nold/Atmosphere
1
0
Fork 0
mirror of https://github.com/Atmosphere-NX/Atmosphere synced 2024-11-09 22:56:35 +00:00
Code Issues Projects Releases Packages Wiki Activity

ro: implement 9.1.0 security measures

Browse source
This commit is contained in:
Michael Scire 2020-02-24 18:02:01 -08:00
parent f427c3d7a5
commit ba8c77fec6
4 changed files with 121 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
libraries/libstratosphere/include/stratosphere/ro/ro_types.hpp
View file

@ -86,8 +86,12 @@ namespace ams::ro {
return this->num_hashes; return this->num_hashes;
} }
size_t GetHashesOffset() const {
return this->hashes_offset;
}
uintptr_t GetHashes() const { uintptr_t GetHashes() const {
return reinterpret_cast<uintptr_t>(this) + this->hashes_offset; return reinterpret_cast<uintptr_t>(this) + this->GetHashesOffset();
} }
u32 GetKeyGeneration() const { u32 GetKeyGeneration() const {
@ -114,12 +118,16 @@ namespace ams::ro {
return reinterpret_cast<const u8 *>(std::addressof(this->program_id)); return reinterpret_cast<const u8 *>(std::addressof(this->program_id));
} }
size_t GetSignedAreaSize() const; size_t GetSignedAreaSize() const {
return this->size - this->GetSignedAreaOffset();
}
size_t GetSignedAreaOffset() const;
}; };
static_assert(sizeof(NrrHeader) == 0x350, "NrrHeader definition!"); static_assert(sizeof(NrrHeader) == 0x350, "NrrHeader definition!");
inline size_t NrrHeader::GetSignedAreaSize() const { inline size_t NrrHeader::GetSignedAreaOffset() const {
return this->size - OFFSETOF(NrrHeader, program_id); return OFFSETOF(NrrHeader, program_id);
} }
class NroHeader { class NroHeader {

56
stratosphere/ro/source/impl/ro_nrr_utils.cpp
View file

@ -193,7 +193,7 @@ namespace ams::ro::impl {
} }
/* Utilities for working with NRRs. */ /* Utilities for working with NRRs. */
Result MapAndValidateNrr(NrrHeader **out_header, u64 *out_mapped_code_address, Handle process_handle, ncm::ProgramId program_id, u64 nrr_heap_address, u64 nrr_heap_size, ModuleType expected_type, bool enforce_type) { Result MapAndValidateNrr(NrrHeader **out_header, u64 *out_mapped_code_address, void *out_hash, size_t out_hash_size, Handle process_handle, ncm::ProgramId program_id, u64 nrr_heap_address, u64 nrr_heap_size, ModuleType expected_type, bool enforce_type) {
map::MappedCodeMemory nrr_mcm(ResultInternalError{}); map::MappedCodeMemory nrr_mcm(ResultInternalError{});
/* First, map the NRR. */ /* First, map the NRR. */
@ -214,6 +214,9 @@ namespace ams::ro::impl {
nrr_map.Invalidate(); nrr_map.Invalidate();
nrr_mcm.Invalidate(); nrr_mcm.Invalidate();
/* Save a copy of the hash that we verified. */
crypto::GenerateSha256Hash(out_hash, out_hash_size, nrr_header->GetSignedArea(), nrr_header->GetSignedAreaSize());
*out_header = nrr_header; *out_header = nrr_header;
*out_mapped_code_address = code_address; *out_mapped_code_address = code_address;
return ResultSuccess(); return ResultSuccess();
@ -225,4 +228,55 @@ namespace ams::ro::impl {
return ResultSuccess(); return ResultSuccess();
} }
bool ValidateNrrHashTableEntry(const void *nrr_hash, const NrrHeader *header, const u8 *hash_table, const void *desired_hash) {
crypto::Sha256Generator sha256;
sha256.Initialize();
const size_t size = header->GetSignedAreaSize();
const size_t pre_hash_table_size = header->GetHashesOffset() - header->GetSignedAreaOffset();
const size_t num_hashes = header->GetNumHashes();
/* Hash data before the hash table. */
sha256.Update(header->GetSignedArea(), pre_hash_table_size);
/* Hash the hash table, checking if the desired hash exists inside it. */
size_t remaining_size = size - pre_hash_table_size;
bool found_hash = false;
for (size_t i = 0; i < num_hashes; i++) {
/* Get the current hash. */
u8 cur_hash[crypto::Sha256Generator::HashSize];
std::memcpy(cur_hash, hash_table, sizeof(cur_hash));
/* Hash the current hash. */
sha256.Update(cur_hash, sizeof(cur_hash));
/* Check if the current hash is our target. */
found_hash |= std::memcmp(cur_hash, desired_hash, sizeof(cur_hash)) == 0;
/* Advance our pointers. */
hash_table += sizeof(cur_hash);
remaining_size -= sizeof(cur_hash);
}
/* Data after the hash table should be all zeroes. */
u8 work_buf[crypto::Sha256Generator::HashSize];
{
crypto::ClearMemory(work_buf, sizeof(work_buf));
while (remaining_size > 0) {
const size_t cur_size = std::min(remaining_size, sizeof(work_buf));
sha256.Update(work_buf, cur_size);
remaining_size -= cur_size;
}
}
/* Validate the final hash. */
sha256.GetHash(work_buf, sizeof(work_buf));
/* Use & operator to avoid short circuiting. */
const bool is_valid = found_hash & (std::memcmp(work_buf, nrr_hash, sizeof(work_buf)) == 0);
/* Return result. */
return is_valid;
}
} }

4
stratosphere/ro/source/impl/ro_nrr_utils.hpp
View file

@ -20,7 +20,9 @@
namespace ams::ro::impl { namespace ams::ro::impl {
/* Utilities for working with NRRs. */ /* Utilities for working with NRRs. */
Result MapAndValidateNrr(NrrHeader **out_header, u64 *out_mapped_code_address, Handle process_handle, ncm::ProgramId program_id, u64 nrr_heap_address, u64 nrr_heap_size, ModuleType expected_type, bool enforce_type); Result MapAndValidateNrr(NrrHeader **out_header, u64 *out_mapped_code_address, void *out_hash, size_t out_hash_size, Handle process_handle, ncm::ProgramId program_id, u64 nrr_heap_address, u64 nrr_heap_size, ModuleType expected_type, bool enforce_type);
Result UnmapNrr(Handle process_handle, const NrrHeader *header, u64 nrr_heap_address, u64 nrr_heap_size, u64 mapped_code_address); Result UnmapNrr(Handle process_handle, const NrrHeader *header, u64 nrr_heap_address, u64 nrr_heap_size, u64 mapped_code_address);
bool ValidateNrrHashTableEntry(const void *nrr_hash, const NrrHeader *header, const u8 *hash_table, const void *desired_hash);
} }

68
stratosphere/ro/source/impl/ro_service_impl.cpp
View file

@ -23,28 +23,28 @@ namespace ams::ro::impl {
namespace { namespace {
/* Convenience definitions. */ /* Convenience definitions. */
constexpr size_t MaxSessions = 0x4; constexpr size_t MaxSessions = 0x3; /* 2 official sessions (applet + application, 1 homebrew session). */
constexpr size_t MaxNrrInfos = 0x40; constexpr size_t MaxNrrInfos = 0x40;
constexpr size_t MaxNroInfos = 0x40; constexpr size_t MaxNroInfos = 0x40;
/* Types. */ /* Types. */
struct Sha256Hash { struct Sha256Hash {
u8 hash[SHA256_HASH_SIZE]; u8 hash[crypto::Sha256Generator::HashSize];
bool operator==(const Sha256Hash &o) const { bool operator==(const Sha256Hash &o) const {
return std::memcmp(this, &o, sizeof(*this)) == 0; return std::memcmp(this, std::addressof(o), sizeof(*this)) == 0;
} }
bool operator!=(const Sha256Hash &o) const { bool operator!=(const Sha256Hash &o) const {
return std::memcmp(this, &o, sizeof(*this)) != 0; return std::memcmp(this, std::addressof(o), sizeof(*this)) != 0;
} }
bool operator<(const Sha256Hash &o) const { bool operator<(const Sha256Hash &o) const {
return std::memcmp(this, &o, sizeof(*this)) < 0; return std::memcmp(this, std::addressof(o), sizeof(*this)) < 0;
} }
bool operator>(const Sha256Hash &o) const { bool operator>(const Sha256Hash &o) const {
return std::memcmp(this, &o, sizeof(*this)) > 0; return std::memcmp(this, std::addressof(o), sizeof(*this)) > 0;
} }
}; };
static_assert(sizeof(Sha256Hash) == sizeof(Sha256Hash::hash), "Sha256Hash definition!"); static_assert(sizeof(Sha256Hash) == sizeof(Sha256Hash::hash));
struct NroInfo { struct NroInfo {
u64 base_address; u64 base_address;
@ -58,10 +58,12 @@ namespace ams::ro::impl {
}; };
struct NrrInfo { struct NrrInfo {
const NrrHeader *header; const NrrHeader *mapped_header;
u64 nrr_heap_address; u64 nrr_heap_address;
u64 nrr_heap_size; u64 nrr_heap_size;
u64 mapped_code_address; u64 mapped_code_address;
NrrHeader cached_header;
Sha256Hash signed_area_hash;
}; };
struct ProcessContext { struct ProcessContext {
@ -154,14 +156,40 @@ namespace ams::ro::impl {
Result ValidateHasNroHash(const NroHeader *nro_header) const { Result ValidateHasNroHash(const NroHeader *nro_header) const {
/* Calculate hash. */ /* Calculate hash. */
Sha256Hash hash; Sha256Hash hash;
sha256CalculateHash(&hash, nro_header, nro_header->GetSize()); crypto::GenerateSha256Hash(std::addressof(hash), sizeof(hash), nro_header, nro_header->GetSize());
for (size_t i = 0; i < MaxNrrInfos; i++) { for (size_t i = 0; i < MaxNrrInfos; i++) {
if (this->nrr_in_use[i]) { /* Ensure we only check NRRs that are used. */
const NrrHeader *nrr_header = this->nrr_infos[i].header; if (!this->nrr_in_use[i]) {
const Sha256Hash *nro_hashes = reinterpret_cast<const Sha256Hash *>(nrr_header->GetHashes()); continue;
R_UNLESS(!std::binary_search(nro_hashes, nro_hashes + nrr_header->GetNumHashes(), hash), ResultSuccess());
} }
/* Get the mapped header, ensure that it has hashes. */
const NrrHeader *cached_nrr_header = std::addressof(this->nrr_infos[i].cached_header);
const NrrHeader *mapped_nrr_header = this->nrr_infos[i].mapped_header;
const size_t mapped_num_hashes = mapped_nrr_header->GetNumHashes();
if (mapped_num_hashes == 0) {
continue;
}
/* Locate the hash within the mapped array. */
const Sha256Hash *mapped_nro_hashes_start = reinterpret_cast<const Sha256Hash *>(mapped_nrr_header->GetHashes());
const Sha256Hash *mapped_nro_hashes_end = mapped_nro_hashes_start + mapped_nrr_header->GetNumHashes();
const Sha256Hash *mapped_lower_bound = std::lower_bound(mapped_nro_hashes_start, mapped_nro_hashes_end, hash);
if (mapped_lower_bound == mapped_nro_hashes_end || (*mapped_lower_bound != hash)) {
continue;
}
/* Check that the hash entry is valid, since our heuristic passed. */
const void *nrr_hash = std::addressof(this->nrr_infos[i].signed_area_hash);
const u8 *hash_table = reinterpret_cast<const u8 *>(mapped_nro_hashes_start);
if (!ValidateNrrHashTableEntry(nrr_hash, cached_nrr_header, hash_table, std::addressof(hash))) {
continue;
}
/* The hash is valid! */
return ResultSuccess();
} }
return ResultNotAuthorized(); return ResultNotAuthorized();
@ -288,7 +316,7 @@ namespace ams::ro::impl {
if (context->process_handle != INVALID_HANDLE) { if (context->process_handle != INVALID_HANDLE) {
for (size_t i = 0; i < MaxNrrInfos; i++) { for (size_t i = 0; i < MaxNrrInfos; i++) {
if (context->nrr_in_use[i]) { if (context->nrr_in_use[i]) {
UnmapNrr(context->process_handle, context->nrr_infos[i].header, context->nrr_infos[i].nrr_heap_address, context->nrr_infos[i].nrr_heap_size, context->nrr_infos[i].mapped_code_address); UnmapNrr(context->process_handle, context->nrr_infos[i].mapped_header, context->nrr_infos[i].nrr_heap_address, context->nrr_infos[i].nrr_heap_size, context->nrr_infos[i].mapped_code_address);
} }
} }
svcCloseHandle(context->process_handle); svcCloseHandle(context->process_handle);
@ -391,17 +419,23 @@ namespace ams::ro::impl {
NrrInfo *nrr_info = nullptr; NrrInfo *nrr_info = nullptr;
R_TRY(context->GetFreeNrrInfo(&nrr_info)); R_TRY(context->GetFreeNrrInfo(&nrr_info));
/* Prepare to cache the NRR's signature hash. */
Sha256Hash signed_area_hash;
ON_SCOPE_EXIT { crypto::ClearMemory(std::addressof(signed_area_hash), sizeof(signed_area_hash)); };
/* Map. */ /* Map. */
NrrHeader *header = nullptr; NrrHeader *header = nullptr;
u64 mapped_code_address = 0; u64 mapped_code_address = 0;
R_TRY(MapAndValidateNrr(&header, &mapped_code_address, context->process_handle, program_id, nrr_address, nrr_size, expected_type, enforce_type)); R_TRY(MapAndValidateNrr(&header, &mapped_code_address, std::addressof(signed_area_hash), sizeof(signed_area_hash), context->process_handle, program_id, nrr_address, nrr_size, expected_type, enforce_type));
/* Set NRR info. */ /* Set NRR info. */
context->SetNrrInfoInUse(nrr_info, true); context->SetNrrInfoInUse(nrr_info, true);
nrr_info->header = header; nrr_info->mapped_header = header;
nrr_info->nrr_heap_address = nrr_address; nrr_info->nrr_heap_address = nrr_address;
nrr_info->nrr_heap_size = nrr_size; nrr_info->nrr_heap_size = nrr_size;
nrr_info->mapped_code_address = mapped_code_address; nrr_info->mapped_code_address = mapped_code_address;
nrr_info->cached_header = *header;
std::memcpy(std::addressof(nrr_info->signed_area_hash), std::addressof(signed_area_hash), sizeof(signed_area_hash));
return ResultSuccess(); return ResultSuccess();
} }
@ -425,7 +459,7 @@ namespace ams::ro::impl {
context->SetNrrInfoInUse(nrr_info, false); context->SetNrrInfoInUse(nrr_info, false);
std::memset(nrr_info, 0, sizeof(*nrr_info)); std::memset(nrr_info, 0, sizeof(*nrr_info));
} }
return UnmapNrr(context->process_handle, nrr_backup.header, nrr_backup.nrr_heap_address, nrr_backup.nrr_heap_size, nrr_backup.mapped_code_address); return UnmapNrr(context->process_handle, nrr_backup.mapped_header, nrr_backup.nrr_heap_address, nrr_backup.nrr_heap_size, nrr_backup.mapped_code_address);
} }
Result LoadNro(u64 *out_address, size_t context_id, u64 nro_address, u64 nro_size, u64 bss_address, u64 bss_size) { Result LoadNro(u64 *out_address, size_t context_id, u64 nro_address, u64 nro_size, u64 bss_address, u64 bss_size) {