sandbox/win/src/service_resolver_64.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/win/src/service_resolver.h"
   6
   7 #include "base/memory/scoped_ptr.h"
   8 #include "sandbox/win/src/sandbox_nt_util.h"
   9 #include "sandbox/win/src/win_utils.h"
  10
  11 namespace {
  12 #pragma pack(push, 1)
  13
  14 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C;
  15 const USHORT kSyscall = 0x050F;
  16 const BYTE kRetNp = 0xC3;
  17 const ULONG64 kMov1 = 0x54894808244C8948;
  18 const ULONG64 kMov2 = 0x4C182444894C1024;
  19 const ULONG kMov3 = 0x20244C89;
  20
  21 // Service code for 64 bit systems.
  22 struct ServiceEntry {
  23   // This struct contains roughly the following code:
  24   // 00 mov     r10,rcx
  25   // 03 mov     eax,52h
  26   // 08 syscall
  27   // 0a ret
  28   // 0b xchg    ax,ax
  29   // 0e xchg    ax,ax
  30
  31   ULONG mov_r10_rcx_mov_eax;  // = 4C 8B D1 B8
  32   ULONG service_id;
  33   USHORT syscall;             // = 0F 05
  34   BYTE ret;                   // = C3
  35   BYTE pad;                   // = 66
  36   USHORT xchg_ax_ax1;         // = 66 90
  37   USHORT xchg_ax_ax2;         // = 66 90
  38 };
  39
  40 // Service code for 64 bit Windows 8.
  41 struct ServiceEntryW8 {
  42   // This struct contains the following code:
  43   // 00 48894c2408      mov     [rsp+8], rcx
  44   // 05 4889542410      mov     [rsp+10], rdx
  45   // 0a 4c89442418      mov     [rsp+18], r8
  46   // 0f 4c894c2420      mov     [rsp+20], r9
  47   // 14 4c8bd1          mov     r10,rcx
  48   // 17 b825000000      mov     eax,25h
  49   // 1c 0f05            syscall
  50   // 1e c3              ret
  51   // 1f 90              nop
  52
  53   ULONG64 mov_1;              // = 48 89 4C 24 08 48 89 54
  54   ULONG64 mov_2;              // = 24 10 4C 89 44 24 18 4C
  55   ULONG mov_3;                // = 89 4C 24 20
  56   ULONG mov_r10_rcx_mov_eax;  // = 4C 8B D1 B8
  57   ULONG service_id;
  58   USHORT syscall;             // = 0F 05
  59   BYTE ret;                   // = C3
  60   BYTE nop;                   // = 90
  61 };
  62
  63 // We don't have an internal thunk for x64.
  64 struct ServiceFullThunk {
  65   union {
  66     ServiceEntry original;
  67     ServiceEntryW8 original_w8;
  68   };
  69 };
  70
  71 #pragma pack(pop)
  72
  73 bool IsService(const void* source) {
  74   const ServiceEntry* service =
  75       reinterpret_cast<const ServiceEntry*>(source);
  76
  77   return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
  78           kSyscall == service->syscall && kRetNp == service->ret);
  79 }
  80
  81 };  // namespace
  82
  83 namespace sandbox {
  84
  85 NTSTATUS ServiceResolverThunk::Setup(const void* target_module,
  86                                      const void* interceptor_module,
  87                                      const char* target_name,
  88                                      const char* interceptor_name,
  89                                      const void* interceptor_entry_point,
  90                                      void* thunk_storage,
  91                                      size_t storage_bytes,
  92                                      size_t* storage_used) {
  93   NTSTATUS ret = Init(target_module, interceptor_module, target_name,
  94                       interceptor_name, interceptor_entry_point,
  95                       thunk_storage, storage_bytes);
  96   if (!NT_SUCCESS(ret))
  97     return ret;
  98
  99   size_t thunk_bytes = GetThunkSize();
 100   scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]);
 101   ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(
 102                                 thunk_buffer.get());
 103
 104   if (!IsFunctionAService(&thunk->original))
 105     return STATUS_UNSUCCESSFUL;
 106
 107   ret = PerformPatch(thunk, thunk_storage);
 108
 109   if (NULL != storage_used)
 110     *storage_used = thunk_bytes;
 111
 112   return ret;
 113 }
 114
 115 size_t ServiceResolverThunk::GetThunkSize() const {
 116   return sizeof(ServiceFullThunk);
 117 }
 118
 119 NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module,
 120                                          const char* target_name,
 121                                          BYTE* thunk_storage,
 122                                          size_t storage_bytes,
 123                                          size_t* storage_used) {
 124   NTSTATUS ret = ResolveTarget(target_module, target_name, &target_);
 125   if (!NT_SUCCESS(ret))
 126     return ret;
 127
 128   size_t thunk_bytes = GetThunkSize();
 129   if (storage_bytes < thunk_bytes)
 130     return STATUS_UNSUCCESSFUL;
 131
 132   ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage);
 133
 134   if (!IsFunctionAService(&thunk->original))
 135     return STATUS_UNSUCCESSFUL;
 136
 137   if (NULL != storage_used)
 138     *storage_used = thunk_bytes;
 139
 140   return ret;
 141 }
 142
 143 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const {
 144   ServiceFullThunk function_code;
 145   SIZE_T read;
 146   if (!::ReadProcessMemory(process_, target_, &function_code,
 147                            sizeof(function_code), &read))
 148     return false;
 149
 150   if (sizeof(function_code) != read)
 151     return false;
 152
 153   if (!IsService(&function_code)) {
 154     // See if it's the Win8 signature.
 155     ServiceEntryW8* w8_service = &function_code.original_w8;
 156     if (!IsService(&w8_service->mov_r10_rcx_mov_eax) ||
 157         w8_service->mov_1 != kMov1 || w8_service->mov_1 != kMov1 ||
 158         w8_service->mov_1 != kMov1) {
 159       return false;
 160     }
 161   }
 162
 163   // Save the verified code.
 164   memcpy(local_thunk, &function_code, sizeof(function_code));
 165
 166   return true;
 167 }
 168
 169 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk,
 170                                             void* remote_thunk) {
 171   // Patch the original code.
 172   ServiceEntry local_service;
 173   DCHECK_NT(GetInternalThunkSize() >= sizeof(local_service));
 174   if (!SetInternalThunk(&local_service, sizeof(local_service), NULL,
 175                         interceptor_))
 176     return STATUS_UNSUCCESSFUL;
 177
 178   // Copy the local thunk buffer to the child.
 179   SIZE_T actual;
 180   if (!::WriteProcessMemory(process_, remote_thunk, local_thunk,
 181                             sizeof(ServiceFullThunk), &actual))
 182     return STATUS_UNSUCCESSFUL;
 183
 184   if (sizeof(ServiceFullThunk) != actual)
 185     return STATUS_UNSUCCESSFUL;
 186
 187   // And now change the function to intercept, on the child.
 188   if (NULL != ntdll_base_) {
 189     // Running a unit test.
 190     if (!::WriteProcessMemory(process_, target_, &local_service,
 191                               sizeof(local_service), &actual))
 192       return STATUS_UNSUCCESSFUL;
 193   } else {
 194     if (!WriteProtectedChildMemory(process_, target_, &local_service,
 195                                    sizeof(local_service)))
 196       return STATUS_UNSUCCESSFUL;
 197   }
 198
 199   return STATUS_SUCCESS;
 200 }
 201
 202 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
 203   NOTREACHED_NT();
 204   return false;
 205 }
 206
 207 }  // namespace sandbox