chrome/browser/safe_browsing/incident_reporting/module_integrity_verifier_win.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_INTEGRITY_VERIFIER_WIN_H_
   6 #define CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_INTEGRITY_VERIFIER_WIN_H_
   7
   8 #include <stdint.h>
   9
  10 #include <set>
  11 #include <string>
  12
  13 namespace base {
  14 namespace win {
  15 class PEImage;
  16 class PEImageAsData;
  17 }  // namespace win
  18 }  // namespace base
  19
  20 namespace safe_browsing {
  21
  22 // This enum defines the possible module states VerifyModule can return.
  23 enum ModuleState {
  24   MODULE_STATE_UNKNOWN,
  25   MODULE_STATE_UNMODIFIED,
  26   MODULE_STATE_MODIFIED,
  27 };
  28
  29 // Helper to grab the addresses and size of the code section of a PEImage.
  30 // Returns two addresses: one for the dll loaded as a library, the other for the
  31 // dll loaded as data.
  32 bool GetCodeAddrsAndSize(const base::win::PEImage& mem_peimage,
  33                          const base::win::PEImageAsData& disk_peimage,
  34                          uint8_t** mem_code_addr,
  35                          uint8_t** disk_code_addr,
  36                          uint32_t* code_size);
  37
  38 // Examines the code section of the given module in memory and on disk, looking
  39 // for unexpected differences.  Returns a ModuleState and and a set of the
  40 // possibly modified exports.
  41 ModuleState VerifyModule(const wchar_t* module_name,
  42                          std::set<std::string>* modified_exports);
  43
  44 }  // namespace safe_browsing
  45
  46 #endif  // CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_INTEGRITY_VERIFIER_WIN_H_