Added the base exploitability module for windows. This only adds the very basic exception type based analysis for now.
BUG=NONE TEST=MinidumpProcessorTest.TestExploitilityEngine Review URL: http://breakpad.appspot.com/189001 git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@698 4c0a9323-5329-0410-9bdc-e9ce6186880e
This commit is contained in:
parent
9a57c16c97
commit
cec12872c4
9 changed files with 288 additions and 32 deletions
|
@ -101,6 +101,8 @@ src_libbreakpad_la_SOURCES = \
|
||||||
src/processor/contained_range_map-inl.h \
|
src/processor/contained_range_map-inl.h \
|
||||||
src/processor/contained_range_map.h \
|
src/processor/contained_range_map.h \
|
||||||
src/processor/exploitability.cc \
|
src/processor/exploitability.cc \
|
||||||
|
src/processor/exploitability_win.h \
|
||||||
|
src/processor/exploitability_win.cc \
|
||||||
src/processor/linked_ptr.h \
|
src/processor/linked_ptr.h \
|
||||||
src/processor/logging.h \
|
src/processor/logging.h \
|
||||||
src/processor/logging.cc \
|
src/processor/logging.cc \
|
||||||
|
@ -304,6 +306,7 @@ src_processor_minidump_processor_unittest_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
|
@ -370,6 +373,7 @@ src_processor_network_source_line_resolver_server_unittest_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
|
@ -441,6 +445,7 @@ src_processor_stackwalker_selftest_LDADD = \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
src/processor/pathname_stripper.lo \
|
src/processor/pathname_stripper.lo \
|
||||||
|
@ -543,6 +548,7 @@ src_processor_minidump_stackwalk_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
|
|
27
Makefile.in
27
Makefile.in
|
@ -172,7 +172,8 @@ am_src_libbreakpad_la_OBJECTS = src/processor/basic_code_modules.lo \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/binarystream.lo src/processor/call_stack.lo \
|
src/processor/binarystream.lo src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo src/processor/logging.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo src/processor/logging.lo \
|
||||||
src/processor/minidump.lo src/processor/minidump_processor.lo \
|
src/processor/minidump.lo src/processor/minidump_processor.lo \
|
||||||
src/processor/network_source_line_resolver.lo \
|
src/processor/network_source_line_resolver.lo \
|
||||||
src/processor/network_source_line_server.lo \
|
src/processor/network_source_line_server.lo \
|
||||||
|
@ -284,7 +285,8 @@ src_processor_minidump_processor_unittest_DEPENDENCIES = \
|
||||||
src/processor/basic_code_modules.lo \
|
src/processor/basic_code_modules.lo \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/call_stack.lo src/processor/cfi_frame_info.lo \
|
src/processor/call_stack.lo src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo src/processor/logging.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo src/processor/minidump.lo \
|
src/processor/minidump_processor.lo src/processor/minidump.lo \
|
||||||
src/processor/pathname_stripper.lo \
|
src/processor/pathname_stripper.lo \
|
||||||
src/processor/process_state.lo src/processor/stackwalker.lo \
|
src/processor/process_state.lo src/processor/stackwalker.lo \
|
||||||
|
@ -302,7 +304,8 @@ src_processor_minidump_stackwalk_DEPENDENCIES = \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/binarystream.lo src/processor/call_stack.lo \
|
src/processor/binarystream.lo src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo src/processor/logging.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo src/processor/logging.lo \
|
||||||
src/processor/minidump.lo src/processor/minidump_processor.lo \
|
src/processor/minidump.lo src/processor/minidump_processor.lo \
|
||||||
src/processor/pathname_stripper.lo \
|
src/processor/pathname_stripper.lo \
|
||||||
src/processor/process_state.lo \
|
src/processor/process_state.lo \
|
||||||
|
@ -335,7 +338,8 @@ src_processor_network_source_line_resolver_server_unittest_DEPENDENCIES = \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/binarystream.lo src/processor/call_stack.lo \
|
src/processor/binarystream.lo src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo src/processor/logging.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo src/processor/minidump.lo \
|
src/processor/minidump_processor.lo src/processor/minidump.lo \
|
||||||
src/processor/network_source_line_resolver.lo \
|
src/processor/network_source_line_resolver.lo \
|
||||||
src/processor/network_source_line_server.lo \
|
src/processor/network_source_line_server.lo \
|
||||||
|
@ -427,8 +431,8 @@ src_processor_stackwalker_selftest_DEPENDENCIES = \
|
||||||
src/processor/basic_code_modules.lo \
|
src/processor/basic_code_modules.lo \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/call_stack.lo src/processor/exploitability.lo \
|
src/processor/call_stack.lo src/processor/exploitability.lo \
|
||||||
src/processor/logging.lo src/processor/minidump.lo \
|
src/processor/exploitability_win.lo src/processor/logging.lo \
|
||||||
src/processor/pathname_stripper.lo \
|
src/processor/minidump.lo src/processor/pathname_stripper.lo \
|
||||||
src/processor/stackwalker.lo \
|
src/processor/stackwalker.lo \
|
||||||
src/processor/stackwalker_amd64.lo \
|
src/processor/stackwalker_amd64.lo \
|
||||||
src/processor/stackwalker_arm.lo \
|
src/processor/stackwalker_arm.lo \
|
||||||
|
@ -736,6 +740,8 @@ src_libbreakpad_la_SOURCES = \
|
||||||
src/processor/contained_range_map-inl.h \
|
src/processor/contained_range_map-inl.h \
|
||||||
src/processor/contained_range_map.h \
|
src/processor/contained_range_map.h \
|
||||||
src/processor/exploitability.cc \
|
src/processor/exploitability.cc \
|
||||||
|
src/processor/exploitability_win.h \
|
||||||
|
src/processor/exploitability_win.cc \
|
||||||
src/processor/linked_ptr.h \
|
src/processor/linked_ptr.h \
|
||||||
src/processor/logging.h \
|
src/processor/logging.h \
|
||||||
src/processor/logging.cc \
|
src/processor/logging.cc \
|
||||||
|
@ -902,6 +908,7 @@ src_processor_minidump_processor_unittest_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
|
@ -974,6 +981,7 @@ src_processor_network_source_line_resolver_server_unittest_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
|
@ -1053,6 +1061,7 @@ src_processor_stackwalker_selftest_LDADD = \
|
||||||
src/processor/basic_source_line_resolver.lo \
|
src/processor/basic_source_line_resolver.lo \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
src/processor/pathname_stripper.lo \
|
src/processor/pathname_stripper.lo \
|
||||||
|
@ -1162,6 +1171,7 @@ src_processor_minidump_stackwalk_LDADD = \
|
||||||
src/processor/call_stack.lo \
|
src/processor/call_stack.lo \
|
||||||
src/processor/cfi_frame_info.lo \
|
src/processor/cfi_frame_info.lo \
|
||||||
src/processor/exploitability.lo \
|
src/processor/exploitability.lo \
|
||||||
|
src/processor/exploitability_win.lo \
|
||||||
src/processor/logging.lo \
|
src/processor/logging.lo \
|
||||||
src/processor/minidump.lo \
|
src/processor/minidump.lo \
|
||||||
src/processor/minidump_processor.lo \
|
src/processor/minidump_processor.lo \
|
||||||
|
@ -1494,6 +1504,8 @@ src/processor/cfi_frame_info.lo: src/processor/$(am__dirstamp) \
|
||||||
src/processor/$(DEPDIR)/$(am__dirstamp)
|
src/processor/$(DEPDIR)/$(am__dirstamp)
|
||||||
src/processor/exploitability.lo: src/processor/$(am__dirstamp) \
|
src/processor/exploitability.lo: src/processor/$(am__dirstamp) \
|
||||||
src/processor/$(DEPDIR)/$(am__dirstamp)
|
src/processor/$(DEPDIR)/$(am__dirstamp)
|
||||||
|
src/processor/exploitability_win.lo: src/processor/$(am__dirstamp) \
|
||||||
|
src/processor/$(DEPDIR)/$(am__dirstamp)
|
||||||
src/processor/logging.lo: src/processor/$(am__dirstamp) \
|
src/processor/logging.lo: src/processor/$(am__dirstamp) \
|
||||||
src/processor/$(DEPDIR)/$(am__dirstamp)
|
src/processor/$(DEPDIR)/$(am__dirstamp)
|
||||||
src/processor/minidump.lo: src/processor/$(am__dirstamp) \
|
src/processor/minidump.lo: src/processor/$(am__dirstamp) \
|
||||||
|
@ -1955,6 +1967,8 @@ mostlyclean-compile:
|
||||||
-rm -f src/processor/contained_range_map_unittest.$(OBJEXT)
|
-rm -f src/processor/contained_range_map_unittest.$(OBJEXT)
|
||||||
-rm -f src/processor/exploitability.$(OBJEXT)
|
-rm -f src/processor/exploitability.$(OBJEXT)
|
||||||
-rm -f src/processor/exploitability.lo
|
-rm -f src/processor/exploitability.lo
|
||||||
|
-rm -f src/processor/exploitability_win.$(OBJEXT)
|
||||||
|
-rm -f src/processor/exploitability_win.lo
|
||||||
-rm -f src/processor/logging.$(OBJEXT)
|
-rm -f src/processor/logging.$(OBJEXT)
|
||||||
-rm -f src/processor/logging.lo
|
-rm -f src/processor/logging.lo
|
||||||
-rm -f src/processor/minidump.$(OBJEXT)
|
-rm -f src/processor/minidump.$(OBJEXT)
|
||||||
|
@ -2082,6 +2096,7 @@ distclean-compile:
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/cfi_frame_info.Plo@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/cfi_frame_info.Plo@am__quote@
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/contained_range_map_unittest.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/contained_range_map_unittest.Po@am__quote@
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability.Plo@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability.Plo@am__quote@
|
||||||
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability_win.Plo@am__quote@
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/logging.Plo@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/logging.Plo@am__quote@
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/minidump.Plo@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/minidump.Plo@am__quote@
|
||||||
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/minidump_dump.Po@am__quote@
|
@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/minidump_dump.Po@am__quote@
|
||||||
|
|
|
@ -34,7 +34,7 @@
|
||||||
*
|
*
|
||||||
* Author: Mark Mentovai
|
* Author: Mark Mentovai
|
||||||
* Split into its own file: Neal Sidhwaney */
|
* Split into its own file: Neal Sidhwaney */
|
||||||
|
|
||||||
|
|
||||||
#ifndef GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__
|
#ifndef GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__
|
||||||
#define GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__
|
#define GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__
|
||||||
|
@ -105,5 +105,12 @@ typedef enum {
|
||||||
generated by Visual C++ compiler */
|
generated by Visual C++ compiler */
|
||||||
} MDExceptionCodeWin;
|
} MDExceptionCodeWin;
|
||||||
|
|
||||||
|
// These constants are defined in the MSDN documentation of
|
||||||
|
// the EXCEPTION_RECORD structure.
|
||||||
|
typedef enum {
|
||||||
|
MD_ACCESS_VIOLATION_WIN_READ = 0,
|
||||||
|
MD_ACCESS_VIOLATION_WIN_WRITE = 1,
|
||||||
|
MD_ACCESS_VIOLATION_WIN_EXEC = 8
|
||||||
|
} MDAccessViolationTypeWin;
|
||||||
|
|
||||||
#endif /* GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__ */
|
#endif /* GOOGLE_BREAKPAD_COMMON_MINIDUMP_EXCEPTION_WIN32_H__ */
|
||||||
|
|
|
@ -59,12 +59,12 @@ class Exploitability {
|
||||||
Exploitability(Minidump *dump,
|
Exploitability(Minidump *dump,
|
||||||
ProcessState *process_state);
|
ProcessState *process_state);
|
||||||
|
|
||||||
private:
|
|
||||||
virtual ExploitabilityRating CheckPlatformExploitability() = 0;
|
|
||||||
|
|
||||||
Minidump *dump_;
|
Minidump *dump_;
|
||||||
ProcessState *process_state_;
|
ProcessState *process_state_;
|
||||||
SystemInfo *system_info_;
|
SystemInfo *system_info_;
|
||||||
|
|
||||||
|
private:
|
||||||
|
virtual ExploitabilityRating CheckPlatformExploitability() = 0;
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace google_breakpad
|
} // namespace google_breakpad
|
||||||
|
|
|
@ -39,6 +39,7 @@
|
||||||
#include "google_breakpad/processor/exploitability.h"
|
#include "google_breakpad/processor/exploitability.h"
|
||||||
#include "google_breakpad/processor/minidump.h"
|
#include "google_breakpad/processor/minidump.h"
|
||||||
#include "google_breakpad/processor/process_state.h"
|
#include "google_breakpad/processor/process_state.h"
|
||||||
|
#include "processor/exploitability_win.h"
|
||||||
#include "processor/logging.h"
|
#include "processor/logging.h"
|
||||||
#include "processor/scoped_ptr.h"
|
#include "processor/scoped_ptr.h"
|
||||||
|
|
||||||
|
@ -68,10 +69,14 @@ Exploitability *Exploitability::ExploitabilityForPlatform(
|
||||||
|
|
||||||
switch (raw_system_info->platform_id) {
|
switch (raw_system_info->platform_id) {
|
||||||
case MD_OS_WIN32_NT:
|
case MD_OS_WIN32_NT:
|
||||||
case MD_OS_WIN32_WINDOWS:
|
case MD_OS_WIN32_WINDOWS: {
|
||||||
case MD_OS_UNIX:
|
platform_exploitability = new ExploitabilityWin(dump,
|
||||||
|
process_state);
|
||||||
|
break;
|
||||||
|
}
|
||||||
case MD_OS_MAC_OS_X:
|
case MD_OS_MAC_OS_X:
|
||||||
case MD_OS_LINUX:
|
case MD_OS_LINUX:
|
||||||
|
case MD_OS_UNIX:
|
||||||
case MD_OS_SOLARIS:
|
case MD_OS_SOLARIS:
|
||||||
default: {
|
default: {
|
||||||
platform_exploitability = NULL;
|
platform_exploitability = NULL;
|
||||||
|
|
168
src/processor/exploitability_win.cc
Normal file
168
src/processor/exploitability_win.cc
Normal file
|
@ -0,0 +1,168 @@
|
||||||
|
// Copyright (c) 2010 Google Inc.
|
||||||
|
// All rights reserved.
|
||||||
|
//
|
||||||
|
// Redistribution and use in source and binary forms, with or without
|
||||||
|
// modification, are permitted provided that the following conditions are
|
||||||
|
// met:
|
||||||
|
//
|
||||||
|
// * Redistributions of source code must retain the above copyright
|
||||||
|
// notice, this list of conditions and the following disclaimer.
|
||||||
|
// * Redistributions in binary form must reproduce the above
|
||||||
|
// copyright notice, this list of conditions and the following disclaimer
|
||||||
|
// in the documentation and/or other materials provided with the
|
||||||
|
// distribution.
|
||||||
|
// * Neither the name of Google Inc. nor the names of its
|
||||||
|
// contributors may be used to endorse or promote products derived from
|
||||||
|
// this software without specific prior written permission.
|
||||||
|
//
|
||||||
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||||
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||||
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||||
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||||
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||||
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||||
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||||
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
|
||||||
|
// exploitability_win.cc: Windows specific exploitability engine.
|
||||||
|
//
|
||||||
|
// Provides a guess at the exploitability of the crash for the Windows
|
||||||
|
// platform given a minidump and process_state.
|
||||||
|
//
|
||||||
|
// Author: Cris Neckar
|
||||||
|
|
||||||
|
#include "processor/exploitability_win.h"
|
||||||
|
|
||||||
|
#include "google_breakpad/common/minidump_exception_win32.h"
|
||||||
|
#include "processor/logging.h"
|
||||||
|
#include "processor/scoped_ptr.h"
|
||||||
|
|
||||||
|
namespace google_breakpad {
|
||||||
|
|
||||||
|
// The cutoff that we use to judge if and address is likely an offset
|
||||||
|
// from null.
|
||||||
|
static const u_int64_t kProbableNullOffset = 4096;
|
||||||
|
|
||||||
|
// The various cutoffs for the different ratings.
|
||||||
|
static const size_t kHighCutoff = 85;
|
||||||
|
static const size_t kMediumCutoff = 65;
|
||||||
|
static const size_t kLowCutoff = 45;
|
||||||
|
static const size_t kInterestingCutoff = 25;
|
||||||
|
|
||||||
|
// Predefined incremental values for conditional weighting.
|
||||||
|
static const size_t kTinyBump = 5;
|
||||||
|
static const size_t kSmallBump = 20;
|
||||||
|
static const size_t kMediumBump = 50;
|
||||||
|
static const size_t kLargeBump = 70;
|
||||||
|
static const size_t kHugeBump = 90;
|
||||||
|
|
||||||
|
ExploitabilityWin::ExploitabilityWin(Minidump *dump,
|
||||||
|
ProcessState *process_state)
|
||||||
|
: Exploitability(dump, process_state) { }
|
||||||
|
|
||||||
|
ExploitabilityRating ExploitabilityWin::CheckPlatformExploitability() {
|
||||||
|
MinidumpException *exception = dump_->GetException();
|
||||||
|
if (!exception)
|
||||||
|
return EXPLOITABILITY_ERR_PROCESSING;
|
||||||
|
|
||||||
|
const MDRawExceptionStream *raw_exception = exception->exception();
|
||||||
|
if (!raw_exception)
|
||||||
|
return EXPLOITABILITY_ERR_PROCESSING;
|
||||||
|
|
||||||
|
u_int64_t address = raw_exception->exception_record.exception_address;
|
||||||
|
u_int32_t exception_code = raw_exception->exception_record.exception_code;
|
||||||
|
u_int32_t exception_flags = raw_exception->exception_record.exception_flags;
|
||||||
|
|
||||||
|
u_int32_t exploitability_weight = 0;
|
||||||
|
|
||||||
|
switch (exception_code) {
|
||||||
|
// This is almost certainly recursion.
|
||||||
|
case MD_EXCEPTION_CODE_WIN_STACK_OVERFLOW:
|
||||||
|
exploitability_weight += kTinyBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
// These exceptions tend to be benign and we can generally ignore them.
|
||||||
|
case MD_EXCEPTION_CODE_WIN_INTEGER_DIVIDE_BY_ZERO:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_INTEGER_OVERFLOW:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_FLOAT_DIVIDE_BY_ZERO:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_FLOAT_INEXACT_RESULT:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_FLOAT_OVERFLOW:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_FLOAT_UNDERFLOW:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_IN_PAGE_ERROR:
|
||||||
|
exploitability_weight += kTinyBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
// These exceptions will typically mean that we have jumped where we
|
||||||
|
// shouldn't.
|
||||||
|
case MD_EXCEPTION_CODE_WIN_ILLEGAL_INSTRUCTION:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_FLOAT_INVALID_OPERATION:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_PRIVILEGED_INSTRUCTION:
|
||||||
|
exploitability_weight += kLargeBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
// These represent bugs in exception handlers.
|
||||||
|
case MD_EXCEPTION_CODE_WIN_INVALID_DISPOSITION:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_NONCONTINUABLE_EXCEPTION:
|
||||||
|
exploitability_weight += kSmallBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case MD_EXCEPTION_CODE_WIN_HEAP_CORRUPTION:
|
||||||
|
case MD_EXCEPTION_CODE_WIN_STACK_BUFFER_OVERRUN:
|
||||||
|
exploitability_weight += kHugeBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case MD_EXCEPTION_CODE_WIN_GUARD_PAGE_VIOLATION:
|
||||||
|
exploitability_weight += kLargeBump;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case MD_EXCEPTION_CODE_WIN_ACCESS_VIOLATION:
|
||||||
|
bool near_null = (address <= kProbableNullOffset);
|
||||||
|
if (raw_exception->exception_record.number_parameters >= 1) {
|
||||||
|
MDAccessViolationTypeWin av_type =
|
||||||
|
static_cast<MDAccessViolationTypeWin>
|
||||||
|
(raw_exception->exception_record.exception_information[0]);
|
||||||
|
switch (av_type) {
|
||||||
|
case MD_ACCESS_VIOLATION_WIN_READ:
|
||||||
|
if (near_null)
|
||||||
|
exploitability_weight += kSmallBump;
|
||||||
|
else
|
||||||
|
exploitability_weight += kMediumBump;
|
||||||
|
break;
|
||||||
|
case MD_ACCESS_VIOLATION_WIN_WRITE:
|
||||||
|
if (near_null)
|
||||||
|
exploitability_weight += kSmallBump;
|
||||||
|
else
|
||||||
|
exploitability_weight += kHugeBump;
|
||||||
|
break;
|
||||||
|
case MD_ACCESS_VIOLATION_WIN_EXEC:
|
||||||
|
if (near_null)
|
||||||
|
exploitability_weight += kSmallBump;
|
||||||
|
else
|
||||||
|
exploitability_weight += kHugeBump;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
return EXPLOITABILITY_ERR_PROCESSING;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
return EXPLOITABILITY_ERR_PROCESSING;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Based on the calculated weight we return a simplified classification.
|
||||||
|
if (exploitability_weight > kHighCutoff)
|
||||||
|
return EXPLOITABILITY_HIGH;
|
||||||
|
if (exploitability_weight > kMediumCutoff)
|
||||||
|
return EXPLOITABLITY_MEDIUM;
|
||||||
|
if (exploitability_weight > kLowCutoff)
|
||||||
|
return EXPLOITABILITY_LOW;
|
||||||
|
if (exploitability_weight > kInterestingCutoff)
|
||||||
|
return EXPLOITABILITY_INTERESTING;
|
||||||
|
|
||||||
|
return EXPLOITABILITY_NONE;
|
||||||
|
}
|
||||||
|
|
||||||
|
} // namespace google_breakpad
|
55
src/processor/exploitability_win.h
Normal file
55
src/processor/exploitability_win.h
Normal file
|
@ -0,0 +1,55 @@
|
||||||
|
// Copyright (c) 2010 Google Inc.
|
||||||
|
// All rights reserved.
|
||||||
|
//
|
||||||
|
// Redistribution and use in source and binary forms, with or without
|
||||||
|
// modification, are permitted provided that the following conditions are
|
||||||
|
// met:
|
||||||
|
//
|
||||||
|
// * Redistributions of source code must retain the above copyright
|
||||||
|
// notice, this list of conditions and the following disclaimer.
|
||||||
|
// * Redistributions in binary form must reproduce the above
|
||||||
|
// copyright notice, this list of conditions and the following disclaimer
|
||||||
|
// in the documentation and/or other materials provided with the
|
||||||
|
// distribution.
|
||||||
|
// * Neither the name of Google Inc. nor the names of its
|
||||||
|
// contributors may be used to endorse or promote products derived from
|
||||||
|
// this software without specific prior written permission.
|
||||||
|
//
|
||||||
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||||
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||||
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||||
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||||
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||||
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||||
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||||
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||||
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||||
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
|
||||||
|
// exploitability_win.h: Windows specific exploitability engine.
|
||||||
|
//
|
||||||
|
// Provides a guess at the exploitability of the crash for the Windows
|
||||||
|
// platform given a minidump and process_state.
|
||||||
|
//
|
||||||
|
// Author: Cris Neckar
|
||||||
|
|
||||||
|
#ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_WIN_H_
|
||||||
|
#define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_WIN_H_
|
||||||
|
|
||||||
|
#include "google_breakpad/common/breakpad_types.h"
|
||||||
|
#include "google_breakpad/processor/exploitability.h"
|
||||||
|
|
||||||
|
namespace google_breakpad {
|
||||||
|
|
||||||
|
class ExploitabilityWin : public Exploitability {
|
||||||
|
public:
|
||||||
|
ExploitabilityWin(Minidump *dump,
|
||||||
|
ProcessState *process_state);
|
||||||
|
|
||||||
|
virtual ExploitabilityRating CheckPlatformExploitability();
|
||||||
|
};
|
||||||
|
|
||||||
|
} // namespace google_breakpad
|
||||||
|
|
||||||
|
#endif // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_WIN_H_
|
|
@ -96,8 +96,8 @@ ProcessResult MinidumpProcessor::Process(
|
||||||
dump, &process_state->crash_address_);
|
dump, &process_state->crash_address_);
|
||||||
}
|
}
|
||||||
|
|
||||||
// This will just return an empty string if it doesn't exist.
|
// This will just return an empty string if it doesn't exist.
|
||||||
process_state->assertion_ = GetAssertion(dump);
|
process_state->assertion_ = GetAssertion(dump);
|
||||||
|
|
||||||
MinidumpModuleList *module_list = dump->GetModuleList();
|
MinidumpModuleList *module_list = dump->GetModuleList();
|
||||||
|
|
||||||
|
@ -267,7 +267,7 @@ ProcessResult MinidumpProcessor::Process(
|
||||||
if (!dump.Read()) {
|
if (!dump.Read()) {
|
||||||
BPLOG(ERROR) << "Minidump " << dump.path() << " could not be read";
|
BPLOG(ERROR) << "Minidump " << dump.path() << " could not be read";
|
||||||
return PROCESS_ERROR_MINIDUMP_NOT_FOUND;
|
return PROCESS_ERROR_MINIDUMP_NOT_FOUND;
|
||||||
}
|
}
|
||||||
|
|
||||||
return Process(&dump, process_state);
|
return Process(&dump, process_state);
|
||||||
}
|
}
|
||||||
|
@ -730,14 +730,17 @@ string MinidumpProcessor::GetCrashReason(Minidump *dump, u_int64_t *address) {
|
||||||
// This information is useful in addition to the code address, which
|
// This information is useful in addition to the code address, which
|
||||||
// will be present in the crash thread's instruction field anyway.
|
// will be present in the crash thread's instruction field anyway.
|
||||||
if (raw_exception->exception_record.number_parameters >= 1) {
|
if (raw_exception->exception_record.number_parameters >= 1) {
|
||||||
switch (raw_exception->exception_record.exception_information[0]) {
|
MDAccessViolationTypeWin av_type =
|
||||||
case 0:
|
static_cast<MDAccessViolationTypeWin>
|
||||||
|
(raw_exception->exception_record.exception_information[0]);
|
||||||
|
switch (av_type) {
|
||||||
|
case MD_ACCESS_VIOLATION_WIN_READ:
|
||||||
reason = "EXCEPTION_ACCESS_VIOLATION_READ";
|
reason = "EXCEPTION_ACCESS_VIOLATION_READ";
|
||||||
break;
|
break;
|
||||||
case 1:
|
case MD_ACCESS_VIOLATION_WIN_WRITE:
|
||||||
reason = "EXCEPTION_ACCESS_VIOLATION_WRITE";
|
reason = "EXCEPTION_ACCESS_VIOLATION_WRITE";
|
||||||
break;
|
break;
|
||||||
case 8:
|
case MD_ACCESS_VIOLATION_WIN_EXEC:
|
||||||
reason = "EXCEPTION_ACCESS_VIOLATION_EXEC";
|
reason = "EXCEPTION_ACCESS_VIOLATION_EXEC";
|
||||||
break;
|
break;
|
||||||
default:
|
default:
|
||||||
|
@ -814,8 +817,8 @@ string MinidumpProcessor::GetCrashReason(Minidump *dump, u_int64_t *address) {
|
||||||
reason = "EXCEPTION_HEAP_CORRUPTION";
|
reason = "EXCEPTION_HEAP_CORRUPTION";
|
||||||
break;
|
break;
|
||||||
case MD_EXCEPTION_CODE_WIN_UNHANDLED_CPP_EXCEPTION:
|
case MD_EXCEPTION_CODE_WIN_UNHANDLED_CPP_EXCEPTION:
|
||||||
reason = "Unhandled C++ Exception";
|
reason = "Unhandled C++ Exception";
|
||||||
break;
|
break;
|
||||||
default:
|
default:
|
||||||
BPLOG(INFO) << "Unknown exception reason " << reason;
|
BPLOG(INFO) << "Unknown exception reason " << reason;
|
||||||
break;
|
break;
|
||||||
|
@ -1064,8 +1067,7 @@ string MinidumpProcessor::GetCrashReason(Minidump *dump, u_int64_t *address) {
|
||||||
}
|
}
|
||||||
|
|
||||||
// static
|
// static
|
||||||
string MinidumpProcessor::GetAssertion(Minidump *dump)
|
string MinidumpProcessor::GetAssertion(Minidump *dump) {
|
||||||
{
|
|
||||||
MinidumpAssertion *assertion = dump->GetAssertion();
|
MinidumpAssertion *assertion = dump->GetAssertion();
|
||||||
if (!assertion)
|
if (!assertion)
|
||||||
return "";
|
return "";
|
||||||
|
|
|
@ -58,10 +58,10 @@ class MockMinidump : public Minidump {
|
||||||
MockMinidump() : Minidump("") {
|
MockMinidump() : Minidump("") {
|
||||||
}
|
}
|
||||||
|
|
||||||
MOCK_METHOD0(Read,bool());
|
MOCK_METHOD0(Read, bool());
|
||||||
MOCK_CONST_METHOD0(path, string());
|
MOCK_CONST_METHOD0(path, string());
|
||||||
MOCK_CONST_METHOD0(header,const MDRawHeader*());
|
MOCK_CONST_METHOD0(header, const MDRawHeader*());
|
||||||
MOCK_METHOD0(GetThreadList,MinidumpThreadList*());
|
MOCK_METHOD0(GetThreadList, MinidumpThreadList*());
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -179,7 +179,6 @@ class MockSymbolSupplier : public SymbolSupplier {
|
||||||
};
|
};
|
||||||
|
|
||||||
class MinidumpProcessorTest : public ::testing::Test {
|
class MinidumpProcessorTest : public ::testing::Test {
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
TEST_F(MinidumpProcessorTest, TestCorruptMinidumps) {
|
TEST_F(MinidumpProcessorTest, TestCorruptMinidumps) {
|
||||||
|
@ -257,9 +256,9 @@ TEST_F(MinidumpProcessorTest, TestExploitilityEngine) {
|
||||||
ASSERT_EQ(processor.Process(minidump_file, &state),
|
ASSERT_EQ(processor.Process(minidump_file, &state),
|
||||||
google_breakpad::PROCESS_OK);
|
google_breakpad::PROCESS_OK);
|
||||||
|
|
||||||
// Test that exploitability module correctly fails to supply
|
// Test that the supplied dump registers as HIGH. This dump demonstrates
|
||||||
// an engine for this platform
|
// a write access violation to an address which is not near null.
|
||||||
ASSERT_EQ(google_breakpad::EXPLOITABILITY_ERR_NOENGINE,
|
ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
|
||||||
state.exploitability());
|
state.exploitability());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -342,8 +341,7 @@ TEST_F(MinidumpProcessorTest, TestBasicProcessing) {
|
||||||
state.Clear();
|
state.Clear();
|
||||||
supplier.set_interrupt(true);
|
supplier.set_interrupt(true);
|
||||||
ASSERT_EQ(processor.Process(minidump_file, &state),
|
ASSERT_EQ(processor.Process(minidump_file, &state),
|
||||||
google_breakpad::PROCESS_SYMBOL_SUPPLIER_INTERRUPTED
|
google_breakpad::PROCESS_SYMBOL_SUPPLIER_INTERRUPTED);
|
||||||
);
|
|
||||||
}
|
}
|
||||||
} // namespace
|
} // namespace
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue