Make chrome_elf use thunks instead of function pointers.

1. Add functionality to ServiceResolverThunk to copy a thunk without patching.
2. Move chrome_elf thunk-handling code to a common location.
3. Use a thunk instead of a f'n ptr for redirects.

BUG=334379

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=255151

Review URL: https://codereview.chromium.org/183833004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@257749 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 52 insertions, 1 deletions

diff --git a/chrome_elf/ntdll_cache.cc b/chrome_elf/ntdll_cache.cc
index 2f4dbdf..a0429a4 100644
--- a/chrome_elf/ntdll_cache.cc
+++ b/chrome_elf/ntdll_cache.cc
@@ -2,14 +2,28 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome_elf/ntdll_cache.h"
+
 #include <stdint.h>
 #include <windows.h>
 
+#include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/win/pe_image.h"
-#include "chrome_elf/ntdll_cache.h"
+#include "chrome_elf/thunk_getter.h"
+#include "sandbox/win/src/interception_internal.h"
+#include "sandbox/win/src/internal_types.h"
+#include "sandbox/win/src/service_resolver.h"
 
 FunctionLookupTable g_ntdll_lookup;
 
+// Allocate storage for thunks in a page of this module to save on doing
+// an extra allocation at run time.
+#pragma section(".crthunk",read,execute)
+__declspec(allocate(".crthunk")) sandbox::ThunkData g_nt_thunk_storage;
+
+
+
 namespace {
 
 bool EnumExportsCallback(const base::win::PEImage& image,
@@ -35,4 +49,41 @@ void InitCache() {
   base::win::PEImage ntdll_image(ntdll_handle);
 
   ntdll_image.EnumExports(EnumExportsCallback, NULL);
+
+  // If ntdll has already been patched, don't copy it.
+  const bool kRelaxed = false;
+
+  // Create a thunk via the appropriate ServiceResolver instance.
+  scoped_ptr<sandbox::ServiceResolverThunk> thunk(GetThunk(kRelaxed));
+
+  if (thunk.get()) {
+    BYTE* thunk_storage = reinterpret_cast<BYTE*>(&g_nt_thunk_storage);
+
+    // Mark the thunk storage as readable and writeable, since we
+    // are ready to write to it.
+    DWORD old_protect = 0;
+    if (!::VirtualProtect(&g_nt_thunk_storage,
+                          sizeof(g_nt_thunk_storage),
+                          PAGE_EXECUTE_READWRITE,
+                          &old_protect)) {
+      return;
+    }
+
+    size_t storage_used = 0;
+    NTSTATUS ret = thunk->CopyThunk(::GetModuleHandle(sandbox::kNtdllName),
+                                    "NtCreateFile",
+                                    thunk_storage,
+                                    sizeof(sandbox::ThunkData),
+                                    &storage_used);
+
+    if (!NT_SUCCESS(ret)) {
+      memset(&g_nt_thunk_storage, 0, sizeof(g_nt_thunk_storage));
+    }
+
+    // Ensure that the pointer to the old function can't be changed.
+    ::VirtualProtect(&g_nt_thunk_storage,
+                     sizeof(g_nt_thunk_storage),
+                     PAGE_EXECUTE_READ,
+                     &old_protect);
+  }
 }