interceptors_64.cc 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/interceptors_64.h"
  5. #include "sandbox/win/src/filesystem_interception.h"
  6. #include "sandbox/win/src/interceptors.h"
  7. #include "sandbox/win/src/named_pipe_interception.h"
  8. #include "sandbox/win/src/policy_target.h"
  9. #include "sandbox/win/src/process_mitigations_win32k_interception.h"
  10. #include "sandbox/win/src/process_thread_interception.h"
  11. #include "sandbox/win/src/sandbox_nt_types.h"
  12. #include "sandbox/win/src/sandbox_types.h"
  13. #include "sandbox/win/src/signed_interception.h"
  14. #include "sandbox/win/src/target_interceptions.h"
  15. namespace sandbox {
  16. SANDBOX_INTERCEPT OriginalFunctions g_originals;
  17. NTSTATUS WINAPI TargetNtMapViewOfSection64(HANDLE section,
  18. HANDLE process,
  19. PVOID* base,
  20. ULONG_PTR zero_bits,
  21. SIZE_T commit_size,
  22. PLARGE_INTEGER offset,
  23. PSIZE_T view_size,
  24. SECTION_INHERIT inherit,
  25. ULONG allocation_type,
  26. ULONG protect) {
  27. NtMapViewOfSectionFunction orig_fn =
  28. reinterpret_cast<NtMapViewOfSectionFunction>(
  29. g_originals[MAP_VIEW_OF_SECTION_ID]);
  30. return TargetNtMapViewOfSection(orig_fn, section, process, base, zero_bits,
  31. commit_size, offset, view_size, inherit,
  32. allocation_type, protect);
  33. }
  34. NTSTATUS WINAPI TargetNtUnmapViewOfSection64(HANDLE process, PVOID base) {
  35. NtUnmapViewOfSectionFunction orig_fn =
  36. reinterpret_cast<NtUnmapViewOfSectionFunction>(
  37. g_originals[UNMAP_VIEW_OF_SECTION_ID]);
  38. return TargetNtUnmapViewOfSection(orig_fn, process, base);
  39. }
  40. // -----------------------------------------------------------------------
  41. NTSTATUS WINAPI
  42. TargetNtSetInformationThread64(HANDLE thread,
  43. NT_THREAD_INFORMATION_CLASS thread_info_class,
  44. PVOID thread_information,
  45. ULONG thread_information_bytes) {
  46. NtSetInformationThreadFunction orig_fn =
  47. reinterpret_cast<NtSetInformationThreadFunction>(
  48. g_originals[SET_INFORMATION_THREAD_ID]);
  49. return TargetNtSetInformationThread(orig_fn, thread, thread_info_class,
  50. thread_information,
  51. thread_information_bytes);
  52. }
  53. NTSTATUS WINAPI TargetNtOpenThreadToken64(HANDLE thread,
  54. ACCESS_MASK desired_access,
  55. BOOLEAN open_as_self,
  56. PHANDLE token) {
  57. NtOpenThreadTokenFunction orig_fn =
  58. reinterpret_cast<NtOpenThreadTokenFunction>(
  59. g_originals[OPEN_THREAD_TOKEN_ID]);
  60. return TargetNtOpenThreadToken(orig_fn, thread, desired_access, open_as_self,
  61. token);
  62. }
  63. NTSTATUS WINAPI TargetNtOpenThreadTokenEx64(HANDLE thread,
  64. ACCESS_MASK desired_access,
  65. BOOLEAN open_as_self,
  66. ULONG handle_attributes,
  67. PHANDLE token) {
  68. NtOpenThreadTokenExFunction orig_fn =
  69. reinterpret_cast<NtOpenThreadTokenExFunction>(
  70. g_originals[OPEN_THREAD_TOKEN_EX_ID]);
  71. return TargetNtOpenThreadTokenEx(orig_fn, thread, desired_access,
  72. open_as_self, handle_attributes, token);
  73. }
  74. // -----------------------------------------------------------------------
  75. SANDBOX_INTERCEPT NTSTATUS WINAPI
  76. TargetNtCreateFile64(PHANDLE file,
  77. ACCESS_MASK desired_access,
  78. POBJECT_ATTRIBUTES object_attributes,
  79. PIO_STATUS_BLOCK io_status,
  80. PLARGE_INTEGER allocation_size,
  81. ULONG file_attributes,
  82. ULONG sharing,
  83. ULONG disposition,
  84. ULONG options,
  85. PVOID ea_buffer,
  86. ULONG ea_length) {
  87. NtCreateFileFunction orig_fn =
  88. reinterpret_cast<NtCreateFileFunction>(g_originals[CREATE_FILE_ID]);
  89. return TargetNtCreateFile(orig_fn, file, desired_access, object_attributes,
  90. io_status, allocation_size, file_attributes,
  91. sharing, disposition, options, ea_buffer,
  92. ea_length);
  93. }
  94. SANDBOX_INTERCEPT NTSTATUS WINAPI
  95. TargetNtOpenFile64(PHANDLE file,
  96. ACCESS_MASK desired_access,
  97. POBJECT_ATTRIBUTES object_attributes,
  98. PIO_STATUS_BLOCK io_status,
  99. ULONG sharing,
  100. ULONG options) {
  101. NtOpenFileFunction orig_fn =
  102. reinterpret_cast<NtOpenFileFunction>(g_originals[OPEN_FILE_ID]);
  103. return TargetNtOpenFile(orig_fn, file, desired_access, object_attributes,
  104. io_status, sharing, options);
  105. }
  106. SANDBOX_INTERCEPT NTSTATUS WINAPI
  107. TargetNtQueryAttributesFile64(POBJECT_ATTRIBUTES object_attributes,
  108. PFILE_BASIC_INFORMATION file_attributes) {
  109. NtQueryAttributesFileFunction orig_fn =
  110. reinterpret_cast<NtQueryAttributesFileFunction>(
  111. g_originals[QUERY_ATTRIB_FILE_ID]);
  112. return TargetNtQueryAttributesFile(orig_fn, object_attributes,
  113. file_attributes);
  114. }
  115. SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryFullAttributesFile64(
  116. POBJECT_ATTRIBUTES object_attributes,
  117. PFILE_NETWORK_OPEN_INFORMATION file_attributes) {
  118. NtQueryFullAttributesFileFunction orig_fn =
  119. reinterpret_cast<NtQueryFullAttributesFileFunction>(
  120. g_originals[QUERY_FULL_ATTRIB_FILE_ID]);
  121. return TargetNtQueryFullAttributesFile(orig_fn, object_attributes,
  122. file_attributes);
  123. }
  124. SANDBOX_INTERCEPT NTSTATUS WINAPI
  125. TargetNtSetInformationFile64(HANDLE file,
  126. PIO_STATUS_BLOCK io_status,
  127. PVOID file_information,
  128. ULONG length,
  129. FILE_INFORMATION_CLASS file_information_class) {
  130. NtSetInformationFileFunction orig_fn =
  131. reinterpret_cast<NtSetInformationFileFunction>(
  132. g_originals[SET_INFO_FILE_ID]);
  133. return TargetNtSetInformationFile(orig_fn, file, io_status, file_information,
  134. length, file_information_class);
  135. }
  136. // -----------------------------------------------------------------------
  137. SANDBOX_INTERCEPT HANDLE WINAPI
  138. TargetCreateNamedPipeW64(LPCWSTR pipe_name,
  139. DWORD open_mode,
  140. DWORD pipe_mode,
  141. DWORD max_instance,
  142. DWORD out_buffer_size,
  143. DWORD in_buffer_size,
  144. DWORD default_timeout,
  145. LPSECURITY_ATTRIBUTES security_attributes) {
  146. CreateNamedPipeWFunction orig_fn = reinterpret_cast<CreateNamedPipeWFunction>(
  147. g_originals[CREATE_NAMED_PIPE_ID]);
  148. return TargetCreateNamedPipeW(orig_fn, pipe_name, open_mode, pipe_mode,
  149. max_instance, out_buffer_size, in_buffer_size,
  150. default_timeout, security_attributes);
  151. }
  152. // -----------------------------------------------------------------------
  153. SANDBOX_INTERCEPT NTSTATUS WINAPI
  154. TargetNtOpenThread64(PHANDLE thread,
  155. ACCESS_MASK desired_access,
  156. POBJECT_ATTRIBUTES object_attributes,
  157. PCLIENT_ID client_id) {
  158. NtOpenThreadFunction orig_fn =
  159. reinterpret_cast<NtOpenThreadFunction>(g_originals[OPEN_THREAD_ID]);
  160. return TargetNtOpenThread(orig_fn, thread, desired_access, object_attributes,
  161. client_id);
  162. }
  163. SANDBOX_INTERCEPT NTSTATUS WINAPI
  164. TargetNtOpenProcess64(PHANDLE process,
  165. ACCESS_MASK desired_access,
  166. POBJECT_ATTRIBUTES object_attributes,
  167. PCLIENT_ID client_id) {
  168. NtOpenProcessFunction orig_fn =
  169. reinterpret_cast<NtOpenProcessFunction>(g_originals[OPEN_PROCESS_ID]);
  170. return TargetNtOpenProcess(orig_fn, process, desired_access,
  171. object_attributes, client_id);
  172. }
  173. SANDBOX_INTERCEPT NTSTATUS WINAPI
  174. TargetNtOpenProcessToken64(HANDLE process,
  175. ACCESS_MASK desired_access,
  176. PHANDLE token) {
  177. NtOpenProcessTokenFunction orig_fn =
  178. reinterpret_cast<NtOpenProcessTokenFunction>(
  179. g_originals[OPEN_PROCESS_TOKEN_ID]);
  180. return TargetNtOpenProcessToken(orig_fn, process, desired_access, token);
  181. }
  182. SANDBOX_INTERCEPT NTSTATUS WINAPI
  183. TargetNtOpenProcessTokenEx64(HANDLE process,
  184. ACCESS_MASK desired_access,
  185. ULONG handle_attributes,
  186. PHANDLE token) {
  187. NtOpenProcessTokenExFunction orig_fn =
  188. reinterpret_cast<NtOpenProcessTokenExFunction>(
  189. g_originals[OPEN_PROCESS_TOKEN_EX_ID]);
  190. return TargetNtOpenProcessTokenEx(orig_fn, process, desired_access,
  191. handle_attributes, token);
  192. }
  193. SANDBOX_INTERCEPT HANDLE WINAPI
  194. TargetCreateThread64(LPSECURITY_ATTRIBUTES thread_attributes,
  195. SIZE_T stack_size,
  196. LPTHREAD_START_ROUTINE start_address,
  197. PVOID parameter,
  198. DWORD creation_flags,
  199. LPDWORD thread_id) {
  200. CreateThreadFunction orig_fn =
  201. reinterpret_cast<CreateThreadFunction>(g_originals[CREATE_THREAD_ID]);
  202. return TargetCreateThread(orig_fn, thread_attributes, stack_size,
  203. start_address, parameter, creation_flags,
  204. thread_id);
  205. }
  206. // -----------------------------------------------------------------------
  207. SANDBOX_INTERCEPT BOOL WINAPI TargetGdiDllInitialize64(HANDLE dll,
  208. DWORD reason) {
  209. GdiDllInitializeFunction orig_fn =
  210. reinterpret_cast<GdiDllInitializeFunction>(g_originals[GDIINITIALIZE_ID]);
  211. return TargetGdiDllInitialize(orig_fn, dll, reason);
  212. }
  213. SANDBOX_INTERCEPT HGDIOBJ WINAPI TargetGetStockObject64(int object) {
  214. GetStockObjectFunction orig_fn =
  215. reinterpret_cast<GetStockObjectFunction>(g_originals[GETSTOCKOBJECT_ID]);
  216. return TargetGetStockObject(orig_fn, object);
  217. }
  218. SANDBOX_INTERCEPT ATOM WINAPI
  219. TargetRegisterClassW64(const WNDCLASS* wnd_class) {
  220. RegisterClassWFunction orig_fn =
  221. reinterpret_cast<RegisterClassWFunction>(g_originals[REGISTERCLASSW_ID]);
  222. return TargetRegisterClassW(orig_fn, wnd_class);
  223. }
  224. SANDBOX_INTERCEPT NTSTATUS WINAPI
  225. TargetNtCreateSection64(PHANDLE section_handle,
  226. ACCESS_MASK desired_access,
  227. POBJECT_ATTRIBUTES object_attributes,
  228. PLARGE_INTEGER maximum_size,
  229. ULONG section_page_protection,
  230. ULONG allocation_attributes,
  231. HANDLE file_handle) {
  232. NtCreateSectionFunction orig_fn =
  233. reinterpret_cast<NtCreateSectionFunction>(g_originals[CREATE_SECTION_ID]);
  234. return TargetNtCreateSection(
  235. orig_fn, section_handle, desired_access, object_attributes, maximum_size,
  236. section_page_protection, allocation_attributes, file_handle);
  237. }
  238. } // namespace sandbox