txt"); 405 DoWriteCheck(file_name, FILE_ATTRIBUTE_NORMAL, false); 406 DoReadCheck(file_name, FILE_ATTRIBUTE_NORMAL, false); 407 } 408 409 } // namespace 410