SUPHardenedVerifyImage-win.cpp revision 02a86c3f55161b12d393bdf96b01c0086fd42313
/* $Id$ */
/** @file
* VirtualBox Support Library/Driver - Hardened Image Verification, Windows.
*/
/*
* Copyright (C) 2006-2014 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* you can redistribute it and/or modify it under the terms of the GNU
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#ifdef IN_RING0
# define IPRT_NT_MAP_TO_ZW
# include <iprt/nt/nt.h>
# include <ntimage.h>
#else
# include <iprt/nt/nt-and-windows.h>
# include "Wintrust.h"
# include "Softpub.h"
# include "mscat.h"
# ifndef LOAD_LIBRARY_SEARCH_APPLICATION_DIR
# define LOAD_LIBRARY_SEARCH_SYSTEM32 0x800
# endif
#endif
#include <VBox/sup.h>
#include <VBox/err.h>
#include <iprt/ctype.h>
#include <iprt/ldr.h>
#include <iprt/log.h>
#include <iprt/path.h>
#include <iprt/string.h>
#include <iprt/crypto/pkcs7.h>
#include <iprt/crypto/store.h>
#ifdef IN_RING0
# include "SUPDrvInternal.h"
#else
# include "SUPLibInternal.h"
#endif
#include "win/SUPHardenedVerify-win.h"
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
/** The size of static hash (output) buffers.
* Avoids dynamic allocations and cleanups for of small buffers as well as extra
* calls for getting the appropriate buffer size. The largest digest in regular
* use by current windows version is SHA-512, we double this and hope it's
* enough a good while. */
#define SUPHARDNTVI_MAX_CAT_HASH_SIZE 128
/*******************************************************************************
* Structures and Typedefs *
*******************************************************************************/
/**
* SUP image verifier loader reader instance.
*/
typedef struct SUPHNTVIRDR
{
/** The core reader structure. */
RTLDRREADER Core;
/** The file handle . */
HANDLE hFile;
/** Current file offset. */
RTFOFF off;
/** The file size. */
RTFOFF cbFile;
/** Flags for the verification callback, SUPHNTVI_F_XXX. */
uint32_t fFlags;
/** The executable timstamp in second since unix epoch. */
uint64_t uTimestamp;
/** Log name. */
char szFilename[1];
} SUPHNTVIRDR;
/** Pointer to an SUP image verifier loader reader instance. */
typedef SUPHNTVIRDR *PSUPHNTVIRDR;
#ifdef IN_RING3
typedef LONG (WINAPI * PFNWINVERIFYTRUST)(HWND hwnd, GUID const *pgActionID, PVOID pWVTData);
typedef BOOL (WINAPI * PFNCRYPTCATADMINACQUIRECONTEXT)(HCATADMIN *phCatAdmin, const GUID *pGuidSubsystem, DWORD dwFlags);
typedef BOOL (WINAPI * PFNCRYPTCATADMINACQUIRECONTEXT2)(HCATADMIN *phCatAdmin, const GUID *pGuidSubsystem, PCWSTR pwszHashAlgorithm,
struct _CERT_STRONG_SIGN_PARA const *pStrongHashPolicy, DWORD dwFlags);
typedef BOOL (WINAPI * PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE)(HANDLE hFile, DWORD *pcbHash, BYTE *pbHash, DWORD dwFlags);
typedef BOOL (WINAPI * PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE2)(HCATADMIN hCatAdmin, HANDLE hFile, DWORD *pcbHash,
BYTE *pbHash, DWORD dwFlags);
typedef HCATINFO (WINAPI *PFNCRYPTCATADMINENUMCATALOGFROMHASH)(HCATADMIN hCatAdmin, BYTE *pbHash, DWORD cbHash,
DWORD dwFlags, HCATINFO *phPrevCatInfo);
typedef BOOL (WINAPI * PFNCRYPTCATADMINRELEASECATALOGCONTEXT)(HCATADMIN hCatAdmin, HCATINFO hCatInfo, DWORD dwFlags);
typedef BOOL (WINAPI * PFNCRYPTCATDADMINRELEASECONTEXT)(HCATADMIN hCatAdmin, DWORD dwFlags);
typedef BOOL (WINAPI * PFNCRYPTCATCATALOGINFOFROMCONTEXT)(HCATINFO hCatInfo, CATALOG_INFO *psCatInfo, DWORD dwFlags);
typedef HCERTSTORE (WINAPI *PFNCERTOPENSTORE)(PCSTR pszStoreProvider, DWORD dwEncodingType, HCRYPTPROV_LEGACY hCryptProv,
DWORD dwFlags, const void *pvParam);
typedef BOOL (WINAPI *PFNCERTCLOSESTORE)(HCERTSTORE hCertStore, DWORD dwFlags);
typedef PCCERT_CONTEXT (WINAPI *PFNCERTENUMCERTIFICATESINSTORE)(HCERTSTORE hCertStore, PCCERT_CONTEXT pPrevCertContext);
#endif
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/** The build certificate. */
static RTCRX509CERTIFICATE g_BuildX509Cert;
/** Store for root software publisher certificates. */
static RTCRSTORE g_hSpcRootStore = NIL_RTCRSTORE;
/** Store for root NT kernel certificates. */
static RTCRSTORE g_hNtKernelRootStore = NIL_RTCRSTORE;
/** Store containing SPC, NT kernel signing, and timestamp root certificates. */
static RTCRSTORE g_hSpcAndNtKernelRootStore = NIL_RTCRSTORE;
/** Store for supplemental certificates for use with
* g_hSpcAndNtKernelRootStore. */
static RTCRSTORE g_hSpcAndNtKernelSuppStore = NIL_RTCRSTORE;
/** The full \\SystemRoot\\System32 path. */
SUPSYSROOTDIRBUF g_System32NtPath;
/** The full \\SystemRoot\\WinSxS path. */
SUPSYSROOTDIRBUF g_WinSxSNtPath;
/** Set after we've retrived other SPC root certificates from the system. */
static bool g_fHaveOtherRoots = false;
#if defined(IN_RING3) && !defined(IN_SUP_HARDENED_R3)
/** Combined windows NT version number. See SUP_MAKE_NT_VER_COMBINED and
* SUP_MAKE_NT_VER_SIMPLE. */
uint32_t g_uNtVerCombined;
#endif
#ifdef IN_RING3
/** Timestamp hack working around issues with old DLLs that we ship.
* See supHardenedWinVerifyImageByHandle() for details. */
static uint64_t g_uBuildTimestampHack = 0;
#endif
#ifdef IN_RING3
/** Pointer to WinVerifyTrust. */
PFNWINVERIFYTRUST g_pfnWinVerifyTrust;
/** Pointer to CryptCATAdminAcquireContext. */
PFNCRYPTCATADMINACQUIRECONTEXT g_pfnCryptCATAdminAcquireContext;
/** Pointer to CryptCATAdminAcquireContext2 if available. */
PFNCRYPTCATADMINACQUIRECONTEXT2 g_pfnCryptCATAdminAcquireContext2;
/** Pointer to CryptCATAdminCalcHashFromFileHandle. */
PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE g_pfnCryptCATAdminCalcHashFromFileHandle;
/** Pointer to CryptCATAdminCalcHashFromFileHandle2. */
PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE2 g_pfnCryptCATAdminCalcHashFromFileHandle2;
/** Pointer to CryptCATAdminEnumCatalogFromHash. */
PFNCRYPTCATADMINENUMCATALOGFROMHASH g_pfnCryptCATAdminEnumCatalogFromHash;
/** Pointer to CryptCATAdminReleaseCatalogContext. */
PFNCRYPTCATADMINRELEASECATALOGCONTEXT g_pfnCryptCATAdminReleaseCatalogContext;
/** Pointer to CryptCATAdminReleaseContext. */
PFNCRYPTCATDADMINRELEASECONTEXT g_pfnCryptCATAdminReleaseContext;
/** Pointer to CryptCATCatalogInfoFromContext. */
PFNCRYPTCATCATALOGINFOFROMCONTEXT g_pfnCryptCATCatalogInfoFromContext;
#endif
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
#ifdef IN_RING3
static int supR3HardNtViCallWinVerifyTrust(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PRTERRINFO pErrInfo,
PFNWINVERIFYTRUST pfnWinVerifyTrust);
static int supR3HardNtViCallWinVerifyTrustCatFile(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PRTERRINFO pErrInfo,
PFNWINVERIFYTRUST pfnWinVerifyTrust);
#endif
/** @copydoc RTLDRREADER::pfnRead */
static DECLCALLBACK(int) supHardNtViRdrRead(PRTLDRREADER pReader, void *pvBuf, size_t cb, RTFOFF off)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pReader;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
if ((ULONG)cb != cb)
return VERR_OUT_OF_RANGE;
/*
* For some reason I'm getting occational read error in an XP VM with
* STATUS_FAILED_DRIVER_ENTRY. Redoing the call again works in the
* debugger, so try do that automatically.
*/
for (uint32_t iTry = 0;; iTry++)
{
LARGE_INTEGER offNt;
offNt.QuadPart = off;
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
NTSTATUS rcNt = NtReadFile(pNtViRdr->hFile,
NULL /*hEvent*/,
NULL /*ApcRoutine*/,
NULL /*ApcContext*/,
&Ios,
pvBuf,
(ULONG)cb,
&offNt,
NULL);
if (NT_SUCCESS(rcNt))
rcNt = Ios.Status;
if (NT_SUCCESS(rcNt))
{
if (Ios.Information == cb)
{
pNtViRdr->off = off + cb;
return VINF_SUCCESS;
}
#ifdef IN_RING3
supR3HardenedError(VERR_READ_ERROR, false,
"supHardNtViRdrRead: Only got %#zx bytes when requesting %#zx bytes at %#llx in '%s'.\n",
Ios.Information, off, cb, pNtViRdr->szFilename);
#endif
pNtViRdr->off = -1;
return VERR_READ_ERROR;
}
/*
* Delay a little before we retry?
*/
#ifdef IN_RING3
if (iTry == 0)
NtYieldExecution();
else if (iTry >= 1)
{
LARGE_INTEGER Time;
Time.QuadPart = -1000000 / 100; /* 1ms in 100ns units, relative time. */
NtDelayExecution(TRUE, &Time);
}
#endif
/*
* Before we give up, we'll try split up the request in case the
* kernel is low on memory or similar. For simplicity reasons, we do
* this in a recursion fashion.
*/
if (iTry >= 2)
{
if (cb >= _8K)
{
size_t const cbBlock = RT_ALIGN_Z(cb / 4, 512);
while (cb > 0)
{
size_t cbThisRead = RT_MIN(cb, cbBlock);
int rc = supHardNtViRdrRead(&pNtViRdr->Core, pvBuf, cbThisRead, off);
if (RT_FAILURE(rc))
return rc;
off += cbThisRead;
cb -= cbThisRead;
pvBuf = (uint8_t *)pvBuf + cbThisRead;
}
return VINF_SUCCESS;
}
#ifdef IN_RING3
supR3HardenedError(VERR_READ_ERROR, false, "supHardNtViRdrRead: Error %#x reading %#zx bytes at %#llx in '%s'.\n",
rcNt, off, cb, pNtViRdr->szFilename);
#endif
pNtViRdr->off = -1;
return VERR_READ_ERROR;
}
}
}
/** @copydoc RTLDRREADER::pfnTell */
static DECLCALLBACK(RTFOFF) supHardNtViRdrTell(PRTLDRREADER pReader)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pReader;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
return pNtViRdr->off;
}
/** @copydoc RTLDRREADER::pfnSize */
static DECLCALLBACK(RTFOFF) supHardNtViRdrSize(PRTLDRREADER pReader)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pReader;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
return pNtViRdr->cbFile;
}
/** @copydoc RTLDRREADER::pfnLogName */
static DECLCALLBACK(const char *) supHardNtViRdrLogName(PRTLDRREADER pReader)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pReader;
return pNtViRdr->szFilename;
}
/** @copydoc RTLDRREADER::pfnMap */
static DECLCALLBACK(int) supHardNtViRdrMap(PRTLDRREADER pReader, const void **ppvBits)
{
return VERR_NOT_SUPPORTED;
}
/** @copydoc RTLDRREADER::pfnUnmap */
static DECLCALLBACK(int) supHardNtViRdrUnmap(PRTLDRREADER pReader, const void *pvBits)
{
return VERR_NOT_SUPPORTED;
}
/** @copydoc RTLDRREADER::pfnDestroy */
static DECLCALLBACK(int) supHardNtViRdrDestroy(PRTLDRREADER pReader)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pReader;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
pNtViRdr->Core.uMagic = ~RTLDRREADER_MAGIC;
pNtViRdr->hFile = NULL;
RTMemFree(pNtViRdr);
return VINF_SUCCESS;
}
/**
* Creates a loader reader instance for the given NT file handle.
*
* @returns iprt status code.
* @param hFile Native NT file handle.
* @param pwszName Optional file name.
* @param fFlags Flags, SUPHNTVI_F_XXX.
* @param ppNtViRdr Where to store the reader instance on success.
*/
static int supHardNtViRdrCreate(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PSUPHNTVIRDR *ppNtViRdr)
{
/*
* Try determine the size of the file.
*/
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
FILE_STANDARD_INFORMATION StdInfo;
NTSTATUS rcNt = NtQueryInformationFile(hFile, &Ios, &StdInfo, sizeof(StdInfo), FileStandardInformation);
if (!NT_SUCCESS(rcNt) || !NT_SUCCESS(Ios.Status))
return VERR_LDRVI_FILE_LENGTH_ERROR;
/*
* Calc the file name length and allocate memory for the reader instance.
*/
size_t cchFilename = 0;
if (pwszName)
cchFilename = RTUtf16CalcUtf8Len(pwszName);
int rc = VERR_NO_MEMORY;
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)RTMemAllocZ(sizeof(*pNtViRdr) + cchFilename);
if (!pNtViRdr)
return VERR_NO_MEMORY;
/*
* Initialize the structure.
*/
if (cchFilename)
{
char *pszName = &pNtViRdr->szFilename[0];
rc = RTUtf16ToUtf8Ex(pwszName, RTSTR_MAX, &pszName, cchFilename + 1, NULL);
AssertStmt(RT_SUCCESS(rc), pNtViRdr->szFilename[0] = '\0');
}
else
pNtViRdr->szFilename[0] = '\0';
pNtViRdr->Core.uMagic = RTLDRREADER_MAGIC;
pNtViRdr->Core.pfnRead = supHardNtViRdrRead;
pNtViRdr->Core.pfnTell = supHardNtViRdrTell;
pNtViRdr->Core.pfnSize = supHardNtViRdrSize;
pNtViRdr->Core.pfnLogName = supHardNtViRdrLogName;
pNtViRdr->Core.pfnMap = supHardNtViRdrMap;
pNtViRdr->Core.pfnUnmap = supHardNtViRdrUnmap;
pNtViRdr->Core.pfnDestroy = supHardNtViRdrDestroy;
pNtViRdr->hFile = hFile;
pNtViRdr->off = 0;
pNtViRdr->cbFile = StdInfo.EndOfFile.QuadPart;
pNtViRdr->fFlags = fFlags;
*ppNtViRdr = pNtViRdr;
return VINF_SUCCESS;
}
/**
* Simple case insensitive UTF-16 / ASCII path compare.
*
* @returns true if equal, false if not.
* @param pwszLeft The UTF-16 path string.
* @param pszRight The ascii string.
*/
static bool supHardViUtf16PathIsEqual(PCRTUTF16 pwszLeft, const char *pszRight)
{
for (;;)
{
RTUTF16 wc = *pwszLeft++;
uint8_t b = *pszRight++;
if (b != wc)
{
if (wc >= 0x80)
return false;
wc = RT_C_TO_LOWER(wc);
if (wc != b)
{
b = RT_C_TO_LOWER(b);
if (wc != b)
{
if (wc == '/')
wc = '\\';
if (b == '/')
b = '\\';
if (wc != b)
return false;
}
}
}
if (!b)
return true;
}
}
/**
* Simple case insensitive UTF-16 / ASCII ends-with path predicate.
*
* @returns true if equal, false if not.
* @param pwsz The UTF-16 path string.
* @param pszSuffix The ascii suffix string.
*/
static bool supHardViUtf16PathEndsWith(PCRTUTF16 pwsz, const char *pszSuffix)
{
size_t cwc = RTUtf16Len(pwsz);
size_t cchSuffix = strlen(pszSuffix);
if (cwc >= cchSuffix)
return supHardViUtf16PathIsEqual(pwsz + cwc - cchSuffix, pszSuffix);
return false;
}
/**
* Simple case insensitive UTF-16 / ASCII starts-with path predicate.
*
* @returns true if starts with given string, false if not.
* @param pwsz The UTF-16 path string.
* @param pszPrefix The ascii prefix string.
*/
static bool supHardViUtf16PathStartsWith(PCRTUTF16 pwszLeft, const char *pszRight)
{
for (;;)
{
RTUTF16 wc = *pwszLeft++;
uint8_t b = *pszRight++;
if (b != wc)
{
if (!b)
return true;
if (wc >= 0x80 || wc == 0)
return false;
wc = RT_C_TO_LOWER(wc);
if (wc != b)
{
b = RT_C_TO_LOWER(b);
if (wc != b)
{
if (wc == '/')
wc = '\\';
if (b == '/')
b = '\\';
if (wc != b)
return false;
}
}
}
}
}
/**
* Counts slashes in the given UTF-8 path string.
*
* @returns Number of slashes.
* @param pwsz The UTF-16 path string.
*/
static uint32_t supHardViUtf16PathCountSlashes(PCRTUTF16 pwsz)
{
uint32_t cSlashes = 0;
RTUTF16 wc;
while ((wc = *pwsz++) != '\0')
if (wc == '/' || wc == '\\')
cSlashes++;
return cSlashes;
}
#ifdef VBOX_PERMIT_MORE
/**
* Checks if the path goes into %windir%\apppatch\.
*
* @returns true if apppatch, false if not.
* @param pwszPath The path to examine.
*/
DECLHIDDEN(bool) supHardViIsAppPatchDir(PCRTUTF16 pwszPath, uint32_t cwcName)
{
uint32_t cwcWinDir = (g_System32NtPath.UniStr.Length - sizeof(L"System32")) / sizeof(WCHAR);
if (cwcName <= cwcWinDir + sizeof("AppPatch"))
return false;
if (memcmp(pwszPath, g_System32NtPath.UniStr.Buffer, cwcWinDir * sizeof(WCHAR)))
return false;
if (!supHardViUtf16PathStartsWith(&pwszPath[cwcWinDir], "\\AppPatch\\"))
return false;
return g_uNtVerCombined >= SUP_NT_VER_VISTA;
}
#else
# error should not get here..
#endif
/**
* Checks if the unsigned DLL is fine or not.
*
* @returns VINF_LDRVI_NOT_SIGNED or @a rc.
* @param hLdrMod The loader module handle.
* @param pwszName The NT name of the DLL/EXE.
* @param fFlags Flags.
* @param rc The status code..
*/
static int supHardNtViCheckIfNotSignedOk(RTLDRMOD hLdrMod, PCRTUTF16 pwszName, uint32_t fFlags, int rc)
{
if (fFlags & (SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING))
return rc;
/*
* Version macros.
*/
uint32_t const uNtVer = g_uNtVerCombined;
#define IS_XP() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(5, 1) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(5, 2) )
#define IS_W2K3() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(5, 2) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(5, 3) )
#define IS_VISTA() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(6, 0) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 1) )
#define IS_W70() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(6, 1) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 2) )
#define IS_W80() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(6, 2) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 3) )
#define IS_W81() ( uNtVer >= SUP_MAKE_NT_VER_SIMPLE(6, 3) && uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 4) )
/*
* The System32 directory.
*
* System32 is full of unsigned DLLs shipped by microsoft, graphics
* hardware vendors, input device/method vendors and whatnot else that
* actually needs to be loaded into a process for it to work correctly.
* We have to ASSUME that anything our process attempts to load from
* System32 is trustworthy and that the Windows system with the help of
* anti-virus software make sure there is nothing evil lurking in System32
* or being loaded from it.
*
* A small measure of protection is to list DLLs we know should be signed
* and decline loading unsigned versions of them, assuming they have been
* replaced by an adversary with evil intentions.
*/
PCRTUTF16 pwsz;
uint32_t cwcName = (uint32_t)RTUtf16Len(pwszName);
uint32_t cwcOther = g_System32NtPath.UniStr.Length / sizeof(WCHAR);
if ( cwcName > cwcOther
&& RTPATH_IS_SLASH(pwszName[cwcOther])
&& memcmp(pwszName, g_System32NtPath.UniStr.Buffer, g_System32NtPath.UniStr.Length) == 0)
{
pwsz = pwszName + cwcOther + 1;
/* Core DLLs. */
if (supHardViUtf16PathIsEqual(pwsz, "ntdll.dll"))
return uNtVer < SUP_NT_VER_VISTA ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "kernel32.dll"))
return uNtVer < SUP_NT_VER_W81 ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "kernelbase.dll"))
return IS_W80() || IS_W70() ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "apisetschema.dll"))
return IS_W70() ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "apphelp.dll"))
return uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 4) ? VINF_LDRVI_NOT_SIGNED : rc;
#ifdef VBOX_PERMIT_MORE
if (uNtVer >= SUP_NT_VER_W70) /* hard limit: user32.dll is unwanted prior to w7. */
{
if (supHardViUtf16PathIsEqual(pwsz, "sfc.dll"))
return uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 4) ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "sfc_os.dll"))
return uNtVer < SUP_MAKE_NT_VER_SIMPLE(6, 4) ? VINF_LDRVI_NOT_SIGNED : rc;
if (supHardViUtf16PathIsEqual(pwsz, "user32.dll"))
return uNtVer < SUP_NT_VER_W81 ? VINF_LDRVI_NOT_SIGNED : rc;
}
#endif
#ifndef IN_RING0
# if 0 /* Allow anything below System32 that WinVerifyTrust thinks is fine. */
/* The ATI drivers load system drivers into the process, allow this,
but reject anything else from a subdirectory. */
uint32_t cSlashes = supHardViUtf16PathCountSlashes(pwsz);
if (cSlashes > 0)
{
if ( cSlashes == 1
&& supHardViUtf16PathStartsWith(pwsz, "drivers\\ati")
&& ( supHardViUtf16PathEndsWith(pwsz, ".sys")
|| supHardViUtf16PathEndsWith(pwsz, ".dll") ) )
return VINF_LDRVI_NOT_SIGNED;
return rc;
}
# endif
/* Check that this DLL isn't supposed to be signed on this windows
version. If it should, it's likely to be a fake. */
/** @todo list of signed dlls for various windows versions. */
/** @todo check file permissions? TrustedInstaller is supposed to be involved
* with all of them. */
return VINF_LDRVI_NOT_SIGNED;
#else
return rc;
#endif
}
#ifndef IN_RING0
/*
* The WinSxS white list.
*
* Just like with System32 there are potentially a number of DLLs that
* could be required from WinSxS. However, so far only comctl32.dll
* variations have been required. So, we limit ourselves to explicit
* whitelisting of unsigned families of DLLs.
*/
cwcOther = g_WinSxSNtPath.UniStr.Length / sizeof(WCHAR);
if ( cwcName > cwcOther
&& RTPATH_IS_SLASH(pwszName[cwcOther])
&& memcmp(pwszName, g_WinSxSNtPath.UniStr.Buffer, g_WinSxSNtPath.UniStr.Length) == 0)
{
pwsz = pwszName + cwcOther + 1;
cwcName -= cwcOther + 1;
/* The WinSxS layout means everything worth loading is exactly one level down. */
uint32_t cSlashes = supHardViUtf16PathCountSlashes(pwsz);
if (cSlashes != 1)
return rc;
# if 0 /* See below */
/* The common controls mess. */
# ifdef RT_ARCH_AMD64
if (supHardViUtf16PathStartsWith(pwsz, "amd64_microsoft.windows.common-controls_"))
# elif defined(RT_ARCH_X86)
if (supHardViUtf16PathStartsWith(pwsz, "x86_microsoft.windows.common-controls_"))
# else
# error "Unsupported architecture"
# endif
{
if (supHardViUtf16PathEndsWith(pwsz, "\\comctl32.dll"))
return VINF_LDRVI_NOT_SIGNED;
}
# endif
/* Allow anything slightly microsoftish from WinSxS. W2K3 wanted winhttp.dll early on... */
# ifdef RT_ARCH_AMD64
if (supHardViUtf16PathStartsWith(pwsz, "amd64_microsoft."))
# elif defined(RT_ARCH_X86)
if (supHardViUtf16PathStartsWith(pwsz, "x86_microsoft."))
# else
# error "Unsupported architecture"
# endif
{
return VINF_LDRVI_NOT_SIGNED;
}
return rc;
}
#endif
#ifdef VBOX_PERMIT_MORE
/*
* AppPatch whitelist.
*/
if (supHardViIsAppPatchDir(pwszName, cwcName))
{
cwcOther = g_System32NtPath.UniStr.Length / sizeof(WCHAR); /* ASSUMES System32 is called System32. */
pwsz = pwszName + cwcOther + 1;
if (supHardViUtf16PathIsEqual(pwsz, "acres.dll"))
return VINF_LDRVI_NOT_SIGNED;
# ifdef RT_ARCH_AMD64
if (supHardViUtf16PathIsEqual(pwsz, "AppPatch64\\AcGenral.dll"))
return VINF_LDRVI_NOT_SIGNED;
# elif defined(RT_ARCH_X86)
if (supHardViUtf16PathIsEqual(pwsz, "AcGenral.dll"))
return VINF_LDRVI_NOT_SIGNED;
# endif
return rc;
}
#else
# error should not be here...
#endif
return rc;
}
/**
* @callback_method_impl{RTCRPKCS7VERIFYCERTCALLBACK,
* Standard code signing. Use this for Microsoft SPC.}
*/
static DECLCALLBACK(int) supHardNtViCertVerifyCallback(PCRTCRX509CERTIFICATE pCert, RTCRX509CERTPATHS hCertPaths,
void *pvUser, PRTERRINFO pErrInfo)
{
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pvUser;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
/*
* If there is no certificate path build & validator associated with this
* callback, it must be because of the build certificate. We trust the
* build certificate without any second thoughts.
*/
if (hCertPaths == NIL_RTCRX509CERTPATHS)
{
if (RTCrX509Certificate_Compare(pCert, &g_BuildX509Cert) == 0) /* healthy paranoia */
return VINF_SUCCESS;
return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_NOT_BUILD_CERT_IPE, "Not valid kernel code signature.");
}
/*
* Standard code signing capabilites required.
*/
int rc = RTCrPkcs7VerifyCertCallbackCodeSigning(pCert, hCertPaths, NULL, pErrInfo);
if (RT_SUCCESS(rc))
{
/*
* If kernel signing, a valid certificate path must be anchored by the
* microsoft kernel signing root certificate.
*/
if (pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING)
{
uint32_t cPaths = RTCrX509CertPathsGetPathCount(hCertPaths);
uint32_t cFound = 0;
uint32_t cValid = 0;
for (uint32_t iPath = 0; iPath < cPaths; iPath++)
{
bool fTrusted;
PCRTCRX509NAME pSubject;
PCRTCRX509SUBJECTPUBLICKEYINFO pPublicKeyInfo;
int rcVerify;
rc = RTCrX509CertPathsQueryPathInfo(hCertPaths, iPath, &fTrusted, NULL /*pcNodes*/, &pSubject, &pPublicKeyInfo,
NULL, NULL /*pCertCtx*/, &rcVerify);
AssertRCBreak(rc);
if (RT_SUCCESS(rcVerify))
{
Assert(fTrusted);
cValid++;
/*
* Search the kernel signing root store for a matching anchor.
*/
RTCRSTORECERTSEARCH Search;
rc = RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280(g_hNtKernelRootStore, pSubject, &Search);
AssertRCBreak(rc);
PCRTCRCERTCTX pCertCtx;
while ((pCertCtx = RTCrStoreCertSearchNext(g_hNtKernelRootStore, &Search)) != NULL)
{
PCRTCRX509SUBJECTPUBLICKEYINFO pCertPubKeyInfo = NULL;
if (pCertCtx->pCert)
pCertPubKeyInfo = &pCertCtx->pCert->TbsCertificate.SubjectPublicKeyInfo;
else if (pCertCtx->pTaInfo)
pCertPubKeyInfo = &pCertCtx->pTaInfo->PubKey;
else
pCertPubKeyInfo = NULL;
if ( pCertPubKeyInfo
&& RTCrX509SubjectPublicKeyInfo_Compare(pCertPubKeyInfo, pPublicKeyInfo) == 0)
cFound++;
RTCrCertCtxRelease(pCertCtx);
}
int rc2 = RTCrStoreCertSearchDestroy(g_hNtKernelRootStore, &Search); AssertRC(rc2);
}
}
if (RT_SUCCESS(rc) && cFound == 0)
rc = RTErrInfoSetF(pErrInfo, VERR_SUP_VP_NOT_VALID_KERNEL_CODE_SIGNATURE, "Not valid kernel code signature.");
if (RT_SUCCESS(rc) && cValid < 2 && g_fHaveOtherRoots)
rc = RTErrInfoSetF(pErrInfo, VERR_SUP_VP_UNEXPECTED_VALID_PATH_COUNT,
"Expected at least %u valid paths, not %u.", 2, cValid);
}
}
/*
* More requirements? NT5 build lab?
*/
return rc;
}
static DECLCALLBACK(int) supHardNtViCallback(RTLDRMOD hLdrMod, RTLDRSIGNATURETYPE enmSignature,
void const *pvSignature, size_t cbSignature,
PRTERRINFO pErrInfo, void *pvUser)
{
/*
* Check out the input.
*/
PSUPHNTVIRDR pNtViRdr = (PSUPHNTVIRDR)pvUser;
Assert(pNtViRdr->Core.uMagic == RTLDRREADER_MAGIC);
AssertReturn(cbSignature == sizeof(RTCRPKCS7CONTENTINFO), VERR_INTERNAL_ERROR_5);
PCRTCRPKCS7CONTENTINFO pContentInfo = (PCRTCRPKCS7CONTENTINFO)pvSignature;
AssertReturn(RTCrPkcs7ContentInfo_IsSignedData(pContentInfo), VERR_INTERNAL_ERROR_5);
AssertReturn(pContentInfo->u.pSignedData->SignerInfos.cItems == 1, VERR_INTERNAL_ERROR_5);
PCRTCRPKCS7SIGNERINFO pSignerInfo = &pContentInfo->u.pSignedData->SignerInfos.paItems[0];
/*
* If special certificate requirements, check them out before validating
* the signature.
*/
if (pNtViRdr->fFlags & SUPHNTVI_F_REQUIRE_BUILD_CERT)
{
if (!RTCrX509Certificate_MatchIssuerAndSerialNumber(&g_BuildX509Cert,
&pSignerInfo->IssuerAndSerialNumber.Name,
&pSignerInfo->IssuerAndSerialNumber.SerialNumber))
return RTErrInfoSet(pErrInfo, VERR_SUP_VP_NOT_SIGNED_WITH_BUILD_CERT, "Not signed with the build certificate.");
}
/*
* Verify the signature.
*/
RTTIMESPEC ValidationTime;
RTTimeSpecSetSeconds(&ValidationTime, pNtViRdr->uTimestamp);
return RTCrPkcs7VerifySignedData(pContentInfo, 0, g_hSpcAndNtKernelSuppStore, g_hSpcAndNtKernelRootStore, &ValidationTime,
supHardNtViCertVerifyCallback, pNtViRdr, pErrInfo);
}
/**
* Checks if it's safe to call WinVerifyTrust or whether we might end up in an
* infinite recursion.
*
* @returns true if ok, false if not.
* @param hFile The file name.
* @param pwszName The executable name.
*/
static bool supR3HardNtViCanCallWinVerifyTrust(HANDLE hFile, PCRTUTF16 pwszName)
{
/*
* Recursion preventions hacks:
* - Don't try call WinVerifyTrust on Wintrust.dll when called from the
* create section hook. CRYPT32.DLL tries to load WinTrust.DLL in some cases.
*/
size_t cwcName = RTUtf16Len(pwszName);
if ( hFile != NULL
&& cwcName > g_System32NtPath.UniStr.Length / sizeof(WCHAR)
&& !memcmp(pwszName, g_System32NtPath.UniStr.Buffer, g_System32NtPath.UniStr.Length)
&& supHardViUtf16PathIsEqual(&pwszName[g_System32NtPath.UniStr.Length / sizeof(WCHAR)], "\\wintrust.dll"))
return false;
return true;
}
/**
* Verifies the given executable image.
*
* @returns IPRT status code.
* @param hFile File handle to the executable file.
* @param pwszName Full NT path to the DLL in question, used for dealing
* with unsigned system dlls as well as for error/logging.
* @param fFlags Flags, SUPHNTVI_F_XXX.
* @param pfCacheable Where to return whether the result can be cached. A
* valid value is always returned. Optional.
* @param pErrInfo Pointer to error info structure. Optional.
*/
DECLHIDDEN(int) supHardenedWinVerifyImageByHandle(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags,
bool *pfCacheable, PRTERRINFO pErrInfo)
{
/* Clear the cacheable indicator as it needs to be valid in all return paths. */
if (pfCacheable)
*pfCacheable = false;
#ifdef IN_RING3
/* Check that the caller has performed the necessary library initialization. */
if (!RTCrX509Certificate_IsPresent(&g_BuildX509Cert))
return RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER,
"supHardenedWinVerifyImageByHandle: supHardenedWinInitImageVerifier was not called.");
#endif
/*
* Create a reader instance.
*/
PSUPHNTVIRDR pNtViRdr;
int rc = supHardNtViRdrCreate(hFile, pwszName, fFlags, &pNtViRdr);
if (RT_SUCCESS(rc))
{
/*
* Open the image.
*/
RTLDRMOD hLdrMod;
RTLDRARCH enmArch = fFlags & SUPHNTVI_F_RC_IMAGE ? RTLDRARCH_X86_32 : RTLDRARCH_HOST;
if (fFlags & SUPHNTVI_F_RESOURCE_IMAGE)
enmArch = RTLDRARCH_WHATEVER;
rc = RTLdrOpenWithReader(&pNtViRdr->Core, RTLDR_O_FOR_VALIDATION, enmArch, &hLdrMod, pErrInfo);
if (RT_SUCCESS(rc))
{
/*
* Verify it.
*
* The PKCS #7 SignedData signature is checked in the callback. Any
* signing certificate restrictions are also enforced there.
*
* For the time being, we use the executable timestamp as the
* certificate validation date. We must query that first to avoid
* potential issues re-entering the loader code from the callback.
*
* Update: Save the first timestamp we validate with build cert and
* use this as a minimum timestamp for further build cert
* validations. This works around issues with old DLLs that
* we sign against with our certificate (crt, sdl, qt).
*/
rc = RTLdrQueryProp(hLdrMod, RTLDRPROP_TIMESTAMP_SECONDS, &pNtViRdr->uTimestamp, sizeof(pNtViRdr->uTimestamp));
if (RT_SUCCESS(rc))
{
#ifdef IN_RING3 /* Hack alert! (see above) */
if ( (fFlags & SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING)
&& (fFlags & SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT)
&& pNtViRdr->uTimestamp < g_uBuildTimestampHack)
pNtViRdr->uTimestamp = g_uBuildTimestampHack;
#endif
rc = RTLdrVerifySignature(hLdrMod, supHardNtViCallback, pNtViRdr, pErrInfo);
#ifdef IN_RING3 /* Hack alert! (see above) */
if ((fFlags & SUPHNTVI_F_REQUIRE_BUILD_CERT) && g_uBuildTimestampHack == 0 && RT_SUCCESS(rc))
g_uBuildTimestampHack = pNtViRdr->uTimestamp;
#endif
/*
* Microsoft doesn't sign a whole bunch of DLLs, so we have to
* ASSUME that a bunch of system DLLs are fine.
*/
if (rc == VERR_LDRVI_NOT_SIGNED)
rc = supHardNtViCheckIfNotSignedOk(hLdrMod, pwszName, fFlags, rc);
if (RT_FAILURE(rc))
RTErrInfoAddF(pErrInfo, rc, ": %ls", pwszName);
/*
* Check for the signature checking enforcement, if requested to do so.
*/
if (RT_SUCCESS(rc) && (fFlags & SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT))
{
bool fEnforced = false;
int rc2 = RTLdrQueryProp(hLdrMod, RTLDRPROP_SIGNATURE_CHECKS_ENFORCED, &fEnforced, sizeof(fEnforced));
if (RT_FAILURE(rc2))
rc = RTErrInfoSetF(pErrInfo, rc2, "Querying RTLDRPROP_SIGNATURE_CHECKS_ENFORCED failed on %ls: %Rrc.",
pwszName, rc2);
else if (!fEnforced)
rc = RTErrInfoSetF(pErrInfo, VERR_SUP_VP_SIGNATURE_CHECKS_NOT_ENFORCED,
"The image '%ls' was not linked with /IntegrityCheck.", pwszName);
}
}
else
RTErrInfoSetF(pErrInfo, rc, "RTLdrQueryProp/RTLDRPROP_TIMESTAMP_SECONDS failed on %ls: %Rrc", pwszName, rc);
int rc2 = RTLdrClose(hLdrMod); AssertRC(rc2);
#ifdef IN_RING3
/*
* Call the windows verify trust API if we've resolved it.
*/
if ( g_pfnWinVerifyTrust
&& supR3HardNtViCanCallWinVerifyTrust(hFile, pwszName))
{
if (pfCacheable)
*pfCacheable = g_pfnWinVerifyTrust != NULL;
if (rc != VERR_LDRVI_NOT_SIGNED)
{
if (rc == VINF_LDRVI_NOT_SIGNED)
{
if (fFlags & SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION)
{
int rc2 = supR3HardNtViCallWinVerifyTrustCatFile(hFile, pwszName, fFlags, pErrInfo,
g_pfnWinVerifyTrust);
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile -> %d (org %d)\n", rc2, rc));
rc = rc2;
}
else
{
AssertFailed();
rc = VERR_LDRVI_NOT_SIGNED;
}
}
else if (RT_SUCCESS(rc))
rc = supR3HardNtViCallWinVerifyTrust(hFile, pwszName, fFlags, pErrInfo, g_pfnWinVerifyTrust);
else
{
int rc2 = supR3HardNtViCallWinVerifyTrust(hFile, pwszName, fFlags, pErrInfo, g_pfnWinVerifyTrust);
AssertMsg(RT_FAILURE_NP(rc2),
("rc=%Rrc, rc2=%Rrc %s", rc, rc2, pErrInfo ? pErrInfo->pszMsg : "<no-err-info>"));
}
}
}
#else
if (pfCacheable)
*pfCacheable = true;
#endif /* IN_RING3 */
}
else
supHardNtViRdrDestroy(&pNtViRdr->Core);
}
SUP_DPRINTF(("supHardenedWinVerifyImageByHandle: -> %d (%ls)\n", rc, pwszName));
return rc;
}
#ifdef IN_RING3
/**
* supHardenedWinVerifyImageByHandle version without the name.
*
* The name is derived from the handle.
*
* @returns IPRT status code.
* @param hFile File handle to the executable file.
* @param fFlags Flags, SUPHNTVI_F_XXX.
* @param pErrInfo Pointer to error info structure. Optional.
*/
DECLHIDDEN(int) supHardenedWinVerifyImageByHandleNoName(HANDLE hFile, uint32_t fFlags, PRTERRINFO pErrInfo)
{
/*
* Determine the NT name and call the verification function.
*/
union
{
UNICODE_STRING UniStr;
uint8_t abBuffer[(MAX_PATH + 8 + 1) * 2];
} uBuf;
ULONG cbIgn;
NTSTATUS rcNt = NtQueryObject(hFile,
ObjectNameInformation,
&uBuf,
sizeof(uBuf) - sizeof(WCHAR),
&cbIgn);
if (NT_SUCCESS(rcNt))
uBuf.UniStr.Buffer[uBuf.UniStr.Length / sizeof(WCHAR)] = '\0';
else
uBuf.UniStr.Buffer = (WCHAR *)L"TODO3";
return supHardenedWinVerifyImageByHandle(hFile, uBuf.UniStr.Buffer, fFlags, NULL /*pfCacheable*/, pErrInfo);
}
#endif /* IN_RING3 */
/**
* Retrieves the full official path to the system root or one of it's sub
* directories.
*
* This code is also used by the support driver.
*
* @returns VBox status code.
* @param pvBuf The output buffer. This will contain a
* UNICODE_STRING followed (at the kernel's
* discretion) the string buffer.
* @param cbBuf The size of the buffer @a pvBuf points to.
* @param enmDir Which directory under the system root we're
* interested in.
* @param pErrInfo Pointer to error info structure. Optional.
*/
DECLHIDDEN(int) supHardNtGetSystemRootDir(void *pvBuf, uint32_t cbBuf, SUPHARDNTSYSROOTDIR enmDir, PRTERRINFO pErrInfo)
{
HANDLE hFile = RTNT_INVALID_HANDLE_VALUE;
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
UNICODE_STRING NtName;
switch (enmDir)
{
case kSupHardNtSysRootDir_System32:
{
static const WCHAR s_wszNameSystem32[] = L"\\SystemRoot\\System32\\";
NtName.Buffer = (PWSTR)s_wszNameSystem32;
NtName.Length = sizeof(s_wszNameSystem32) - sizeof(WCHAR);
NtName.MaximumLength = sizeof(s_wszNameSystem32);
break;
}
case kSupHardNtSysRootDir_WinSxS:
{
static const WCHAR s_wszNameWinSxS[] = L"\\SystemRoot\\WinSxS\\";
NtName.Buffer = (PWSTR)s_wszNameWinSxS;
NtName.Length = sizeof(s_wszNameWinSxS) - sizeof(WCHAR);
NtName.MaximumLength = sizeof(s_wszNameWinSxS);
break;
}
default:
AssertFailed();
return VERR_INVALID_PARAMETER;
}
OBJECT_ATTRIBUTES ObjAttr;
InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
NTSTATUS rcNt = NtCreateFile(&hFile,
FILE_READ_DATA | SYNCHRONIZE,
&ObjAttr,
&Ios,
NULL /* Allocation Size*/,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN,
FILE_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT | FILE_SYNCHRONOUS_IO_NONALERT,
NULL /*EaBuffer*/,
0 /*EaLength*/);
if (NT_SUCCESS(rcNt))
rcNt = Ios.Status;
if (NT_SUCCESS(rcNt))
{
ULONG cbIgn;
rcNt = NtQueryObject(hFile,
ObjectNameInformation,
pvBuf,
cbBuf - sizeof(WCHAR),
&cbIgn);
NtClose(hFile);
if (NT_SUCCESS(rcNt))
{
PUNICODE_STRING pUniStr = (PUNICODE_STRING)pvBuf;
if (pUniStr->Length > 0)
{
/* Make sure it's terminated so it can safely be printed.*/
pUniStr->Buffer[pUniStr->Length / sizeof(WCHAR)] = '\0';
return VINF_SUCCESS;
}
return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_SYSTEM32_PATH,
"NtQueryObject returned an empty path for '%ls'", NtName.Buffer);
}
return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_SYSTEM32_PATH, "NtQueryObject failed on '%ls' dir: %#x", NtName.Buffer, rcNt);
}
return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_SYSTEM32_PATH, "Failure to open '%ls': %#x", NtName.Buffer, rcNt);
}
/**
* Initialize one certificate entry.
*
* @returns VBox status code.
* @param pCert The X.509 certificate representation to init.
* @param pabCert The raw DER encoded certificate.
* @param cbCert The size of the raw certificate.
* @param pErrInfo Where to return extended error info. Optional.
* @param pszErrorTag Error tag.
*/
static int supHardNtViCertInit(PRTCRX509CERTIFICATE pCert, unsigned char const *pabCert, unsigned cbCert,
PRTERRINFO pErrInfo, const char *pszErrorTag)
{
AssertReturn(cbCert > 16 && cbCert < _128K,
RTErrInfoSetF(pErrInfo, VERR_INTERNAL_ERROR_3, "%s: cbCert=%#x out of range", pszErrorTag, cbCert));
AssertReturn(!RTCrX509Certificate_IsPresent(pCert),
RTErrInfoSetF(pErrInfo, VERR_WRONG_ORDER, "%s: Certificate already decoded?", pszErrorTag));
RTASN1CURSORPRIMARY PrimaryCursor;
RTAsn1CursorInitPrimary(&PrimaryCursor, pabCert, cbCert, pErrInfo, &g_RTAsn1DefaultAllocator, RTASN1CURSOR_FLAGS_DER, NULL);
int rc = RTCrX509Certificate_DecodeAsn1(&PrimaryCursor.Cursor, 0, pCert, pszErrorTag);
if (RT_SUCCESS(rc))
rc = RTCrX509Certificate_CheckSanity(pCert, 0, pErrInfo, pszErrorTag);
return rc;
}
static int supHardNtViCertStoreAddArray(RTCRSTORE hStore, PCSUPTAENTRY paCerts, unsigned cCerts, PRTERRINFO pErrInfo)
{
for (uint32_t i = 0; i < cCerts; i++)
{
int rc = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_TAF_DER, paCerts[i].pch, paCerts[i].cb, pErrInfo);
if (RT_FAILURE(rc))
return rc;
}
return VINF_SUCCESS;
}
/**
* Initialize a certificate table.
*
* @param phStore Where to return the store pointer.
* @param paCerts1 Pointer to the first certificate table.
* @param cCerts1 Entries in the first certificate table.
* @param paCerts2 Pointer to the second certificate table.
* @param cCerts2 Entries in the second certificate table.
* @param paCerts3 Pointer to the third certificate table.
* @param cCerts3 Entries in the third certificate table.
* @param pErrInfo Where to return extended error info. Optional.
* @param pszErrorTag Error tag.
*/
static int supHardNtViCertStoreInit(PRTCRSTORE phStore,
PCSUPTAENTRY paCerts1, unsigned cCerts1,
PCSUPTAENTRY paCerts2, unsigned cCerts2,
PCSUPTAENTRY paCerts3, unsigned cCerts3,
PRTERRINFO pErrInfo, const char *pszErrorTag)
{
AssertReturn(*phStore == NIL_RTCRSTORE, VERR_WRONG_ORDER);
int rc = RTCrStoreCreateInMem(phStore, cCerts1 + cCerts2);
if (RT_FAILURE(rc))
return RTErrInfoSetF(pErrInfo, rc, "RTCrStoreCreateMemoryStore failed: %Rrc", rc);
rc = supHardNtViCertStoreAddArray(*phStore, paCerts1, cCerts1, pErrInfo);
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreAddArray(*phStore, paCerts2, cCerts2, pErrInfo);
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreAddArray(*phStore, paCerts3, cCerts3, pErrInfo);
return rc;
}
/**
* This initializes the certificates globals so we don't have to reparse them
* every time we need to verify an image.
*
* @returns IPRT status code.
* @param pErrInfo Where to return extended error info. Optional.
*/
DECLHIDDEN(int) supHardenedWinInitImageVerifier(PRTERRINFO pErrInfo)
{
AssertReturn(!RTCrX509Certificate_IsPresent(&g_BuildX509Cert), VERR_WRONG_ORDER);
/*
* Get the system root paths.
*/
int rc = supHardNtGetSystemRootDir(&g_System32NtPath, sizeof(g_System32NtPath), kSupHardNtSysRootDir_System32, pErrInfo);
if (RT_SUCCESS(rc))
rc = supHardNtGetSystemRootDir(&g_WinSxSNtPath, sizeof(g_WinSxSNtPath), kSupHardNtSysRootDir_WinSxS, pErrInfo);
if (RT_SUCCESS(rc))
{
/*
* Initialize it, leaving the cleanup to the termination call.
*/
rc = supHardNtViCertInit(&g_BuildX509Cert, g_abSUPBuildCert, g_cbSUPBuildCert, pErrInfo, "BuildCertificate");
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreInit(&g_hSpcRootStore, g_aSUPSpcRootTAs, g_cSUPSpcRootTAs,
NULL, 0, NULL, 0, pErrInfo, "SpcRoot");
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreInit(&g_hNtKernelRootStore, g_aSUPNtKernelRootTAs, g_cSUPNtKernelRootTAs,
NULL, 0, NULL, 0, pErrInfo, "NtKernelRoot");
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreInit(&g_hSpcAndNtKernelRootStore,
g_aSUPSpcRootTAs, g_cSUPSpcRootTAs,
g_aSUPNtKernelRootTAs, g_cSUPNtKernelRootTAs,
g_aSUPTimestampTAs, g_cSUPTimestampTAs,
pErrInfo, "SpcAndNtKernelRoot");
if (RT_SUCCESS(rc))
rc = supHardNtViCertStoreInit(&g_hSpcAndNtKernelSuppStore,
NULL, 0, NULL, 0, NULL, 0,
pErrInfo, "SpcAndNtKernelSupplemental");
#if 0 /* For the time being, always trust the build certificate. It bypasses the timestamp issues of CRT and SDL. */
/* If the build certificate is a test singing certificate, it must be a
trusted root or we'll fail to validate anything. */
if ( RT_SUCCESS(rc)
&& RTCrX509Name_Compare(&g_BuildX509Cert.TbsCertificate.Subject, &g_BuildX509Cert.TbsCertificate.Issuer) == 0)
#else
if (RT_SUCCESS(rc))
#endif
rc = RTCrStoreCertAddEncoded(g_hSpcAndNtKernelRootStore, RTCRCERTCTX_F_ENC_X509_DER,
g_abSUPBuildCert, g_cbSUPBuildCert, pErrInfo);
if (RT_SUCCESS(rc))
return VINF_SUCCESS;
supHardenedWinTermImageVerifier();
}
return rc;
}
/**
* Releases resources allocated by supHardenedWinInitImageVerifier.
*/
DECLHIDDEN(void) supHardenedWinTermImageVerifier(void)
{
if (RTCrX509Certificate_IsPresent(&g_BuildX509Cert))
RTAsn1VtDelete(&g_BuildX509Cert.SeqCore.Asn1Core);
RTCrStoreRelease(g_hSpcAndNtKernelSuppStore);
g_hSpcAndNtKernelSuppStore = NIL_RTCRSTORE;
RTCrStoreRelease(g_hSpcAndNtKernelRootStore);
g_hSpcAndNtKernelRootStore = NIL_RTCRSTORE;
RTCrStoreRelease(g_hNtKernelRootStore);
g_hNtKernelRootStore = NIL_RTCRSTORE;
RTCrStoreRelease(g_hSpcRootStore);
g_hSpcRootStore = NIL_RTCRSTORE;
}
#ifdef IN_RING3
/**
* This is a hardcoded list of certificates we thing we might need.
*
* @returns true if wanted, false if not.
* @param pCert The certificate.
*/
static bool supR3HardenedWinIsDesiredRootCA(PCRTCRX509CERTIFICATE pCert)
{
/*
* Check that it's a plausible root certificate.
*/
if (!RTCrX509Certificate_IsSelfSigned(pCert))
return false;
if (RTAsn1Integer_UnsignedCompareWithU32(&pCert->TbsCertificate.T0.Version, 3) > 0)
{
if ( !(pCert->TbsCertificate.T3.fExtKeyUsage & RTCRX509CERT_KEY_USAGE_F_KEY_CERT_SIGN)
&& (pCert->TbsCertificate.T3.fFlags & RTCRX509TBSCERTIFICATE_F_PRESENT_KEY_USAGE) )
return false;
if ( pCert->TbsCertificate.T3.pBasicConstraints
&& !pCert->TbsCertificate.T3.pBasicConstraints->CA.fValue)
return false;
}
if (pCert->TbsCertificate.SubjectPublicKeyInfo.SubjectPublicKey.cBits < 256) /* mostly for u64KeyId reading. */
return false;
/*
* Array of names and key clues of the certificates we want.
*/
static struct
{
uint64_t u64KeyId;
const char *pszName;
} const s_aWanted[] =
{
/* SPC */
{ UINT64_C(0xffffffffffffffff), "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority" },
{ UINT64_C(0xffffffffffffffff), "L=Internet, O=VeriSign, Inc., OU=VeriSign Commercial Software Publishers CA" },
{ UINT64_C(0x491857ead79dde00), "C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority" },
/* TS */
{ UINT64_C(0xffffffffffffffff), "O=Microsoft Trust Network, OU=Microsoft Corporation, OU=Microsoft Time Stamping Service Root, OU=Copyright (c) 1997 Microsoft Corp." },
{ UINT64_C(0xffffffffffffffff), "O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign Time Stamping Service Root, OU=NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc." },
{ UINT64_C(0xffffffffffffffff), "C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA" },
/* Additional Windows 8.1 list: */
{ UINT64_C(0x5ad46780fa5df300), "DC=com, DC=microsoft, CN=Microsoft Root Certificate Authority" },
{ UINT64_C(0x3be670c1bd02a900), "OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Corporation, CN=Microsoft Root Authority" },
{ UINT64_C(0x4d3835aa4180b200), "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2011" },
{ UINT64_C(0x646e3fe3ba08df00), "C=US, O=MSFT, CN=Microsoft Authenticode(tm) Root Authority" },
{ UINT64_C(0xece4e4289e08b900), "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010" },
{ UINT64_C(0x59faf1086271bf00), "C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2" },
{ UINT64_C(0x3d98ab22bb04a300), "C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root" },
{ UINT64_C(0x91e3728b8b40d000), "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Certification Authority" },
{ UINT64_C(0x61a3a33f81aace00), "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Object" },
{ UINT64_C(0x9e5bc2d78b6a3636), "C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com" },
{ UINT64_C(0xf4fd306318ccda00), "C=US, O=GeoTrust Inc., CN=GeoTrust Global CA" },
{ UINT64_C(0xa0ee62086758b15d), "C=US, O=Equifax, OU=Equifax Secure Certificate Authority" },
{ UINT64_C(0x8ff6fc03c1edbd00), "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Root Certificate Authority - G2" },
{ UINT64_C(0xa3ce8d99e60eda00), "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA" },
{ UINT64_C(0xa671e9fec832b700), "C=US, O=Starfield Technologies, Inc., OU=Starfield Class 2 Certification Authority" },
{ UINT64_C(0xa8de7211e13be200), "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA" },
{ UINT64_C(0x0ff3891b54348328), "C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.netSecure Server Certification Authority" },
{ UINT64_C(0x7ae89c50f0b6a00f), "C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root" },
{ UINT64_C(0xd45980fbf0a0ac00), "C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA" },
{ UINT64_C(0x9e5bc2d78b6a3636), "C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA, Email=premium-server@thawte.com" },
{ UINT64_C(0x7c4fd32ec1b1ce00), "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA" },
{ UINT64_C(0xd4fbe673e5ccc600), "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA" },
{ UINT64_C(0x16e64d2a56ccf200), "C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., OU=http://certificates.starfieldtech.com/repository/, CN=Starfield Services Root Certificate Authority" },
{ UINT64_C(0x6e2ba21058eedf00), "C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN - DATACorp SGC" },
{ UINT64_C(0xb28612a94b4dad00), "O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.netCertification Authority (2048)" },
{ UINT64_C(0x357a29080824af00), "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class3 Public Primary Certification Authority - G5" },
{ UINT64_C(0x466cbc09db88c100), "C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Certification Authority" },
{ UINT64_C(0x9259c8abe5ca713a), "L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com/, Email=info@valicert.com" },
{ UINT64_C(0x1f78fc529cbacb00), "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class3 Public Primary Certification Authority - G3" },
{ UINT64_C(0x8043e4ce150ead00), "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA" },
{ UINT64_C(0x00f2e6331af7b700), "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root" },
};
uint64_t const u64KeyId = pCert->TbsCertificate.SubjectPublicKeyInfo.SubjectPublicKey.uBits.pu64[1];
uint32_t i = RT_ELEMENTS(s_aWanted);
while (i-- > 0)
if ( s_aWanted[i].u64KeyId == u64KeyId
|| s_aWanted[i].u64KeyId == UINT64_MAX)
if (RTCrX509Name_MatchWithString(&pCert->TbsCertificate.Subject, s_aWanted[i].pszName))
return true;
#ifdef DEBUG_bird
char szTmp[512];
szTmp[sizeof(szTmp) - 1] = '\0';
RTCrX509Name_FormatAsString(&pCert->TbsCertificate.Issuer, szTmp, sizeof(szTmp) - 1, NULL);
SUP_DPRINTF(("supR3HardenedWinIsDesiredRootCA: %#llx %s\n", u64KeyId, szTmp));
#endif
return false;
}
/**
* Called by supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation to
* import selected root CAs from the system certificate store.
*
* These certificates permits us to correctly validate third party DLLs.
*
* @param fLoadLibraryFlags The LoadLibraryExW flags that the caller
* found to work. Avoids us having to retry on
* ERROR_INVALID_PARAMETER.
*/
static void supR3HardenedWinRetrieveTrustedRootCAs(DWORD fLoadLibraryFlags)
{
uint32_t cAdded = 0;
/*
* Load crypt32.dll and resolve the APIs we need.
*/
HMODULE hCrypt32 = LoadLibraryExW(L"\\\\.\\GLOBALROOT\\SystemRoot\\System32\\crypt32.dll", NULL, fLoadLibraryFlags);
if (!hCrypt32)
supR3HardenedFatal("Error loading 'crypt32.dll': %u", GetLastError());
#define RESOLVE_CRYPT32_API(a_Name, a_pfnType) \
a_pfnType pfn##a_Name = (a_pfnType)GetProcAddress(hCrypt32, #a_Name); \
if (pfn##a_Name == NULL) supR3HardenedFatal("Error locating '" #a_Name "' in 'crypt32.dll': %u", GetLastError())
RESOLVE_CRYPT32_API(CertOpenStore, PFNCERTOPENSTORE);
RESOLVE_CRYPT32_API(CertCloseStore, PFNCERTCLOSESTORE);
RESOLVE_CRYPT32_API(CertEnumCertificatesInStore, PFNCERTENUMCERTIFICATESINSTORE);
#undef RESOLVE_CRYPT32_API
/*
* Open the root store and look for the certificates we wish to use.
*/
DWORD fOpenStore = CERT_STORE_OPEN_EXISTING_FLAG | CERT_STORE_READONLY_FLAG;
HCERTSTORE hStore = pfnCertOpenStore(CERT_STORE_PROV_SYSTEM_W, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
NULL /* hCryptProv = default */, CERT_SYSTEM_STORE_LOCAL_MACHINE | fOpenStore, L"Root");
if (!hStore)
hStore = pfnCertOpenStore(CERT_STORE_PROV_SYSTEM_W, PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
NULL /* hCryptProv = default */, CERT_SYSTEM_STORE_CURRENT_USER | fOpenStore, L"Root");
if (hStore)
{
PCCERT_CONTEXT pCurCtx = NULL;
while ((pCurCtx = pfnCertEnumCertificatesInStore(hStore, pCurCtx)) != NULL)
{
if (pCurCtx->dwCertEncodingType & X509_ASN_ENCODING)
{
RTASN1CURSORPRIMARY PrimaryCursor;
RTAsn1CursorInitPrimary(&PrimaryCursor, pCurCtx->pbCertEncoded, pCurCtx->cbCertEncoded, NULL /*pErrInfo*/,
&g_RTAsn1DefaultAllocator, RTASN1CURSOR_FLAGS_DER, "CurCtx");
RTCRX509CERTIFICATE MyCert;
int rc = RTCrX509Certificate_DecodeAsn1(&PrimaryCursor.Cursor, 0, &MyCert, "Cert");
AssertRC(rc);
if (RT_SUCCESS(rc))
{
if (supR3HardenedWinIsDesiredRootCA(&MyCert))
{
rc = RTCrStoreCertAddEncoded(g_hSpcRootStore, RTCRCERTCTX_F_ENC_X509_DER,
pCurCtx->pbCertEncoded, pCurCtx->cbCertEncoded, NULL /*pErrInfo*/);
AssertRC(rc);
rc = RTCrStoreCertAddEncoded(g_hSpcAndNtKernelRootStore, RTCRCERTCTX_F_ENC_X509_DER,
pCurCtx->pbCertEncoded, pCurCtx->cbCertEncoded, NULL /*pErrInfo*/);
AssertRC(rc);
cAdded++;
}
RTCrX509Certificate_Delete(&MyCert);
}
}
}
pfnCertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
g_fHaveOtherRoots = true;
}
SUP_DPRINTF(("supR3HardenedWinRetrieveTrustedRootCAs: cAdded=%u\n", cAdded));
}
/**
* Resolves the WinVerifyTrust API after the process has been verified and
* installs a thread creation hook.
*
* The WinVerifyTrust API is used in addition our own Authenticode verification
* code. If the image has the IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY flag
* set, it will be checked again by the kernel. All our image has this flag set
* and we require all VBox extensions to have it set as well. In effect, the
* authenticode signature will be checked two or three times.
*/
DECLHIDDEN(void) supR3HardenedWinResolveVerifyTrustApiAndHookThreadCreation(void)
{
# ifdef IN_SUP_HARDENED_R3
/*
* Load our the support library DLL that does the thread hooking as the
* security API may trigger the creation of COM worker threads (or
* whatever they are).
*
* The thread creation hook makes the threads very slippery to debuggers by
* irreversably disabling most (if not all) debug events for them.
*/
char szPath[RTPATH_MAX];
supR3HardenedPathSharedLibs(szPath, sizeof(szPath) - sizeof("/VBoxSupLib.DLL"));
suplibHardenedStrCat(szPath, "/VBoxSupLib.DLL");
HMODULE hSupLibMod = (HMODULE)supR3HardenedWinLoadLibrary(szPath, true /*fSystem32Only*/);
if (hSupLibMod == NULL)
supR3HardenedFatal("Error loading '%s': %u", szPath, GetLastError());
# endif
/*
* Resolve it.
*/
DWORD fFlags = 0;
if (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0))
fFlags = LOAD_LIBRARY_SEARCH_SYSTEM32;
HMODULE hWintrust = LoadLibraryExW(L"\\\\.\\GLOBALROOT\\SystemRoot\\System32\\Wintrust.dll", NULL, fFlags);
if ( hWintrust == NULL
&& fFlags
&& g_uNtVerCombined < SUP_MAKE_NT_VER_SIMPLE(6, 2)
&& GetLastError() == ERROR_INVALID_PARAMETER)
{
fFlags = 0;
hWintrust = LoadLibraryExW(L"\\\\.\\GLOBALROOT\\SystemRoot\\System32\\Wintrust.dll", NULL, fFlags);
}
if (hWintrust == NULL)
supR3HardenedFatal("Error loading 'Wintrust.dll': %u", GetLastError());
#define RESOLVE_CRYPT_API(a_Name, a_pfnType, a_uMinWinVer) \
do { \
g_pfn##a_Name = (a_pfnType)GetProcAddress(hWintrust, #a_Name); \
if (g_pfn##a_Name == NULL && (a_uMinWinVer) < g_uNtVerCombined) \
supR3HardenedFatal("Error locating '" #a_Name "' in 'Wintrust.dll': %u", GetLastError()); \
} while (0)
PFNWINVERIFYTRUST pfnWinVerifyTrust = (PFNWINVERIFYTRUST)GetProcAddress(hWintrust, "WinVerifyTrust");
if (!pfnWinVerifyTrust)
supR3HardenedFatal("Error locating 'WinVerifyTrust' in 'Wintrust.dll': %u", GetLastError());
RESOLVE_CRYPT_API(CryptCATAdminAcquireContext, PFNCRYPTCATADMINACQUIRECONTEXT, 0);
RESOLVE_CRYPT_API(CryptCATAdminCalcHashFromFileHandle, PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE, 0);
RESOLVE_CRYPT_API(CryptCATAdminEnumCatalogFromHash, PFNCRYPTCATADMINENUMCATALOGFROMHASH, 0);
RESOLVE_CRYPT_API(CryptCATAdminReleaseCatalogContext, PFNCRYPTCATADMINRELEASECATALOGCONTEXT, 0);
RESOLVE_CRYPT_API(CryptCATAdminReleaseContext, PFNCRYPTCATDADMINRELEASECONTEXT, 0);
RESOLVE_CRYPT_API(CryptCATCatalogInfoFromContext, PFNCRYPTCATCATALOGINFOFROMCONTEXT, 0);
RESOLVE_CRYPT_API(CryptCATAdminAcquireContext2, PFNCRYPTCATADMINACQUIRECONTEXT2, SUP_NT_VER_W80);
RESOLVE_CRYPT_API(CryptCATAdminCalcHashFromFileHandle2, PFNCRYPTCATADMINCALCHASHFROMFILEHANDLE2, SUP_NT_VER_W80);
/*
* Call it on ourselves and ntdll to make sure it loads all the providers
* now, we would otherwise geting into recursive trouble in the
* NtCreateSection hook.
*/
# ifdef IN_SUP_HARDENED_R3
RTERRINFOSTATIC ErrInfoStatic;
RTErrInfoInitStatic(&ErrInfoStatic);
int rc = supR3HardNtViCallWinVerifyTrust(NULL, g_SupLibHardenedExeNtPath.UniStr.Buffer, 0,
&ErrInfoStatic.Core, pfnWinVerifyTrust);
if (RT_FAILURE(rc))
supR3HardenedFatal("WinVerifyTrust failed on stub executable: %s", ErrInfoStatic.szMsg);
# endif
if (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0)) /* ntdll isn't signed on XP, assuming this is the case on W2K3 for now. */
supR3HardNtViCallWinVerifyTrust(NULL, L"\\SystemRoot\\System32\\ntdll.dll", 0, NULL, pfnWinVerifyTrust);
supR3HardNtViCallWinVerifyTrustCatFile(NULL, L"\\SystemRoot\\System32\\ntdll.dll", 0, NULL, pfnWinVerifyTrust);
g_pfnWinVerifyTrust = pfnWinVerifyTrust;
/*
* Now, get trusted root CAs so we can verify a broader scope of signatures.
*/
supR3HardenedWinRetrieveTrustedRootCAs(fFlags);
}
static int supR3HardNtViNtToWinPath(PCRTUTF16 pwszNtName, PCRTUTF16 *ppwszWinPath,
PRTUTF16 pwszWinPathBuf, size_t cwcWinPathBuf)
{
static const RTUTF16 s_wszPrefix[] = L"\\\\.\\GLOBALROOT";
if (*pwszNtName != '\\' && *pwszNtName != '/')
return VERR_PATH_DOES_NOT_START_WITH_ROOT;
size_t cwcNtName = RTUtf16Len(pwszNtName);
if (RT_ELEMENTS(s_wszPrefix) + cwcNtName > cwcWinPathBuf)
return VERR_FILENAME_TOO_LONG;
memcpy(pwszWinPathBuf, s_wszPrefix, sizeof(s_wszPrefix));
memcpy(&pwszWinPathBuf[sizeof(s_wszPrefix) / sizeof(RTUTF16) - 1], pwszNtName, (cwcNtName + 1) * sizeof(RTUTF16));
*ppwszWinPath = pwszWinPathBuf;
return VINF_SUCCESS;
}
/**
* Calls WinVerifyTrust to verify an PE image.
*
* @returns VBox status code.
* @param hFile File handle to the executable file.
* @param pwszName Full NT path to the DLL in question, used for
* dealing with unsigned system dlls as well as for
* error/logging.
* @param fFlags Flags, SUPHNTVI_F_XXX.
* @param pErrInfo Pointer to error info structure. Optional.
* @param pfnWinVerifyTrust Pointer to the API.
*/
static int supR3HardNtViCallWinVerifyTrust(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PRTERRINFO pErrInfo,
PFNWINVERIFYTRUST pfnWinVerifyTrust)
{
/*
* Convert the name into a Windows name.
*/
RTUTF16 wszWinPathBuf[MAX_PATH];
PCRTUTF16 pwszWinPath;
int rc = supR3HardNtViNtToWinPath(pwszName, &pwszWinPath, wszWinPathBuf, RT_ELEMENTS(wszWinPathBuf));
if (RT_FAILURE(rc))
return RTErrInfoSetF(pErrInfo, rc, "Bad path passed to supR3HardNtViCallWinVerifyTrust: rc=%Rrc '%ls'", rc, pwszName);
/*
* Construct input parameters and call the API.
*/
WINTRUST_FILE_INFO FileInfo;
RT_ZERO(FileInfo);
FileInfo.cbStruct = sizeof(FileInfo);
FileInfo.pcwszFilePath = pwszWinPath;
FileInfo.hFile = hFile;
GUID PolicyActionGuid = WINTRUST_ACTION_GENERIC_VERIFY_V2;
WINTRUST_DATA TrustData;
RT_ZERO(TrustData);
TrustData.cbStruct = sizeof(TrustData);
TrustData.fdwRevocationChecks = WTD_REVOKE_NONE; /* Keep simple for now. */
TrustData.dwStateAction = WTD_STATEACTION_VERIFY;
TrustData.dwUIChoice = WTD_UI_NONE;
TrustData.dwProvFlags = 0;
if (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0))
TrustData.dwProvFlags = WTD_CACHE_ONLY_URL_RETRIEVAL;
else
TrustData.dwProvFlags = WTD_REVOCATION_CHECK_NONE;
TrustData.dwUnionChoice = WTD_CHOICE_FILE;
TrustData.pFile = &FileInfo;
HRESULT hrc = pfnWinVerifyTrust(NULL /*hwnd*/, &PolicyActionGuid, &TrustData);
if (hrc == S_OK)
rc = VINF_SUCCESS;
else
{
/*
* Failed. Format a nice error message.
*/
# ifdef DEBUG_bird
__debugbreak();
# endif
const char *pszErrConst = NULL;
switch (hrc)
{
case TRUST_E_SYSTEM_ERROR: pszErrConst = "TRUST_E_SYSTEM_ERROR"; break;
case TRUST_E_NO_SIGNER_CERT: pszErrConst = "TRUST_E_NO_SIGNER_CERT"; break;
case TRUST_E_COUNTER_SIGNER: pszErrConst = "TRUST_E_COUNTER_SIGNER"; break;
case TRUST_E_CERT_SIGNATURE: pszErrConst = "TRUST_E_CERT_SIGNATURE"; break;
case TRUST_E_TIME_STAMP: pszErrConst = "TRUST_E_TIME_STAMP"; break;
case TRUST_E_BAD_DIGEST: pszErrConst = "TRUST_E_BAD_DIGEST"; break;
case TRUST_E_BASIC_CONSTRAINTS: pszErrConst = "TRUST_E_BASIC_CONSTRAINTS"; break;
case TRUST_E_FINANCIAL_CRITERIA: pszErrConst = "TRUST_E_FINANCIAL_CRITERIA"; break;
case TRUST_E_PROVIDER_UNKNOWN: pszErrConst = "TRUST_E_PROVIDER_UNKNOWN"; break;
case TRUST_E_ACTION_UNKNOWN: pszErrConst = "TRUST_E_ACTION_UNKNOWN"; break;
case TRUST_E_SUBJECT_FORM_UNKNOWN: pszErrConst = "TRUST_E_SUBJECT_FORM_UNKNOWN"; break;
case TRUST_E_SUBJECT_NOT_TRUSTED: pszErrConst = "TRUST_E_SUBJECT_NOT_TRUSTED"; break;
case TRUST_E_NOSIGNATURE: pszErrConst = "TRUST_E_NOSIGNATURE"; break;
case TRUST_E_FAIL: pszErrConst = "TRUST_E_FAIL"; break;
case TRUST_E_EXPLICIT_DISTRUST: pszErrConst = "TRUST_E_EXPLICIT_DISTRUST"; break;
}
if (pszErrConst)
rc = RTErrInfoSetF(pErrInfo, VERR_LDRVI_UNSUPPORTED_ARCH,
"WinVerifyTrust failed with hrc=%s on '%ls'", pszErrConst, pwszName);
else
rc = RTErrInfoSetF(pErrInfo, VERR_LDRVI_UNSUPPORTED_ARCH,
"WinVerifyTrust failed with hrc=%Rhrc on '%ls'", hrc, pwszName);
}
/* clean up state data. */
TrustData.dwStateAction = WTD_STATEACTION_CLOSE;
FileInfo.hFile = NULL;
hrc = pfnWinVerifyTrust(NULL /*hwnd*/, &PolicyActionGuid, &TrustData);
return rc;
}
/**
* Calls WinVerifyTrust to verify an PE image via catalog files.
*
* @returns VBox status code.
* @param hFile File handle to the executable file.
* @param pwszName Full NT path to the DLL in question, used for
* dealing with unsigned system dlls as well as for
* error/logging.
* @param fFlags Flags, SUPHNTVI_F_XXX.
* @param pErrInfo Pointer to error info structure. Optional.
* @param pfnWinVerifyTrust Pointer to the API.
*/
static int supR3HardNtViCallWinVerifyTrustCatFile(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PRTERRINFO pErrInfo,
PFNWINVERIFYTRUST pfnWinVerifyTrust)
{
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: hFile=%p pwszName=%ls\n", hFile, pwszName));
/*
* Convert the name into a Windows name.
*/
RTUTF16 wszWinPathBuf[MAX_PATH];
PCRTUTF16 pwszWinPath;
int rc = supR3HardNtViNtToWinPath(pwszName, &pwszWinPath, wszWinPathBuf, RT_ELEMENTS(wszWinPathBuf));
if (RT_FAILURE(rc))
return RTErrInfoSetF(pErrInfo, rc, "Bad path passed to supR3HardNtViCallWinVerifyTrustCatFile: rc=%Rrc '%ls'", rc, pwszName);
/*
* Open the file if we didn't get a handle.
*/
HANDLE hFileClose = NULL;
if (hFile == RTNT_INVALID_HANDLE_VALUE || hFile == NULL)
{
hFile = RTNT_INVALID_HANDLE_VALUE;
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
UNICODE_STRING NtName;
NtName.Buffer = (PWSTR)pwszName;
NtName.Length = (USHORT)(RTUtf16Len(pwszName) * sizeof(WCHAR));
NtName.MaximumLength = NtName.Length + sizeof(WCHAR);
OBJECT_ATTRIBUTES ObjAttr;
InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
NTSTATUS rcNt = NtCreateFile(&hFile,
FILE_READ_DATA | SYNCHRONIZE,
&ObjAttr,
&Ios,
NULL /* Allocation Size*/,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
NULL /*EaBuffer*/,
0 /*EaLength*/);
if (NT_SUCCESS(rcNt))
rcNt = Ios.Status;
if (!NT_SUCCESS(rcNt))
return RTErrInfoSetF(pErrInfo, RTErrConvertFromNtStatus(rcNt),
"NtCreateFile returned %#x opening '%ls'.", rcNt, pwszName);
hFileClose = hFile;
}
/*
* On Windows 8.0 and later there are more than one digest choice.
*/
rc = VERR_LDRVI_NOT_SIGNED;
static struct
{
/** The digest algorithm name. */
const WCHAR *pszAlgorithm;
/** Cached catalog admin handle. */
HCATADMIN volatile hCachedCatAdmin;
} s_aHashes[] =
{
{ NULL, NULL },
{ L"SHA256", NULL },
};
for (uint32_t i = 0; i < RT_ELEMENTS(s_aHashes); i++)
{
/*
* Another loop for dealing with different trust provider policies
* required for successfully validating different catalog signatures.
*/
bool fTryNextPolicy;
uint32_t iPolicy = 0;
static const GUID s_aPolicies[] =
{
DRIVER_ACTION_VERIFY, /* Works with microsoft bits. Most frequently used, thus first. */
WINTRUST_ACTION_GENERIC_VERIFY_V2, /* Works with ATI and other SPC kernel-code signed stuff. */
};
do
{
/*
* Create a context.
*/
fTryNextPolicy = false;
BOOL fRc;
HCATADMIN hCatAdmin = ASMAtomicXchgPtr(&s_aHashes[i].hCachedCatAdmin, NULL);
if (hCatAdmin)
fRc = TRUE;
else if (g_pfnCryptCATAdminAcquireContext2)
fRc = g_pfnCryptCATAdminAcquireContext2(&hCatAdmin, &s_aPolicies[iPolicy], s_aHashes[i].pszAlgorithm,
NULL /*pStrongHashPolicy*/, 0 /*dwFlags*/);
else
fRc = g_pfnCryptCATAdminAcquireContext(&hCatAdmin, &s_aPolicies[iPolicy], 0 /*dwFlags*/);
if (fRc)
{
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: hCatAdmin=%p\n", hCatAdmin));
/*
* Hash the file.
*/
BYTE abHash[SUPHARDNTVI_MAX_CAT_HASH_SIZE];
DWORD cbHash = sizeof(abHash);
if (g_pfnCryptCATAdminCalcHashFromFileHandle2)
fRc = g_pfnCryptCATAdminCalcHashFromFileHandle2(hCatAdmin, hFile, &cbHash, abHash, 0 /*dwFlags*/);
else
fRc = g_pfnCryptCATAdminCalcHashFromFileHandle(hFile, &cbHash, abHash, 0 /*dwFlags*/);
if (fRc)
{
/* Produce a string version of it that we can pass to WinVerifyTrust. */
RTUTF16 wszDigest[SUPHARDNTVI_MAX_CAT_HASH_SIZE * 2 + 1];
int rc2 = RTUtf16PrintHexBytes(wszDigest, RT_ELEMENTS(wszDigest), abHash, cbHash, RTSTRPRINTHEXBYTES_F_UPPER);
if (RT_SUCCESS(rc2))
{
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: cbHash=%u wszDigest=%ls\n", cbHash, wszDigest));
/*
* Enumerate catalog information that matches the hash.
*/
uint32_t iCat = 0;
HCATINFO hCatInfoPrev = NULL;
do
{
/* Get the next match. */
HCATINFO hCatInfo = g_pfnCryptCATAdminEnumCatalogFromHash(hCatAdmin, abHash, cbHash, 0, &hCatInfoPrev);
if (!hCatInfo)
{
if (iCat == 0)
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: CryptCATAdminEnumCatalogFromHash failed %u\n", GetLastError()));
break;
}
Assert(hCatInfoPrev == NULL);
hCatInfoPrev = hCatInfo;
/*
* Call WinVerifyTrust.
*/
CATALOG_INFO CatInfo;
CatInfo.cbStruct = sizeof(CatInfo);
CatInfo.wszCatalogFile[0] = '\0';
if (g_pfnCryptCATCatalogInfoFromContext(hCatInfo, &CatInfo, 0 /*dwFlags*/))
{
WINTRUST_CATALOG_INFO WtCatInfo;
RT_ZERO(WtCatInfo);
WtCatInfo.cbStruct = sizeof(WtCatInfo);
WtCatInfo.dwCatalogVersion = 0;
WtCatInfo.pcwszCatalogFilePath = CatInfo.wszCatalogFile;
WtCatInfo.pcwszMemberTag = wszDigest;
WtCatInfo.pcwszMemberFilePath = pwszWinPath;
WtCatInfo.pbCalculatedFileHash = abHash;
WtCatInfo.cbCalculatedFileHash = cbHash;
WtCatInfo.pcCatalogContext = NULL;
WINTRUST_DATA TrustData;
RT_ZERO(TrustData);
TrustData.cbStruct = sizeof(TrustData);
TrustData.fdwRevocationChecks = WTD_REVOKE_NONE; /* Keep simple for now. */
TrustData.dwStateAction = WTD_STATEACTION_VERIFY;
TrustData.dwUIChoice = WTD_UI_NONE;
TrustData.dwProvFlags = 0;
if (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0))
TrustData.dwProvFlags = WTD_CACHE_ONLY_URL_RETRIEVAL;
else
TrustData.dwProvFlags = WTD_REVOCATION_CHECK_NONE;
TrustData.dwUnionChoice = WTD_CHOICE_CATALOG;
TrustData.pCatalog = &WtCatInfo;
HRESULT hrc = pfnWinVerifyTrust(NULL /*hwnd*/, &s_aPolicies[iPolicy], &TrustData);
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => %#x; cat=%ls\n", hrc, CatInfo.wszCatalogFile));
if (SUCCEEDED(hrc))
rc = VINF_SUCCESS;
else if (hrc == TRUST_E_NOSIGNATURE)
{ /* ignore because it's useless. */ }
else if (hrc == ERROR_INVALID_PARAMETER)
{ /* This is returned if the given file isn't found in the catalog, it seems. */ }
else
{
rc = RTErrInfoSetF(pErrInfo, VERR_SUP_VP_WINTRUST_CAT_FAILURE,
"WinVerifyTrust failed with hrc=%#x on '%ls' and .cat-file='%ls'.",
hrc, pwszWinPath, CatInfo.wszCatalogFile);
fTryNextPolicy = (hrc == CERT_E_UNTRUSTEDROOT);
}
/* clean up state data. */
TrustData.dwStateAction = WTD_STATEACTION_CLOSE;
hrc = pfnWinVerifyTrust(NULL /*hwnd*/, &s_aPolicies[iPolicy], &TrustData);
Assert(SUCCEEDED(hrc));
}
else
{
rc = RTErrInfoSetF(pErrInfo, RTErrConvertFromWin32(GetLastError()),
"CryptCATCatalogInfoFromContext failed: %d [file=%s]",
GetLastError(), pwszName);
SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: CryptCATCatalogInfoFromContext failed\n"));
}
iCat++;
} while (rc == VERR_LDRVI_NOT_SIGNED && iCat < 128);
if (hCatInfoPrev != NULL)
if (!g_pfnCryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfoPrev, 0 /*dwFlags*/))
AssertFailed();
}
else
rc = RTErrInfoSetF(pErrInfo, rc2, "RTUtf16PrintHexBytes failed: %Rrc", rc);
}
else
rc = RTErrInfoSetF(pErrInfo, RTErrConvertFromWin32(GetLastError()),
"CryptCATAdminCalcHashFromFileHandle[2] failed: %d [file=%s]", GetLastError(), pwszName);
if (!ASMAtomicCmpXchgPtr(&s_aHashes[i].hCachedCatAdmin, hCatAdmin, NULL))
if (!g_pfnCryptCATAdminReleaseContext(hCatAdmin, 0 /*dwFlags*/))
AssertFailed();
}
else
rc = RTErrInfoSetF(pErrInfo, RTErrConvertFromWin32(GetLastError()),
"CryptCATAdminAcquireContext[2] failed: %d [file=%s]", GetLastError(), pwszName);
iPolicy++;
} while ( fTryNextPolicy
&& iPolicy < RT_ELEMENTS(s_aPolicies));
/*
* Only repeat if we've got g_pfnCryptCATAdminAcquireContext2 and can specify the hash algorithm.
*/
if (!g_pfnCryptCATAdminAcquireContext2)
break;
if (rc != VERR_LDRVI_NOT_SIGNED)
break;
}
if (hFileClose != NULL)
NtClose(hFileClose);
return rc;
}
/**
* Initializes g_uNtVerCombined and g_NtVerInfo.
* Called from suplibHardenedWindowsMain and suplibOsInit.
*/
DECLHIDDEN(void) supR3HardenedWinInitVersion(void)
{
/*
* Get the windows version. Use RtlGetVersion as GetVersionExW and
* GetVersion might not be telling the whole truth (8.0 on 8.1 depending on
* the application manifest).
*/
OSVERSIONINFOEXW NtVerInfo;
suplibHardenedMemSet(&NtVerInfo, 0, sizeof(NtVerInfo));
NtVerInfo.dwOSVersionInfoSize = sizeof(RTL_OSVERSIONINFOEXW);
if (!NT_SUCCESS(RtlGetVersion((PRTL_OSVERSIONINFOW)&NtVerInfo)))
{
suplibHardenedMemSet(&NtVerInfo, 0, sizeof(NtVerInfo));
NtVerInfo.dwOSVersionInfoSize = sizeof(RTL_OSVERSIONINFOW);
if (!NT_SUCCESS(RtlGetVersion((PRTL_OSVERSIONINFOW)&NtVerInfo)))
{
NtVerInfo.dwOSVersionInfoSize = sizeof(NtVerInfo);
if (!GetVersionExW((OSVERSIONINFOW *)&NtVerInfo))
{
suplibHardenedMemSet(&NtVerInfo, 0, sizeof(NtVerInfo));
DWORD dwVer = GetVersion();
NtVerInfo.dwMajorVersion = RT_BYTE1(dwVer);
NtVerInfo.dwMinorVersion = RT_BYTE2(dwVer);
NtVerInfo.dwBuildNumber = RT_BIT_32(31) & dwVer ? 0 : RT_HI_U16(dwVer);
}
}
}
g_uNtVerCombined = SUP_MAKE_NT_VER_COMBINED(NtVerInfo.dwMajorVersion, NtVerInfo.dwMinorVersion, NtVerInfo.dwBuildNumber,
NtVerInfo.wServicePackMajor, NtVerInfo.wServicePackMinor);
}
#endif /* IN_RING3 */