1 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sandbox/win/sandbox_poc/pocdll/exports.h"
6 #include "sandbox/win/sandbox_poc/pocdll/utils.h"
7 #include "sandbox/win/tools/finder/ntundoc.h"
9 // This file contains the tests used to verify the security of handles in
12 NTQUERYOBJECT NtQueryObject;
13 NTQUERYINFORMATIONFILE NtQueryInformationFile;
14 NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
16 void POCDLL_API TestGetHandle(HANDLE log) {
17 HandleToFile handle2file;
18 FILE *output = handle2file.Translate(log, "w");
20 // Initialize the NTAPI functions we need
21 HMODULE ntdll_handle = ::GetModuleHandle(L"ntdll.dll");
23 fprintf(output, "[ERROR] Cannot load ntdll.dll. Error %ld\r\n",
28 NtQueryObject = reinterpret_cast<NTQUERYOBJECT>(
29 GetProcAddress(ntdll_handle, "NtQueryObject"));
30 NtQueryInformationFile = reinterpret_cast<NTQUERYINFORMATIONFILE>(
31 GetProcAddress(ntdll_handle, "NtQueryInformationFile"));
32 NtQuerySystemInformation = reinterpret_cast<NTQUERYSYSTEMINFORMATION>(
33 GetProcAddress(ntdll_handle, "NtQuerySystemInformation"));
35 if (!NtQueryObject || !NtQueryInformationFile || !NtQuerySystemInformation) {
36 fprintf(output, "[ERROR] Cannot load all NT functions. Error %ld\r\n",
41 // Get the number of handles on the system
42 DWORD buffer_size = 0;
43 SYSTEM_HANDLE_INFORMATION_EX temp_info;
44 NTSTATUS status = NtQuerySystemInformation(
45 SystemHandleInformation, &temp_info, sizeof(temp_info),
48 fprintf(output, "[ERROR] Get the number of handles. Error 0x%lX\r\n",
53 SYSTEM_HANDLE_INFORMATION_EX *system_handles =
54 reinterpret_cast<SYSTEM_HANDLE_INFORMATION_EX*>(new BYTE[buffer_size]);
56 status = NtQuerySystemInformation(SystemHandleInformation, system_handles,
57 buffer_size, &buffer_size);
58 if (STATUS_SUCCESS != status) {
59 fprintf(output, "[ERROR] Failed to get the handle list. Error 0x%lX\r\n",
61 delete [] system_handles;
65 for (ULONG i = 0; i < system_handles->NumberOfHandles; ++i) {
66 USHORT h = system_handles->Information[i].Handle;
67 if (system_handles->Information[i].ProcessId != ::GetCurrentProcessId())
70 OBJECT_NAME_INFORMATION *name = NULL;
72 // Query the name information a first time to get the size of the name.
73 status = NtQueryObject(reinterpret_cast<HANDLE>(h),
74 ObjectNameInformation,
80 name = reinterpret_cast<OBJECT_NAME_INFORMATION *>(new BYTE[name_size]);
82 // Query the name information a second time to get the name of the
83 // object referenced by the handle.
84 status = NtQueryObject(reinterpret_cast<HANDLE>(h),
85 ObjectNameInformation,
91 PUBLIC_OBJECT_TYPE_INFORMATION *type = NULL;
94 // Query the object to get the size of the object type name.
95 status = NtQueryObject(reinterpret_cast<HANDLE>(h),
96 ObjectTypeInformation,
101 type = reinterpret_cast<PUBLIC_OBJECT_TYPE_INFORMATION *>(
102 new BYTE[type_size]);
104 // Query the type information a second time to get the object type
106 status = NtQueryObject(reinterpret_cast<HANDLE>(h),
107 ObjectTypeInformation,
113 // NtQueryObject cannot return the name for a file. In this case we
114 // need to ask NtQueryInformationFile
115 FILE_NAME_INFORMATION *file_name = NULL;
116 if (type && wcsncmp(L"File", type->TypeName.Buffer,
117 (type->TypeName.Length /
118 sizeof(type->TypeName.Buffer[0]))) == 0) {
119 // This function does not return the size of the buffer. We need to
120 // iterate and always increase the buffer size until the function
121 // succeeds. (Or at least does not fail with STATUS_BUFFER_OVERFLOW)
122 ULONG size_file = MAX_PATH;
123 IO_STATUS_BLOCK status_block = {0};
125 // Delete the previous buffer create. The buffer was too small
127 delete[] reinterpret_cast<BYTE*>(file_name);
131 // Increase the buffer and do the call agan
132 size_file += MAX_PATH;
133 file_name = reinterpret_cast<FILE_NAME_INFORMATION *>(
134 new BYTE[size_file]);
135 status = NtQueryInformationFile(reinterpret_cast<HANDLE>(h),
139 FileNameInformation);
140 } while (status == STATUS_BUFFER_OVERFLOW);
142 if (STATUS_SUCCESS != status) {
151 UNICODE_STRING file_name_string;
152 file_name_string.Buffer = file_name->FileName;
153 file_name_string.Length = (USHORT)file_name->FileNameLength;
154 file_name_string.MaximumLength = (USHORT)file_name->FileNameLength;
155 fprintf(output, "[GRANTED] Handle 0x%4.4X Access: 0x%8.8lX "
156 "Type: %-13wZ Path: %wZ\r\n",
158 system_handles->Information[i].GrantedAccess,
159 type ? &type->TypeName : NULL,
162 fprintf(output, "[GRANTED] Handle 0x%4.4X Access: 0x%8.8lX "
163 "Type: %-13wZ Path: %wZ\r\n",
165 system_handles->Information[i].GrantedAccess,
166 type ? &type->TypeName : NULL,
167 name ? &name->ObjectName : NULL);
183 if (system_handles) {
184 delete [] system_handles;