yuzu-emu/breakpad
1
0
Fork 0
mirror of https://github.com/yuzu-emu/breakpad.git synced 2024-11-27 23:14:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

Patch from CDN to add support for an exploitability engine

Browse Source 
A=cdn
R=nealsid



git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@662 4c0a9323-5329-0410-9bdc-e9ce6186880e
This commit is contained in:
nealsid 2010-08-24 14:28:10 +00:00
parent 3b7d8ee362
commit 8d2c518c0b
7 changed files with 286 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
Makefile.in
View File

@ -164,7 +164,8 @@ am_src_libbreakpad_la_OBJECTS = src/processor/basic_code_modules.lo \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo src/processor/tokenize.lo \
src/processor/udp_network.lo
src/processor/udp_network.lo \
src/processor/exploitability.lo
src_libbreakpad_la_OBJECTS = $(am_src_libbreakpad_la_OBJECTS)
@SELFTEST_TRUE@am__EXEEXT_1 = \
@SELFTEST_TRUE@ src/processor/stackwalker_selftest$(EXEEXT)
@ -258,7 +259,8 @@ src_processor_minidump_processor_unittest_DEPENDENCIES = \
src/processor/stackwalker_arm.lo \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo src/processor/tokenize.lo
src/processor/stackwalker_x86.lo src/processor/tokenize.lo \
src/processor/exploitability.lo
am_src_processor_minidump_stackwalk_OBJECTS = \
src/processor/minidump_stackwalk.$(OBJEXT)
src_processor_minidump_stackwalk_OBJECTS = \
@ -279,7 +281,8 @@ src_processor_minidump_stackwalk_DEPENDENCIES = \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo src/processor/tokenize.lo \
src/processor/udp_network.lo
src/processor/udp_network.lo \
src/processor/exploitability.lo
am_src_processor_minidump_unittest_OBJECTS = src/common/src_processor_minidump_unittest-test_assembler.$(OBJEXT) \
src/processor/src_processor_minidump_unittest-minidump_unittest.$(OBJEXT) \
src/processor/src_processor_minidump_unittest-synth_minidump.$(OBJEXT) \
@ -312,7 +315,8 @@ src_processor_network_source_line_resolver_server_unittest_DEPENDENCIES = \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo src/processor/tokenize.lo \
src/processor/udp_network.lo
src/processor/udp_network.lo \
src/processor/exploitability.lo
am_src_processor_network_source_line_resolver_unittest_OBJECTS = src/processor/src_processor_network_source_line_resolver_unittest-network_source_line_resolver_unittest.$(OBJEXT) \
src/testing/gtest/src/src_processor_network_source_line_resolver_unittest-gtest-all.$(OBJEXT) \
src/testing/src/src_processor_network_source_line_resolver_unittest-gmock-all.$(OBJEXT)
@ -674,6 +678,7 @@ src_libbreakpad_la_SOURCES = \
src/google_breakpad/processor/stackwalker.h \
src/google_breakpad/processor/symbol_supplier.h \
src/google_breakpad/processor/system_info.h \
src/google_breakpad/processor/exploitability.h \
src/processor/address_map-inl.h \
src/processor/address_map.h \
src/processor/basic_code_module.h \
@ -721,7 +726,8 @@ src_libbreakpad_la_SOURCES = \
src/processor/tokenize.cc \
src/processor/tokenize.h \
src/processor/udp_network.cc \
src/processor/udp_network.h
src/processor/udp_network.h \
src/processor/exploitability.cc
check_SCRIPTS = \
src/processor/minidump_dump_test \
@ -855,7 +861,8 @@ src_processor_minidump_processor_unittest_LDADD = \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo \
src/processor/tokenize.lo
src/processor/tokenize.lo \
src/processor/exploitability.lo
src_processor_minidump_unittest_SOURCES = \
src/common/test_assembler.cc \
@ -930,7 +937,8 @@ src_processor_network_source_line_resolver_server_unittest_LDADD = \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo \
src/processor/tokenize.lo \
src/processor/udp_network.lo
src/processor/udp_network.lo \
src/processor/exploitability.lo
src_processor_network_source_line_server_unittest_SOURCES = \
src/processor/network_source_line_server_unittest.cc \
@ -987,7 +995,8 @@ src_processor_stackwalker_selftest_LDADD = \
src/processor/stackwalker_ppc.lo \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo \
src/processor/tokenize.lo
src/processor/tokenize.lo \
src/processor/exploitability.lo
src_processor_stackwalker_amd64_unittest_SOURCES = \
src/common/test_assembler.cc \
@ -1100,7 +1109,8 @@ src_processor_minidump_stackwalk_LDADD = \
src/processor/stackwalker_sparc.lo \
src/processor/stackwalker_x86.lo \
src/processor/tokenize.lo \
src/processor/udp_network.lo
src/processor/udp_network.lo \
src/processor/exploitability.lo
src_processor_source_daemon_SOURCES = \
src/processor/source_daemon.cc
@ -1863,6 +1873,8 @@ mostlyclean-compile:
-rm -f src/processor/cfi_frame_info.$(OBJEXT)
-rm -f src/processor/cfi_frame_info.lo
-rm -f src/processor/contained_range_map_unittest.$(OBJEXT)
-rm -f src/processor/exploitability.$(OBJEXT)
-rm -f src/processor/exploitability.lo
-rm -f src/processor/logging.$(OBJEXT)
-rm -f src/processor/logging.lo
-rm -f src/processor/minidump.$(OBJEXT)

72
src/google_breakpad/processor/exploitability.h Normal file
View File

@ -0,0 +1,72 @@
// Copyright (c) 2010 Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// exploitability_engine.h: Generic exploitability engine.
//
// The Exploitability class is an abstract base class providing common
// generic methods that apply to exploitability engines for specific platforms.
// Specific implementations will extend this class by providing run
// methods to fill in the exploitability_ enumeration of the ProcessState
// for a crash.
//
// Author: Cris Neckar
#ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_H_
#define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_H_
#include "google_breakpad/common/breakpad_types.h"
#include "google_breakpad/processor/minidump.h"
#include "google_breakpad/processor/process_state.h"
namespace google_breakpad {
class Exploitability {
public:
virtual ~Exploitability() {}
static Exploitability *ExploitabilityForPlatform(Minidump *dump,
ProcessState *process_state);
ExploitabilityRating CheckExploitability();
protected:
Exploitability(Minidump *dump,
ProcessState *process_state);
private:
virtual ExploitabilityRating CheckPlatformExploitability() = 0;
Minidump *dump_;
ProcessState *process_state_;
SystemInfo *system_info_;
};
} // namespace google_breakpad
#endif // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_H_

13
src/google_breakpad/processor/minidump_processor.h
View File

@ -94,6 +94,14 @@ class MinidumpProcessor {
// implementation of the SymbolSupplier abstract base class.
MinidumpProcessor(SymbolSupplier *supplier,
SourceLineResolverInterface *resolver);
// Initializes the MinidumpProcessor with the option of
// enabling the exploitability framework to analyze dumps
// for probable security relevance.
MinidumpProcessor(SymbolSupplier *supplier,
SourceLineResolverInterface *resolver,
bool enable_exploitability);
~MinidumpProcessor();
// Processes the minidump file and fills process_state with the result.
@ -149,6 +157,11 @@ class MinidumpProcessor {
private:
SymbolSupplier *supplier_;
SourceLineResolverInterface *resolver_;
// This flag enables the exploitability scanner which attempts to
// guess how likely it is that the crash represents an exploitable
// memory corruption issue.
bool enable_exploitability_;
};
} // namespace google_breakpad

42
src/google_breakpad/processor/process_state.h
View File

@ -48,6 +48,42 @@ using std::vector;
class CallStack;
class CodeModules;
enum ExploitabilityRating {
EXPLOITABILITY_HIGH, // The crash likely represents
// a exploitable memory corruption
// vulnerability.
EXPLOITABLITY_MEDIUM, // The crash appears to corrupt
// memory in a way which may be
// exploitable in some situations.
EXPLOITABILITY_LOW, // The crash either does not corrupt
// memory directly or control over
// the effected data is limited. The
// issue may still be exploitable
// on certain platforms or situations.
EXPLOITABILITY_INTERESTING, // The crash does not appear to be
// directly exploitable. However it
// represents a condition which should
// be furthur analyzed.
EXPLOITABILITY_NONE, // The crash does not appear to represent
// an exploitable condition.
EXPLOITABILITY_NOT_ANALYZED, // The crash was not analyzed for
// exploitability because the engine
// was disabled.
EXPLOITABILITY_ERR_NOENGINE, // The supplied minidump's platform does
// not have a exploitability engine
// associated with it.
EXPLOITABILITY_ERR_PROCESSING // An error occured within the
// exploitability engine and no rating
// was calculated.
};
class ProcessState {
public:
ProcessState() : modules_(NULL) { Clear(); }
@ -69,6 +105,7 @@ class ProcessState {
}
const SystemInfo* system_info() const { return &system_info_; }
const CodeModules* modules() const { return modules_; }
ExploitabilityRating exploitability() const { return exploitability_; }
private:
// MinidumpProcessor is responsible for building ProcessState objects.
@ -119,6 +156,11 @@ class ProcessState {
// The modules that were loaded into the process represented by the
// ProcessState.
const CodeModules *modules_;
// The exploitability rating as determined by the exploitability
// engine. When the exploitability engine is not enabled this
// defaults to EXPLOITABILITY_NONE.
ExploitabilityRating exploitability_;
};
} // namespace google_breakpad

89
src/processor/exploitability.cc Normal file
View File

@ -0,0 +1,89 @@
// Copyright (c) 2010 Google Inc.
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following disclaimer
// in the documentation and/or other materials provided with the
// distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived from
// this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// exploitability_engine.cc: Generic exploitability engine.
//
// See exploitable_engine.h for documentation.
//
// Author: Cris Neckar
#include <cassert>
#include "google_breakpad/processor/exploitability.h"
#include "google_breakpad/processor/minidump.h"
#include "google_breakpad/processor/process_state.h"
#include "processor/logging.h"
#include "processor/scoped_ptr.h"
namespace google_breakpad {
Exploitability::Exploitability(Minidump *dump,
ProcessState *process_state)
: dump_(dump),
process_state_(process_state) {}
ExploitabilityRating Exploitability::CheckExploitability() {
return CheckPlatformExploitability();
}
Exploitability *Exploitability::ExploitabilityForPlatform(
Minidump *dump,
ProcessState *process_state) {
Exploitability *platform_exploitability = NULL;
MinidumpSystemInfo *minidump_system_info = dump->GetSystemInfo();
if (!minidump_system_info)
return NULL;
const MDRawSystemInfo *raw_system_info =
minidump_system_info->system_info();
if (!raw_system_info)
return NULL;
switch (raw_system_info->platform_id) {
case MD_OS_WIN32_NT:
case MD_OS_WIN32_WINDOWS:
case MD_OS_UNIX:
case MD_OS_MAC_OS_X:
case MD_OS_LINUX:
case MD_OS_SOLARIS:
default: {
platform_exploitability = NULL;
break;
}
}
BPLOG_IF(ERROR, !platform_exploitability) <<
"No Exploitability module for platform: " <<
process_state->system_info()->os;
return platform_exploitability;
}
} // namespace google_breakpad

27
src/processor/minidump_processor.cc
View File

@ -35,6 +35,7 @@
#include "google_breakpad/processor/call_stack.h"
#include "google_breakpad/processor/minidump.h"
#include "google_breakpad/processor/process_state.h"
#include "google_breakpad/processor/exploitability.h"
#include "processor/logging.h"
#include "processor/scoped_ptr.h"
#include "processor/stackwalker_x86.h"
@ -43,7 +44,15 @@ namespace google_breakpad {
MinidumpProcessor::MinidumpProcessor(SymbolSupplier *supplier,
SourceLineResolverInterface *resolver)
: supplier_(supplier), resolver_(resolver) {
: supplier_(supplier), resolver_(resolver),
enable_exploitability_(false) {
}
MinidumpProcessor::MinidumpProcessor(SymbolSupplier *supplier,
SourceLineResolverInterface *resolver,
bool enable_exploitability)
: supplier_(supplier), resolver_(resolver),
enable_exploitability_(enable_exploitability) {
}
MinidumpProcessor::~MinidumpProcessor() {
@ -230,6 +239,22 @@ ProcessResult MinidumpProcessor::Process(
process_state->requesting_thread_ = -1;
}
// Exploitability defaults to EXPLOITABILITY_NOT_ANALYZED
process_state->exploitability_ = EXPLOITABILITY_NOT_ANALYZED;
// If an exploitability run was requested we perform the platform specific
// rating.
if (enable_exploitability_) {
scoped_ptr<Exploitability> exploitability(
Exploitability::ExploitabilityForPlatform(dump, process_state));
// The engine will be null if the platform is not supported
if (exploitability != NULL) {
process_state->exploitability_ = exploitability->CheckExploitability();
} else {
process_state->exploitability_ = EXPLOITABILITY_ERR_NOENGINE;
}
}
BPLOG(INFO) << "Processed " << dump->path();
return PROCESS_OK;
}

23
src/processor/minidump_processor_unittest.cc
View File

@ -245,6 +245,24 @@ TEST_F(MinidumpProcessorTest, TestSymbolSupplierLookupCounts) {
google_breakpad::PROCESS_OK);
}
TEST_F(MinidumpProcessorTest, TestExploitilityEngine) {
TestSymbolSupplier supplier;
BasicSourceLineResolver resolver;
MinidumpProcessor processor(&supplier, &resolver, true);
string minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
"/src/processor/testdata/minidump2.dmp";
ProcessState state;
ASSERT_EQ(processor.Process(minidump_file, &state),
google_breakpad::PROCESS_OK);
// Test that exploitability module correctly fails to supply
// an engine for this platform
ASSERT_EQ(google_breakpad::EXPLOITABILITY_ERR_NOENGINE,
state.exploitability());
}
TEST_F(MinidumpProcessorTest, TestBasicProcessing) {
TestSymbolSupplier supplier;
BasicSourceLineResolver resolver;
@ -315,6 +333,11 @@ TEST_F(MinidumpProcessorTest, TestBasicProcessing) {
ASSERT_EQ(state.modules()->GetModuleForAddress(0x77d43210)->version(),
"5.1.2600.2622");
// Test that disabled exploitability engine defaults to
// EXPLOITABILITY_NOT_ANALYZED.
ASSERT_EQ(google_breakpad::EXPLOITABILITY_NOT_ANALYZED,
state.exploitability());
// Test that the symbol supplier can interrupt processing
state.Clear();
supplier.set_interrupt(true);