1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "sandbox/win/src/service_resolver.h"
6
7 #include "base/memory/scoped_ptr.h"
8 #include "sandbox/win/src/sandbox_nt_util.h"
9 #include "sandbox/win/src/win_utils.h"
10
11 namespace {
12 #pragma pack(push, 1)
13
14 const ULONG kMmovR10EcxMovEax = 0xB8D18B4C;
15 const USHORT kSyscall = 0x050F;
16 const BYTE kRetNp = 0xC3;
17 const ULONG64 kMov1 = 0x54894808244C8948;
18 const ULONG64 kMov2 = 0x4C182444894C1024;
19 const ULONG kMov3 = 0x20244C89;
20
21 // Service code for 64 bit systems.
22 struct ServiceEntry {
23 // This struct contains roughly the following code:
24 // 00 mov r10,rcx
25 // 03 mov eax,52h
26 // 08 syscall
27 // 0a ret
28 // 0b xchg ax,ax
29 // 0e xchg ax,ax
30
31 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
32 ULONG service_id;
33 USHORT syscall; // = 0F 05
34 BYTE ret; // = C3
35 BYTE pad; // = 66
36 USHORT xchg_ax_ax1; // = 66 90
37 USHORT xchg_ax_ax2; // = 66 90
38 };
39
40 // Service code for 64 bit Windows 8.
41 struct ServiceEntryW8 {
42 // This struct contains the following code:
43 // 00 48894c2408 mov [rsp+8], rcx
44 // 05 4889542410 mov [rsp+10], rdx
45 // 0a 4c89442418 mov [rsp+18], r8
46 // 0f 4c894c2420 mov [rsp+20], r9
47 // 14 4c8bd1 mov r10,rcx
48 // 17 b825000000 mov eax,25h
49 // 1c 0f05 syscall
50 // 1e c3 ret
51 // 1f 90 nop
52
53 ULONG64 mov_1; // = 48 89 4C 24 08 48 89 54
54 ULONG64 mov_2; // = 24 10 4C 89 44 24 18 4C
55 ULONG mov_3; // = 89 4C 24 20
56 ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
57 ULONG service_id;
58 USHORT syscall; // = 0F 05
59 BYTE ret; // = C3
60 BYTE nop; // = 90
61 };
62
63 // We don't have an internal thunk for x64.
64 struct ServiceFullThunk {
65 union {
66 ServiceEntry original;
67 ServiceEntryW8 original_w8;
68 };
69 };
70
71 #pragma pack(pop)
72
IsService(const void * source)73 bool IsService(const void* source) {
74 const ServiceEntry* service =
75 reinterpret_cast<const ServiceEntry*>(source);
76
77 return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
78 kSyscall == service->syscall && kRetNp == service->ret);
79 }
80
81 }; // namespace
82
83 namespace sandbox {
84
Setup(const void * target_module,const void * interceptor_module,const char * target_name,const char * interceptor_name,const void * interceptor_entry_point,void * thunk_storage,size_t storage_bytes,size_t * storage_used)85 NTSTATUS ServiceResolverThunk::Setup(const void* target_module,
86 const void* interceptor_module,
87 const char* target_name,
88 const char* interceptor_name,
89 const void* interceptor_entry_point,
90 void* thunk_storage,
91 size_t storage_bytes,
92 size_t* storage_used) {
93 NTSTATUS ret = Init(target_module, interceptor_module, target_name,
94 interceptor_name, interceptor_entry_point,
95 thunk_storage, storage_bytes);
96 if (!NT_SUCCESS(ret))
97 return ret;
98
99 size_t thunk_bytes = GetThunkSize();
100 scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]);
101 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(
102 thunk_buffer.get());
103
104 if (!IsFunctionAService(&thunk->original))
105 return STATUS_UNSUCCESSFUL;
106
107 ret = PerformPatch(thunk, thunk_storage);
108
109 if (NULL != storage_used)
110 *storage_used = thunk_bytes;
111
112 return ret;
113 }
114
GetThunkSize() const115 size_t ServiceResolverThunk::GetThunkSize() const {
116 return sizeof(ServiceFullThunk);
117 }
118
CopyThunk(const void * target_module,const char * target_name,BYTE * thunk_storage,size_t storage_bytes,size_t * storage_used)119 NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module,
120 const char* target_name,
121 BYTE* thunk_storage,
122 size_t storage_bytes,
123 size_t* storage_used) {
124 NTSTATUS ret = ResolveTarget(target_module, target_name, &target_);
125 if (!NT_SUCCESS(ret))
126 return ret;
127
128 size_t thunk_bytes = GetThunkSize();
129 if (storage_bytes < thunk_bytes)
130 return STATUS_UNSUCCESSFUL;
131
132 ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage);
133
134 if (!IsFunctionAService(&thunk->original))
135 return STATUS_UNSUCCESSFUL;
136
137 if (NULL != storage_used)
138 *storage_used = thunk_bytes;
139
140 return ret;
141 }
142
IsFunctionAService(void * local_thunk) const143 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const {
144 ServiceFullThunk function_code;
145 SIZE_T read;
146 if (!::ReadProcessMemory(process_, target_, &function_code,
147 sizeof(function_code), &read))
148 return false;
149
150 if (sizeof(function_code) != read)
151 return false;
152
153 if (!IsService(&function_code)) {
154 // See if it's the Win8 signature.
155 ServiceEntryW8* w8_service = &function_code.original_w8;
156 if (!IsService(&w8_service->mov_r10_rcx_mov_eax) ||
157 w8_service->mov_1 != kMov1 || w8_service->mov_1 != kMov1 ||
158 w8_service->mov_1 != kMov1) {
159 return false;
160 }
161 }
162
163 // Save the verified code.
164 memcpy(local_thunk, &function_code, sizeof(function_code));
165
166 return true;
167 }
168
PerformPatch(void * local_thunk,void * remote_thunk)169 NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk,
170 void* remote_thunk) {
171 ServiceFullThunk* full_local_thunk =
172 reinterpret_cast<ServiceFullThunk*>(local_thunk);
173 ServiceFullThunk* full_remote_thunk =
174 reinterpret_cast<ServiceFullThunk*>(remote_thunk);
175
176 // Patch the original code.
177 ServiceEntry local_service;
178 DCHECK_NT(GetInternalThunkSize() >= sizeof(local_service));
179 if (!SetInternalThunk(&local_service, sizeof(local_service), NULL,
180 interceptor_))
181 return STATUS_UNSUCCESSFUL;
182
183 // Copy the local thunk buffer to the child.
184 SIZE_T actual;
185 if (!::WriteProcessMemory(process_, remote_thunk, local_thunk,
186 sizeof(ServiceFullThunk), &actual))
187 return STATUS_UNSUCCESSFUL;
188
189 if (sizeof(ServiceFullThunk) != actual)
190 return STATUS_UNSUCCESSFUL;
191
192 // And now change the function to intercept, on the child.
193 if (NULL != ntdll_base_) {
194 // Running a unit test.
195 if (!::WriteProcessMemory(process_, target_, &local_service,
196 sizeof(local_service), &actual))
197 return STATUS_UNSUCCESSFUL;
198 } else {
199 if (!WriteProtectedChildMemory(process_, target_, &local_service,
200 sizeof(local_service)))
201 return STATUS_UNSUCCESSFUL;
202 }
203
204 return STATUS_SUCCESS;
205 }
206
IsFunctionAService(void * local_thunk) const207 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
208 NOTREACHED_NT();
209 return false;
210 }
211
212 } // namespace sandbox
213