1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "sandbox/win/src/service_resolver.h"
6
7#include "base/memory/scoped_ptr.h"
8#include "sandbox/win/src/sandbox_nt_util.h"
9#include "sandbox/win/src/win_utils.h"
10
11namespace {
12#pragma pack(push, 1)
13
14const ULONG kMmovR10EcxMovEax = 0xB8D18B4C;
15const USHORT kSyscall = 0x050F;
16const BYTE kRetNp = 0xC3;
17const ULONG64 kMov1 = 0x54894808244C8948;
18const ULONG64 kMov2 = 0x4C182444894C1024;
19const ULONG kMov3 = 0x20244C89;
20
21// Service code for 64 bit systems.
22struct ServiceEntry {
23  // This struct contains roughly the following code:
24  // 00 mov     r10,rcx
25  // 03 mov     eax,52h
26  // 08 syscall
27  // 0a ret
28  // 0b xchg    ax,ax
29  // 0e xchg    ax,ax
30
31  ULONG mov_r10_rcx_mov_eax;  // = 4C 8B D1 B8
32  ULONG service_id;
33  USHORT syscall;             // = 0F 05
34  BYTE ret;                   // = C3
35  BYTE pad;                   // = 66
36  USHORT xchg_ax_ax1;         // = 66 90
37  USHORT xchg_ax_ax2;         // = 66 90
38};
39
40// Service code for 64 bit Windows 8.
41struct ServiceEntryW8 {
42  // This struct contains the following code:
43  // 00 48894c2408      mov     [rsp+8], rcx
44  // 05 4889542410      mov     [rsp+10], rdx
45  // 0a 4c89442418      mov     [rsp+18], r8
46  // 0f 4c894c2420      mov     [rsp+20], r9
47  // 14 4c8bd1          mov     r10,rcx
48  // 17 b825000000      mov     eax,25h
49  // 1c 0f05            syscall
50  // 1e c3              ret
51  // 1f 90              nop
52
53  ULONG64 mov_1;              // = 48 89 4C 24 08 48 89 54
54  ULONG64 mov_2;              // = 24 10 4C 89 44 24 18 4C
55  ULONG mov_3;                // = 89 4C 24 20
56  ULONG mov_r10_rcx_mov_eax;  // = 4C 8B D1 B8
57  ULONG service_id;
58  USHORT syscall;             // = 0F 05
59  BYTE ret;                   // = C3
60  BYTE nop;                   // = 90
61};
62
63// We don't have an internal thunk for x64.
64struct ServiceFullThunk {
65  union {
66    ServiceEntry original;
67    ServiceEntryW8 original_w8;
68  };
69};
70
71#pragma pack(pop)
72
73bool IsService(const void* source) {
74  const ServiceEntry* service =
75      reinterpret_cast<const ServiceEntry*>(source);
76
77  return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
78          kSyscall == service->syscall && kRetNp == service->ret);
79}
80
81};  // namespace
82
83namespace sandbox {
84
85NTSTATUS ServiceResolverThunk::Setup(const void* target_module,
86                                     const void* interceptor_module,
87                                     const char* target_name,
88                                     const char* interceptor_name,
89                                     const void* interceptor_entry_point,
90                                     void* thunk_storage,
91                                     size_t storage_bytes,
92                                     size_t* storage_used) {
93  NTSTATUS ret = Init(target_module, interceptor_module, target_name,
94                      interceptor_name, interceptor_entry_point,
95                      thunk_storage, storage_bytes);
96  if (!NT_SUCCESS(ret))
97    return ret;
98
99  size_t thunk_bytes = GetThunkSize();
100  scoped_ptr<char[]> thunk_buffer(new char[thunk_bytes]);
101  ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(
102                                thunk_buffer.get());
103
104  if (!IsFunctionAService(&thunk->original))
105    return STATUS_UNSUCCESSFUL;
106
107  ret = PerformPatch(thunk, thunk_storage);
108
109  if (NULL != storage_used)
110    *storage_used = thunk_bytes;
111
112  return ret;
113}
114
115size_t ServiceResolverThunk::GetThunkSize() const {
116  return sizeof(ServiceFullThunk);
117}
118
119NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module,
120                                         const char* target_name,
121                                         BYTE* thunk_storage,
122                                         size_t storage_bytes,
123                                         size_t* storage_used) {
124  NTSTATUS ret = ResolveTarget(target_module, target_name, &target_);
125  if (!NT_SUCCESS(ret))
126    return ret;
127
128  size_t thunk_bytes = GetThunkSize();
129  if (storage_bytes < thunk_bytes)
130    return STATUS_UNSUCCESSFUL;
131
132  ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage);
133
134  if (!IsFunctionAService(&thunk->original))
135    return STATUS_UNSUCCESSFUL;
136
137  if (NULL != storage_used)
138    *storage_used = thunk_bytes;
139
140  return ret;
141}
142
143bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const {
144  ServiceFullThunk function_code;
145  SIZE_T read;
146  if (!::ReadProcessMemory(process_, target_, &function_code,
147                           sizeof(function_code), &read))
148    return false;
149
150  if (sizeof(function_code) != read)
151    return false;
152
153  if (!IsService(&function_code)) {
154    // See if it's the Win8 signature.
155    ServiceEntryW8* w8_service = &function_code.original_w8;
156    if (!IsService(&w8_service->mov_r10_rcx_mov_eax) ||
157        w8_service->mov_1 != kMov1 || w8_service->mov_1 != kMov1 ||
158        w8_service->mov_1 != kMov1) {
159      return false;
160    }
161  }
162
163  // Save the verified code.
164  memcpy(local_thunk, &function_code, sizeof(function_code));
165
166  return true;
167}
168
169NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk,
170                                            void* remote_thunk) {
171  ServiceFullThunk* full_local_thunk =
172      reinterpret_cast<ServiceFullThunk*>(local_thunk);
173  ServiceFullThunk* full_remote_thunk =
174      reinterpret_cast<ServiceFullThunk*>(remote_thunk);
175
176  // Patch the original code.
177  ServiceEntry local_service;
178  DCHECK_NT(GetInternalThunkSize() >= sizeof(local_service));
179  if (!SetInternalThunk(&local_service, sizeof(local_service), NULL,
180                        interceptor_))
181    return STATUS_UNSUCCESSFUL;
182
183  // Copy the local thunk buffer to the child.
184  SIZE_T actual;
185  if (!::WriteProcessMemory(process_, remote_thunk, local_thunk,
186                            sizeof(ServiceFullThunk), &actual))
187    return STATUS_UNSUCCESSFUL;
188
189  if (sizeof(ServiceFullThunk) != actual)
190    return STATUS_UNSUCCESSFUL;
191
192  // And now change the function to intercept, on the child.
193  if (NULL != ntdll_base_) {
194    // Running a unit test.
195    if (!::WriteProcessMemory(process_, target_, &local_service,
196                              sizeof(local_service), &actual))
197      return STATUS_UNSUCCESSFUL;
198  } else {
199    if (!WriteProtectedChildMemory(process_, target_, &local_service,
200                                   sizeof(local_service)))
201      return STATUS_UNSUCCESSFUL;
202  }
203
204  return STATUS_SUCCESS;
205}
206
207bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
208  NOTREACHED_NT();
209  return false;
210}
211
212}  // namespace sandbox
213