src/processor/exploitability_win.cc - platform/external/google-breakpad - Git at Google


            
            // Copyright (c) 2010 Google Inc.

            
            // All rights reserved.

            
            //

            
            // Redistribution and use in source and binary forms, with or without

            
            // modification, are permitted provided that the following conditions are

            
            // met:

            
            //

            
            //     * Redistributions of source code must retain the above copyright

            
            // notice, this list of conditions and the following disclaimer.

            
            //     * Redistributions in binary form must reproduce the above

            
            // copyright notice, this list of conditions and the following disclaimer

            
            // in the documentation and/or other materials provided with the

            
            // distribution.

            
            //     * Neither the name of Google Inc. nor the names of its

            
            // contributors may be used to endorse or promote products derived from

            
            // this software without specific prior written permission.

            
            //

            
            // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

            
            // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

            
            // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

            
            // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

            
            // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

            
            // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

            
            // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

            
            // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

            
            // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

            
            // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

            
            // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


            // exploitability_win.cc: Windows specific exploitability engine.

            
            //

            
            // Provides a guess at the exploitability of the crash for the Windows

            
            // platform given a minidump and process_state.

            
            //

            
            // Author: Cris Neckar


            #include <vector>


            #include "processor/exploitability_win.h"


            #include "common/scoped_ptr.h"

            
            #include "google_breakpad/common/minidump_exception_win32.h"

            
            #include "google_breakpad/processor/minidump.h"

            
            #include "processor/disassembler_x86.h"

            
            #include "processor/logging.h"


            #include "third_party/libdisasm/libdis.h"


            namespace google_breakpad {


            // The cutoff that we use to judge if and address is likely an offset

            
            // from various interesting addresses.

            
            static const uint64_t kProbableNullOffset = 4096;

            
            static const uint64_t kProbableStackOffset = 8192;


            // The various cutoffs for the different ratings.

            
            static const size_t kHighCutoff        = 100;

            
            static const size_t kMediumCutoff      = 80;

            
            static const size_t kLowCutoff         = 50;

            
            static const size_t kInterestingCutoff = 25;


            // Predefined incremental values for conditional weighting.

            
            static const size_t kTinyBump          = 5;

            
            static const size_t kSmallBump         = 20;

            
            static const size_t kMediumBump        = 50;

            
            static const size_t kLargeBump         = 70;

            
            static const size_t kHugeBump          = 90;


            // The maximum number of bytes to disassemble past the program counter.

            
            static const size_t kDisassembleBytesBeyondPC = 2048;


            ExploitabilityWin::ExploitabilityWin(Minidump* dump,

            
                                                 ProcessState* process_state)

            
                : Exploitability(dump, process_state) { }


            ExploitabilityRating ExploitabilityWin::CheckPlatformExploitability() {

            
              MinidumpException* exception = dump_->GetException();

            
              if (!exception) {

            
                BPLOG(INFO) << "Minidump does not have exception record.";

            
                return EXPLOITABILITY_ERR_PROCESSING;

            
              }


              const MDRawExceptionStream* raw_exception = exception->exception();

            
              if (!raw_exception) {

            
                BPLOG(INFO) << "Could not obtain raw exception info.";

            
                return EXPLOITABILITY_ERR_PROCESSING;

            
              }


              const MinidumpContext* context = exception->GetContext();

            
              if (!context) {

            
                BPLOG(INFO) << "Could not obtain exception context.";

            
                return EXPLOITABILITY_ERR_PROCESSING;

            
              }


              MinidumpMemoryList* memory_list = dump_->GetMemoryList();

            
              bool memory_available = true;

            
              if (!memory_list) {

            
                BPLOG(INFO) << "Minidump memory segments not available.";

            
                memory_available = false;

            
              }

            
              uint64_t address = process_state_->crash_address();

            
              uint32_t exception_code = raw_exception->exception_record.exception_code;


              uint32_t exploitability_weight = 0;


              uint64_t stack_ptr = 0;

            
              uint64_t instruction_ptr = 0;


              // Getting the instruction pointer.

            
              if (!context->GetInstructionPointer(&instruction_ptr)) {

            
                return EXPLOITABILITY_ERR_PROCESSING;

            
              }


              // Getting the stack pointer.

            
              if (!context->GetStackPointer(&stack_ptr)) {

            
                return EXPLOITABILITY_ERR_PROCESSING;

            
              }


              // Check if we are executing on the stack.

            
              if (instruction_ptr <= (stack_ptr + kProbableStackOffset) &&

            
                  instruction_ptr >= (stack_ptr - kProbableStackOffset))

            
                exploitability_weight += kHugeBump;


              switch (exception_code) {

            
                // This is almost certainly recursion.

            
                case MD_EXCEPTION_CODE_WIN_STACK_OVERFLOW:

            
                  exploitability_weight += kTinyBump;

            
                  break;


                // These exceptions tend to be benign and we can generally ignore them.

            
                case MD_EXCEPTION_CODE_WIN_INTEGER_DIVIDE_BY_ZERO:

            
                case MD_EXCEPTION_CODE_WIN_INTEGER_OVERFLOW:

            
                case MD_EXCEPTION_CODE_WIN_FLOAT_DIVIDE_BY_ZERO:

            
                case MD_EXCEPTION_CODE_WIN_FLOAT_INEXACT_RESULT:

            
                case MD_EXCEPTION_CODE_WIN_FLOAT_OVERFLOW:

            
                case MD_EXCEPTION_CODE_WIN_FLOAT_UNDERFLOW:

            
                case MD_EXCEPTION_CODE_WIN_IN_PAGE_ERROR:

            
                  exploitability_weight += kTinyBump;

            
                  break;


                // These exceptions will typically mean that we have jumped where we

            
                // shouldn't.

            
                case MD_EXCEPTION_CODE_WIN_ILLEGAL_INSTRUCTION:

            
                case MD_EXCEPTION_CODE_WIN_FLOAT_INVALID_OPERATION:

            
                case MD_EXCEPTION_CODE_WIN_PRIVILEGED_INSTRUCTION:

            
                  exploitability_weight += kLargeBump;

            
                  break;


                // These represent bugs in exception handlers.

            
                case MD_EXCEPTION_CODE_WIN_INVALID_DISPOSITION:

            
                case MD_EXCEPTION_CODE_WIN_NONCONTINUABLE_EXCEPTION:

            
                  exploitability_weight += kSmallBump;

            
                  break;


                case MD_EXCEPTION_CODE_WIN_HEAP_CORRUPTION:

            
                case MD_EXCEPTION_CODE_WIN_STACK_BUFFER_OVERRUN:

            
                  exploitability_weight += kHugeBump;

            
                  break;


                case MD_EXCEPTION_CODE_WIN_GUARD_PAGE_VIOLATION:

            
                  exploitability_weight += kLargeBump;

            
                  break;


                case MD_EXCEPTION_CODE_WIN_ACCESS_VIOLATION:

            
                  bool near_null = (address <= kProbableNullOffset);

            
                  bool bad_read = false;

            
                  bool bad_write = false;

            
                  if (raw_exception->exception_record.number_parameters >= 1) {

            
                    MDAccessViolationTypeWin av_type =

            
                        static_cast<MDAccessViolationTypeWin>

            
                        (raw_exception->exception_record.exception_information[0]);

            
                    switch (av_type) {

            
                      case MD_ACCESS_VIOLATION_WIN_READ:

            
                        bad_read = true;

            
                        if (near_null)

            
                          exploitability_weight += kSmallBump;

            
                        else

            
                          exploitability_weight += kMediumBump;

            
                        break;

            
                      case MD_ACCESS_VIOLATION_WIN_WRITE:

            
                        bad_write = true;

            
                        if (near_null)

            
                          exploitability_weight += kSmallBump;

            
                        else

            
                          exploitability_weight += kHugeBump;

            
                        break;

            
                      case MD_ACCESS_VIOLATION_WIN_EXEC:

            
                        if (near_null)

            
                          exploitability_weight += kSmallBump;

            
                        else

            
                          exploitability_weight += kHugeBump;

            
                        break;

            
                      default:

            
                        BPLOG(INFO) << "Unrecognized access violation type.";

            
                        return EXPLOITABILITY_ERR_PROCESSING;

            
                        break;

            
                    }

            
                    MinidumpMemoryRegion* instruction_region = 0;

            
                    if (memory_available) {

            
                      instruction_region =

            
                          memory_list->GetMemoryRegionForAddress(instruction_ptr);

            
                    }

            
                    if (!near_null && instruction_region &&

            
                        context->GetContextCPU() == MD_CONTEXT_X86 &&

            
                        (bad_read || bad_write)) {

            
                      // Perform checks related to memory around instruction pointer.

            
                      uint32_t memory_offset =

            
                          instruction_ptr - instruction_region->GetBase();

            
                      uint32_t available_memory =

            
                          instruction_region->GetSize() - memory_offset;

            
                      available_memory = available_memory > kDisassembleBytesBeyondPC ?

            
                          kDisassembleBytesBeyondPC : available_memory;

            
                      if (available_memory) {

            
                        const uint8_t* raw_memory =

            
                            instruction_region->GetMemory() + memory_offset;

            
                        DisassemblerX86 disassembler(raw_memory,

            
                                                     available_memory,

            
                                                     instruction_ptr);

            
                        disassembler.NextInstruction();

            
                        if (bad_read)

            
                          disassembler.setBadRead();

            
                        else

            
                          disassembler.setBadWrite();

            
                        if (disassembler.currentInstructionValid()) {

            
                          // Check if the faulting instruction falls into one of

            
                          // several interesting groups.

            
                          switch (disassembler.currentInstructionGroup()) {

            
                            case libdis::insn_controlflow:

            
                              exploitability_weight += kLargeBump;

            
                              break;

            
                            case libdis::insn_string:

            
                              exploitability_weight += kHugeBump;

            
                              break;

            
                            default:

            
                              break;

            
                          }

            
                          // Loop the disassembler through the code and check if it

            
                          // IDed any interesting conditions in the near future.

            
                          // Multiple flags may be set so treat each equally.

            
                          while (disassembler.NextInstruction() &&

            
                                 disassembler.currentInstructionValid() &&

            
                                 !disassembler.endOfBlock())

            
                            continue;

            
                          if (disassembler.flags() & DISX86_BAD_BRANCH_TARGET)

            
                            exploitability_weight += kLargeBump;

            
                          if (disassembler.flags() & DISX86_BAD_ARGUMENT_PASSED)

            
                            exploitability_weight += kTinyBump;

            
                          if (disassembler.flags() & DISX86_BAD_WRITE)

            
                            exploitability_weight += kMediumBump;

            
                          if (disassembler.flags() & DISX86_BAD_BLOCK_WRITE)

            
                            exploitability_weight += kMediumBump;

            
                          if (disassembler.flags() & DISX86_BAD_READ)

            
                            exploitability_weight += kTinyBump;

            
                          if (disassembler.flags() & DISX86_BAD_BLOCK_READ)

            
                            exploitability_weight += kTinyBump;

            
                          if (disassembler.flags() & DISX86_BAD_COMPARISON)

            
                            exploitability_weight += kTinyBump;

            
                        }

            
                      }

            
                    }

            
                    if (!near_null && AddressIsAscii(address))

            
                      exploitability_weight += kMediumBump;

            
                  } else {

            
                    BPLOG(INFO) << "Access violation type parameter missing.";

            
                    return EXPLOITABILITY_ERR_PROCESSING;

            
                  }

            
              }


              // Based on the calculated weight we return a simplified classification.

            
              BPLOG(INFO) << "Calculated exploitability weight: " << exploitability_weight;

            
              if (exploitability_weight >= kHighCutoff)

            
                return EXPLOITABILITY_HIGH;

            
              if (exploitability_weight >= kMediumCutoff)

            
                return EXPLOITABLITY_MEDIUM;

            
              if (exploitability_weight >= kLowCutoff)

            
                return EXPLOITABILITY_LOW;

            
              if (exploitability_weight >= kInterestingCutoff)

            
                return EXPLOITABILITY_INTERESTING;


              return EXPLOITABILITY_NONE;

            
            }


            }  // namespace google_breakpad
	// Copyright (c) 2010 Google Inc.
	// All rights reserved.
	//
	// Redistribution and use in source and binary forms, with or without
	// modification, are permitted provided that the following conditions are
	// met:
	//
	// * Redistributions of source code must retain the above copyright
	// notice, this list of conditions and the following disclaimer.
	// * Redistributions in binary form must reproduce the above
	// copyright notice, this list of conditions and the following disclaimer
	// in the documentation and/or other materials provided with the
	// distribution.
	// * Neither the name of Google Inc. nor the names of its
	// contributors may be used to endorse or promote products derived from
	// this software without specific prior written permission.
	//
	// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
	// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

	// exploitability_win.cc: Windows specific exploitability engine.
	//
	// Provides a guess at the exploitability of the crash for the Windows
	// platform given a minidump and process_state.
	//
	// Author: Cris Neckar

	#include <vector>

	#include "processor/exploitability_win.h"

	#include "common/scoped_ptr.h"
	#include "google_breakpad/common/minidump_exception_win32.h"
	#include "google_breakpad/processor/minidump.h"
	#include "processor/disassembler_x86.h"
	#include "processor/logging.h"

	#include "third_party/libdisasm/libdis.h"

	namespace google_breakpad {

	// The cutoff that we use to judge if and address is likely an offset
	// from various interesting addresses.
	static const uint64_t kProbableNullOffset = 4096;
	static const uint64_t kProbableStackOffset = 8192;

	// The various cutoffs for the different ratings.
	static const size_t kHighCutoff = 100;
	static const size_t kMediumCutoff = 80;
	static const size_t kLowCutoff = 50;
	static const size_t kInterestingCutoff = 25;

	// Predefined incremental values for conditional weighting.
	static const size_t kTinyBump = 5;
	static const size_t kSmallBump = 20;
	static const size_t kMediumBump = 50;
	static const size_t kLargeBump = 70;
	static const size_t kHugeBump = 90;

	// The maximum number of bytes to disassemble past the program counter.
	static const size_t kDisassembleBytesBeyondPC = 2048;

	ExploitabilityWin::ExploitabilityWin(Minidump* dump,
	ProcessState* process_state)
	: Exploitability(dump, process_state) { }

	ExploitabilityRating ExploitabilityWin::CheckPlatformExploitability() {
	MinidumpException* exception = dump_->GetException();
	if (!exception) {
	BPLOG(INFO) << "Minidump does not have exception record.";
	return EXPLOITABILITY_ERR_PROCESSING;
	}

	const MDRawExceptionStream* raw_exception = exception->exception();
	if (!raw_exception) {
	BPLOG(INFO) << "Could not obtain raw exception info.";
	return EXPLOITABILITY_ERR_PROCESSING;
	}

	const MinidumpContext* context = exception->GetContext();
	if (!context) {
	BPLOG(INFO) << "Could not obtain exception context.";
	return EXPLOITABILITY_ERR_PROCESSING;
	}

	MinidumpMemoryList* memory_list = dump_->GetMemoryList();
	bool memory_available = true;
	if (!memory_list) {
	BPLOG(INFO) << "Minidump memory segments not available.";
	memory_available = false;
	}
	uint64_t address = process_state_->crash_address();
	uint32_t exception_code = raw_exception->exception_record.exception_code;

	uint32_t exploitability_weight = 0;

	uint64_t stack_ptr = 0;
	uint64_t instruction_ptr = 0;

	// Getting the instruction pointer.
	if (!context->GetInstructionPointer(&instruction_ptr)) {
	return EXPLOITABILITY_ERR_PROCESSING;
	}

	// Getting the stack pointer.
	if (!context->GetStackPointer(&stack_ptr)) {
	return EXPLOITABILITY_ERR_PROCESSING;
	}

	// Check if we are executing on the stack.
	if (instruction_ptr <= (stack_ptr + kProbableStackOffset) &&
	instruction_ptr >= (stack_ptr - kProbableStackOffset))
	exploitability_weight += kHugeBump;

	switch (exception_code) {
	// This is almost certainly recursion.
	case MD_EXCEPTION_CODE_WIN_STACK_OVERFLOW:
	exploitability_weight += kTinyBump;
	break;

	// These exceptions tend to be benign and we can generally ignore them.
	case MD_EXCEPTION_CODE_WIN_INTEGER_DIVIDE_BY_ZERO:
	case MD_EXCEPTION_CODE_WIN_INTEGER_OVERFLOW:
	case MD_EXCEPTION_CODE_WIN_FLOAT_DIVIDE_BY_ZERO:
	case MD_EXCEPTION_CODE_WIN_FLOAT_INEXACT_RESULT:
	case MD_EXCEPTION_CODE_WIN_FLOAT_OVERFLOW:
	case MD_EXCEPTION_CODE_WIN_FLOAT_UNDERFLOW:
	case MD_EXCEPTION_CODE_WIN_IN_PAGE_ERROR:
	exploitability_weight += kTinyBump;
	break;

	// These exceptions will typically mean that we have jumped where we
	// shouldn't.
	case MD_EXCEPTION_CODE_WIN_ILLEGAL_INSTRUCTION:
	case MD_EXCEPTION_CODE_WIN_FLOAT_INVALID_OPERATION:
	case MD_EXCEPTION_CODE_WIN_PRIVILEGED_INSTRUCTION:
	exploitability_weight += kLargeBump;
	break;

	// These represent bugs in exception handlers.
	case MD_EXCEPTION_CODE_WIN_INVALID_DISPOSITION:
	case MD_EXCEPTION_CODE_WIN_NONCONTINUABLE_EXCEPTION:
	exploitability_weight += kSmallBump;
	break;

	case MD_EXCEPTION_CODE_WIN_HEAP_CORRUPTION:
	case MD_EXCEPTION_CODE_WIN_STACK_BUFFER_OVERRUN:
	exploitability_weight += kHugeBump;
	break;

	case MD_EXCEPTION_CODE_WIN_GUARD_PAGE_VIOLATION:
	exploitability_weight += kLargeBump;
	break;

	case MD_EXCEPTION_CODE_WIN_ACCESS_VIOLATION:
	bool near_null = (address <= kProbableNullOffset);
	bool bad_read = false;
	bool bad_write = false;
	if (raw_exception->exception_record.number_parameters >= 1) {
	MDAccessViolationTypeWin av_type =
	static_cast<MDAccessViolationTypeWin>
	(raw_exception->exception_record.exception_information[0]);
	switch (av_type) {
	case MD_ACCESS_VIOLATION_WIN_READ:
	bad_read = true;
	if (near_null)
	exploitability_weight += kSmallBump;
	else
	exploitability_weight += kMediumBump;
	break;
	case MD_ACCESS_VIOLATION_WIN_WRITE:
	bad_write = true;
	if (near_null)
	exploitability_weight += kSmallBump;
	else
	exploitability_weight += kHugeBump;
	break;
	case MD_ACCESS_VIOLATION_WIN_EXEC:
	if (near_null)
	exploitability_weight += kSmallBump;
	else
	exploitability_weight += kHugeBump;
	break;
	default:
	BPLOG(INFO) << "Unrecognized access violation type.";
	return EXPLOITABILITY_ERR_PROCESSING;
	break;
	}
	MinidumpMemoryRegion* instruction_region = 0;
	if (memory_available) {
	instruction_region =
	memory_list->GetMemoryRegionForAddress(instruction_ptr);
	}
	if (!near_null && instruction_region &&
	context->GetContextCPU() == MD_CONTEXT_X86 &&
	(bad_read \|\| bad_write)) {
	// Perform checks related to memory around instruction pointer.
	uint32_t memory_offset =
	instruction_ptr - instruction_region->GetBase();
	uint32_t available_memory =
	instruction_region->GetSize() - memory_offset;
	available_memory = available_memory > kDisassembleBytesBeyondPC ?
	kDisassembleBytesBeyondPC : available_memory;
	if (available_memory) {
	const uint8_t* raw_memory =
	instruction_region->GetMemory() + memory_offset;
	DisassemblerX86 disassembler(raw_memory,
	available_memory,
	instruction_ptr);
	disassembler.NextInstruction();
	if (bad_read)
	disassembler.setBadRead();
	else
	disassembler.setBadWrite();
	if (disassembler.currentInstructionValid()) {
	// Check if the faulting instruction falls into one of
	// several interesting groups.
	switch (disassembler.currentInstructionGroup()) {
	case libdis::insn_controlflow:
	exploitability_weight += kLargeBump;
	break;
	case libdis::insn_string:
	exploitability_weight += kHugeBump;
	break;
	default:
	break;
	}
	// Loop the disassembler through the code and check if it
	// IDed any interesting conditions in the near future.
	// Multiple flags may be set so treat each equally.
	while (disassembler.NextInstruction() &&
	disassembler.currentInstructionValid() &&
	!disassembler.endOfBlock())
	continue;
	if (disassembler.flags() & DISX86_BAD_BRANCH_TARGET)
	exploitability_weight += kLargeBump;
	if (disassembler.flags() & DISX86_BAD_ARGUMENT_PASSED)
	exploitability_weight += kTinyBump;
	if (disassembler.flags() & DISX86_BAD_WRITE)
	exploitability_weight += kMediumBump;
	if (disassembler.flags() & DISX86_BAD_BLOCK_WRITE)
	exploitability_weight += kMediumBump;
	if (disassembler.flags() & DISX86_BAD_READ)
	exploitability_weight += kTinyBump;
	if (disassembler.flags() & DISX86_BAD_BLOCK_READ)
	exploitability_weight += kTinyBump;
	if (disassembler.flags() & DISX86_BAD_COMPARISON)
	exploitability_weight += kTinyBump;
	}
	}
	}
	if (!near_null && AddressIsAscii(address))
	exploitability_weight += kMediumBump;
	} else {
	BPLOG(INFO) << "Access violation type parameter missing.";
	return EXPLOITABILITY_ERR_PROCESSING;
	}
	}

	// Based on the calculated weight we return a simplified classification.
	BPLOG(INFO) << "Calculated exploitability weight: " << exploitability_weight;
	if (exploitability_weight >= kHighCutoff)
	return EXPLOITABILITY_HIGH;
	if (exploitability_weight >= kMediumCutoff)
	return EXPLOITABLITY_MEDIUM;
	if (exploitability_weight >= kLowCutoff)
	return EXPLOITABILITY_LOW;
	if (exploitability_weight >= kInterestingCutoff)
	return EXPLOITABILITY_INTERESTING;

	return EXPLOITABILITY_NONE;
	}

	} // namespace google_breakpad