Pepper flash opens a console window on Windows

[Czarek]

Found an issue in the Chromium tracker that refers to the "echo NOT SANDBOXED" code. To quote: "the Flash code has a simple piece of testing code, compiled into release builds, that does effectively":

Code: Select all

system("echo NOT SANDBOXED")


See https://code.google.com/p/chromium/issu ... ?id=240905

When you google "echo NOT SANDBOXED" you will find that this issue also occurs in Steam and in Atom/Electron.

[Czarek]

It should be possible to hook and intercept any calls to the libc system() function and ignore those with the "echo NOT SANDBOXED" string. See https://en.wikipedia.org/wiki/Hooking .

[fasecero]

Since that chromium post was marked as "won't fix", I have tried to fix this without success. I have come up with this so far (Windows only):

- Installing a hook procedure using SetWindowsHookEx() to intercept the console messages like WM_CREATE or WM_SHOWWINDOW. While I can intercept these messages using WH_CALLWNDPROC in SetWindowsHookEx, it will not let me modify them. Using WH_GETMESSAGE in SetWindowsHookEx, I can't detect any of these messages.

- Attaching a hidden console using AttachConsole(ATTACH_PARENT_PROCESS) and AllocConsole(), hoping that the "NOT SANDBOXED" message will appear on this console, but the message still show up in a new (extra) console.

[amaitland]

I've posted a followup message on the chrome tracker, see if anyone responds.

I still think a few more people commenting and asking politely would be helpful.

[Czarek]

I've posted a followup message on the chrome tracker, see if anyone responds.

I still think a few more people commenting and asking politely would be helpful.

I've responded to scottmg's comment with my reflections. However I don't think many comments, especially those just saying "please fix it" will be helpful. They will just restrict comments on the issue

[fasecero]

Who knows. I currently use CEF in two projects, one with c++ only so no problem there using sandbox. The other, however, works with .net where sandbox is not supported, and this console It's very annoying.

I have noticed that the console seems to be hidden by the main window through the Topmost property (WS_EX_TOPMOST style), so maybe this could work, far from ideal, thought. When browsing for the first time -> Topmost = True, then load an empty .swf file so the console window is triggered and finally when the navigation is complete -> TopMost = False, a static variable should control that this happens only one time.

[iegor]

From my past research I can say, that in case of Windows there is a CreateProcess call from pepperflash library. See my comment https://code.google.com/p/chromium/issues/detail?id=508002#c11.
Temporarily I managed to block CreateProcess calls from pepper plugins processes. But it's not an ideal solution though.

[fasecero]

Changing TopMost again and again generates some focus issues. Thanks for the update, I had forgotten that info. Just hooked up the CreateProcess function with .net and blocking calls that contain "echo NOT sandboxed" string... it seems to work properly.

[amaitland]

Changing TopMost again and again generates some focus issues. Thanks for the update, I had forgotten that info. Just hooked up the CreateProcess function with .net and blocking calls that contain "echo NOT sandboxed" string... it seems to work properly.

Any chance you could post your .Net code as an example?

[fasecero]

Sure, but you will need to add a new third-party reference. Download EasyHook (https://easyhook.github.io/downloads.html), add a reference to EasyHook.dll and copy EasyHook32.dll to the same directory. Make sure to call the InitHook() function in the child process.

Code: Select all

Imports System.Runtime.InteropServices
Imports EasyHook

#Region "       CreateProcess hook"

    Public Sub InitHook()
        Dim CreateFileHook = LocalHook.Create(EasyHook.LocalHook.GetProcAddress("kernel32.dll", "CreateProcessA"), New CreateProcessDelegate(AddressOf CreateProcessHooked), Nothing)
        CreateFileHook.ThreadACL.SetExclusiveACL(New Integer() {})
    End Sub

    Public Function CreateProcessHooked( _
        lpApplicationName As String, _
        lpCommandLine As String, _
        ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
        ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
        bInheritHandles As Boolean, _
        dwCreationFlags As UInt32, _
        lpEnvironment As IntPtr, _
        lpCurrentDirectory As String, _
        <[In]> ByRef lpStartupInfo As STARTUPINFO, _
        <[Out]> ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean

        If InStr(lpCommandLine, "echo NOT SANDBOXED") Then
            Return 1
        End If

        Return CreateProcess(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
    End Function

    <UnmanagedFunctionPointer(CallingConvention.Winapi, SetLastError:=True)> _
    Public Delegate Function CreateProcessDelegate( _
    lpApplicationName As String, _
    lpCommandLine As String, _
    ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
    ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
    bInheritHandles As Boolean, _
    dwCreationFlags As UInt32, _
    lpEnvironment As IntPtr, _
    lpCurrentDirectory As String, _
    <[In]> ByRef lpStartupInfo As STARTUPINFO, _
    <[Out]> ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean

    <DllImport("kernel32.dll")> _
    Function CreateProcess( _
    lpApplicationName As String, _
    lpCommandLine As String, _
    ByRef lpProcessAttributes As SECURITY_ATTRIBUTES, _
    ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _
    bInheritHandles As Boolean, _
    dwCreationFlags As UInt32, _
    lpEnvironment As IntPtr, _
    lpCurrentDirectory As String, _
    <[In]> ByRef lpStartupInfo As STARTUPINFO, _
    <[Out]> ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean
    End Function

    <StructLayout(LayoutKind.Sequential)> _
    Structure SECURITY_ATTRIBUTES
        Public nLength As Integer
        Public lpSecurityDescriptor As IntPtr
        Public bInheritHandle As Integer
    End Structure

    <StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)> _
    Structure STARTUPINFO
        Public cb As Integer
        Public lpReserved As String
        Public lpDesktop As String
        Public lpTitle As String
        Public dwX As Integer
        Public dwY As Integer
        Public dwXSize As Integer
        Public dwYSize As Integer
        Public dwXCountChars As Integer
        Public dwYCountChars As Integer
        Public dwFillAttribute As Integer
        Public dwFlags As Integer
        Public wShowWindow As Short
        Public cbReserved2 As Short
        Public lpReserved2 As Integer
        Public hStdInput As Integer
        Public hStdOutput As Integer
        Public hStdError As Integer
    End Structure

    Structure PROCESS_INFORMATION
        Public hProcess As IntPtr
        Public hThread As IntPtr
        Public dwProcessId As Integer
        Public dwThreadId As Integer
    End Structure

#End Region