integrity.c File Reference

#include "wine/test.h"
#include "windef.h"
#include "winbase.h"
#include "winuser.h"
#include "winerror.h"
#include "winnt.h"
#include "imagehlp.h"
#include "psapi.h"

Include dependency graph for integrity.c:

Go to the source code of this file.

Macros
#define	COBJMACROS

Functions
static	BOOL (WINAPI *pImageAddCertificate)(HANDLE
static	PIMAGE_NT_HEADERS (WINAPI *pCheckSumMappedFile)(PVOID
static BOOL	copy_dll_file (void)
static DWORD	get_file_size (void)
static DWORD	test_add_certificate (const char *cert_data, int len)
static void	test_get_certificate (const char *cert_data, int index)
static void	test_remove_certificate (int index)
static void	test_pe_checksum (void)
	START_TEST (integrity)

Variables
static HMODULE	hImageHlp
static HMODULE	hPsapi
static HMODULE	hNtdll
static char	test_dll_path [MAX_PATH]
static	LPWIN_CERTIFICATE
static	PDWORD
static	WORD
static	DWORD
static	HMODULE
static	LPMODULEINFO
static const char	test_cert_data []
static const char	test_cert_data_2 [] = {0xDE,0xAD,0xBE,0xEF,0x01,0x02,0x03}
static char	test_pe_executable []

Macro Definition Documentation

COBJMACROS

#define COBJMACROS

Definition at line 21 of file integrity.c.

Function Documentation

BOOL()

static BOOL ( WINAPI *  pImageAddCertificate )

static

copy_dll_file()

static BOOL copy_dll_file ( void  )

static

Definition at line 120 of file integrity.c.

{
    char sys_dir[MAX_PATH+15];
    char temp_path[MAX_PATH];
 
    if (GetSystemDirectoryA(sys_dir, MAX_PATH) == 0)
    {
        skip("Failed to get system directory. Skipping certificate/PE image tests.\n");
        return FALSE;
    }
 
    if (sys_dir[lstrlenA(sys_dir) - 1] != '\\')
        lstrcatA(sys_dir, "\\");
 
    lstrcatA(sys_dir, "imagehlp.dll");
 
    /* Copy DLL to a temp file */
    GetTempPathA(MAX_PATH, temp_path);
    GetTempFileNameA(temp_path, "img", 0, test_dll_path);
 
    if (CopyFileA(sys_dir, test_dll_path, FALSE) == 0)
    {
        skip("Unable to create copy of imagehlp.dll for tests.\n");
        return FALSE;
    }
 
    return TRUE;
}

Referenced by START_TEST().

get_file_size()

static DWORD get_file_size ( void  )

static

Definition at line 149 of file integrity.c.

{
    HANDLE file;
    DWORD filesize = 0;
 
    file = CreateFileA(test_dll_path, GENERIC_READ, FILE_SHARE_READ, NULL,
                       OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
        return 0;
 
    filesize = GetFileSize(file, NULL);
    CloseHandle(file);
 
    return filesize;
}

Referenced by get_file_sizes_cab(), get_file_sizes_lz(), get_file_sizes_none(), START_TEST(), and test_SetupQuerySpaceRequiredOnDriveA().

PIMAGE_NT_HEADERS()

static PIMAGE_NT_HEADERS ( WINAPI *  pCheckSumMappedFile )

static

START_TEST()

START_TEST

(

integrity

)

Definition at line 391 of file integrity.c.

{
    DWORD file_size, file_size_orig, first, second;
 
    hImageHlp = LoadLibraryA("imagehlp.dll");
 
    if (!hImageHlp)
    {
        win_skip("ImageHlp unavailable\n");
        return;
    }
 
    if (!copy_dll_file())
    {
        FreeLibrary(hImageHlp);
        return;
    }
 
    file_size_orig = get_file_size();
 
    pImageAddCertificate = (void *) GetProcAddress(hImageHlp, "ImageAddCertificate");
    pImageEnumerateCertificates = (void *) GetProcAddress(hImageHlp, "ImageEnumerateCertificates");
    pImageGetCertificateData = (void *) GetProcAddress(hImageHlp, "ImageGetCertificateData");
    pImageGetCertificateHeader = (void *) GetProcAddress(hImageHlp, "ImageGetCertificateHeader");
    pImageRemoveCertificate = (void *) GetProcAddress(hImageHlp, "ImageRemoveCertificate");
    pCheckSumMappedFile = (void *) GetProcAddress(hImageHlp, "CheckSumMappedFile");
 
    hPsapi = LoadLibraryA("psapi.dll");
    if (hPsapi)
        pGetModuleInformation = (void *) GetProcAddress(hPsapi, "GetModuleInformation");
 
    hNtdll = LoadLibraryA("ntdll.dll");
    if (hNtdll)
        pRtlImageNtHeader = (void *) GetProcAddress(hNtdll, "RtlImageNtHeader");
 
    first = test_add_certificate(test_cert_data, sizeof(test_cert_data));
    test_get_certificate(test_cert_data, first);
    test_remove_certificate(first);
 
    file_size = get_file_size();
    ok(file_size == file_size_orig, "File size different after add and remove (old: %d; new: %d)\n", file_size_orig, file_size);
 
    /* Try adding multiple certificates */
    first = test_add_certificate(test_cert_data, sizeof(test_cert_data));
    second = test_add_certificate(test_cert_data_2, sizeof(test_cert_data_2));
    ok(second == first + 1, "got %d %d\n", first, second);
 
    test_get_certificate(test_cert_data, first);
    test_get_certificate(test_cert_data_2, second);
 
    /* Remove the first one and verify the second certificate is intact */
    test_remove_certificate(first);
    second--;
    test_get_certificate(test_cert_data_2, second);
 
    test_remove_certificate(second);
 
    file_size = get_file_size();
    ok(file_size == file_size_orig, "File size different after add and remove (old: %d; new: %d)\n", file_size_orig, file_size);
 
    test_pe_checksum();
 
    if (hPsapi) FreeLibrary(hPsapi);
    if (hNtdll) FreeLibrary(hNtdll);
    FreeLibrary(hImageHlp);
    DeleteFileA(test_dll_path);
}

test_add_certificate()

static DWORD test_add_certificate ( const char *  cert_data, int  len  )

static

Definition at line 165 of file integrity.c.

{
    HANDLE hFile;
    LPWIN_CERTIFICATE cert;
    DWORD cert_len;
    DWORD index;
    BOOL ret;
 
    hFile = CreateFileA(test_dll_path, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 
    if (hFile == INVALID_HANDLE_VALUE)
    {
        skip("Unable to open %s, skipping test\n", test_dll_path);
        return ~0;
    }
 
    cert_len = sizeof(WIN_CERTIFICATE) + len;
    cert = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, cert_len);
 
    if (!cert)
    {
        skip("Unable to allocate memory, skipping test\n");
        CloseHandle(hFile);
        return ~0;
    }
 
    cert->dwLength = cert_len;
    cert->wRevision = WIN_CERT_REVISION_1_0;
    cert->wCertificateType = WIN_CERT_TYPE_PKCS_SIGNED_DATA;
    CopyMemory(cert->bCertificate, cert_data, len);
 
    ret = pImageAddCertificate(hFile, cert, &index);
    ok(ret, "Unable to add certificate to image, error %x\n", GetLastError());
    trace("added cert index %d\n", index);
 
    HeapFree(GetProcessHeap(), 0, cert);
    CloseHandle(hFile);
    return index;
}

Referenced by START_TEST().

test_get_certificate()

static void test_get_certificate ( const char *  cert_data, int  index  )

static

Definition at line 205 of file integrity.c.

{
    HANDLE hFile;
    LPWIN_CERTIFICATE cert;
    DWORD cert_len = 0;
    DWORD err;
    BOOL ret;
 
    hFile = CreateFileA(test_dll_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 
    if (hFile == INVALID_HANDLE_VALUE)
    {
        skip("Unable to open %s, skipping test\n", test_dll_path);
        return;
    }
 
    ret = pImageGetCertificateData(hFile, index, NULL, &cert_len);
    err = GetLastError();
 
    ok ((ret == FALSE) && (err == ERROR_INSUFFICIENT_BUFFER), "ImageGetCertificateData gave unexpected result; ret=%d / err=%x\n", ret, err);
 
    cert = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, cert_len);
 
    if (!cert)
    {
        skip("Unable to allocate memory, skipping test\n");
        CloseHandle(hFile);
        return;
    }
 
    ret = pImageGetCertificateData(hFile, index, cert, &cert_len);
    ok(ret, "Unable to retrieve certificate; err=%x\n", GetLastError());
    ok(memcmp(cert->bCertificate, cert_data, cert_len - sizeof(WIN_CERTIFICATE)) == 0, "Certificate retrieved did not match original\n");
 
    HeapFree(GetProcessHeap(), 0, cert);
    CloseHandle(hFile);
}

Referenced by START_TEST().

test_pe_checksum()

static void test_pe_checksum ( void  )

static

Definition at line 269 of file integrity.c.

{
    DWORD checksum_orig, checksum_new, checksum_correct;
    PIMAGE_NT_HEADERS nt_header;
    PIMAGE_NT_HEADERS ret;
    MODULEINFO modinfo;
    char buffer[20];
    BOOL ret_bool;
 
    if (!pCheckSumMappedFile)
    {
        win_skip("CheckSumMappedFile not supported, skipping tests\n");
        return;
    }
 
    SetLastError(0xdeadbeef);
    ret = pCheckSumMappedFile(NULL, 0, &checksum_orig, &checksum_new);
    ok(!ret, "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok(((GetLastError() == ERROR_INVALID_PARAMETER)||(GetLastError() == 0xdeadbeef)),
       "Expected 0xdeadbeef (XP) or ERROR_INVALID_PARAMETER (Vista+), got %x\n", GetLastError());
 
    SetLastError(0xdeadbeef);
    ret = pCheckSumMappedFile((void *)0xdeadbeef, 0, &checksum_orig, &checksum_new);
    ok(!ret, "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok(((GetLastError() == ERROR_INVALID_PARAMETER)||(GetLastError() == 0xdeadbeef)),
       "Expected 0xdeadbeef (XP) or ERROR_INVALID_PARAMETER (Vista+), got %x\n", GetLastError());
 
    /* basic checksum tests */
    memset(buffer, 0x11, sizeof(buffer));
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(buffer, sizeof(buffer), &checksum_orig, &checksum_new);
    ok(ret == NULL, "Expected NULL, got %p\n", ret);
    todo_wine ok(checksum_orig == 0, "Expected 0, got %x\n", checksum_orig);
    todo_wine ok(checksum_new == 0xaabe, "Expected 0xaabe, got %x\n", checksum_new);
 
    memset(buffer, 0x22, sizeof(buffer));
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(buffer, sizeof(buffer), &checksum_orig, &checksum_new);
    ok(ret == NULL, "Expected NULL, got %p\n", ret);
    todo_wine ok(checksum_orig == 0, "Expected 0, got %x\n", checksum_orig);
    todo_wine ok(checksum_new == 0x5569, "Expected 0x5569, got %x\n", checksum_new);
 
    memset(buffer, 0x22, sizeof(buffer));
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(buffer, 10, &checksum_orig, &checksum_new);
    ok(ret == NULL, "Expected NULL, got %p\n", ret);
    todo_wine ok(checksum_orig == 0, "Expected 0, got %x\n", checksum_orig);
    todo_wine ok(checksum_new == 0xaab4, "Expected 0xaab4, got %x\n", checksum_new);
 
    memset(buffer, 0x22, sizeof(buffer));
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(buffer, 11, &checksum_orig, &checksum_new);
    ok(ret == NULL, "Expected NULL, got %p\n", ret);
    todo_wine ok(checksum_orig == 0, "Expected 0, got %x\n", checksum_orig);
    todo_wine ok(checksum_new == 0xaad7, "Expected 0xaad7, got %x\n", checksum_new);
 
    /* test checksum of PE module */
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(test_pe_executable, sizeof(test_pe_executable),
                              &checksum_orig, &checksum_new);
    ok((char *)ret == test_pe_executable + 0x80, "Expected %p, got %p\n", test_pe_executable + 0x80, ret);
    ok(checksum_orig == 0xabcdef11, "Expected 0xabcdef11, got %x\n", checksum_orig);
    ok(checksum_new == 0xaa4, "Expected 0xaa4, got %x\n", checksum_new);
 
    if (!pGetModuleInformation)
    {
        win_skip("GetModuleInformation not supported, skipping tests\n");
        return;
    }
 
    ret_bool = pGetModuleInformation(GetCurrentProcess(), GetModuleHandleA(NULL),
                                     &modinfo, sizeof(modinfo));
    ok(ret_bool, "GetModuleInformation failed, error: %x\n", GetLastError());
 
    SetLastError(0xdeadbeef);
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(modinfo.lpBaseOfDll, modinfo.SizeOfImage, &checksum_orig, &checksum_new);
    ok(ret != NULL, "Expected CheckSumMappedFile to succeed\n");
    ok(GetLastError() == 0xdeadbeef, "Expected err=0xdeadbeef, got %x\n", GetLastError());
    ok(checksum_orig != 0xdeadbeef, "Expected orig checksum != 0xdeadbeef\n");
    ok(checksum_new != 0xdeadbeef, "Expected new checksum != 0xdeadbeef\n");
 
    SetLastError(0xdeadbeef);
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile((char *)modinfo.lpBaseOfDll + 100, modinfo.SizeOfImage - 100,
                              &checksum_orig, &checksum_new);
    ok(!ret, "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok(GetLastError() == 0xdeadbeef, "Expected err=0xdeadbeef, got %x\n", GetLastError());
    todo_wine ok(checksum_orig == 0, "Expected 0, got %x\n", checksum_orig);
    todo_wine ok(checksum_new != 0 && checksum_new != 0xdeadbeef, "Got unexpected value %x\n", checksum_new);
 
    nt_header = pRtlImageNtHeader( modinfo.lpBaseOfDll );
    checksum_correct = nt_header->OptionalHeader.CheckSum;
 
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(modinfo.lpBaseOfDll, (char *)nt_header - (char *)modinfo.lpBaseOfDll,
                              &checksum_orig, &checksum_new);
    ok(!ret || (ret == nt_header), "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok((checksum_orig == 0) || (checksum_orig == checksum_correct), "Expected %x, got %x\n", checksum_correct, checksum_orig);
    ok(checksum_new != 0 && checksum_new != 0xdeadbeef, "Got unexpected value %x\n", checksum_new);
 
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(modinfo.lpBaseOfDll, sizeof(IMAGE_DOS_HEADER),
                              &checksum_orig, &checksum_new);
    ok(!ret || (ret == nt_header), "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok((checksum_orig == 0) || (checksum_orig == checksum_correct), "Expected %x, got %x\n", checksum_correct, checksum_orig);
    ok(checksum_new != 0 && checksum_new != 0xdeadbeef, "Got unexpected value %x\n", checksum_new);
 
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile(modinfo.lpBaseOfDll, 0, &checksum_orig, &checksum_new);
    ok(!ret || (ret == nt_header), "Expected CheckSumMappedFile to fail, got %p\n", ret);
    ok((checksum_orig == 0xdeadbeef) || (checksum_orig == checksum_correct), "Expected %x, got %x\n", checksum_correct, checksum_orig);
    ok((checksum_new == 0xdeadbeef) || (checksum_new != 0 && checksum_new != 0xdeadbeef), "Got unexpected value %x\n", checksum_new);
 
    checksum_orig = checksum_new = 0xdeadbeef;
    ret = pCheckSumMappedFile((char *)modinfo.lpBaseOfDll + 1, 0,
                              &checksum_orig, &checksum_new);
    ok(ret == NULL, "Expected NULL, got %p\n", ret);
    ok((checksum_orig == 0) || (checksum_orig == 0xdeadbeef), "Expected 0, got %x\n", checksum_orig);
    ok((checksum_new == 0) || (checksum_new == 0xdeadbeef), "Expected 0, got %x\n", checksum_new);
}

Referenced by START_TEST().

test_remove_certificate()

static void test_remove_certificate ( int  index )

static

Definition at line 243 of file integrity.c.

{
    DWORD orig_count = 0, count = 0;
    HANDLE hFile;
    BOOL ret;
 
    hFile = CreateFileA(test_dll_path, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 
    if (hFile == INVALID_HANDLE_VALUE)
    {
        skip("Unable to open %s, skipping test\n", test_dll_path);
        return;
    }
 
    ret = pImageEnumerateCertificates(hFile, CERT_SECTION_TYPE_ANY, &orig_count, NULL, 0);
    ok (ret, "Unable to enumerate certificates in file; err=%x\n", GetLastError());
    ret = pImageRemoveCertificate(hFile, index);
    ok (ret, "Unable to remove certificate from file; err=%x\n", GetLastError());
 
    /* Test to see if the certificate has actually been removed */
    pImageEnumerateCertificates(hFile, CERT_SECTION_TYPE_ANY, &count, NULL, 0);
    ok (count == orig_count - 1, "Certificate count mismatch; orig=%d new=%d\n", orig_count, count);
 
    CloseHandle(hFile);
}

Referenced by START_TEST().

Variable Documentation

DWORD

DWORD

Definition at line 35 of file integrity.c.

hImageHlp

HMODULE hImageHlp

static

Definition at line 31 of file integrity.c.

Referenced by START_TEST().

HMODULE

HMODULE

Definition at line 41 of file integrity.c.

hNtdll

HMODULE hNtdll

static

Definition at line 31 of file integrity.c.

Referenced by START_TEST().

hPsapi

HMODULE hPsapi

static

Definition at line 31 of file integrity.c.

Referenced by init_pointers(), and START_TEST().

LPMODULEINFO

LPMODULEINFO

Definition at line 41 of file integrity.c.

LPWIN_CERTIFICATE

LPWIN_CERTIFICATE

Definition at line 34 of file integrity.c.

PDWORD

PDWORD

Definition at line 34 of file integrity.c.

test_cert_data

const char test_cert_data[]

static

Definition at line 45 of file integrity.c.

Referenced by START_TEST().

test_cert_data_2

const char test_cert_data_2[] = {0xDE,0xAD,0xBE,0xEF,0x01,0x02,0x03}

static

Definition at line 97 of file integrity.c.

Referenced by START_TEST().

test_dll_path

char test_dll_path[MAX_PATH]

static

Definition at line 32 of file integrity.c.

Referenced by copy_dll_file(), get_file_size(), START_TEST(), test_add_certificate(), test_get_certificate(), and test_remove_certificate().

test_pe_executable

char test_pe_executable[]

static

Initial value:

=
{
    0x4d,0x5a,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0xff,0xff,0x00,
    0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x80,0x00,0x00,0x00,0x0e,0x1f,0xba,0x0e,0x00,0xb4,0x09,0xcd,0x21,0xb8,0x01,
    0x4c,0xcd,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6f,0x67,0x72,0x61,0x6d,
    0x20,0x63,0x61,0x6e,0x6e,0x6f,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6e,0x20,
    0x69,0x6e,0x20,0x44,0x4f,0x53,0x20,0x6d,0x6f,0x64,0x65,0x2e,0x0d,0x0d,0x0a,
    0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x45,0x00,0x00,0x4c,0x01,0x0f,
    0x00,0xfd,0x38,0xc9,0x55,0x00,0x24,0x01,0x00,0xea,0x04,0x00,0x00,0xe0,0x00,
    0x07,0x01,0x0b,0x01,0x02,0x18,0x00,0x1a,0x00,0x00,0x00,0x2c,0x00,0x00,0x00,
    0x06,0x00,0x00,0xe0,0x14,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x30,0x00,0x00,
    0x00,0x00,0x40,0x00,0x00,0x10,0x00,0x00,0x00,0x02,0x00,0x00,0x04,0x00,0x00,
    0x00,0x01,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xc0,
    0x01,0x00,0x00,0x04,0x00,0x00, 0x11,0xEF,0xCD,0xAB,0x03,0x00,
    0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x00,0x00,
    0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00
}

Definition at line 99 of file integrity.c.

Referenced by test_pe_checksum().

WORD

WORD

Definition at line 35 of file integrity.c.