interception_unittest.cc 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // This file contains unit tests for InterceptionManager.
  5. // The tests require private information so the whole interception.cc file is
  6. // included from this file.
  7. #include "sandbox/win/src/interception.h"
  8. #include <windows.h>
  9. #include <stddef.h>
  10. #include <algorithm>
  11. #include <memory>
  12. #include <set>
  13. #include "base/bits.h"
  14. #include "sandbox/win/src/interception_internal.h"
  15. #include "sandbox/win/src/interceptors.h"
  16. #include "sandbox/win/src/target_process.h"
  17. #include "testing/gtest/include/gtest/gtest.h"
  18. namespace sandbox {
  19. namespace internal {
  20. size_t GetGranularAlignedRandomOffset(size_t size);
  21. }
  22. // Walks the settings buffer, verifying that the values make sense and counting
  23. // objects.
  24. // Arguments:
  25. // buffer (in): the buffer to walk.
  26. // size (in): buffer size
  27. // num_dlls (out): count of the dlls on the buffer.
  28. // num_function (out): count of intercepted functions.
  29. // num_names (out): count of named interceptor functions.
  30. void WalkBuffer(void* buffer,
  31. size_t size,
  32. int* num_dlls,
  33. int* num_functions,
  34. int* num_names) {
  35. ASSERT_TRUE(buffer);
  36. ASSERT_TRUE(num_functions);
  37. ASSERT_TRUE(num_names);
  38. *num_dlls = *num_functions = *num_names = 0;
  39. SharedMemory* memory = reinterpret_cast<SharedMemory*>(buffer);
  40. ASSERT_GT(size, sizeof(SharedMemory));
  41. DllPatchInfo* dll = &memory->dll_list[0];
  42. for (int i = 0; i < memory->num_intercepted_dlls; i++) {
  43. ASSERT_NE(0u, wcslen(dll->dll_name));
  44. ASSERT_EQ(0u, dll->record_bytes % sizeof(size_t));
  45. ASSERT_EQ(0u, dll->offset_to_functions % sizeof(size_t));
  46. ASSERT_NE(0, dll->num_functions);
  47. FunctionInfo* function = reinterpret_cast<FunctionInfo*>(
  48. reinterpret_cast<char*>(dll) + dll->offset_to_functions);
  49. for (int j = 0; j < dll->num_functions; j++) {
  50. ASSERT_EQ(0u, function->record_bytes % sizeof(size_t));
  51. char* name = function->function;
  52. size_t length = strlen(name);
  53. ASSERT_NE(0u, length);
  54. name += length + 1;
  55. // look for overflows
  56. ASSERT_GT(reinterpret_cast<char*>(buffer) + size, name + strlen(name));
  57. // look for a named interceptor
  58. if (strlen(name)) {
  59. (*num_names)++;
  60. EXPECT_TRUE(!function->interceptor_address);
  61. } else {
  62. EXPECT_TRUE(function->interceptor_address);
  63. }
  64. (*num_functions)++;
  65. function = reinterpret_cast<FunctionInfo*>(
  66. reinterpret_cast<char*>(function) + function->record_bytes);
  67. }
  68. (*num_dlls)++;
  69. dll = reinterpret_cast<DllPatchInfo*>(reinterpret_cast<char*>(dll) +
  70. dll->record_bytes);
  71. }
  72. }
  73. TEST(InterceptionManagerTest, GetGranularAlignedRandomOffset) {
  74. std::set<size_t> sizes;
  75. // 544 is current value of interceptions_.size() * sizeof(ThunkData) +
  76. // sizeof(DllInterceptionData).
  77. const size_t kThunkBytes = 544;
  78. // ciel(log2(544)) = 10.
  79. // Alignment must be 2^10 = 1024.
  80. const size_t kAlignmentBits = base::bits::Log2Ceiling(kThunkBytes);
  81. const size_t kAlignment = static_cast<size_t>(1) << kAlignmentBits;
  82. const size_t kAllocGranularity = 65536;
  83. // Generate enough sample data to ensure there is at least one value in each
  84. // potential bucket.
  85. for (size_t i = 0; i < 1000000; i++)
  86. sizes.insert(internal::GetGranularAlignedRandomOffset(kThunkBytes));
  87. size_t prev_val = 0;
  88. size_t min_val = kAllocGranularity;
  89. size_t min_nonzero_val = kAllocGranularity;
  90. size_t max_val = 0;
  91. for (size_t val : sizes) {
  92. ASSERT_LT(val, kAllocGranularity);
  93. if (prev_val)
  94. ASSERT_EQ(val - prev_val, kAlignment);
  95. if (val)
  96. min_nonzero_val = std::min(val, min_nonzero_val);
  97. min_val = std::min(val, min_val);
  98. prev_val = val;
  99. max_val = std::max(val, max_val);
  100. }
  101. ASSERT_EQ(max_val, kAllocGranularity - kAlignment);
  102. ASSERT_EQ(0u, min_val);
  103. ASSERT_EQ(min_nonzero_val, kAlignment);
  104. }
  105. TEST(InterceptionManagerTest, BufferLayout1) {
  106. wchar_t exe_name[MAX_PATH];
  107. ASSERT_NE(0u, GetModuleFileName(nullptr, exe_name, MAX_PATH - 1));
  108. auto target = TargetProcess::MakeTargetProcessForTesting(
  109. ::GetCurrentProcess(), ::GetModuleHandle(exe_name));
  110. InterceptionManager interceptions(*target, true);
  111. // Any pointer will do for a function pointer.
  112. void* function = &interceptions;
  113. // We don't care about the interceptor id.
  114. interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtCreateFile",
  115. INTERCEPTION_SERVICE_CALL, function,
  116. OPEN_KEY_ID);
  117. interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateFileEx",
  118. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  119. interceptions.AddToPatchedFunctions(L"user32.dll", "FindWindow",
  120. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  121. interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateMutex",
  122. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  123. interceptions.AddToPatchedFunctions(L"user32.dll", "PostMsg",
  124. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  125. interceptions.AddToPatchedFunctions(L"user32.dll", "PostMsg",
  126. INTERCEPTION_EAT, "replacement",
  127. OPEN_KEY_ID);
  128. interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
  129. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  130. interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtClose",
  131. INTERCEPTION_SERVICE_CALL, function,
  132. OPEN_KEY_ID);
  133. interceptions.AddToPatchedFunctions(L"some.dll", "Superfn", INTERCEPTION_EAT,
  134. function, OPEN_KEY_ID);
  135. interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
  136. INTERCEPTION_EAT, "a", OPEN_KEY_ID);
  137. interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
  138. INTERCEPTION_EAT, "abc", OPEN_KEY_ID);
  139. interceptions.AddToPatchedFunctions(L"a.dll", "p", INTERCEPTION_EAT, function,
  140. OPEN_KEY_ID);
  141. interceptions.AddToPatchedFunctions(L"b.dll",
  142. "TheIncredibleCallToSaveTheWorld",
  143. INTERCEPTION_EAT, function, OPEN_KEY_ID);
  144. interceptions.AddToPatchedFunctions(L"a.dll", "BIsLame", INTERCEPTION_EAT,
  145. function, OPEN_KEY_ID);
  146. interceptions.AddToPatchedFunctions(L"a.dll", "ARules", INTERCEPTION_EAT,
  147. function, OPEN_KEY_ID);
  148. // Verify that all interceptions were added
  149. ASSERT_EQ(15u, interceptions.interceptions_.size());
  150. size_t buffer_size = interceptions.GetBufferSize();
  151. std::unique_ptr<BYTE[]> local_buffer(new BYTE[buffer_size]);
  152. ASSERT_TRUE(interceptions.SetupConfigBuffer(local_buffer.get(), buffer_size));
  153. // At this point, the interceptions should have been separated into two
  154. // groups: one group with the local ("cold") interceptions, consisting of
  155. // everything from ntdll and stuff set as INTRECEPTION_SERVICE_CALL, and
  156. // another group with the interceptions belonging to dlls that will be "hot"
  157. // patched on the client. The second group lives on local_buffer, and the
  158. // first group remains on the list of interceptions (inside the object
  159. // "interceptions"). There are 2 local interceptions (of ntdll); the
  160. // other 13 have to be sent to the child to be performed "hot".
  161. EXPECT_EQ(2u, interceptions.interceptions_.size());
  162. int num_dlls, num_functions, num_names;
  163. WalkBuffer(local_buffer.get(), buffer_size, &num_dlls, &num_functions,
  164. &num_names);
  165. // The 13 interceptions on the buffer (to the child) should be grouped on 6
  166. // dlls. Only four interceptions are using an explicit name for the
  167. // interceptor function.
  168. EXPECT_EQ(6, num_dlls);
  169. EXPECT_EQ(13, num_functions);
  170. EXPECT_EQ(3, num_names);
  171. }
  172. TEST(InterceptionManagerTest, BufferLayout2) {
  173. wchar_t exe_name[MAX_PATH];
  174. ASSERT_NE(0u, GetModuleFileName(nullptr, exe_name, MAX_PATH - 1));
  175. auto target = TargetProcess::MakeTargetProcessForTesting(
  176. ::GetCurrentProcess(), ::GetModuleHandle(exe_name));
  177. InterceptionManager interceptions(*target, true);
  178. // Any pointer will do for a function pointer.
  179. void* function = &interceptions;
  180. interceptions.AddToUnloadModules(L"some01.dll");
  181. // We don't care about the interceptor id.
  182. interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtCreateFile",
  183. INTERCEPTION_SERVICE_CALL, function,
  184. OPEN_FILE_ID);
  185. interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateFileEx",
  186. INTERCEPTION_EAT, function, OPEN_FILE_ID);
  187. interceptions.AddToUnloadModules(L"some02.dll");
  188. // Verify that all interceptions were added
  189. ASSERT_EQ(4u, interceptions.interceptions_.size());
  190. size_t buffer_size = interceptions.GetBufferSize();
  191. std::unique_ptr<BYTE[]> local_buffer(new BYTE[buffer_size]);
  192. ASSERT_TRUE(interceptions.SetupConfigBuffer(local_buffer.get(), buffer_size));
  193. // At this point, the interceptions should have been separated into two
  194. // groups: one group with the local ("cold") interceptions, and another
  195. // group with the interceptions belonging to dlls that will be "hot"
  196. // patched on the client. The second group lives on local_buffer, and the
  197. // first group remains on the list of interceptions, in this case just one.
  198. EXPECT_EQ(1u, interceptions.interceptions_.size());
  199. int num_dlls, num_functions, num_names;
  200. WalkBuffer(local_buffer.get(), buffer_size, &num_dlls, &num_functions,
  201. &num_names);
  202. EXPECT_EQ(3, num_dlls);
  203. EXPECT_EQ(3, num_functions);
  204. EXPECT_EQ(0, num_names);
  205. }
  206. } // namespace sandbox