sandbox/win/src/interception.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 // For information about interceptions as a whole see
   6 // http://dev.chromium.org/developers/design-documents/sandbox .
   7
   8 #include <set>
   9
  10 #include "sandbox/win/src/interception.h"
  11
  12 #include "base/logging.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/win/pe_image.h"
  15 #include "base/win/windows_version.h"
  16 #include "sandbox/win/src/interception_internal.h"
  17 #include "sandbox/win/src/interceptors.h"
  18 #include "sandbox/win/src/sandbox.h"
  19 #include "sandbox/win/src/sandbox_utils.h"
  20 #include "sandbox/win/src/service_resolver.h"
  21 #include "sandbox/win/src/target_interceptions.h"
  22 #include "sandbox/win/src/target_process.h"
  23 #include "sandbox/win/src/wow64.h"
  24
  25 namespace {
  26
  27 const char kMapViewOfSectionName[] = "NtMapViewOfSection";
  28 const char kUnmapViewOfSectionName[] = "NtUnmapViewOfSection";
  29
  30 // Standard allocation granularity and page size for Windows.
  31 const size_t kAllocGranularity = 65536;
  32 const size_t kPageSize = 4096;
  33
  34 // Find a random offset within 64k and aligned to ceil(log2(size)).
  35 size_t GetGranularAlignedRandomOffset(size_t size) {
  36   CHECK_LE(size, kAllocGranularity);
  37   unsigned int offset;
  38
  39   do {
  40     rand_s(&offset);
  41     offset &= (kAllocGranularity - 1);
  42   } while (offset > (kAllocGranularity - size));
  43
  44   // Find an alignment between 64 and the page size (4096).
  45   size_t align_size = kPageSize;
  46   for (size_t new_size = align_size / 2;  new_size >= size; new_size /= 2) {
  47     align_size = new_size;
  48   }
  49   return offset & ~(align_size - 1);
  50 }
  51
  52 }  // namespace
  53
  54 namespace sandbox {
  55
  56 SANDBOX_INTERCEPT SharedMemory* g_interceptions;
  57
  58 // Table of the unpatched functions that we intercept. Mapped from the parent.
  59 SANDBOX_INTERCEPT OriginalFunctions g_originals = { NULL };
  60
  61 // Magic constant that identifies that this function is not to be patched.
  62 const char kUnloadDLLDummyFunction[] = "@";
  63
  64 InterceptionManager::InterceptionManager(TargetProcess* child_process,
  65                                          bool relaxed)
  66     : child_(child_process), names_used_(false), relaxed_(relaxed) {
  67   child_->AddRef();
  68 }
  69 InterceptionManager::~InterceptionManager() {
  70   child_->Release();
  71 }
  72
  73 bool InterceptionManager::AddToPatchedFunctions(
  74     const wchar_t* dll_name, const char* function_name,
  75     InterceptionType interception_type, const void* replacement_code_address,
  76     InterceptorId id) {
  77   InterceptionData function;
  78   function.type = interception_type;
  79   function.id = id;
  80   function.dll = dll_name;
  81   function.function = function_name;
  82   function.interceptor_address = replacement_code_address;
  83
  84   interceptions_.push_back(function);
  85   return true;
  86 }
  87
  88 bool InterceptionManager::AddToPatchedFunctions(
  89     const wchar_t* dll_name, const char* function_name,
  90     InterceptionType interception_type, const char* replacement_function_name,
  91     InterceptorId id) {
  92   InterceptionData function;
  93   function.type = interception_type;
  94   function.id = id;
  95   function.dll = dll_name;
  96   function.function = function_name;
  97   function.interceptor = replacement_function_name;
  98   function.interceptor_address = NULL;
  99
 100   interceptions_.push_back(function);
 101   names_used_ = true;
 102   return true;
 103 }
 104
 105 bool InterceptionManager::AddToUnloadModules(const wchar_t* dll_name) {
 106   InterceptionData module_to_unload;
 107   module_to_unload.type = INTERCEPTION_UNLOAD_MODULE;
 108   module_to_unload.dll = dll_name;
 109   // The next two are dummy values that make the structures regular, instead
 110   // of having special cases. They should not be used.
 111   module_to_unload.function = kUnloadDLLDummyFunction;
 112   module_to_unload.interceptor_address = reinterpret_cast<void*>(1);
 113
 114   interceptions_.push_back(module_to_unload);
 115   return true;
 116 }
 117
 118 bool InterceptionManager::InitializeInterceptions() {
 119   if (interceptions_.empty())
 120     return true;  // Nothing to do here
 121
 122   size_t buffer_bytes = GetBufferSize();
 123   scoped_ptr<char[]> local_buffer(new char[buffer_bytes]);
 124
 125   if (!SetupConfigBuffer(local_buffer.get(), buffer_bytes))
 126     return false;
 127
 128   void* remote_buffer;
 129   if (!CopyDataToChild(local_buffer.get(), buffer_bytes, &remote_buffer))
 130     return false;
 131
 132   bool hot_patch_needed = (0 != buffer_bytes);
 133   if (!PatchNtdll(hot_patch_needed))
 134     return false;
 135
 136   g_interceptions = reinterpret_cast<SharedMemory*>(remote_buffer);
 137   ResultCode rc = child_->TransferVariable("g_interceptions",
 138                                            &g_interceptions,
 139                                            sizeof(g_interceptions));
 140   return (SBOX_ALL_OK == rc);
 141 }
 142
 143 size_t InterceptionManager::GetBufferSize() const {
 144   std::set<std::wstring> dlls;
 145   size_t buffer_bytes = 0;
 146
 147   std::list<InterceptionData>::const_iterator it = interceptions_.begin();
 148   for (; it != interceptions_.end(); ++it) {
 149     // skip interceptions that are performed from the parent
 150     if (!IsInterceptionPerformedByChild(*it))
 151       continue;
 152
 153     if (!dlls.count(it->dll)) {
 154       // NULL terminate the dll name on the structure
 155       size_t dll_name_bytes = (it->dll.size() + 1) * sizeof(wchar_t);
 156
 157       // include the dll related size
 158       buffer_bytes += RoundUpToMultiple(offsetof(DllPatchInfo, dll_name) +
 159                                             dll_name_bytes, sizeof(size_t));
 160       dlls.insert(it->dll);
 161     }
 162
 163     // we have to NULL terminate the strings on the structure
 164     size_t strings_chars = it->function.size() + it->interceptor.size() + 2;
 165
 166     // a new FunctionInfo is required per function
 167     size_t record_bytes = offsetof(FunctionInfo, function) + strings_chars;
 168     record_bytes = RoundUpToMultiple(record_bytes, sizeof(size_t));
 169     buffer_bytes += record_bytes;
 170   }
 171
 172   if (0 != buffer_bytes)
 173     // add the part of SharedMemory that we have not counted yet
 174     buffer_bytes += offsetof(SharedMemory, dll_list);
 175
 176   return buffer_bytes;
 177 }
 178
 179 // Basically, walk the list of interceptions moving them to the config buffer,
 180 // but keeping together all interceptions that belong to the same dll.
 181 // The config buffer is a local buffer, not the one allocated on the child.
 182 bool InterceptionManager::SetupConfigBuffer(void* buffer, size_t buffer_bytes) {
 183   if (0 == buffer_bytes)
 184     return true;
 185
 186   DCHECK(buffer_bytes > sizeof(SharedMemory));
 187
 188   SharedMemory* shared_memory = reinterpret_cast<SharedMemory*>(buffer);
 189   DllPatchInfo* dll_info = shared_memory->dll_list;
 190   int num_dlls = 0;
 191
 192   shared_memory->interceptor_base = names_used_ ? child_->MainModule() : NULL;
 193
 194   buffer_bytes -= offsetof(SharedMemory, dll_list);
 195   buffer = dll_info;
 196
 197   std::list<InterceptionData>::iterator it = interceptions_.begin();
 198   for (; it != interceptions_.end();) {
 199     // skip interceptions that are performed from the parent
 200     if (!IsInterceptionPerformedByChild(*it)) {
 201       ++it;
 202       continue;
 203     }
 204
 205     const std::wstring dll = it->dll;
 206     if (!SetupDllInfo(*it, &buffer, &buffer_bytes))
 207       return false;
 208
 209     // walk the interceptions from this point, saving the ones that are
 210     // performed on this dll, and removing the entry from the list.
 211     // advance the iterator before removing the element from the list
 212     std::list<InterceptionData>::iterator rest = it;
 213     for (; rest != interceptions_.end();) {
 214       if (rest->dll == dll) {
 215         if (!SetupInterceptionInfo(*rest, &buffer, &buffer_bytes, dll_info))
 216           return false;
 217         if (it == rest)
 218           ++it;
 219         rest = interceptions_.erase(rest);
 220       } else {
 221         ++rest;
 222       }
 223     }
 224     dll_info = reinterpret_cast<DllPatchInfo*>(buffer);
 225     ++num_dlls;
 226   }
 227
 228   shared_memory->num_intercepted_dlls = num_dlls;
 229   return true;
 230 }
 231
 232 // Fills up just the part that depends on the dll, not the info that depends on
 233 // the actual interception.
 234 bool InterceptionManager::SetupDllInfo(const InterceptionData& data,
 235                                        void** buffer,
 236                                        size_t* buffer_bytes) const {
 237   DCHECK(buffer_bytes);
 238   DCHECK(buffer);
 239   DCHECK(*buffer);
 240
 241   DllPatchInfo* dll_info = reinterpret_cast<DllPatchInfo*>(*buffer);
 242
 243   // the strings have to be zero terminated
 244   size_t required = offsetof(DllPatchInfo, dll_name) +
 245                     (data.dll.size() + 1) * sizeof(wchar_t);
 246   required = RoundUpToMultiple(required, sizeof(size_t));
 247   if (*buffer_bytes < required)
 248     return false;
 249
 250   *buffer_bytes -= required;
 251   *buffer = reinterpret_cast<char*>(*buffer) + required;
 252
 253   // set up the dll info to be what we know about it at this time
 254   dll_info->unload_module = (data.type == INTERCEPTION_UNLOAD_MODULE);
 255   dll_info->record_bytes = required;
 256   dll_info->offset_to_functions = required;
 257   dll_info->num_functions = 0;
 258   data.dll._Copy_s(dll_info->dll_name, data.dll.size(), data.dll.size());
 259   dll_info->dll_name[data.dll.size()] = L'\0';
 260
 261   return true;
 262 }
 263
 264 bool InterceptionManager::SetupInterceptionInfo(const InterceptionData& data,
 265                                                 void** buffer,
 266                                                 size_t* buffer_bytes,
 267                                                 DllPatchInfo* dll_info) const {
 268   DCHECK(buffer_bytes);
 269   DCHECK(buffer);
 270   DCHECK(*buffer);
 271
 272   if ((dll_info->unload_module) &&
 273       (data.function != kUnloadDLLDummyFunction)) {
 274     // Can't specify a dll for both patch and unload.
 275     NOTREACHED();
 276   }
 277
 278   FunctionInfo* function = reinterpret_cast<FunctionInfo*>(*buffer);
 279
 280   size_t name_bytes = data.function.size();
 281   size_t interceptor_bytes = data.interceptor.size();
 282
 283   // the strings at the end of the structure are zero terminated
 284   size_t required = offsetof(FunctionInfo, function) +
 285                     name_bytes + interceptor_bytes + 2;
 286   required = RoundUpToMultiple(required, sizeof(size_t));
 287   if (*buffer_bytes < required)
 288     return false;
 289
 290   // update the caller's values
 291   *buffer_bytes -= required;
 292   *buffer = reinterpret_cast<char*>(*buffer) + required;
 293
 294   function->record_bytes = required;
 295   function->type = data.type;
 296   function->id = data.id;
 297   function->interceptor_address = data.interceptor_address;
 298   char* names = function->function;
 299
 300   data.function._Copy_s(names, name_bytes, name_bytes);
 301   names += name_bytes;
 302   *names++ = '\0';
 303
 304   // interceptor follows the function_name
 305   data.interceptor._Copy_s(names, interceptor_bytes, interceptor_bytes);
 306   names += interceptor_bytes;
 307   *names++ = '\0';
 308
 309   // update the dll table
 310   dll_info->num_functions++;
 311   dll_info->record_bytes += required;
 312
 313   return true;
 314 }
 315
 316 bool InterceptionManager::CopyDataToChild(const void* local_buffer,
 317                                           size_t buffer_bytes,
 318                                           void** remote_buffer) const {
 319   DCHECK(NULL != remote_buffer);
 320   if (0 == buffer_bytes) {
 321     *remote_buffer = NULL;
 322     return true;
 323   }
 324
 325   HANDLE child = child_->Process();
 326
 327   // Allocate memory on the target process without specifying the address
 328   void* remote_data = ::VirtualAllocEx(child, NULL, buffer_bytes,
 329                                        MEM_COMMIT, PAGE_READWRITE);
 330   if (NULL == remote_data)
 331     return false;
 332
 333   SIZE_T bytes_written;
 334   BOOL success = ::WriteProcessMemory(child, remote_data, local_buffer,
 335                                       buffer_bytes, &bytes_written);
 336   if (FALSE == success || bytes_written != buffer_bytes) {
 337     ::VirtualFreeEx(child, remote_data, 0, MEM_RELEASE);
 338     return false;
 339   }
 340
 341   *remote_buffer = remote_data;
 342
 343   return true;
 344 }
 345
 346 // Only return true if the child should be able to perform this interception.
 347 bool InterceptionManager::IsInterceptionPerformedByChild(
 348     const InterceptionData& data) const {
 349   if (INTERCEPTION_INVALID == data.type)
 350     return false;
 351
 352   if (INTERCEPTION_SERVICE_CALL == data.type)
 353     return false;
 354
 355   if (data.type >= INTERCEPTION_LAST)
 356     return false;
 357
 358   std::wstring ntdll(kNtdllName);
 359   if (ntdll == data.dll)
 360     return false;  // ntdll has to be intercepted from the parent
 361
 362   return true;
 363 }
 364
 365 bool InterceptionManager::PatchNtdll(bool hot_patch_needed) {
 366   // Maybe there is nothing to do
 367   if (!hot_patch_needed && interceptions_.empty())
 368     return true;
 369
 370   if (hot_patch_needed) {
 371 #if SANDBOX_EXPORTS
 372     // Make sure the functions are not excluded by the linker.
 373 #if defined(_WIN64)
 374     #pragma comment(linker, "/include:TargetNtMapViewOfSection64")
 375     #pragma comment(linker, "/include:TargetNtUnmapViewOfSection64")
 376 #else
 377     #pragma comment(linker, "/include:_TargetNtMapViewOfSection@44")
 378     #pragma comment(linker, "/include:_TargetNtUnmapViewOfSection@12")
 379 #endif
 380 #endif
 381     ADD_NT_INTERCEPTION(NtMapViewOfSection, MAP_VIEW_OF_SECTION_ID, 44);
 382     ADD_NT_INTERCEPTION(NtUnmapViewOfSection, UNMAP_VIEW_OF_SECTION_ID, 12);
 383   }
 384
 385   // Reserve a full 64k memory range in the child process.
 386   HANDLE child = child_->Process();
 387   BYTE* thunk_base = reinterpret_cast<BYTE*>(
 388                          ::VirtualAllocEx(child, NULL, kAllocGranularity,
 389                                           MEM_RESERVE, PAGE_NOACCESS));
 390
 391   // Find an aligned, random location within the reserved range.
 392   size_t thunk_bytes = interceptions_.size() * sizeof(ThunkData) +
 393                        sizeof(DllInterceptionData);
 394   size_t thunk_offset = GetGranularAlignedRandomOffset(thunk_bytes);
 395
 396   // Split the base and offset along page boundaries.
 397   thunk_base += thunk_offset & ~(kPageSize - 1);
 398   thunk_offset &= kPageSize - 1;
 399
 400   // Make an aligned, padded allocation, and move the pointer to our chunk.
 401   size_t thunk_bytes_padded = (thunk_bytes + kPageSize - 1) & kPageSize;
 402   thunk_base = reinterpret_cast<BYTE*>(
 403                    ::VirtualAllocEx(child, thunk_base, thunk_bytes_padded,
 404                                     MEM_COMMIT, PAGE_EXECUTE_READWRITE));
 405   CHECK(thunk_base);  // If this fails we'd crash anyway on an invalid access.
 406   DllInterceptionData* thunks = reinterpret_cast<DllInterceptionData*>(
 407                                     thunk_base + thunk_offset);
 408
 409   DllInterceptionData dll_data;
 410   dll_data.data_bytes = thunk_bytes;
 411   dll_data.num_thunks = 0;
 412   dll_data.used_bytes = offsetof(DllInterceptionData, thunks);
 413
 414   // Reset all helpers for a new child.
 415   memset(g_originals, 0, sizeof(g_originals));
 416
 417   // this should write all the individual thunks to the child's memory
 418   if (!PatchClientFunctions(thunks, thunk_bytes, &dll_data))
 419     return false;
 420
 421   // and now write the first part of the table to the child's memory
 422   SIZE_T written;
 423   bool ok = FALSE != ::WriteProcessMemory(child, thunks, &dll_data,
 424                                           offsetof(DllInterceptionData, thunks),
 425                                           &written);
 426
 427   if (!ok || (offsetof(DllInterceptionData, thunks) != written))
 428     return false;
 429
 430   // Attempt to protect all the thunks, but ignore failure
 431   DWORD old_protection;
 432   ::VirtualProtectEx(child, thunks, thunk_bytes,
 433                      PAGE_EXECUTE_READ, &old_protection);
 434
 435   ResultCode ret = child_->TransferVariable("g_originals", g_originals,
 436                                             sizeof(g_originals));
 437   return (SBOX_ALL_OK == ret);
 438 }
 439
 440 bool InterceptionManager::PatchClientFunctions(DllInterceptionData* thunks,
 441                                                size_t thunk_bytes,
 442                                                DllInterceptionData* dll_data) {
 443   DCHECK(NULL != thunks);
 444   DCHECK(NULL != dll_data);
 445
 446   HMODULE ntdll_base = ::GetModuleHandle(kNtdllName);
 447   if (!ntdll_base)
 448     return false;
 449
 450   base::win::PEImage ntdll_image(ntdll_base);
 451
 452   // Bypass purify's interception.
 453   wchar_t* loader_get = reinterpret_cast<wchar_t*>(
 454                             ntdll_image.GetProcAddress("LdrGetDllHandle"));
 455   if (loader_get) {
 456     if (!GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
 457                                GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
 458                            loader_get, &ntdll_base))
 459       return false;
 460   }
 461
 462   if (base::win::GetVersion() <= base::win::VERSION_VISTA) {
 463     Wow64 WowHelper(child_, ntdll_base);
 464     if (!WowHelper.WaitForNtdll())
 465       return false;
 466   }
 467
 468   char* interceptor_base = NULL;
 469
 470 #if SANDBOX_EXPORTS
 471   interceptor_base = reinterpret_cast<char*>(child_->MainModule());
 472   HMODULE local_interceptor = ::LoadLibrary(child_->Name());
 473 #endif
 474
 475   ServiceResolverThunk* thunk;
 476 #if defined(_WIN64)
 477   thunk = new ServiceResolverThunk(child_->Process(), relaxed_);
 478 #else
 479   base::win::OSInfo* os_info = base::win::OSInfo::GetInstance();
 480   if (os_info->wow64_status() == base::win::OSInfo::WOW64_ENABLED) {
 481     if (os_info->version() >= base::win::VERSION_WIN8)
 482       thunk = new Wow64W8ResolverThunk(child_->Process(), relaxed_);
 483     else
 484       thunk = new Wow64ResolverThunk(child_->Process(), relaxed_);
 485   } else if (!IsXPSP2OrLater()) {
 486     thunk = new Win2kResolverThunk(child_->Process(), relaxed_);
 487   } else if (os_info->version() >= base::win::VERSION_WIN8) {
 488     thunk = new Win8ResolverThunk(child_->Process(), relaxed_);
 489   } else {
 490     thunk = new ServiceResolverThunk(child_->Process(), relaxed_);
 491   }
 492 #endif
 493
 494   std::list<InterceptionData>::iterator it = interceptions_.begin();
 495   for (; it != interceptions_.end(); ++it) {
 496     const std::wstring ntdll(kNtdllName);
 497     if (it->dll != ntdll)
 498       break;
 499
 500     if (INTERCEPTION_SERVICE_CALL != it->type)
 501       break;
 502
 503 #if SANDBOX_EXPORTS
 504     // We may be trying to patch by function name.
 505     if (NULL == it->interceptor_address) {
 506       const char* address;
 507       NTSTATUS ret = thunk->ResolveInterceptor(local_interceptor,
 508                                                it->interceptor.c_str(),
 509                                                reinterpret_cast<const void**>(
 510                                                &address));
 511       if (!NT_SUCCESS(ret))
 512         break;
 513
 514       // Translate the local address to an address on the child.
 515       it->interceptor_address = interceptor_base + (address -
 516                                     reinterpret_cast<char*>(local_interceptor));
 517     }
 518 #endif
 519     NTSTATUS ret = thunk->Setup(ntdll_base,
 520                                 interceptor_base,
 521                                 it->function.c_str(),
 522                                 it->interceptor.c_str(),
 523                                 it->interceptor_address,
 524                                 &thunks->thunks[dll_data->num_thunks],
 525                                 thunk_bytes - dll_data->used_bytes,
 526                                 NULL);
 527     if (!NT_SUCCESS(ret))
 528       break;
 529
 530     DCHECK(!g_originals[it->id]);
 531     g_originals[it->id] = &thunks->thunks[dll_data->num_thunks];
 532
 533     dll_data->num_thunks++;
 534     dll_data->used_bytes += sizeof(ThunkData);
 535   }
 536
 537   delete(thunk);
 538
 539 #if SANDBOX_EXPORTS
 540   if (NULL != local_interceptor)
 541     ::FreeLibrary(local_interceptor);
 542 #endif
 543
 544   if (it != interceptions_.end())
 545     return false;
 546
 547   return true;
 548 }
 549
 550 }  // namespace sandbox