Toshihito Kikuchi b27dd298e9 Bug 1684532 - Detect injected dependent modules in NtMapViewOfSection. r=mhowell ... This patch is to improve the way to detect an injected dependent module for automatic DLL blocking (bug 1659438). In the previous version, we created a list of dependent modules in the launcher process and shared it with other processes via the shared section. However, it was not compatible with third-party applications who tamper the Import Table and revert it in the injected module's DllMain (bug 1682834) because we parsed the Import Table in the launcher process after it was reverted. With this patch, we check the Import Table in `patched_NtMapViewOfSection`, so we can see tampering before it's reverted. More specifically, we create a list of dependent modules in the browser process as below. 1. The launcher process creates a section object and initializes the kernel32.dll's functions in it. 2. The launcher process transfers a writable handle of the shared section to the browser process. 3. In the browser process, if an injected dependent module is being mapped by `NtMapViewOfSection`, we add its NT path to the shared section and block it with `REDIRECT_TO_NOOP_ENTRYPOINT`. 4. The `main` function of the browser process converts the writable handle of the shared section into a readonly handle. 5. The browser process transfers a readonly handle of the shared section to a sandbox process. Since automatic DLL blocking may still cause a compat issue like bug 1682304, we activate it only in Nightly for now. Differential Revision: https://phabricator.services.mozilla.com/D101460		2021-01-13 08:38:16 +00:00
..
src	Bug 1684532 - Detect injected dependent modules in NtMapViewOfSection. r=mhowell	2021-01-13 08:38:16 +00:00
SandboxInitialization.cpp
SandboxInitialization.h