diff options
Diffstat (limited to 'chrome_elf/ntdll_cache.cc')
-rw-r--r-- | chrome_elf/ntdll_cache.cc | 89 |
1 files changed, 0 insertions, 89 deletions
diff --git a/chrome_elf/ntdll_cache.cc b/chrome_elf/ntdll_cache.cc deleted file mode 100644 index a0429a4..0000000 --- a/chrome_elf/ntdll_cache.cc +++ /dev/null @@ -1,89 +0,0 @@ -// Copyright 2013 The Chromium Authors. All rights reserved. -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -#include "chrome_elf/ntdll_cache.h" - -#include <stdint.h> -#include <windows.h> - -#include "base/basictypes.h" -#include "base/memory/scoped_ptr.h" -#include "base/win/pe_image.h" -#include "chrome_elf/thunk_getter.h" -#include "sandbox/win/src/interception_internal.h" -#include "sandbox/win/src/internal_types.h" -#include "sandbox/win/src/service_resolver.h" - -FunctionLookupTable g_ntdll_lookup; - -// Allocate storage for thunks in a page of this module to save on doing -// an extra allocation at run time. -#pragma section(".crthunk",read,execute) -__declspec(allocate(".crthunk")) sandbox::ThunkData g_nt_thunk_storage; - - - -namespace { - -bool EnumExportsCallback(const base::win::PEImage& image, - DWORD ordinal, - DWORD hint, - LPCSTR name, - PVOID function_addr, - LPCSTR forward, - PVOID cookie) { - // Our lookup only cares about named functions that are in ntdll, so skip - // unnamed or forwarded exports. - if (name && function_addr) - g_ntdll_lookup[std::string(name)] = function_addr; - - return true; -} - -} // namespace - -void InitCache() { - HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll"); - - base::win::PEImage ntdll_image(ntdll_handle); - - ntdll_image.EnumExports(EnumExportsCallback, NULL); - - // If ntdll has already been patched, don't copy it. - const bool kRelaxed = false; - - // Create a thunk via the appropriate ServiceResolver instance. - scoped_ptr<sandbox::ServiceResolverThunk> thunk(GetThunk(kRelaxed)); - - if (thunk.get()) { - BYTE* thunk_storage = reinterpret_cast<BYTE*>(&g_nt_thunk_storage); - - // Mark the thunk storage as readable and writeable, since we - // are ready to write to it. - DWORD old_protect = 0; - if (!::VirtualProtect(&g_nt_thunk_storage, - sizeof(g_nt_thunk_storage), - PAGE_EXECUTE_READWRITE, - &old_protect)) { - return; - } - - size_t storage_used = 0; - NTSTATUS ret = thunk->CopyThunk(::GetModuleHandle(sandbox::kNtdllName), - "NtCreateFile", - thunk_storage, - sizeof(sandbox::ThunkData), - &storage_used); - - if (!NT_SUCCESS(ret)) { - memset(&g_nt_thunk_storage, 0, sizeof(g_nt_thunk_storage)); - } - - // Ensure that the pointer to the old function can't be changed. - ::VirtualProtect(&g_nt_thunk_storage, - sizeof(g_nt_thunk_storage), - PAGE_EXECUTE_READ, - &old_protect); - } -} |