service_resolver_64.cc 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/win/src/service_resolver.h"
  5. #include <stddef.h>
  6. #include <memory>
  7. #include "sandbox/win/src/sandbox_nt_util.h"
  8. #include "sandbox/win/src/win_utils.h"
  9. namespace {
  10. #if defined(_M_X64)
  11. #pragma pack(push, 1)
  12. const ULONG kMmovR10EcxMovEax = 0xB8D18B4C;
  13. const USHORT kSyscall = 0x050F;
  14. const BYTE kRetNp = 0xC3;
  15. const ULONG64 kMov1 = 0x54894808244C8948;
  16. const ULONG64 kMov2 = 0x4C182444894C1024;
  17. const ULONG kMov3 = 0x20244C89;
  18. const USHORT kTestByte = 0x04F6;
  19. const BYTE kPtr = 0x25;
  20. const BYTE kRet = 0xC3;
  21. const USHORT kJne = 0x0375;
  22. // Service code for 64 bit systems.
  23. struct ServiceEntry {
  24. // This struct contains roughly the following code:
  25. // 00 mov r10,rcx
  26. // 03 mov eax,52h
  27. // 08 syscall
  28. // 0a ret
  29. // 0b xchg ax,ax
  30. // 0e xchg ax,ax
  31. ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
  32. ULONG service_id;
  33. USHORT syscall; // = 0F 05
  34. BYTE ret; // = C3
  35. BYTE pad; // = 66
  36. USHORT xchg_ax_ax1; // = 66 90
  37. USHORT xchg_ax_ax2; // = 66 90
  38. };
  39. // Service code for 64 bit Windows 8.
  40. struct ServiceEntryW8 {
  41. // This struct contains the following code:
  42. // 00 48894c2408 mov [rsp+8], rcx
  43. // 05 4889542410 mov [rsp+10], rdx
  44. // 0a 4c89442418 mov [rsp+18], r8
  45. // 0f 4c894c2420 mov [rsp+20], r9
  46. // 14 4c8bd1 mov r10,rcx
  47. // 17 b825000000 mov eax,25h
  48. // 1c 0f05 syscall
  49. // 1e c3 ret
  50. // 1f 90 nop
  51. ULONG64 mov_1; // = 48 89 4C 24 08 48 89 54
  52. ULONG64 mov_2; // = 24 10 4C 89 44 24 18 4C
  53. ULONG mov_3; // = 89 4C 24 20
  54. ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
  55. ULONG service_id;
  56. USHORT syscall; // = 0F 05
  57. BYTE ret; // = C3
  58. BYTE nop; // = 90
  59. };
  60. // Service code for 64 bit systems with int 2e fallback.
  61. struct ServiceEntryWithInt2E {
  62. // This struct contains roughly the following code:
  63. // 00 4c8bd1 mov r10,rcx
  64. // 03 b855000000 mov eax,52h
  65. // 08 f604250803fe7f01 test byte ptr SharedUserData!308, 1
  66. // 10 7503 jne [over syscall]
  67. // 12 0f05 syscall
  68. // 14 c3 ret
  69. // 15 cd2e int 2e
  70. // 17 c3 ret
  71. ULONG mov_r10_rcx_mov_eax; // = 4C 8B D1 B8
  72. ULONG service_id;
  73. USHORT test_byte; // = F6 04
  74. BYTE ptr; // = 25
  75. ULONG user_shared_data_ptr;
  76. BYTE one; // = 01
  77. USHORT jne_over_syscall; // = 75 03
  78. USHORT syscall; // = 0F 05
  79. BYTE ret; // = C3
  80. USHORT int2e; // = CD 2E
  81. BYTE ret2; // = C3
  82. };
  83. // We don't have an internal thunk for x64.
  84. struct ServiceFullThunk {
  85. union {
  86. ServiceEntry original;
  87. ServiceEntryW8 original_w8;
  88. ServiceEntryWithInt2E original_int2e_fallback;
  89. };
  90. };
  91. #pragma pack(pop)
  92. bool IsService(const void* source) {
  93. const ServiceEntry* service = reinterpret_cast<const ServiceEntry*>(source);
  94. return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
  95. kSyscall == service->syscall && kRetNp == service->ret);
  96. }
  97. bool IsServiceW8(const void* source) {
  98. const ServiceEntryW8* service =
  99. reinterpret_cast<const ServiceEntryW8*>(source);
  100. return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
  101. kMov1 == service->mov_1 && kMov2 == service->mov_2 &&
  102. kMov3 == service->mov_3);
  103. }
  104. bool IsServiceWithInt2E(const void* source) {
  105. const ServiceEntryWithInt2E* service =
  106. reinterpret_cast<const ServiceEntryWithInt2E*>(source);
  107. return (kMmovR10EcxMovEax == service->mov_r10_rcx_mov_eax &&
  108. kTestByte == service->test_byte && kPtr == service->ptr &&
  109. kJne == service->jne_over_syscall && kSyscall == service->syscall &&
  110. kRet == service->ret && kRet == service->ret2);
  111. }
  112. bool IsAnyService(const void* source) {
  113. return IsService(source) || IsServiceW8(source) || IsServiceWithInt2E(source);
  114. }
  115. #elif defined(_M_ARM64)
  116. #pragma pack(push, 4)
  117. const ULONG kSvc = 0xD4000001;
  118. const ULONG kRetNp = 0xD65F03C0;
  119. const ULONG kServiceIdMask = 0x001FFFE0;
  120. struct ServiceEntry {
  121. ULONG svc;
  122. ULONG ret;
  123. ULONG64 unused;
  124. };
  125. struct ServiceFullThunk {
  126. ServiceEntry original;
  127. };
  128. #pragma pack(pop)
  129. bool IsService(const void* source) {
  130. const ServiceEntry* service = reinterpret_cast<const ServiceEntry*>(source);
  131. return (kSvc == (service->svc & ~kServiceIdMask) && kRetNp == service->ret &&
  132. 0 == service->unused);
  133. }
  134. bool IsAnyService(const void* source) {
  135. return IsService(source);
  136. }
  137. #else
  138. #error "Unsupported Windows 64-bit Arch"
  139. #endif
  140. } // namespace
  141. namespace sandbox {
  142. NTSTATUS ServiceResolverThunk::Setup(const void* target_module,
  143. const void* interceptor_module,
  144. const char* target_name,
  145. const char* interceptor_name,
  146. const void* interceptor_entry_point,
  147. void* thunk_storage,
  148. size_t storage_bytes,
  149. size_t* storage_used) {
  150. NTSTATUS ret =
  151. Init(target_module, interceptor_module, target_name, interceptor_name,
  152. interceptor_entry_point, thunk_storage, storage_bytes);
  153. if (!NT_SUCCESS(ret))
  154. return ret;
  155. size_t thunk_bytes = GetThunkSize();
  156. std::unique_ptr<char[]> thunk_buffer(new char[thunk_bytes]);
  157. ServiceFullThunk* thunk =
  158. reinterpret_cast<ServiceFullThunk*>(thunk_buffer.get());
  159. if (!IsFunctionAService(&thunk->original))
  160. return STATUS_OBJECT_NAME_COLLISION;
  161. ret = PerformPatch(thunk, thunk_storage);
  162. if (storage_used)
  163. *storage_used = thunk_bytes;
  164. return ret;
  165. }
  166. size_t ServiceResolverThunk::GetThunkSize() const {
  167. return sizeof(ServiceFullThunk);
  168. }
  169. NTSTATUS ServiceResolverThunk::CopyThunk(const void* target_module,
  170. const char* target_name,
  171. BYTE* thunk_storage,
  172. size_t storage_bytes,
  173. size_t* storage_used) {
  174. NTSTATUS ret = ResolveTarget(target_module, target_name, &target_);
  175. if (!NT_SUCCESS(ret))
  176. return ret;
  177. size_t thunk_bytes = GetThunkSize();
  178. if (storage_bytes < thunk_bytes)
  179. return STATUS_UNSUCCESSFUL;
  180. ServiceFullThunk* thunk = reinterpret_cast<ServiceFullThunk*>(thunk_storage);
  181. if (!IsFunctionAService(&thunk->original))
  182. return STATUS_OBJECT_NAME_COLLISION;
  183. if (storage_used)
  184. *storage_used = thunk_bytes;
  185. return ret;
  186. }
  187. bool ServiceResolverThunk::IsFunctionAService(void* local_thunk) const {
  188. ServiceFullThunk function_code;
  189. SIZE_T read;
  190. if (!::ReadProcessMemory(process_, target_, &function_code,
  191. sizeof(function_code), &read))
  192. return false;
  193. if (sizeof(function_code) != read)
  194. return false;
  195. if (!IsAnyService(&function_code))
  196. return false;
  197. // Save the verified code.
  198. memcpy(local_thunk, &function_code, sizeof(function_code));
  199. return true;
  200. }
  201. NTSTATUS ServiceResolverThunk::PerformPatch(void* local_thunk,
  202. void* remote_thunk) {
  203. // Patch the original code.
  204. ServiceEntry local_service;
  205. DCHECK_NT(GetInternalThunkSize() <= sizeof(local_service));
  206. if (!SetInternalThunk(&local_service, sizeof(local_service), nullptr,
  207. interceptor_))
  208. return STATUS_UNSUCCESSFUL;
  209. // Copy the local thunk buffer to the child.
  210. SIZE_T actual;
  211. if (!::WriteProcessMemory(process_, remote_thunk, local_thunk,
  212. sizeof(ServiceFullThunk), &actual))
  213. return STATUS_UNSUCCESSFUL;
  214. if (sizeof(ServiceFullThunk) != actual)
  215. return STATUS_UNSUCCESSFUL;
  216. // And now change the function to intercept, on the child.
  217. if (ntdll_base_) {
  218. // Running a unit test.
  219. if (!::WriteProcessMemory(process_, target_, &local_service,
  220. sizeof(local_service), &actual))
  221. return STATUS_UNSUCCESSFUL;
  222. } else {
  223. if (!WriteProtectedChildMemory(process_, target_, &local_service,
  224. sizeof(local_service)))
  225. return STATUS_UNSUCCESSFUL;
  226. }
  227. return STATUS_SUCCESS;
  228. }
  229. bool Wow64ResolverThunk::IsFunctionAService(void* local_thunk) const {
  230. NOTREACHED_NT();
  231. return false;
  232. }
  233. } // namespace sandbox