chrome/browser/safe_browsing/incident_reporting/module_integrity_verifier_win.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/safe_browsing/incident_reporting/module_integrity_verifier_win.h"
   6
   7 #include "base/containers/hash_tables.h"
   8 #include "base/files/file_path.h"
   9 #include "base/files/memory_mapped_file.h"
  10 #include "base/metrics/sparse_histogram.h"
  11 #include "base/scoped_native_library.h"
  12 #include "base/win/pe_image.h"
  13 #include "build/build_config.h"
  14
  15 namespace safe_browsing {
  16
  17 struct ModuleVerificationState {
  18   explicit ModuleVerificationState(HMODULE hModule);
  19   ~ModuleVerificationState();
  20
  21   base::win::PEImageAsData disk_peimage;
  22
  23   // The module's preferred base address minus the base address it actually
  24   // loaded at.
  25   intptr_t image_base_delta;
  26
  27   // The location of the disk_peimage module's code section minus that of the
  28   // mem_peimage module's code section.
  29   intptr_t code_section_delta;
  30
  31   // The bytes corrected by relocs.
  32   base::hash_set<uintptr_t> reloc_addr;
  33
  34   // Set true if the relocation table contains a reloc of type that we don't
  35   // currently handle.
  36   bool unknown_reloc_type;
  37
  38  private:
  39   DISALLOW_COPY_AND_ASSIGN(ModuleVerificationState);
  40 };
  41
  42 ModuleVerificationState::ModuleVerificationState(HMODULE hModule)
  43     : disk_peimage(hModule),
  44       image_base_delta(0),
  45       code_section_delta(0),
  46       reloc_addr(),
  47       unknown_reloc_type(false) {
  48 }
  49
  50 ModuleVerificationState::~ModuleVerificationState() {
  51 }
  52
  53 namespace {
  54
  55 struct Export {
  56   Export(void* addr, const std::string& name);
  57   ~Export();
  58
  59   bool operator<(const Export& other) const;
  60
  61   void* addr;
  62   std::string name;
  63 };
  64
  65 Export::Export(void* addr, const std::string& name) : addr(addr), name(name) {
  66 }
  67
  68 Export::~Export() {
  69 }
  70
  71 bool Export::operator<(const Export& other) const {
  72   return addr < other.addr;
  73 }
  74
  75 bool ByteAccountedForByReloc(uint8_t* byte_addr,
  76                              const ModuleVerificationState& state) {
  77   return ((state.reloc_addr.count(reinterpret_cast<uintptr_t>(byte_addr))) > 0);
  78 }
  79
  80 // Checks each byte in the module's code section again the corresponding byte on
  81 // disk, returning the number of bytes differing between the two.  Also adds the
  82 // names of any modfied functions exported by name to |modified_exports|.
  83 // |exports| must be sorted.
  84 int ExamineBytesDiffInMemory(uint8_t* disk_code_start,
  85                              uint8_t* mem_code_start,
  86                              uint32_t code_size,
  87                              const std::vector<Export>& exports,
  88                              const ModuleVerificationState& state,
  89                              std::set<std::string>* modified_exports) {
  90   int bytes_different = 0;
  91   std::vector<Export>::const_iterator export_it = exports.begin();
  92
  93   for (uint8_t* end = mem_code_start + code_size; mem_code_start != end;
  94        ++mem_code_start) {
  95     if ((*disk_code_start++ != *mem_code_start) &&
  96         !ByteAccountedForByReloc(mem_code_start, state)) {
  97       // We get the largest export address still smaller than |addr|.  It is
  98       // possible that |addr| belongs to some nonexported function located
  99       // between this export and the following one.
 100       Export addr(reinterpret_cast<void*>(mem_code_start), std::string());
 101       std::vector<Export>::const_iterator modified_export_it =
 102           std::upper_bound(export_it, exports.end(), addr);
 103
 104       if (modified_export_it != exports.begin())
 105         modified_exports->insert((modified_export_it - 1)->name);
 106       ++bytes_different;
 107
 108       // No later byte can belong to an earlier export.
 109       export_it = modified_export_it;
 110     }
 111   }
 112   return bytes_different;
 113 }
 114
 115 // Adds to |state->reloc_addr| the bytes of the pointer at |address| that are
 116 // corrected by adding |image_base_delta|.
 117 void AddBytesCorrectedByReloc(uintptr_t address,
 118                               ModuleVerificationState* state) {
 119 #if defined(ARCH_CPU_LITTLE_ENDIAN)
 120 #  define OFFSET(i) i
 121 #else
 122 #  define OFFSET(i) (sizeof(uintptr_t) - i)
 123 #endif
 124
 125   uintptr_t orig_mem_value = *reinterpret_cast<uintptr_t*>(address);
 126   uintptr_t fixed_mem_value = orig_mem_value + state->image_base_delta;
 127   uintptr_t disk_value =
 128       *reinterpret_cast<uintptr_t*>(address + state->code_section_delta);
 129
 130   uintptr_t diff_before = orig_mem_value ^ disk_value;
 131   uintptr_t shared_after = ~(fixed_mem_value ^ disk_value);
 132   int i = 0;
 133   for (uintptr_t fixed = diff_before & shared_after; fixed; fixed >>= 8, ++i) {
 134     if (fixed & 0xFF)
 135       state->reloc_addr.insert(address + OFFSET(i));
 136   }
 137 #undef OFFSET
 138 }
 139
 140 bool AddrIsInCodeSection(void* address,
 141                          uint8_t* code_addr,
 142                          uint32_t code_size) {
 143   return (code_addr <= address && address < code_addr + code_size);
 144 }
 145
 146 bool EnumRelocsCallback(const base::win::PEImage& mem_peimage,
 147                         WORD type,
 148                         void* address,
 149                         void* cookie) {
 150   ModuleVerificationState* state =
 151       reinterpret_cast<ModuleVerificationState*>(cookie);
 152
 153   uint8_t* mem_code_addr = NULL;
 154   uint8_t* disk_code_addr = NULL;
 155   uint32_t code_size = 0;
 156   if (!GetCodeAddrsAndSize(mem_peimage,
 157                            state->disk_peimage,
 158                            &mem_code_addr,
 159                            &disk_code_addr,
 160                            &code_size))
 161     return false;
 162
 163   // If not in the code section return true to continue to the next reloc.
 164   if (!AddrIsInCodeSection(address, mem_code_addr, code_size))
 165     return true;
 166
 167   switch (type) {
 168     case IMAGE_REL_BASED_ABSOLUTE:  // 0
 169       // Absolute type relocations are a noop, sometimes used to pad a section
 170       // of relocations.
 171       break;
 172     case IMAGE_REL_BASED_HIGHLOW:  // 3
 173       // The base relocation applies all 32 bits of the difference to the 32-bit
 174       // field at offset.
 175       AddBytesCorrectedByReloc(reinterpret_cast<uintptr_t>(address), state);
 176       break;
 177     case IMAGE_REL_BASED_DIR64:  // 10
 178       // The base relocation applies the difference to the 64-bit field at
 179       // offset.
 180       // TODO(robertshield): Handle this type of reloc.
 181       break;
 182     default:
 183       // TODO(robertshield): Find a reliable description of the behaviour of the
 184       // remaining types of relocation and handle them.
 185       UMA_HISTOGRAM_SPARSE_SLOWLY("SafeBrowsing.ModuleBaseRelocation", type);
 186       state->unknown_reloc_type = true;
 187       break;
 188   }
 189   return true;
 190 }
 191
 192 bool EnumExportsCallback(const base::win::PEImage& mem_peimage,
 193                          DWORD ordinal,
 194                          DWORD hint,
 195                          LPCSTR name,
 196                          PVOID function_addr,
 197                          LPCSTR forward,
 198                          PVOID cookie) {
 199   std::vector<Export>* exports = reinterpret_cast<std::vector<Export>*>(cookie);
 200   if (name)
 201     exports->push_back(Export(function_addr, std::string(name)));
 202   return true;
 203 }
 204
 205 }  // namespace
 206
 207 bool GetCodeAddrsAndSize(const base::win::PEImage& mem_peimage,
 208                          const base::win::PEImageAsData& disk_peimage,
 209                          uint8_t** mem_code_addr,
 210                          uint8_t** disk_code_addr,
 211                          uint32_t* code_size) {
 212   DWORD base_of_code = mem_peimage.GetNTHeaders()->OptionalHeader.BaseOfCode;
 213
 214   // Get the address and size of the code section in the loaded module image.
 215   PIMAGE_SECTION_HEADER mem_code_header =
 216       mem_peimage.GetImageSectionFromAddr(mem_peimage.RVAToAddr(base_of_code));
 217   if (mem_code_header == NULL)
 218     return false;
 219   *mem_code_addr = reinterpret_cast<uint8_t*>(
 220       mem_peimage.RVAToAddr(mem_code_header->VirtualAddress));
 221   // If the section is padded with zeros when mapped then |VirtualSize| can be
 222   // larger.  Alternatively, |SizeOfRawData| can be rounded up to align
 223   // according to OptionalHeader.FileAlignment.
 224   *code_size = std::min(mem_code_header->Misc.VirtualSize,
 225                         mem_code_header->SizeOfRawData);
 226
 227   // Get the address of the code section in the module mapped as data from disk.
 228   DWORD disk_code_offset = 0;
 229   if (!mem_peimage.ImageAddrToOnDiskOffset(
 230           reinterpret_cast<void*>(*mem_code_addr), &disk_code_offset))
 231     return false;
 232   *disk_code_addr =
 233       reinterpret_cast<uint8_t*>(disk_peimage.module()) + disk_code_offset;
 234   return true;
 235 }
 236
 237 ModuleState VerifyModule(const wchar_t* module_name,
 238                          std::set<std::string>* modified_exports) {
 239   // Get module handle, load a copy from disk as data and create PEImages.
 240   HMODULE module_handle = NULL;
 241   if (!GetModuleHandleEx(0, module_name, &module_handle))
 242     return MODULE_STATE_UNKNOWN;
 243   base::ScopedNativeLibrary native_library(module_handle);
 244
 245   WCHAR module_path[MAX_PATH] = {};
 246   DWORD length =
 247       GetModuleFileName(module_handle, module_path, arraysize(module_path));
 248   if (!length || length == arraysize(module_path))
 249     return MODULE_STATE_UNKNOWN;
 250
 251   base::MemoryMappedFile mapped_module;
 252   if (!mapped_module.Initialize(base::FilePath(module_path)))
 253     return MODULE_STATE_UNKNOWN;
 254   ModuleVerificationState state(
 255       reinterpret_cast<HMODULE>(const_cast<uint8*>(mapped_module.data())));
 256
 257   base::win::PEImage mem_peimage(module_handle);
 258   if (!mem_peimage.VerifyMagic() || !state.disk_peimage.VerifyMagic())
 259     return MODULE_STATE_UNKNOWN;
 260
 261   // Get the list of exports.
 262   std::vector<Export> exports;
 263   mem_peimage.EnumExports(EnumExportsCallback, &exports);
 264   std::sort(exports.begin(), exports.end());
 265
 266   // Get the addresses of the code sections then calculate |code_section_delta|
 267   // and |image_base_delta|.
 268   uint8_t* mem_code_addr = NULL;
 269   uint8_t* disk_code_addr = NULL;
 270   uint32_t code_size = 0;
 271   if (!GetCodeAddrsAndSize(mem_peimage,
 272                            state.disk_peimage,
 273                            &mem_code_addr,
 274                            &disk_code_addr,
 275                            &code_size))
 276     return MODULE_STATE_UNKNOWN;
 277
 278   state.code_section_delta = disk_code_addr - mem_code_addr;
 279
 280   uint8_t* preferred_image_base = reinterpret_cast<uint8_t*>(
 281       state.disk_peimage.GetNTHeaders()->OptionalHeader.ImageBase);
 282   state.image_base_delta =
 283       preferred_image_base - reinterpret_cast<uint8_t*>(mem_peimage.module());
 284
 285   // Get the relocations.
 286   mem_peimage.EnumRelocs(EnumRelocsCallback, &state);
 287   if (state.unknown_reloc_type)
 288     return MODULE_STATE_UNKNOWN;
 289
 290   // Count the modified bytes (after accounting for relocs) and get the set of
 291   // modified functions.
 292   int num_bytes_different = ExamineBytesDiffInMemory(disk_code_addr,
 293                                                      mem_code_addr,
 294                                                      code_size,
 295                                                      exports,
 296                                                      state,
 297                                                      modified_exports);
 298
 299   return num_bytes_different ? MODULE_STATE_MODIFIED : MODULE_STATE_UNMODIFIED;
 300 }
 301
 302 }  // namespace safe_browsing