1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "sandbox/src/wow64.h"
#include <sstream>
#include "base/logging.h"
#include "base/memory/scoped_ptr.h"
#include "base/win/scoped_process_information.h"
#include "base/win/windows_version.h"
#include "sandbox/src/target_process.h"
namespace {
// Holds the information needed for the interception of NtMapViewOfSection on
// 64 bits.
// Warning: do not modify this definition without changing also the code on the
// 64 bit helper process.
struct PatchInfo32 {
HANDLE dll_load; // Event to signal the broker.
ULONG pad1;
HANDLE continue_load; // Event to wait for the broker.
ULONG pad2;
HANDLE section; // First argument of the call.
ULONG pad3;
void* orig_MapViewOfSection;
ULONG original_high;
void* signal_and_wait;
ULONG pad4;
void* patch_location;
ULONG patch_high;
};
// Size of the 64 bit service entry.
const SIZE_T kServiceEntry64Size = 0x10;
// Removes the interception of ntdll64.
bool Restore64Code(HANDLE child, PatchInfo32* patch_info) {
PatchInfo32 local_patch_info;
SIZE_T actual;
if (!::ReadProcessMemory(child, patch_info, &local_patch_info,
sizeof(local_patch_info), &actual))
return false;
if (sizeof(local_patch_info) != actual)
return false;
if (local_patch_info.original_high)
return false;
if (local_patch_info.patch_high)
return false;
char buffer[kServiceEntry64Size];
if (!::ReadProcessMemory(child, local_patch_info.orig_MapViewOfSection,
&buffer, kServiceEntry64Size, &actual))
return false;
if (kServiceEntry64Size != actual)
return false;
if (!::WriteProcessMemory(child, local_patch_info.patch_location, &buffer,
kServiceEntry64Size, &actual))
return false;
if (kServiceEntry64Size != actual)
return false;
return true;
}
typedef BOOL (WINAPI* IsWow64ProcessFunction)(HANDLE process, BOOL* wow64);
} // namespace
namespace sandbox {
Wow64::~Wow64() {
if (dll_load_)
::CloseHandle(dll_load_);
if (continue_load_)
::CloseHandle(continue_load_);
}
// The basic idea is to allocate one page of memory on the child, and initialize
// the first part of it with our version of PatchInfo32. Then launch the helper
// process passing it that address on the child. The helper process will patch
// the 64 bit version of NtMapViewOfFile, and the interception will signal the
// first event on the buffer. We'll be waiting on that event and after the 32
// bit version of ntdll is loaded, we'll remove the interception and return to
// our caller.
bool Wow64::WaitForNtdll() {
if (base::win::OSInfo::GetInstance()->wow64_status() !=
base::win::OSInfo::WOW64_ENABLED)
return true;
const size_t page_size = 4096;
// Create some default manual reset un-named events, not signaled.
dll_load_ = ::CreateEvent(NULL, TRUE, FALSE, NULL);
continue_load_ = ::CreateEvent(NULL, TRUE, FALSE, NULL);
HANDLE current_process = ::GetCurrentProcess();
HANDLE remote_load, remote_continue;
DWORD access = EVENT_MODIFY_STATE | SYNCHRONIZE;
if (!::DuplicateHandle(current_process, dll_load_, child_->Process(),
&remote_load, access, FALSE, 0))
return false;
if (!::DuplicateHandle(current_process, continue_load_, child_->Process(),
&remote_continue, access, FALSE, 0))
return false;
void* buffer = ::VirtualAllocEx(child_->Process(), NULL, page_size,
MEM_COMMIT, PAGE_EXECUTE_READWRITE);
DCHECK(buffer);
if (!buffer)
return false;
PatchInfo32* patch_info = reinterpret_cast<PatchInfo32*>(buffer);
PatchInfo32 local_patch_info = {0};
local_patch_info.dll_load = remote_load;
local_patch_info.continue_load = remote_continue;
SIZE_T written;
if (!::WriteProcessMemory(child_->Process(), patch_info, &local_patch_info,
offsetof(PatchInfo32, section), &written))
return false;
if (offsetof(PatchInfo32, section) != written)
return false;
if (!RunWowHelper(buffer))
return false;
// The child is intercepted on 64 bit, go on and wait for our event.
if (!DllMapped())
return false;
// The 32 bit version is available, cleanup the child.
return Restore64Code(child_->Process(), patch_info);
}
bool Wow64::RunWowHelper(void* buffer) {
COMPILE_ASSERT(sizeof(buffer) <= sizeof(DWORD), unsupported_64_bits);
// Get the path to the helper (beside the exe).
wchar_t prog_name[MAX_PATH];
GetModuleFileNameW(NULL, prog_name, MAX_PATH);
std::wstring path(prog_name);
size_t name_pos = path.find_last_of(L"\\");
if (std::wstring::npos == name_pos)
return false;
path.resize(name_pos + 1);
std::wstringstream command;
command << std::hex << std::showbase << L"\"" << path <<
L"wow_helper.exe\" " << child_->ProcessId() << " " <<
bit_cast<ULONG>(buffer);
scoped_ptr_malloc<wchar_t> writable_command(_wcsdup(command.str().c_str()));
STARTUPINFO startup_info = {0};
startup_info.cb = sizeof(startup_info);
base::win::ScopedProcessInformation process_info;
if (!::CreateProcess(NULL, writable_command.get(), NULL, NULL, FALSE, 0, NULL,
NULL, &startup_info, process_info.Receive()))
return false;
DWORD reason = ::WaitForSingleObject(process_info.process_handle(), INFINITE);
DWORD code;
bool ok =
::GetExitCodeProcess(process_info.process_handle(), &code) ? true : false;
if (WAIT_TIMEOUT == reason)
return false;
return ok && (0 == code);
}
// First we must wake up the child, then wait for dll loads on the child until
// the one we care is loaded; at that point we must suspend the child again.
bool Wow64::DllMapped() {
if (1 != ::ResumeThread(child_->MainThread())) {
NOTREACHED();
return false;
}
for (;;) {
DWORD reason = ::WaitForSingleObject(dll_load_, INFINITE);
if (WAIT_TIMEOUT == reason || WAIT_ABANDONED == reason)
return false;
if (!::ResetEvent(dll_load_))
return false;
bool found = NtdllPresent();
if (found) {
if (::SuspendThread(child_->MainThread()))
return false;
}
if (!::SetEvent(continue_load_))
return false;
if (found)
return true;
}
}
bool Wow64::NtdllPresent() {
const size_t kBufferSize = 512;
char buffer[kBufferSize];
SIZE_T read;
if (!::ReadProcessMemory(child_->Process(), ntdll_, &buffer, kBufferSize,
&read))
return false;
if (kBufferSize != read)
return false;
return true;
}
} // namespace sandbox
|
