in src/processor/exploitability_win.cc [76:281]
ExploitabilityRating ExploitabilityWin::CheckPlatformExploitability() {
MinidumpException *exception = dump_->GetException();
if (!exception) {
BPLOG(INFO) << "Minidump does not have exception record.";
return EXPLOITABILITY_ERR_PROCESSING;
}
const MDRawExceptionStream *raw_exception = exception->exception();
if (!raw_exception) {
BPLOG(INFO) << "Could not obtain raw exception info.";
return EXPLOITABILITY_ERR_PROCESSING;
}
const MinidumpContext *context = exception->GetContext();
if (!context) {
BPLOG(INFO) << "Could not obtain exception context.";
return EXPLOITABILITY_ERR_PROCESSING;
}
MinidumpMemoryList *memory_list = dump_->GetMemoryList();
bool memory_available = true;
if (!memory_list) {
BPLOG(INFO) << "Minidump memory segments not available.";
memory_available = false;
}
uint64_t address = process_state_->crash_address();
uint32_t exception_code = raw_exception->exception_record.exception_code;
uint32_t exploitability_weight = 0;
uint64_t stack_ptr = 0;
uint64_t instruction_ptr = 0;
// Getting the instruction pointer.
if (!context->GetInstructionPointer(&instruction_ptr)) {
return EXPLOITABILITY_ERR_PROCESSING;
}
// Getting the stack pointer.
if (!context->GetStackPointer(&stack_ptr)) {
return EXPLOITABILITY_ERR_PROCESSING;
}
// Check if we are executing on the stack.
if (instruction_ptr <= (stack_ptr + kProbableStackOffset) &&
instruction_ptr >= (stack_ptr - kProbableStackOffset))
exploitability_weight += kHugeBump;
switch (exception_code) {
// This is almost certainly recursion.
case MD_EXCEPTION_CODE_WIN_STACK_OVERFLOW:
exploitability_weight += kTinyBump;
break;
// These exceptions tend to be benign and we can generally ignore them.
case MD_EXCEPTION_CODE_WIN_INTEGER_DIVIDE_BY_ZERO:
case MD_EXCEPTION_CODE_WIN_INTEGER_OVERFLOW:
case MD_EXCEPTION_CODE_WIN_FLOAT_DIVIDE_BY_ZERO:
case MD_EXCEPTION_CODE_WIN_FLOAT_INEXACT_RESULT:
case MD_EXCEPTION_CODE_WIN_FLOAT_OVERFLOW:
case MD_EXCEPTION_CODE_WIN_FLOAT_UNDERFLOW:
case MD_EXCEPTION_CODE_WIN_IN_PAGE_ERROR:
exploitability_weight += kTinyBump;
break;
// These exceptions will typically mean that we have jumped where we
// shouldn't.
case MD_EXCEPTION_CODE_WIN_ILLEGAL_INSTRUCTION:
case MD_EXCEPTION_CODE_WIN_FLOAT_INVALID_OPERATION:
case MD_EXCEPTION_CODE_WIN_PRIVILEGED_INSTRUCTION:
exploitability_weight += kLargeBump;
break;
// These represent bugs in exception handlers.
case MD_EXCEPTION_CODE_WIN_INVALID_DISPOSITION:
case MD_EXCEPTION_CODE_WIN_NONCONTINUABLE_EXCEPTION:
exploitability_weight += kSmallBump;
break;
case MD_EXCEPTION_CODE_WIN_HEAP_CORRUPTION:
case MD_EXCEPTION_CODE_WIN_STACK_BUFFER_OVERRUN:
exploitability_weight += kHugeBump;
break;
case MD_EXCEPTION_CODE_WIN_GUARD_PAGE_VIOLATION:
exploitability_weight += kLargeBump;
break;
case MD_EXCEPTION_CODE_WIN_ACCESS_VIOLATION:
bool near_null = (address <= kProbableNullOffset);
bool bad_read = false;
bool bad_write = false;
if (raw_exception->exception_record.number_parameters >= 1) {
MDAccessViolationTypeWin av_type =
static_cast<MDAccessViolationTypeWin>
(raw_exception->exception_record.exception_information[0]);
switch (av_type) {
case MD_ACCESS_VIOLATION_WIN_READ:
bad_read = true;
if (near_null)
exploitability_weight += kSmallBump;
else
exploitability_weight += kMediumBump;
break;
case MD_ACCESS_VIOLATION_WIN_WRITE:
bad_write = true;
if (near_null)
exploitability_weight += kSmallBump;
else
exploitability_weight += kHugeBump;
break;
case MD_ACCESS_VIOLATION_WIN_EXEC:
if (near_null)
exploitability_weight += kSmallBump;
else
exploitability_weight += kHugeBump;
break;
default:
BPLOG(INFO) << "Unrecognized access violation type.";
return EXPLOITABILITY_ERR_PROCESSING;
break;
}
MinidumpMemoryRegion *instruction_region = 0;
if (memory_available) {
instruction_region =
memory_list->GetMemoryRegionForAddress(instruction_ptr);
}
if (!near_null && instruction_region &&
context->GetContextCPU() == MD_CONTEXT_X86 &&
(bad_read || bad_write)) {
// Perform checks related to memory around instruction pointer.
uint32_t memory_offset =
instruction_ptr - instruction_region->GetBase();
uint32_t available_memory =
instruction_region->GetSize() - memory_offset;
available_memory = available_memory > kDisassembleBytesBeyondPC ?
kDisassembleBytesBeyondPC : available_memory;
if (available_memory) {
const uint8_t *raw_memory =
instruction_region->GetMemory() + memory_offset;
DisassemblerX86 disassembler(raw_memory,
available_memory,
instruction_ptr);
disassembler.NextInstruction();
if (bad_read)
disassembler.setBadRead();
else
disassembler.setBadWrite();
if (disassembler.currentInstructionValid()) {
// Check if the faulting instruction falls into one of
// several interesting groups.
switch (disassembler.currentInstructionGroup()) {
case libdis::insn_controlflow:
exploitability_weight += kLargeBump;
break;
case libdis::insn_string:
exploitability_weight += kHugeBump;
break;
default:
break;
}
// Loop the disassembler through the code and check if it
// IDed any interesting conditions in the near future.
// Multiple flags may be set so treat each equally.
while (disassembler.NextInstruction() &&
disassembler.currentInstructionValid() &&
!disassembler.endOfBlock())
continue;
if (disassembler.flags() & DISX86_BAD_BRANCH_TARGET)
exploitability_weight += kLargeBump;
if (disassembler.flags() & DISX86_BAD_ARGUMENT_PASSED)
exploitability_weight += kTinyBump;
if (disassembler.flags() & DISX86_BAD_WRITE)
exploitability_weight += kMediumBump;
if (disassembler.flags() & DISX86_BAD_BLOCK_WRITE)
exploitability_weight += kMediumBump;
if (disassembler.flags() & DISX86_BAD_READ)
exploitability_weight += kTinyBump;
if (disassembler.flags() & DISX86_BAD_BLOCK_READ)
exploitability_weight += kTinyBump;
if (disassembler.flags() & DISX86_BAD_COMPARISON)
exploitability_weight += kTinyBump;
}
}
}
if (!near_null && AddressIsAscii(address))
exploitability_weight += kMediumBump;
} else {
BPLOG(INFO) << "Access violation type parameter missing.";
return EXPLOITABILITY_ERR_PROCESSING;
}
}
// Based on the calculated weight we return a simplified classification.
BPLOG(INFO) << "Calculated exploitability weight: " << exploitability_weight;
if (exploitability_weight >= kHighCutoff)
return EXPLOITABILITY_HIGH;
if (exploitability_weight >= kMediumCutoff)
return EXPLOITABLITY_MEDIUM;
if (exploitability_weight >= kLowCutoff)
return EXPLOITABILITY_LOW;
if (exploitability_weight >= kInterestingCutoff)
return EXPLOITABILITY_INTERESTING;
return EXPLOITABILITY_NONE;
}