win_utils.h 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_WIN_SRC_WIN_UTILS_H_
  5. #define SANDBOX_WIN_SRC_WIN_UTILS_H_
  6. #include <stdlib.h>
  7. #include <map>
  8. #include <memory>
  9. #include <string>
  10. #include <vector>
  11. #include "base/win/windows_types.h"
  12. #include "third_party/abseil-cpp/absl/types/optional.h"
  13. namespace sandbox {
  14. // Prefix for path used by NT calls.
  15. const wchar_t kNTPrefix[] = L"\\??\\";
  16. const size_t kNTPrefixLen = std::size(kNTPrefix) - 1;
  17. const wchar_t kNTDevicePrefix[] = L"\\Device\\";
  18. const size_t kNTDevicePrefixLen = std::size(kNTDevicePrefix) - 1;
  19. // List of handles mapped to their kernel object type name.
  20. using ProcessHandleMap = std::map<std::wstring, std::vector<HANDLE>>;
  21. // Basic implementation of a singleton which calls the destructor
  22. // when the exe is shutting down or the DLL is being unloaded.
  23. template <typename Derived>
  24. class SingletonBase {
  25. public:
  26. static Derived* GetInstance() {
  27. static Derived* instance = nullptr;
  28. if (!instance) {
  29. instance = new Derived();
  30. // Microsoft CRT extension. In an exe this this called after
  31. // winmain returns, in a dll is called in DLL_PROCESS_DETACH
  32. _onexit(OnExit);
  33. }
  34. return instance;
  35. }
  36. private:
  37. // this is the function that gets called by the CRT when the
  38. // process is shutting down.
  39. static int __cdecl OnExit() {
  40. delete GetInstance();
  41. return 0;
  42. }
  43. };
  44. // Convert a short path (C:\path~1 or \\??\\c:\path~1) to the long version of
  45. // the path. If the path is not a valid filesystem path, the function returns
  46. // false and argument is not modified.
  47. // - If passing in a short native device path (\Device\HarddiskVolumeX\path~1),
  48. // a drive letter string (c:\) must also be provided.
  49. bool ConvertToLongPath(std::wstring* path,
  50. const std::wstring* drive_letter = nullptr);
  51. // Returns ERROR_SUCCESS if the path contains a reparse point,
  52. // ERROR_NOT_A_REPARSE_POINT if there's no reparse point in this path, or an
  53. // error code when the function fails.
  54. // This function is not smart. It looks for each element in the path and
  55. // returns true if any of them is a reparse point.
  56. DWORD IsReparsePoint(const std::wstring& full_path);
  57. // Returns true if the handle corresponds to the object pointed by this path.
  58. bool SameObject(HANDLE handle, const wchar_t* full_path);
  59. // Resolves a handle to an nt path. Returns true if the handle can be resolved.
  60. bool GetPathFromHandle(HANDLE handle, std::wstring* path);
  61. // Resolves a win32 path to an nt path using GetPathFromHandle. The path must
  62. // exist. Returns true if the translation was successful.
  63. bool GetNtPathFromWin32Path(const std::wstring& path, std::wstring* nt_path);
  64. // Resolves a handle to its type name. Returns true if successful.
  65. bool GetTypeNameFromHandle(HANDLE handle, std::wstring* type_name);
  66. // Resolves a user-readable registry path to a system-readable registry path.
  67. // For example, HKEY_LOCAL_MACHINE\\Software\\microsoft is translated to
  68. // \\registry\\machine\\software\\microsoft. Returns false if the path
  69. // cannot be resolved.
  70. bool ResolveRegistryName(std::wstring name, std::wstring* resolved_name);
  71. // Writes |length| bytes from the provided |buffer| into the address space of
  72. // |child_process|, at the specified |address|, preserving the original write
  73. // protection attributes. Returns true on success.
  74. bool WriteProtectedChildMemory(HANDLE child_process,
  75. void* address,
  76. const void* buffer,
  77. size_t length);
  78. // Allocates |buffer_bytes| in child (PAGE_READWRITE) and copies data
  79. // from |local_buffer| in this process into |child|. |remote_buffer|
  80. // contains the address in the chile. If a zero byte copy is
  81. // requested |true| is returned and no allocation or copying is
  82. // attempted. Returns false if allocation or copying fails. If
  83. // copying fails, the allocation will be reversed.
  84. bool CopyToChildMemory(HANDLE child,
  85. const void* local_buffer,
  86. size_t buffer_bytes,
  87. void** remote_buffer);
  88. // Returns true if the provided path points to a pipe.
  89. bool IsPipe(const std::wstring& path);
  90. // Converts a NTSTATUS code to a Win32 error code.
  91. DWORD GetLastErrorFromNtStatus(NTSTATUS status);
  92. // Returns the address of the main exe module in memory taking in account
  93. // address space layout randomization. This uses the process' PEB to extract
  94. // the base address. This should only be called on new, suspended processes.
  95. void* GetProcessBaseAddress(HANDLE process);
  96. // Returns a map of handles open in the current process. The call will only
  97. // works on Windows 8+. The map is keyed by the kernel object type name. If
  98. // querying the handles fails an empty optional value is returned. Note that
  99. // unless all threads are suspended in the process the valid handles could
  100. // change between the return of the list and when you use them.
  101. absl::optional<ProcessHandleMap> GetCurrentProcessHandles();
  102. // Fallback function for GetCurrentProcessHandles. Should only be needed on
  103. // Windows 7 which doesn't support the API to query all process handles. This
  104. // uses a brute force method to get the process handles.
  105. absl::optional<ProcessHandleMap> GetCurrentProcessHandlesWin7();
  106. } // namespace sandbox
  107. // Resolves a function name in NTDLL to a function pointer. The second parameter
  108. // is a pointer to the function pointer.
  109. void ResolveNTFunctionPtr(const char* name, void* ptr);
  110. #endif // SANDBOX_WIN_SRC_WIN_UTILS_H_