1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/src/service_resolver.h"
7 #include "base/memory/scoped_ptr.h"
8 #include "sandbox/src/sandbox_utils.h"
9 #include "sandbox/src/win_utils.h"
14 const BYTE kMovEax
= 0xB8;
15 const BYTE kMovEdx
= 0xBA;
16 const USHORT kMovEdxEsp
= 0xD48B;
17 const USHORT kCallPtrEdx
= 0x12FF;
18 const USHORT kCallEdx
= 0xD2FF;
19 const BYTE kCallEip
= 0xE8;
20 const BYTE kRet
= 0xC2;
21 const BYTE kRet2
= 0xC3;
22 const BYTE kNop
= 0x90;
23 const USHORT kJmpEdx
= 0xE2FF;
24 const USHORT kXorEcx
= 0xC933;
25 const ULONG kLeaEdx
= 0x0424548D;
26 const ULONG kCallFs1
= 0xC015FF64;
27 const USHORT kCallFs2
= 0;
28 const BYTE kCallFs3
= 0;
29 const BYTE kAddEsp1
= 0x83;
30 const USHORT kAddEsp2
= 0x4C4;
31 const BYTE kJmp32
= 0xE9;
32 const USHORT kSysenter
= 0x340F;
34 const int kMaxService
= 1000;
36 // Service code for 32 bit systems.
37 // NOTE: on win2003 "call dword ptr [edx]" is "call edx".
39 // This struct contains roughly the following code:
41 // 05 mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
42 // 0a call dword ptr [edx]
49 USHORT call_ptr_edx
; // = FF 12
55 // Service code for 32 bit Windows 8.
56 struct ServiceEntryW8
{
57 // This struct contains the following code:
58 // 00 b825000000 mov eax,25h
59 // 05 e803000000 call eip+3
61 // 0d 8bd4 mov edx,esp
64 // 12 8bff mov edi,edi
67 BYTE call_eip
; // = E8
71 USHORT mov_edx_esp
; // = BD D4
72 USHORT sysenter
; // = 0F 34
77 // Service code for a 32 bit process running on a 64 bit os.
79 // This struct may contain one of two versions of code:
80 // 1. For XP, Vista and 2K3:
81 // 00 b825000000 mov eax, 25h
82 // 05 33c9 xor ecx, ecx
83 // 07 8d542404 lea edx, [esp + 4]
84 // 0b 64ff15c0000000 call dword ptr fs:[0C0h]
88 // 00 b825000000 mov eax, 25h
89 // 05 33c9 xor ecx, ecx
90 // 07 8d542404 lea edx, [esp + 4]
91 // 0b 64ff15c0000000 call dword ptr fs:[0C0h]
92 // 12 83c404 add esp, 4
95 // So we base the structure on the bigger one:
98 USHORT xor_ecx
; // = 33 C9
99 ULONG lea_edx
; // = 8D 54 24 04
100 ULONG call_fs1
; // = 64 FF 15 C0
101 USHORT call_fs2
; // = 00 00
102 BYTE call_fs3
; // = 00
103 BYTE add_esp1
; // = 83 or ret
104 USHORT add_esp2
; // = C4 04 or num_params
109 // Service code for a 32 bit process running on 64 bit Windows 8.
110 struct Wow64EntryW8
{
111 // 00 b825000000 mov eax, 25h
112 // 05 64ff15c0000000 call dword ptr fs:[0C0h]
115 BYTE mov_eax
; // = B8
117 ULONG call_fs1
; // = 64 FF 15 C0
118 USHORT call_fs2
; // = 00 00
119 BYTE call_fs3
; // = 00
125 // Make sure that relaxed patching works as expected.
126 const size_t kMinServiceSize
= offsetof(ServiceEntry
, ret
);
127 COMPILE_ASSERT(sizeof(ServiceEntryW8
) >= kMinServiceSize
, wrong_service_len
);
128 COMPILE_ASSERT(sizeof(Wow64Entry
) >= kMinServiceSize
, wrong_service_len
);
129 COMPILE_ASSERT(sizeof(Wow64EntryW8
) >= kMinServiceSize
, wrong_service_len
);
131 struct ServiceFullThunk
{
133 ServiceEntry original
;
134 ServiceEntryW8 original_w8
;
136 Wow64EntryW8 wow_64_w8
;
138 int internal_thunk
; // Dummy member to the beginning of the internal thunk.
147 NTSTATUS
ServiceResolverThunk::Setup(const void* target_module
,
148 const void* interceptor_module
,
149 const char* target_name
,
150 const char* interceptor_name
,
151 const void* interceptor_entry_point
,
153 size_t storage_bytes
,
154 size_t* storage_used
) {
155 NTSTATUS ret
= Init(target_module
, interceptor_module
, target_name
,
156 interceptor_name
, interceptor_entry_point
,
157 thunk_storage
, storage_bytes
);
158 if (!NT_SUCCESS(ret
))
162 size_t thunk_bytes
= GetThunkSize();
163 scoped_array
<char> thunk_buffer(new char[thunk_bytes
]);
164 ServiceFullThunk
* thunk
= reinterpret_cast<ServiceFullThunk
*>(
167 if (!IsFunctionAService(&thunk
->original
) &&
168 (!relaxed_
|| !SaveOriginalFunction(&thunk
->original
, thunk_storage
)))
169 return STATUS_UNSUCCESSFUL
;
171 ret
= PerformPatch(thunk
, thunk_storage
);
173 if (NULL
!= storage_used
)
174 *storage_used
= thunk_bytes
;
179 size_t ServiceResolverThunk::GetThunkSize() const {
180 return offsetof(ServiceFullThunk
, internal_thunk
) + GetInternalThunkSize();
183 bool ServiceResolverThunk::IsFunctionAService(void* local_thunk
) const {
184 ServiceEntry function_code
;
186 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
187 sizeof(function_code
), &read
))
190 if (sizeof(function_code
) != read
)
193 if (kMovEax
!= function_code
.mov_eax
||
194 kMovEdx
!= function_code
.mov_edx
||
195 (kCallPtrEdx
!= function_code
.call_ptr_edx
&&
196 kCallEdx
!= function_code
.call_ptr_edx
) ||
197 kRet
!= function_code
.ret
)
200 // Find the system call pointer if we don't already have it.
201 if (kCallEdx
!= function_code
.call_ptr_edx
) {
202 DWORD ki_system_call
;
203 if (!::ReadProcessMemory(process_
,
204 bit_cast
<const void*>(function_code
.stub
),
205 &ki_system_call
, sizeof(ki_system_call
), &read
))
208 if (sizeof(ki_system_call
) != read
)
211 HMODULE module_1
, module_2
;
212 // last check, call_stub should point to a KiXXSystemCall function on ntdll
213 if (!GetModuleHandleHelper(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS
|
214 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT
,
215 bit_cast
<const wchar_t*>(ki_system_call
),
219 if (NULL
!= ntdll_base_
) {
220 // This path is only taken when running the unit tests. We want to be
221 // able to patch a buffer in memory, so target_ is not inside ntdll.
222 module_2
= ntdll_base_
;
224 if (!GetModuleHandleHelper(
225 GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS
|
226 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT
,
227 reinterpret_cast<const wchar_t*>(target_
),
233 if (module_1
!= module_2
)
237 // Save the verified code
238 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
243 NTSTATUS
ServiceResolverThunk::PerformPatch(void* local_thunk
,
244 void* remote_thunk
) {
245 ServiceEntry intercepted_code
;
246 size_t bytes_to_write
= sizeof(intercepted_code
);
247 ServiceFullThunk
*full_local_thunk
= reinterpret_cast<ServiceFullThunk
*>(
249 ServiceFullThunk
*full_remote_thunk
= reinterpret_cast<ServiceFullThunk
*>(
252 // patch the original code
253 memcpy(&intercepted_code
, &full_local_thunk
->original
,
254 sizeof(intercepted_code
));
255 intercepted_code
.mov_eax
= kMovEax
;
256 intercepted_code
.service_id
= full_local_thunk
->original
.service_id
;
257 intercepted_code
.mov_edx
= kMovEdx
;
258 intercepted_code
.stub
= bit_cast
<ULONG
>(&full_remote_thunk
->internal_thunk
);
259 intercepted_code
.call_ptr_edx
= kJmpEdx
;
260 bytes_to_write
= kMinServiceSize
;
262 if (relative_jump_
) {
263 intercepted_code
.mov_eax
= kJmp32
;
264 intercepted_code
.service_id
= relative_jump_
;
265 bytes_to_write
= offsetof(ServiceEntry
, mov_edx
);
269 SetInternalThunk(&full_local_thunk
->internal_thunk
, GetInternalThunkSize(),
270 remote_thunk
, interceptor_
);
272 size_t thunk_size
= GetThunkSize();
274 // copy the local thunk buffer to the child
276 if (!::WriteProcessMemory(process_
, remote_thunk
, local_thunk
,
277 thunk_size
, &written
))
278 return STATUS_UNSUCCESSFUL
;
280 if (thunk_size
!= written
)
281 return STATUS_UNSUCCESSFUL
;
283 // and now change the function to intercept, on the child
284 if (NULL
!= ntdll_base_
) {
285 // running a unit test
286 if (!::WriteProcessMemory(process_
, target_
, &intercepted_code
,
287 bytes_to_write
, &written
))
288 return STATUS_UNSUCCESSFUL
;
290 if (!WriteProtectedChildMemory(process_
, target_
, &intercepted_code
,
292 return STATUS_UNSUCCESSFUL
;
295 return STATUS_SUCCESS
;
298 bool ServiceResolverThunk::SaveOriginalFunction(void* local_thunk
,
299 void* remote_thunk
) {
300 ServiceEntry function_code
;
302 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
303 sizeof(function_code
), &read
))
306 if (sizeof(function_code
) != read
)
309 if (kJmp32
== function_code
.mov_eax
) {
310 // Plain old entry point patch. The relative jump address follows it.
311 ULONG relative
= function_code
.service_id
;
313 // First, fix our copy of their patch.
314 relative
+= bit_cast
<ULONG
>(target_
) - bit_cast
<ULONG
>(remote_thunk
);
316 function_code
.service_id
= relative
;
318 // And now, remember how to re-patch it.
319 ServiceFullThunk
*full_thunk
=
320 reinterpret_cast<ServiceFullThunk
*>(remote_thunk
);
322 const ULONG kJmp32Size
= 5;
324 relative_jump_
= bit_cast
<ULONG
>(&full_thunk
->internal_thunk
) -
325 bit_cast
<ULONG
>(target_
) - kJmp32Size
;
328 // Save the verified code
329 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
334 bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk
) const {
335 Wow64Entry function_code
;
337 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
338 sizeof(function_code
), &read
))
341 if (sizeof(function_code
) != read
)
344 if (kMovEax
!= function_code
.mov_eax
|| kXorEcx
!= function_code
.xor_ecx
||
345 kLeaEdx
!= function_code
.lea_edx
|| kCallFs1
!= function_code
.call_fs1
||
346 kCallFs2
!= function_code
.call_fs2
|| kCallFs3
!= function_code
.call_fs3
)
349 if ((kAddEsp1
== function_code
.add_esp1
&&
350 kAddEsp2
== function_code
.add_esp2
&&
351 kRet
== function_code
.ret
) || kRet
== function_code
.add_esp1
) {
352 // Save the verified code
353 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
360 bool Wow64W8ResolverThunk::IsFunctionAService(void* local_thunk
) const {
361 Wow64EntryW8 function_code
;
363 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
364 sizeof(function_code
), &read
))
367 if (sizeof(function_code
) != read
)
370 if (kMovEax
!= function_code
.mov_eax
|| kCallFs1
!= function_code
.call_fs1
||
371 kCallFs2
!= function_code
.call_fs2
||
372 kCallFs3
!= function_code
.call_fs3
|| kRet
!= function_code
.ret
) {
376 // Save the verified code
377 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
381 bool Win2kResolverThunk::IsFunctionAService(void* local_thunk
) const {
382 ServiceEntry function_code
;
384 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
385 sizeof(function_code
), &read
))
388 if (sizeof(function_code
) != read
)
391 if (kMovEax
!= function_code
.mov_eax
||
392 function_code
.service_id
> kMaxService
)
395 // Save the verified code
396 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
401 bool Win8ResolverThunk::IsFunctionAService(void* local_thunk
) const {
402 ServiceEntryW8 function_code
;
404 if (!::ReadProcessMemory(process_
, target_
, &function_code
,
405 sizeof(function_code
), &read
))
408 if (sizeof(function_code
) != read
)
411 if (kMovEax
!= function_code
.mov_eax
|| kCallEip
!= function_code
.call_eip
||
412 function_code
.call_offset
!= 3 || kRet
!= function_code
.ret_p
||
413 kMovEdxEsp
!= function_code
.mov_edx_esp
||
414 kSysenter
!= function_code
.sysenter
|| kRet2
!= function_code
.ret
) {
418 // Save the verified code
419 memcpy(local_thunk
, &function_code
, sizeof(function_code
));
424 } // namespace sandbox