Compiler Explorer

Source code

typedef signed char int8_t;
typedef short int16_t;
typedef int int32_t;
typedef long long int64_t;
typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned int uint32_t;
typedef unsigned long long uint64_t;

[[nodiscard]]
inline void* __cdecl operator new(size_t _Size, void* _Where) noexcept
{
  (void)_Size;
  return _Where;
}

inline void __cdecl operator delete(void*, void*) noexcept
{
  return;
}

typedef wchar_t WCHAR;
typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;
typedef unsigned long DWORD;
typedef long LONG;
typedef unsigned short USHORT;
typedef USHORT *PUSHORT;
typedef unsigned __int64 ULONG_PTR, *PULONG_PTR;
typedef LONG NTSTATUS;
typedef void *HANDLE;
typedef void *PVOID;
typedef unsigned long ULONG;
typedef __int64 LONGLONG;
typedef ULONG *PULONG;
typedef HANDLE *PHANDLE;
typedef DWORD ACCESS_MASK;
typedef ULONG_PTR SIZE_T, *PSIZE_T;
typedef union _LARGE_INTEGER {
    struct {
        DWORD LowPart;
        LONG HighPart;
    } ;
    struct {
        DWORD LowPart;
        LONG HighPart;
    } u;
    LONGLONG QuadPart;
} LARGE_INTEGER;
typedef LARGE_INTEGER *PLARGE_INTEGER;
typedef LONG NTSTATUS;
typedef struct _UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTR Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING* PUNICODE_STRING;
typedef const UNICODE_STRING* PCUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
  ULONG Length;
  HANDLE RootDirectory;
  PUNICODE_STRING ObjectName;
  ULONG Attributes;
  PVOID SecurityDescriptor;
  PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;
typedef struct _IO_STATUS_BLOCK {
  union {
    NTSTATUS Status;
    PVOID Pointer;
  };
  ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef NTSTATUS(__stdcall* NtCreateFileFunction)(
        PHANDLE FileHandle,
       ACCESS_MASK DesiredAccess,
       POBJECT_ATTRIBUTES ObjectAttributes,
        PIO_STATUS_BLOCK IoStatusBlock,
       PLARGE_INTEGER AllocationSize ,
       ULONG FileAttributes,
       ULONG ShareAccess,
       ULONG CreateDisposition,
       ULONG CreateOptions,
       PVOID EaBuffer ,
       ULONG EaLength);

void* __cdecl memcpy(void* _Dst, void const* _Src, size_t _Size);

typedef void*(__cdecl* memcpyFunction)( void* dest,
                                          const void* src,
                                          size_t count);

struct NtExports {
  memcpyFunction memcpy;
};

extern "C" NtExports g_nt;

const size_t kExtendedReturnCount = 8;
const uint32_t kIPCChannelSize = 1024;
const int kMaxIpcParams = 9;

enum class IpcTag {
  UNUSED = 0,
  NTCREATEFILE,
  LAST
};

enum ResultCode : int {
  SBOX_ALL_OK = 0,
  SBOX_ERROR_CHANNEL_ERROR,
  SBOX_ERROR_BAD_PARAMS,
  SBOX_ERROR_NO_SPACE,
  SBOX_ERROR_LAST
};

enum ArgType {
  INVALID_TYPE = 0,
  WCHAR_TYPE,
  UINT32_TYPE,
  UNISTR_TYPE,
  VOIDPTR_TYPE,
  INPTR_TYPE,
  INOUTPTR_TYPE,
  LAST_TYPE
};

struct ParamInfo {
  ArgType type_;
  uint32_t offset_;
  uint32_t size_;
};

union MultiType {
  uint32_t unsigned_int;
  void* pointer;
  HANDLE handle;
  ULONG_PTR ulong_ptr;
};

struct CrossCallReturn {
  uint32_t tag;
  ResultCode call_outcome;
  union {
    NTSTATUS nt_status;
    DWORD win32_result;
  };
  uint32_t extended_count;
  HANDLE handle;
  MultiType extended[kExtendedReturnCount];
};

class CrossCallParams {
 public:
  IpcTag GetTag() const { return tag_; }
  const void* GetBuffer() const { return this; }
  uint32_t GetParamsCount() const { return params_count_; }
  CrossCallReturn* GetCallReturn() { return &call_return; }
  bool IsInOut() const { return (1 == is_in_out_); }
  void SetIsInOut(bool value) {
    if (value)
      is_in_out_ = 1;
    else
      is_in_out_ = 0;
  }
 protected:
  CrossCallParams(IpcTag tag, uint32_t params_count)
      : tag_(tag), is_in_out_(0), params_count_(params_count) {}

private:
  IpcTag tag_;
  uint32_t is_in_out_;
  CrossCallReturn call_return;
  const uint32_t params_count_;
  CrossCallParams(const CrossCallParams&) = delete;
  CrossCallParams& operator=(const CrossCallParams&) = delete;
};

template <typename T>
class CopyHelper {
 public:
  CopyHelper(const T& t) : t_(t) {}
  const void* GetStart() const { return &t_; }
  bool Update(void* buffer) {
    return true;
  }
  uint32_t GetSize() const { return sizeof(T); }
  bool IsInOut() { return false; }
  ArgType GetType() {
    static_assert(sizeof(T) == sizeof(uint32_t), "specialization needed");
    return UINT32_TYPE;
  }

private:
  const T& t_;
};

template <>
class CopyHelper<void*> {
 public:
  CopyHelper(void* t) : t_(t) {}
  const void* GetStart() const { return &t_; }
  bool Update(void* buffer) {
    return true;
  }

uint32_t GetSize() const { return sizeof(t_); }
  bool IsInOut() { return false; }
  ArgType GetType() { return VOIDPTR_TYPE; }

private:
  const void* t_;
};

template <>
class CopyHelper<const wchar_t*> {
 public:
  CopyHelper(const wchar_t* t) : t_(t) {}
  const void* GetStart() const { return t_; }
  bool Update(void* buffer) {
    return true;
  }
  uint32_t GetSize() const {
    __try {
      return (!t_) ? 0
                   : static_cast<uint32_t>(StringLength(t_) * sizeof(t_[0]));
    } __except (1) {
      return 0xffffffffui32;
    }
  }

bool IsInOut() { return false; }
  ArgType GetType() { return WCHAR_TYPE; }

private:
  static size_t StringLength(const wchar_t* wcs) {
    const wchar_t* eos = wcs;
    while (*eos++);
    return static_cast<size_t>(eos - wcs - 1);
  }

const wchar_t* t_;
};

template <>
class CopyHelper<wchar_t*> : public CopyHelper<const wchar_t*> {
 public:
  typedef CopyHelper<const wchar_t*> Base;
  CopyHelper(wchar_t* t) : Base(t) {}
  const void* GetStart() const { return Base::GetStart(); }
  bool Update(void* buffer) { return Base::Update(buffer); }
  uint32_t GetSize() const { return Base::GetSize(); }
  bool IsInOut() { return Base::IsInOut(); }
  ArgType GetType() { return Base::GetType(); }
};

inline void* memcpy_wrapper(void* dest, const void* src, size_t count) {
  if (g_nt.memcpy)
    return g_nt.memcpy(dest, src, count);
  return memcpy(dest, src, count);
}

inline uint32_t Align(uint32_t value) {
  uint32_t alignment = sizeof(int64_t);
  return ((value + alignment - 1) / alignment) * alignment;
}

template <size_t NUMBER_PARAMS, size_t BLOCK_SIZE>
class ActualCallParams : public CrossCallParams {
 public:
  explicit ActualCallParams(IpcTag tag) : CrossCallParams(tag, NUMBER_PARAMS) {
    param_info_[0].offset_ =
        static_cast<uint32_t>(parameters_ - reinterpret_cast<char*>(this));
  }

ActualCallParams(IpcTag tag, uint32_t number_params)
      : CrossCallParams(tag, number_params) {
    param_info_[0].offset_ =
        static_cast<uint32_t>(parameters_ - reinterpret_cast<char*>(this));
  }

uint32_t OverrideSize(uint32_t new_size) {
    uint32_t previous_size = param_info_[NUMBER_PARAMS].offset_;
    param_info_[NUMBER_PARAMS].offset_ = new_size;
    return previous_size;
  }

bool CopyParamIn(uint32_t index,
                   const void* parameter_address,
                   uint32_t size,
                   bool is_in_out,
                   ArgType type) {
    if (index >= NUMBER_PARAMS) {
      return false;
    }

if (0xffffffffui32 == size) {
      return false;
    }

if (size && !parameter_address) {
      return false;
    }

if ((size > sizeof(*this)) ||
        (param_info_[index].offset_ > (sizeof(*this) - size))) {
      return false;
    }

char* dest = reinterpret_cast<char*>(this) + param_info_[index].offset_;

__try {
      memcpy_wrapper(dest, parameter_address, size);
    } __except (1) {
      return false;
    }

if (is_in_out)
      SetIsInOut(true);

param_info_[index + 1].offset_ = Align(param_info_[index].offset_ + size);
    param_info_[index].size_ = size;
    param_info_[index].type_ = type;
    return true;
  }

void* GetParamPtr(size_t index) {
    return reinterpret_cast<char*>(this) + param_info_[index].offset_;
  }

uint32_t GetSize() const { return param_info_[NUMBER_PARAMS].offset_; }

protected:
  ActualCallParams() : CrossCallParams(IpcTag::UNUSED, NUMBER_PARAMS) {}

private:
  ParamInfo param_info_[NUMBER_PARAMS + 1];
  char parameters_[BLOCK_SIZE - sizeof(CrossCallParams) -
                   sizeof(ParamInfo) * (NUMBER_PARAMS + 1)];
  ActualCallParams(const ActualCallParams&) = delete;
  ActualCallParams& operator=(const ActualCallParams&) = delete;
};

class SharedMemIPCClient {
 public:
  explicit SharedMemIPCClient(void* shared_mem);
  void* GetBuffer();
  void FreeBuffer(void* buffer);
  ResultCode DoCall(CrossCallParams* params, CrossCallReturn* answer);

private:
  size_t LockFreeChannel(bool* severe_failure);
  size_t ChannelIndexFromBuffer(const void* buffer);
  char* first_base_;
};

template <typename IPCProvider,
          typename Par1,
          typename Par2,
          typename Par3,
          typename Par4,
          typename Par5,
          typename Par6,
          typename Par7>
ResultCode CrossCall(IPCProvider& ipc_provider,
                     IpcTag tag,
                     const Par1& p1,
                     const Par2& p2,
                     const Par3& p3,
                     const Par4& p4,
                     const Par5& p5,
                     const Par6& p6,
                     const Par7& p7,
                     CrossCallReturn* answer) {
  typedef ActualCallParams<7, kIPCChannelSize> ActualParams;
  void* raw_mem = ipc_provider.GetBuffer();
  if (!raw_mem) return SBOX_ERROR_NO_SPACE;
  ActualParams* call_params = new (raw_mem) ActualParams(tag);

CopyHelper<Par1> ch1(p1);
  if (!call_params->CopyParamIn(1 - 1, ch1.GetStart(), ch1.GetSize(), ch1.IsInOut(), ch1.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par2> ch2(p2);
  if (!call_params->CopyParamIn(2 - 1, ch2.GetStart(), ch2.GetSize(), ch2.IsInOut(), ch2.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par3> ch3(p3);
  if (!call_params->CopyParamIn(3 - 1, ch3.GetStart(), ch3.GetSize(), ch3.IsInOut(), ch3.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par4> ch4(p4);
  if (!call_params->CopyParamIn(4 - 1, ch4.GetStart(), ch4.GetSize(), ch4.IsInOut(), ch4.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par5> ch5(p5);
  if (!call_params->CopyParamIn(5 - 1, ch5.GetStart(), ch5.GetSize(), ch5.IsInOut(), ch5.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par6> ch6(p6);
  if (!call_params->CopyParamIn(6 - 1, ch6.GetStart(), ch6.GetSize(), ch6.IsInOut(), ch6.GetType()))
    return SBOX_ERROR_NO_SPACE;

CopyHelper<Par7> ch7(p7);
  if (!call_params->CopyParamIn(7 - 1, ch7.GetStart(), ch7.GetSize(), ch7.IsInOut(), ch7.GetType()))
    return SBOX_ERROR_NO_SPACE;

ResultCode result = ipc_provider.DoCall(call_params, answer);
  return result;
}

NTSTATUS __stdcall TargetNtCreateFile(NtCreateFileFunction orig_CreateFile,
                                   PHANDLE file,
                                   ACCESS_MASK desired_access,
                                   POBJECT_ATTRIBUTES object_attributes,
                                   PIO_STATUS_BLOCK io_status,
                                   PLARGE_INTEGER allocation_size,
                                   ULONG file_attributes,
                                   ULONG sharing,
                                   ULONG disposition,
                                   ULONG options,
                                   PVOID ea_buffer,
                                   ULONG ea_length) {
  wchar_t* name = nullptr;
  SharedMemIPCClient ipc(nullptr);
  CrossCallReturn answer = {0};
  CrossCall(ipc, IpcTag::NTCREATEFILE, name, 0, 0, 0, 0, 0, 0, &answer);
  return 0;
}