interceptors_64.h 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_INTERCEPTORS_64_H_
  5. #define SANDBOX_WIN_SRC_INTERCEPTORS_64_H_
  6. #include "sandbox/win/src/nt_internals.h"
  7. #include "sandbox/win/src/sandbox_types.h"
  8. namespace sandbox {
  9. extern "C" {
  10. // Interception of NtMapViewOfSection on the child process.
  11. // It should never be called directly. This function provides the means to
  12. // detect dlls being loaded, so we can patch them if needed.
  13. SANDBOX_INTERCEPT NTSTATUS WINAPI
  14. TargetNtMapViewOfSection64(HANDLE section,
  15. HANDLE process,
  16. PVOID* base,
  17. ULONG_PTR zero_bits,
  18. SIZE_T commit_size,
  19. PLARGE_INTEGER offset,
  20. PSIZE_T view_size,
  21. SECTION_INHERIT inherit,
  22. ULONG allocation_type,
  23. ULONG protect);
  24. // Interception of NtUnmapViewOfSection on the child process.
  25. // It should never be called directly. This function provides the means to
  26. // detect dlls being unloaded, so we can clean up our interceptions.
  27. SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtUnmapViewOfSection64(HANDLE process,
  28. PVOID base);
  29. // -----------------------------------------------------------------------
  30. // Interceptors without IPC.
  31. // Interception of NtSetInformationThread on the child process.
  32. SANDBOX_INTERCEPT NTSTATUS WINAPI
  33. TargetNtSetInformationThread64(HANDLE thread,
  34. NT_THREAD_INFORMATION_CLASS thread_info_class,
  35. PVOID thread_information,
  36. ULONG thread_information_bytes);
  37. // Interception of NtOpenThreadToken on the child process.
  38. SANDBOX_INTERCEPT NTSTATUS WINAPI
  39. TargetNtOpenThreadToken64(HANDLE thread,
  40. ACCESS_MASK desired_access,
  41. BOOLEAN open_as_self,
  42. PHANDLE token);
  43. // Interception of NtOpenThreadTokenEx on the child process.
  44. SANDBOX_INTERCEPT NTSTATUS WINAPI
  45. TargetNtOpenThreadTokenEx64(HANDLE thread,
  46. ACCESS_MASK desired_access,
  47. BOOLEAN open_as_self,
  48. ULONG handle_attributes,
  49. PHANDLE token);
  50. // -----------------------------------------------------------------------
  51. // Interceptors handled by the file system dispatcher.
  52. // Interception of NtCreateFile on the child process.
  53. SANDBOX_INTERCEPT NTSTATUS WINAPI
  54. TargetNtCreateFile64(PHANDLE file,
  55. ACCESS_MASK desired_access,
  56. POBJECT_ATTRIBUTES object_attributes,
  57. PIO_STATUS_BLOCK io_status,
  58. PLARGE_INTEGER allocation_size,
  59. ULONG file_attributes,
  60. ULONG sharing,
  61. ULONG disposition,
  62. ULONG options,
  63. PVOID ea_buffer,
  64. ULONG ea_length);
  65. // Interception of NtOpenFile on the child process.
  66. SANDBOX_INTERCEPT NTSTATUS WINAPI
  67. TargetNtOpenFile64(PHANDLE file,
  68. ACCESS_MASK desired_access,
  69. POBJECT_ATTRIBUTES object_attributes,
  70. PIO_STATUS_BLOCK io_status,
  71. ULONG sharing,
  72. ULONG options);
  73. // Interception of NtQueryAtttributesFile on the child process.
  74. SANDBOX_INTERCEPT NTSTATUS WINAPI
  75. TargetNtQueryAttributesFile64(POBJECT_ATTRIBUTES object_attributes,
  76. PFILE_BASIC_INFORMATION file_attributes);
  77. // Interception of NtQueryFullAtttributesFile on the child process.
  78. SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtQueryFullAttributesFile64(
  79. POBJECT_ATTRIBUTES object_attributes,
  80. PFILE_NETWORK_OPEN_INFORMATION file_attributes);
  81. // Interception of NtSetInformationFile on the child process.
  82. SANDBOX_INTERCEPT NTSTATUS WINAPI
  83. TargetNtSetInformationFile64(HANDLE file,
  84. PIO_STATUS_BLOCK io_status,
  85. PVOID file_information,
  86. ULONG length,
  87. FILE_INFORMATION_CLASS file_information_class);
  88. // -----------------------------------------------------------------------
  89. // Interceptors handled by the named pipe dispatcher.
  90. // Interception of CreateNamedPipeW in kernel32.dll
  91. SANDBOX_INTERCEPT HANDLE WINAPI
  92. TargetCreateNamedPipeW64(LPCWSTR pipe_name,
  93. DWORD open_mode,
  94. DWORD pipe_mode,
  95. DWORD max_instance,
  96. DWORD out_buffer_size,
  97. DWORD in_buffer_size,
  98. DWORD default_timeout,
  99. LPSECURITY_ATTRIBUTES security_attributes);
  100. // -----------------------------------------------------------------------
  101. // Interceptors handled by the process-thread dispatcher.
  102. // Interception of NtOpenThread on the child process.
  103. SANDBOX_INTERCEPT NTSTATUS WINAPI
  104. TargetNtOpenThread64(PHANDLE thread,
  105. ACCESS_MASK desired_access,
  106. POBJECT_ATTRIBUTES object_attributes,
  107. PCLIENT_ID client_id);
  108. // Interception of NtOpenProcess on the child process.
  109. SANDBOX_INTERCEPT NTSTATUS WINAPI
  110. TargetNtOpenProcess64(PHANDLE process,
  111. ACCESS_MASK desired_access,
  112. POBJECT_ATTRIBUTES object_attributes,
  113. PCLIENT_ID client_id);
  114. // Interception of NtOpenProcessToken on the child process.
  115. SANDBOX_INTERCEPT NTSTATUS WINAPI
  116. TargetNtOpenProcessToken64(HANDLE process,
  117. ACCESS_MASK desired_access,
  118. PHANDLE token);
  119. // Interception of NtOpenProcessTokenEx on the child process.
  120. SANDBOX_INTERCEPT NTSTATUS WINAPI
  121. TargetNtOpenProcessTokenEx64(HANDLE process,
  122. ACCESS_MASK desired_access,
  123. ULONG handle_attributes,
  124. PHANDLE token);
  125. // Interception of CreateThread in kernel32.dll.
  126. SANDBOX_INTERCEPT HANDLE WINAPI
  127. TargetCreateThread64(LPSECURITY_ATTRIBUTES thread_attributes,
  128. SIZE_T stack_size,
  129. LPTHREAD_START_ROUTINE start_address,
  130. PVOID parameter,
  131. DWORD creation_flags,
  132. LPDWORD thread_id);
  133. // -----------------------------------------------------------------------
  134. // Interceptors handled by the process mitigations win32k lockdown code.
  135. // Interceptor for the GdiDllInitialize function.
  136. SANDBOX_INTERCEPT BOOL WINAPI TargetGdiDllInitialize64(HANDLE dll,
  137. DWORD reason);
  138. // Interceptor for the GetStockObject function.
  139. SANDBOX_INTERCEPT HGDIOBJ WINAPI TargetGetStockObject64(int object);
  140. // Interceptor for the RegisterClassW function.
  141. SANDBOX_INTERCEPT ATOM WINAPI TargetRegisterClassW64(const WNDCLASS* wnd_class);
  142. // -----------------------------------------------------------------------
  143. // Interceptors handled by the signed process code.
  144. // Interception of NtCreateSection on the child process.
  145. SANDBOX_INTERCEPT NTSTATUS WINAPI
  146. TargetNtCreateSection64(PHANDLE section_handle,
  147. ACCESS_MASK desired_access,
  148. POBJECT_ATTRIBUTES object_attributes,
  149. PLARGE_INTEGER maximum_size,
  150. ULONG section_page_protection,
  151. ULONG allocation_attributes,
  152. HANDLE file_handle);
  153. } // extern "C"
  154. } // namespace sandbox
  155. #endif // SANDBOX_WIN_SRC_INTERCEPTORS_64_H_