1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // This file contains unit tests for InterceptionManager.
6 // The tests require private information so the whole interception.cc file is
7 // included from this file.
8
9 #include "sandbox/win/src/interception.h"
10
11 #include <windows.h>
12
13 #include <stddef.h>
14
15 #include <algorithm>
16 #include <memory>
17 #include <set>
18
19 #include "base/bits.h"
20 #include "sandbox/win/src/interception_internal.h"
21 #include "sandbox/win/src/interceptors.h"
22 #include "sandbox/win/src/target_process.h"
23 #include "testing/gtest/include/gtest/gtest.h"
24
25 namespace sandbox {
26
27 namespace internal {
28 size_t GetGranularAlignedRandomOffset(size_t size);
29 }
30
31 // Walks the settings buffer, verifying that the values make sense and counting
32 // objects.
33 // Arguments:
34 // buffer (in): the buffer to walk.
35 // size (in): buffer size
36 // num_dlls (out): count of the dlls on the buffer.
37 // num_function (out): count of intercepted functions.
38 // num_names (out): count of named interceptor functions.
WalkBuffer(void * buffer,size_t size,int * num_dlls,int * num_functions,int * num_names)39 void WalkBuffer(void* buffer,
40 size_t size,
41 int* num_dlls,
42 int* num_functions,
43 int* num_names) {
44 ASSERT_TRUE(buffer);
45 ASSERT_TRUE(num_functions);
46 ASSERT_TRUE(num_names);
47 *num_dlls = *num_functions = *num_names = 0;
48 SharedMemory* memory = reinterpret_cast<SharedMemory*>(buffer);
49
50 ASSERT_GT(size, sizeof(SharedMemory));
51 DllPatchInfo* dll = &memory->dll_list[0];
52
53 for (int i = 0; i < memory->num_intercepted_dlls; i++) {
54 ASSERT_NE(0u, wcslen(dll->dll_name));
55 ASSERT_EQ(0u, dll->record_bytes % sizeof(size_t));
56 ASSERT_EQ(0u, dll->offset_to_functions % sizeof(size_t));
57 ASSERT_NE(0, dll->num_functions);
58
59 FunctionInfo* function = reinterpret_cast<FunctionInfo*>(
60 reinterpret_cast<char*>(dll) + dll->offset_to_functions);
61
62 for (int j = 0; j < dll->num_functions; j++) {
63 ASSERT_EQ(0u, function->record_bytes % sizeof(size_t));
64
65 char* name = function->function;
66 size_t length = strlen(name);
67 ASSERT_NE(0u, length);
68 name += length + 1;
69
70 // look for overflows
71 ASSERT_GT(reinterpret_cast<char*>(buffer) + size, name + strlen(name));
72
73 // look for a named interceptor
74 if (strlen(name)) {
75 (*num_names)++;
76 EXPECT_TRUE(!function->interceptor_address);
77 } else {
78 EXPECT_TRUE(function->interceptor_address);
79 }
80
81 (*num_functions)++;
82 function = reinterpret_cast<FunctionInfo*>(
83 reinterpret_cast<char*>(function) + function->record_bytes);
84 }
85
86 (*num_dlls)++;
87 dll = reinterpret_cast<DllPatchInfo*>(reinterpret_cast<char*>(dll) +
88 dll->record_bytes);
89 }
90 }
91
TEST(InterceptionManagerTest,GetGranularAlignedRandomOffset)92 TEST(InterceptionManagerTest, GetGranularAlignedRandomOffset) {
93 std::set<size_t> sizes;
94
95 // 544 is current value of interceptions_.size() * sizeof(ThunkData) +
96 // sizeof(DllInterceptionData).
97 const size_t kThunkBytes = 544;
98
99 // ciel(log2(544)) = 10.
100 // Alignment must be 2^10 = 1024.
101 const size_t kAlignmentBits = base::bits::Log2Ceiling(kThunkBytes);
102 const size_t kAlignment = static_cast<size_t>(1) << kAlignmentBits;
103
104 const size_t kAllocGranularity = 65536;
105
106 // Generate enough sample data to ensure there is at least one value in each
107 // potential bucket.
108 for (size_t i = 0; i < 1000000; i++)
109 sizes.insert(internal::GetGranularAlignedRandomOffset(kThunkBytes));
110
111 size_t prev_val = 0;
112 size_t min_val = kAllocGranularity;
113 size_t min_nonzero_val = kAllocGranularity;
114 size_t max_val = 0;
115
116 for (size_t val : sizes) {
117 ASSERT_LT(val, kAllocGranularity);
118 if (prev_val)
119 ASSERT_EQ(val - prev_val, kAlignment);
120 if (val)
121 min_nonzero_val = std::min(val, min_nonzero_val);
122 min_val = std::min(val, min_val);
123 prev_val = val;
124 max_val = std::max(val, max_val);
125 }
126 ASSERT_EQ(max_val, kAllocGranularity - kAlignment);
127 ASSERT_EQ(0u, min_val);
128 ASSERT_EQ(min_nonzero_val, kAlignment);
129 }
130
TEST(InterceptionManagerTest,BufferLayout1)131 TEST(InterceptionManagerTest, BufferLayout1) {
132 wchar_t exe_name[MAX_PATH];
133 ASSERT_NE(0u, GetModuleFileName(nullptr, exe_name, MAX_PATH - 1));
134
135 TargetProcess* target =
136 MakeTestTargetProcess(::GetCurrentProcess(), ::GetModuleHandle(exe_name));
137
138 InterceptionManager interceptions(target, true);
139
140 // Any pointer will do for a function pointer.
141 void* function = &interceptions;
142
143 // We don't care about the interceptor id.
144 interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtCreateFile",
145 INTERCEPTION_SERVICE_CALL, function,
146 OPEN_KEY_ID);
147 interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateFileEx",
148 INTERCEPTION_EAT, function, OPEN_KEY_ID);
149 interceptions.AddToPatchedFunctions(L"kernel32.dll", "SomeFileEx",
150 INTERCEPTION_SMART_SIDESTEP, function,
151 OPEN_KEY_ID);
152 interceptions.AddToPatchedFunctions(L"user32.dll", "FindWindow",
153 INTERCEPTION_EAT, function, OPEN_KEY_ID);
154 interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateMutex",
155 INTERCEPTION_EAT, function, OPEN_KEY_ID);
156 interceptions.AddToPatchedFunctions(L"user32.dll", "PostMsg",
157 INTERCEPTION_EAT, function, OPEN_KEY_ID);
158 interceptions.AddToPatchedFunctions(L"user32.dll", "PostMsg",
159 INTERCEPTION_EAT, "replacement",
160 OPEN_KEY_ID);
161 interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
162 INTERCEPTION_EAT, function, OPEN_KEY_ID);
163 interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtClose",
164 INTERCEPTION_SERVICE_CALL, function,
165 OPEN_KEY_ID);
166 interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtOpenFile",
167 INTERCEPTION_SIDESTEP, function,
168 OPEN_KEY_ID);
169 interceptions.AddToPatchedFunctions(L"some.dll", "Superfn", INTERCEPTION_EAT,
170 function, OPEN_KEY_ID);
171 interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
172 INTERCEPTION_EAT, "a", OPEN_KEY_ID);
173 interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
174 INTERCEPTION_SIDESTEP, "ab", OPEN_KEY_ID);
175 interceptions.AddToPatchedFunctions(L"comctl.dll", "SaveAsDlg",
176 INTERCEPTION_EAT, "abc", OPEN_KEY_ID);
177 interceptions.AddToPatchedFunctions(L"a.dll", "p", INTERCEPTION_EAT, function,
178 OPEN_KEY_ID);
179 interceptions.AddToPatchedFunctions(L"b.dll",
180 "TheIncredibleCallToSaveTheWorld",
181 INTERCEPTION_EAT, function, OPEN_KEY_ID);
182 interceptions.AddToPatchedFunctions(L"a.dll", "BIsLame", INTERCEPTION_EAT,
183 function, OPEN_KEY_ID);
184 interceptions.AddToPatchedFunctions(L"a.dll", "ARules", INTERCEPTION_EAT,
185 function, OPEN_KEY_ID);
186
187 // Verify that all interceptions were added
188 ASSERT_EQ(18u, interceptions.interceptions_.size());
189
190 size_t buffer_size = interceptions.GetBufferSize();
191 std::unique_ptr<BYTE[]> local_buffer(new BYTE[buffer_size]);
192
193 ASSERT_TRUE(interceptions.SetupConfigBuffer(local_buffer.get(), buffer_size));
194
195 // At this point, the interceptions should have been separated into two
196 // groups: one group with the local ("cold") interceptions, consisting of
197 // everything from ntdll and stuff set as INTRECEPTION_SERVICE_CALL, and
198 // another group with the interceptions belonging to dlls that will be "hot"
199 // patched on the client. The second group lives on local_buffer, and the
200 // first group remains on the list of interceptions (inside the object
201 // "interceptions"). There are 3 local interceptions (of ntdll); the
202 // other 15 have to be sent to the child to be performed "hot".
203 EXPECT_EQ(3u, interceptions.interceptions_.size());
204
205 int num_dlls, num_functions, num_names;
206 WalkBuffer(local_buffer.get(), buffer_size, &num_dlls, &num_functions,
207 &num_names);
208
209 // The 15 interceptions on the buffer (to the child) should be grouped on 6
210 // dlls. Only four interceptions are using an explicit name for the
211 // interceptor function.
212 EXPECT_EQ(6, num_dlls);
213 EXPECT_EQ(15, num_functions);
214 EXPECT_EQ(4, num_names);
215 }
216
TEST(InterceptionManagerTest,BufferLayout2)217 TEST(InterceptionManagerTest, BufferLayout2) {
218 wchar_t exe_name[MAX_PATH];
219 ASSERT_NE(0u, GetModuleFileName(nullptr, exe_name, MAX_PATH - 1));
220
221 TargetProcess* target =
222 MakeTestTargetProcess(::GetCurrentProcess(), ::GetModuleHandle(exe_name));
223
224 InterceptionManager interceptions(target, true);
225
226 // Any pointer will do for a function pointer.
227 void* function = &interceptions;
228 interceptions.AddToUnloadModules(L"some01.dll");
229 // We don't care about the interceptor id.
230 interceptions.AddToPatchedFunctions(L"ntdll.dll", "NtCreateFile",
231 INTERCEPTION_SERVICE_CALL, function,
232 OPEN_FILE_ID);
233 interceptions.AddToPatchedFunctions(L"kernel32.dll", "CreateFileEx",
234 INTERCEPTION_EAT, function, OPEN_FILE_ID);
235 interceptions.AddToUnloadModules(L"some02.dll");
236 interceptions.AddToPatchedFunctions(L"kernel32.dll", "SomeFileEx",
237 INTERCEPTION_SMART_SIDESTEP, function,
238 OPEN_FILE_ID);
239 // Verify that all interceptions were added
240 ASSERT_EQ(5u, interceptions.interceptions_.size());
241
242 size_t buffer_size = interceptions.GetBufferSize();
243 std::unique_ptr<BYTE[]> local_buffer(new BYTE[buffer_size]);
244
245 ASSERT_TRUE(interceptions.SetupConfigBuffer(local_buffer.get(), buffer_size));
246
247 // At this point, the interceptions should have been separated into two
248 // groups: one group with the local ("cold") interceptions, and another
249 // group with the interceptions belonging to dlls that will be "hot"
250 // patched on the client. The second group lives on local_buffer, and the
251 // first group remains on the list of interceptions, in this case just one.
252 EXPECT_EQ(1u, interceptions.interceptions_.size());
253
254 int num_dlls, num_functions, num_names;
255 WalkBuffer(local_buffer.get(), buffer_size, &num_dlls, &num_functions,
256 &num_names);
257
258 EXPECT_EQ(3, num_dlls);
259 EXPECT_EQ(4, num_functions);
260 EXPECT_EQ(0, num_names);
261 }
262
263 } // namespace sandbox
264