SUPHardNt: Don't get confused and throw VERR_SUP_VP_NO_FOUND_NO_EXE_MAPPING at the user just because some app happened to start us using the DOS-8.3 filename (SFN) (open(SFN) + map may also cause confusion).

SUPR3HardenedMain-win.cpp: Workaround for a process deadlock caused by our favourite Symantec driver (SysPlant.sys) that would lead to the system getting stuck during reboot and shutdown.

SUPR3HardenedMain-win.cpp: Handle the case where someone uses LdrLoadDll/LoadLibary to find a DLL that has already been loaded.

SUP: Relax image architecture restrictions so 32-bit resource DLLs won't cause unnecessary trouble in 64-bit processes. (untested)

supR3HardenedMonitor_LdrLoadDll: Merged the name mapping log statement into the one before the actually loading, i.e. after we've checked whether to be quiet or not.

SUP: Reduce LdrLoadDll logging. Still one log statement needing suppressing...

SUP: NtCreateFile requires SYNCHRONIZE access when FILE_SYNCHRONOUS_IO_NONALERT is used, while in user mode anyways.

SUP: Missing two FILE_SYNCHRONOUS_IO_NONALERT flags, one of which seems responsible for the occational BSOD 4E (9a,...).

Forward ported r96507: SUP: Don't wait for yourself to quit, wait on your parent. Duh.

SUP: corrected child error message and fudge the memory replace ment kludge a little.

SUP: Revised the dgmaster.sys/sakfile.sys hack as it didn't quite work around the issues in dg at least.

SUP: Try to work around sakfile.sys bsod and dgmaster.sys.

SUP: A bit more logging.

VBoxDrv-win.cpp: Keep the error info string from failed VBoxDrv and VBoxDrvStub open operations so userland can give us better messages to work on. Fixeds a couple of odd bugs.

build fix

SUP: Seems ThreadHideFromDebugger on others might require debugger rights. Ignore errors.

SUP: Handle denormalized command line string pointer and always ignore LdrInitializeThunk when verify or purifying processes.

supR3HardNtChildPurify: Logging improvements.

SUP: Restructured the respawn + child purification code to use the primary thread to trigger the initial image load events since more recent windows versions only seems to trigger these on the primary thread.

build fix

SUP: simplified the ntdll hooking / patching so we can avoid the jump table memory as it may end up where system dlls like kernel32 are supposed to be loaded (STATUS_CONFLICTING_ADDRESSES (0xc0000018) process init failure).

SUP: Check the entire NTDLL during process verification now that we're opening vboxdrv[stub] before it is initialized. check the stub process for extra threads and debugger when the VM process opens vboxdrv.

Tighten the checks on the stub process a little bit (part 1).

SUP: Use LdrRegisterDllNotification when available to make sure we see all DLLs and get a chance to restore our NtDll hooks.

SUP: Do the early init thing on the stub process too.

SUP: Implemented early VM process vboxdrv initialization.

SUP: The child side of early VM process init.

Use our own heap in the hope that we can use it before ntdll is really initialized. Fixed RtlExitProcess issue. More early import work.

Eliminating some more kernel32.dll dependencies, marking APIs we like to use early as OK.

SUP: detect ZoneAlarm installs.

SUP: Log more details on system dlls and hot patching.

SUP: Fixed copy and past bug in supR3HardenedWinVerifyCacheIsMatch. Fixed mostly harmless forwardslash bug in supR3HardenedWinFix8dot3Path.

SUP: Deal with comodo's ntdll export and getprocaddress modifications. Fixed bug in supHardNtLdrCacheOpen.

terrible experiment with kernel32/base and avast.

SUP: Better adversary detection.

SUP: Increase fudge factors when there are known trouble makers around.

SUP: Improve VBoxDrvStub open error reporting.

SUP: Apply redirection to full paths too.

SUP: Disable the 2nd ntdll.dll mapping as avast users are seeing problems with it similar to SEP users had with test build #7.

SUP: Cache errors and don't log LdrLoadDll calls before we've validated the request and know whether to supress the logging.

SUP: Wrong flags field in the wShowWindow forwarding feature.

SUP: Fix Ctrl-C issue.

SUP: Pass along the ShowWindowsFlags.

SUP: Fixed for SEP issue where it would deadlock when we tried mapping the executable into the child process. Since it's hopefully not essential for any of the other anti-products tweaks, I've decided to disable that hack. the 2nd ntdll.dll mapping has been left in.

SUP: Fix deadlock problem when mounting ISO on vista. (Never all WinVerifyTrust while holding the loader semaphore.)

Fixed ACL issue, shouldn't use GENERIC_* in the deny mask when I want to control the special access bits individually. This makes the parent watcher code work and makes it possible open the VM and stub processes for waiting or querying without requiring debugging privileges.

bugfix in previous commit with some new parent watcher code (disabled).

SUP: Fixed comctl32.dll resolving (generic winsxs) and fixed a crash log statement in LdrLoadDll when the search path is used for flags instead of an actual string pointer.

supR3HardenedWinVerifyCacheInsert: bug fix in collision case.

Extended avast cleanup kludge. Added build time option of supporting the application verifier / paged heaps.

SUP: Try reduce the number of error messages about the same DLL.

supR3HardNtPuChTriggerInitialImageEvents: Went a little further wrt mapping decoy images.

SUP: Sabotage thread creation in the stub process and for the initial part of the VM process.

SUP: Explained the opengl modulus-by-zero crash (fixed by system32 dll ownership relaxation). Consistent LdrLoadDll return logging.

SUP: Some more confusing trickery.

SUP: Avast sleep kludge.

SUP: Process the WinVerityTrust todo list from LdrLoadDll, avoid doing it from under NtCreateSection as to avoid messing up the loader. Simplified the WinVerifyTrust redo code in supR3HardenedScreenImage.

uuids

SUP: No need to repeat the IPRT signature check when we just want to do WinVerifyTrust.

Simplified the checks.

SUP,IPRT: Extended RTLdrQueryPropEx with a pvBits parameter, RTLDRPROP_IMPORT_COUNT and RTLDRPROP_IMPORT_MODULE. Hook LdrLoadDll to validate DLLs before they get to NtCreateSection and the loader code/data can be messed up (windows 7 / 32-bit crash). Allow the kernel to buffer the log file, no real need that each write hits the disk.

SUP: Some cleanup and bug hacking.

SUP: Do our own syscalls.

SUP: Cache images for process verficiation.

sup: Check for TrustedInstaller; accept ProgramFiles and CommonFiles.

SUP: Manual imports.

SUP,LDR: Changed RTLdrGetBits to allow not resolving imports. Combined the memory and image purification code with the process validation code, adding a validation kind/mode parameter. The process verfication code now checks that code sections are unmodified. Had to add a self purification run before hooking NtCreateSection to undo a weird kernel32 change that avast made (making GetBinaryTypeW specify write thru when opening a file). So, VM startup is now even slower thanks to avast.

SUP: Fixed windows 7 regression where the child purification code would replace the (PEB::)ApiSetMap section with the start of the apisetschema.dll file because it though it was a normal image mapping.

build fix

SUP: Added logging capabilities to the hardened stub.

SUP: Make the middle respawn process wait on both parent and child. Cleanups.

SUP: some cleanups.

SUP: Don't make assumptions about the NTDLL.DLL location in the child process.

SUP: child-process purification to avoid sysfer.dll.

SUP: Disable hard error popups from NtCreateSection failures.

SUP: Don't verify the VM selector process (SUPSECMAIN_FLAGS_DONT_OPEN_DEV).

short -> long names.

Forward ported r95010 from 4.3

Removed left over DEBUG_bird bits in iprt/asn1.h and added VBOX_PERMIT_VISUAL_STUDIO_PROFILING.

Try again for up to 5 seconds when we see STATUS_NO_SUCH_DEVICE and the driver is initializing.

One more define.

Decode a couple of typical \Devices\VBoxDrvStub failure statuses.

SUP: NT status code conversion fix + cleanups.

Merged in iprt++ dev branch.