1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "sandbox/win/src/service_resolver.h" 6 7 #include "base/memory/scoped_ptr.h" 8 #include "sandbox/win/src/sandbox_nt_util.h" 9 #include "sandbox/win/src/win_utils.h" 10 11 namespace { 12 #pragma pack(push, 1) 13 14 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C; 15 const USHORT kSyscall = 0x050F; 16 const BYTE kRetNp = 0xC3; 17 const ULONG64 kMov1 = 0x54894808244C8948; 18 const ULONG64 kMov2 = 0x4C182444894C1024; 19 const ULONG kMov3 = 0x20244C89; 20 21 // Service code for 64 bit systems. 22 struct ServiceEntry { 23 // This struct contains roughly the following code: 24 // 00 mov r10,rcx 25 // 03 mov eax,52h 26 // 08 syscall 27 // 0a ret 28 // 0b xchg ax,ax 29 // 0e xchg ax,ax 30 31 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 32 ULONG service_id; 33 USHORT syscall; // = 0F 05 34 BYTE ret; // = C3 35 BYTE pad; // = 66 36 USHORT xchg_ax_ax1; // = 66 90 37 USHORT xchg_ax_ax2; // = 66 90 38 }; 39 40 // Service code for 64 bit Windows 8. 41 struct ServiceEntryW8 { 42 // This struct contains the following code: 43 // 00 48894c2408 mov [rsp+8], rcx 44 // 05 4889542410 mov [rsp+10], rdx 45 // 0a 4c89442418 mov [rsp+18], r8 46 // 0f 4c894c2420 mov [rsp+20], r9 47 // 14 4c8bd1 mov r10,rcx 48 // 17 b825000000 mov eax,25h 49 // 1c 0f05 syscall 50 // 1e c3 ret 51 // 1f 90 nop 52 53 ULONG64 mov_1; // = 48 89 4C 24 08 48 89 54 54 ULONG64 mov_2; // = 24 10 4C 89 44 24 18 4C 55 ULONG mov_3; // = 89 4C 24 20 56 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8 57 ULONG service_id; 58 USHORT syscall; // = 0F 05 59 BYTE ret; // = C3 60 BYTE nop; // = 90 61 }; 62 63 // We don't have an internal thunk for x64. 64 struct ServiceFullThunk { 65 union { 66 ServiceEntry original; 67 ServiceEntryW8 original_w8; 68 }; 69 }; 70 71 #pragma pack(pop) 72 73 bool IsService(const void* source) { 74 const ServiceEntry* service = 75 reinterpret_cast<const ServiceEntry*>(source); 76 77 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax && 78 kSyscall == service->syscall && kRetNp == service->ret); 79 } 80 81 }; // namespace 82 83 namespace sandbox { 84 85 NTSTATUS ServiceResolverThunk::Setup(const void* target_module, 86 const void* interceptor_module, 87 const char* target_name, 88 const char* interceptor_name, 89 const void* interceptor_entry_point, 90 void* thunk_storage, 91 size_t storage_bytes, 92 size_t* storage_used) { 93 NTSTATUS ret = Init(target_module, interceptor_module, target_name, 94 interceptor_name, interceptor_entry_point, 95 thunk_storage, storage_bytes); 96 if (!NT_SUCCESS(ret)) 97 return ret; 98 99 size_t thunk_bytes = GetThunkSize(); 100 scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]); 101 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>( 102 thunk_buffer.get()); 103 104 if (!IsFunctionAService(&thunk->original)) 105 return STATUS_UNSUCCESSFUL; 106 107 ret = PerformPatch(thunk, thunk_storage); 108 109 if (NULL != storage_used) 110 *storage_used = thunk_bytes; 111 112 return ret; 113 } 114 115 size_t ServiceResolverThunk::GetThunkSize() const { 116 return sizeof(ServiceFullThunk); 117 } 118 119 NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module, 120 const char* target_name, 121 BYTE* thunk_storage, 122 size_t storage_bytes, 123 size_t* storage_used) { 124 NTSTATUS ret = ResolveTarget(target_module, target_name, &target_); 125 if (!NT_SUCCESS(ret)) 126 return ret; 127 128 size_t thunk_bytes = GetThunkSize(); 129 if (storage_bytes < thunk_bytes) 130 return STATUS_UNSUCCESSFUL; 131 132 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage); 133 134 if (!IsFunctionAService(&thunk->original)) 135 return STATUS_UNSUCCESSFUL; 136 137 if (NULL != storage_used) 138 *storage_used = thunk_bytes; 139 140 return ret; 141 } 142 143 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const { 144 ServiceFullThunk function_code; 145 SIZE_T read; 146 if (!::ReadProcessMemory(process_, target_, &function_code, 147 sizeof(function_code), &read)) 148 return false; 149 150 if (sizeof(function_code) != read) 151 return false; 152 153 if (!IsService(&function_code)) { 154 // See if it's the Win8 signature. 155 ServiceEntryW8* w8_service = &function_code.original_w8; 156 if (!IsService(&w8_service->mov_r10_rcx_mov_eax) || 157 w8_service->mov_1 != kMov1 || w8_service->mov_1 != kMov1 || 158 w8_service->mov_1 != kMov1) { 159 return false; 160 } 161 } 162 163 // Save the verified code. 164 memcpy(local_thunk, &function_code, sizeof(function_code)); 165 166 return true; 167 } 168 169 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk, 170 void* remote_thunk) { 171 ServiceFullThunk* full_local_thunk = 172 reinterpret_cast<ServiceFullThunk*>(local_thunk); 173 ServiceFullThunk* full_remote_thunk = 174 reinterpret_cast<ServiceFullThunk*>(remote_thunk); 175 176 // Patch the original code. 177 ServiceEntry local_service; 178 DCHECK_NT(GetInternalThunkSize() >= sizeof(local_service)); 179 if (!SetInternalThunk(&local_service, sizeof(local_service), NULL, 180 interceptor_)) 181 return STATUS_UNSUCCESSFUL; 182 183 // Copy the local thunk buffer to the child. 184 SIZE_T actual; 185 if (!::WriteProcessMemory(process_, remote_thunk, local_thunk, 186 sizeof(ServiceFullThunk), &actual)) 187 return STATUS_UNSUCCESSFUL; 188 189 if (sizeof(ServiceFullThunk) != actual) 190 return STATUS_UNSUCCESSFUL; 191 192 // And now change the function to intercept, on the child. 193 if (NULL != ntdll_base_) { 194 // Running a unit test. 195 if (!::WriteProcessMemory(process_, target_, &local_service, 196 sizeof(local_service), &actual)) 197 return STATUS_UNSUCCESSFUL; 198 } else { 199 if (!WriteProtectedChildMemory(process_, target_, &local_service, 200 sizeof(local_service))) 201 return STATUS_UNSUCCESSFUL; 202 } 203 204 return STATUS_SUCCESS; 205 } 206 207 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const { 208 NOTREACHED_NT(); 209 return false; 210 } 211 212 } // namespace sandbox 213
