SUPHardenedVerifyProcess-win.cpp revision 9997cd77b8e044f801beb055c5e2a9f0faf59780
/* $Id$ */
/** @file
* VirtualBox Support Library/Driver - Hardened Process Verification, Windows.
*/
/*
* Copyright (C) 2006-2014 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* you can redistribute it and/or modify it under the terms of the GNU
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#ifdef IN_RING0
# define IPRT_NT_MAP_TO_ZW
# include <iprt/nt/nt.h>
# include <ntimage.h>
#else
# include <iprt/nt/nt-and-windows.h>
#endif
#include <VBox/sup.h>
#include <VBox/err.h>
#include <iprt/alloca.h>
#include <iprt/ctype.h>
#include <iprt/param.h>
#include <iprt/string.h>
#include <iprt/zero.h>
#ifdef IN_RING0
# include "SUPDrvInternal.h"
#else
# include "SUPLibInternal.h"
#endif
#include "win/SUPHardenedVerify-win.h"
/*******************************************************************************
* Structures and Typedefs *
*******************************************************************************/
/**
* Virtual address space region.
*/
typedef struct SUPHNTVPREGION
{
/** The RVA of the region. */
uint32_t uRva;
/** The size of the region. */
uint32_t cb;
/** The protection of the region. */
uint32_t fProt;
} SUPHNTVPREGION;
/** Pointer to a virtual address space region. */
typedef SUPHNTVPREGION *PSUPHNTVPREGION;
/**
* Virtual address space image information.
*/
typedef struct SUPHNTVPIMAGE
{
/** The base address of the image. */
uintptr_t uImageBase;
/** The size of the image mapping. */
uintptr_t cbImage;
/** The name from the allowed lists. */
const char *pszName;
/** Name structure for NtQueryVirtualMemory/MemorySectionName. */
struct
{
/** The full unicode name. */
UNICODE_STRING UniStr;
/** Buffer space. */
WCHAR awcBuffer[260];
} Name;
/** The number of mapping regions. */
uint32_t cRegions;
/** Mapping regions. */
SUPHNTVPREGION aRegions[16];
/** The image characteristics from the FileHeader. */
uint16_t fImageCharecteristics;
/** The DLL characteristics from the OptionalHeader. */
uint16_t fDllCharecteristics;
/** Set if this is the DLL. */
bool fDll;
/** Set if the image is NTDLL an the verficiation code needs to watch out for
* the NtCreateSection patch. */
bool fNtCreateSectionPatch;
/** Whether the API set schema hack needs to be applied when verifying memory
* content. The hack means that we only check if the 1st section is mapped. */
bool fApiSetSchemaOnlySection1;
/** This may be a 32-bit resource DLL. */
bool f32bitResourceDll;
/** Pointer to the loader cache entry for the image. */
PSUPHNTLDRCACHEENTRY pCacheEntry;
#ifdef IN_RING0
/** In ring-0 we don't currently cache images, so put it here. */
SUPHNTLDRCACHEENTRY CacheEntry;
#endif
} SUPHNTVPIMAGE;
/** Pointer to image info from the virtual address space scan. */
typedef SUPHNTVPIMAGE *PSUPHNTVPIMAGE;
/**
* Virtual address space scanning state.
*/
typedef struct SUPHNTVPSTATE
{
/** Type of verification to perform. */
SUPHARDNTVPKIND enmKind;
/** Combination of SUPHARDNTVP_F_XXX. */
uint32_t fFlags;
/** The result. */
int rcResult;
/** Number of fixes we've done.
* Only applicable in the purification modes. */
uint32_t cFixes;
/** Number of images in aImages. */
uint32_t cImages;
/** The index of the last image we looked up. */
uint32_t iImageHint;
/** The process handle. */
HANDLE hProcess;
/** Images found in the process.
* The array is large enough to hold the executable, all allowed DLLs, and one
* more so we can get the image name of the first unwanted DLL. */
SUPHNTVPIMAGE aImages[1 + 6 + 1
#ifdef VBOX_PERMIT_VERIFIER_DLL
+ 1
#endif
#ifdef VBOX_PERMIT_MORE
+ 5
#endif
#ifdef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
+ 16
#endif
];
/** Memory compare scratch buffer.*/
uint8_t abMemory[_4K];
/** File compare scratch buffer.*/
uint8_t abFile[_4K];
/** Section headers for use when comparing file and loaded image. */
IMAGE_SECTION_HEADER aSecHdrs[16];
/** Pointer to the error info. */
PRTERRINFO pErrInfo;
} SUPHNTVPSTATE;
/** Pointer to stat information of a virtual address space scan. */
typedef SUPHNTVPSTATE *PSUPHNTVPSTATE;
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/**
* System DLLs allowed to be loaded into the process.
* @remarks supHardNtVpCheckDlls assumes these are lower case.
*/
static const char *g_apszSupNtVpAllowedDlls[] =
{
"ntdll.dll",
"kernel32.dll",
"kernelbase.dll",
"apphelp.dll",
"apisetschema.dll",
#ifdef VBOX_PERMIT_VERIFIER_DLL
"verifier.dll",
#endif
#ifdef VBOX_PERMIT_MORE
# define VBOX_PERMIT_MORE_FIRST_IDX 5
"sfc.dll",
"sfc_os.dll",
"user32.dll",
"acres.dll",
"acgenral.dll",
#endif
#ifdef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
"psapi.dll",
"msvcrt.dll",
"advapi32.dll",
"sechost.dll",
"rpcrt4.dll",
"SamplingRuntime.dll",
#endif
};
/**
* VBox executables allowed to start VMs.
* @remarks Remember to keep in sync with SUPR3HardenedVerify.cpp.
*/
static const char *g_apszSupNtVpAllowedVmExes[] =
{
"VBoxHeadless.exe",
"VirtualBox.exe",
"VBoxSDL.exe",
"VBoxNetDHCP.exe",
"VBoxNetNAT.exe",
"tstMicro.exe",
"tstPDMAsyncCompletion.exe",
"tstPDMAsyncCompletionStress.exe",
"tstVMM.exe",
"tstVMREQ.exe",
"tstCFGM.exe",
"tstIntNet-1.exe",
"tstMMHyperHeap.exe",
"tstRTR0ThreadPreemptionDriver.exe",
"tstRTR0MemUserKernelDriver.exe",
"tstRTR0SemMutexDriver.exe",
"tstRTR0TimerDriver.exe",
"tstSSM.exe",
};
/** Pointer to NtQueryVirtualMemory. Initialized by SUPDrv-win.cpp in
* ring-0, in ring-3 it's just a slightly confusing define. */
#ifdef IN_RING0
PFNNTQUERYVIRTUALMEMORY g_pfnNtQueryVirtualMemory = NULL;
#else
# define g_pfnNtQueryVirtualMemory NtQueryVirtualMemory
#endif
#ifdef IN_RING3
/** The number of valid entries in the loader cache.. */
static uint32_t g_cSupNtVpLdrCacheEntries = 0;
/** The loader cache entries. */
static SUPHNTLDRCACHEENTRY g_aSupNtVpLdrCacheEntries[RT_ELEMENTS(g_apszSupNtVpAllowedDlls) + 1 + 3];
#endif
/**
* Fills in error information.
*
* @returns @a rc.
* @param pErrInfo Pointer to the extended error info structure.
* Can be NULL.
* @param pszErr Where to return error details.
* @param cbErr Size of the buffer @a pszErr points to.
* @param rc The status to return.
* @param pszMsg The format string for the message.
* @param ... The arguments for the format string.
*/
static int supHardNtVpSetInfo1(PRTERRINFO pErrInfo, int rc, const char *pszMsg, ...)
{
va_list va;
#ifdef IN_RING3
va_start(va, pszMsg);
supR3HardenedError(rc, false /*fFatal*/, "%N\n", pszMsg, &va);
va_end(va);
#endif
va_start(va, pszMsg);
RTErrInfoSetV(pErrInfo, rc, pszMsg, va);
va_end(va);
return rc;
}
/**
* Fills in error information.
*
* @returns @a rc.
* @param pThis The process validator instance.
* @param pszErr Where to return error details.
* @param cbErr Size of the buffer @a pszErr points to.
* @param rc The status to return.
* @param pszMsg The format string for the message.
* @param ... The arguments for the format string.
*/
static int supHardNtVpSetInfo2(PSUPHNTVPSTATE pThis, int rc, const char *pszMsg, ...)
{
va_list va;
#ifdef IN_RING3
va_start(va, pszMsg);
supR3HardenedError(rc, false /*fFatal*/, "%N\n", pszMsg, &va);
va_end(va);
#endif
va_start(va, pszMsg);
#ifdef IN_RING0
RTErrInfoSetV(pThis->pErrInfo, rc, pszMsg, va);
pThis->rcResult = rc;
#else
if (RT_SUCCESS(pThis->rcResult))
{
RTErrInfoSetV(pThis->pErrInfo, rc, pszMsg, va);
pThis->rcResult = rc;
}
else
{
RTErrInfoAddF(pThis->pErrInfo, rc, " \n[rc=%d] ", rc);
RTErrInfoAddV(pThis->pErrInfo, rc, pszMsg, va);
}
#endif
va_end(va);
return pThis->rcResult;
}
static int supHardNtVpReadImage(PSUPHNTVPIMAGE pImage, uint64_t off, void *pvBuf, size_t cbRead)
{
return pImage->pCacheEntry->pNtViRdr->Core.pfnRead(&pImage->pCacheEntry->pNtViRdr->Core, pvBuf, cbRead, off);
}
static NTSTATUS supHardNtVpReadMem(HANDLE hProcess, uintptr_t uPtr, void *pvBuf, size_t cbRead)
{
#ifdef IN_RING0
/* ASSUMES hProcess is the current process. */
/** @todo use MmCopyVirtualMemory where available! */
int rc = RTR0MemUserCopyFrom(pvBuf, uPtr, cbRead);
if (RT_SUCCESS(rc))
return STATUS_SUCCESS;
return STATUS_ACCESS_DENIED;
#else
SIZE_T cbIgn;
NTSTATUS rcNt = NtReadVirtualMemory(hProcess, (PVOID)uPtr, pvBuf, cbRead, &cbIgn);
if (NT_SUCCESS(rcNt) && cbIgn != cbRead)
rcNt = STATUS_IO_DEVICE_ERROR;
return rcNt;
#endif
}
#ifdef IN_RING3
static NTSTATUS supHardNtVpFileMemRestore(PSUPHNTVPSTATE pThis, PVOID pvRestoreAddr, uint8_t const *pbFile, uint32_t cbToRestore,
uint32_t fCorrectProtection)
{
PVOID pvProt = pvRestoreAddr;
SIZE_T cbProt = cbToRestore;
ULONG fOldProt = 0;
NTSTATUS rcNt = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, PAGE_READWRITE, &fOldProt);
if (NT_SUCCESS(rcNt))
{
SIZE_T cbIgnored;
rcNt = NtWriteVirtualMemory(pThis->hProcess, pvRestoreAddr, pbFile, cbToRestore, &cbIgnored);
pvProt = pvRestoreAddr;
cbProt = cbToRestore;
NTSTATUS rcNt2 = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, fCorrectProtection, &fOldProt);
if (NT_SUCCESS(rcNt))
rcNt = rcNt2;
}
pThis->cFixes++;
return rcNt;
}
#endif /* IN_RING3 */
typedef struct SUPHNTVPSKIPAREA
{
uint32_t uRva;
uint32_t cb;
} SUPHNTVPSKIPAREA;
typedef SUPHNTVPSKIPAREA *PSUPHNTVPSKIPAREA;
static int supHardNtVpFileMemCompareSection(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage,
uint32_t uRva, uint32_t cb, const uint8_t *pbFile,
int32_t iSh, PSUPHNTVPSKIPAREA paSkipAreas, uint32_t cSkipAreas,
uint32_t fCorrectProtection)
{
AssertCompileAdjacentMembers(SUPHNTVPSTATE, abMemory, abFile); /* Use both the memory and file buffers here. Parfait might hate me for this... */
uint32_t const cbMemory = sizeof(pThis->abMemory) + sizeof(pThis->abFile);
uint8_t * const pbMemory = &pThis->abMemory[0];
while (cb > 0)
{
uint32_t cbThis = RT_MIN(cb, cbMemory);
/* Clipping. */
uint32_t uNextRva = uRva + cbThis;
if (cSkipAreas)
{
uint32_t uRvaEnd = uNextRva;
uint32_t i = cSkipAreas;
while (i-- > 0)
{
uint32_t uSkipEnd = paSkipAreas[i].uRva + paSkipAreas[i].cb;
if ( uRva < uSkipEnd
&& uRvaEnd > paSkipAreas[i].uRva)
{
if (uRva < paSkipAreas[i].uRva)
{
cbThis = paSkipAreas[i].uRva - uRva;
uRvaEnd = paSkipAreas[i].uRva;
uNextRva = uSkipEnd;
}
else if (uRvaEnd >= uSkipEnd)
{
cbThis -= uSkipEnd - uRva;
uRva = uSkipEnd;
}
else
{
uNextRva = uSkipEnd;
cbThis = 0;
break;
}
}
}
}
/* Read the memory. */
NTSTATUS rcNt = supHardNtVpReadMem(pThis->hProcess, pImage->uImageBase + uRva, pbMemory, cbThis);
if (!NT_SUCCESS(rcNt))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_READ_ERROR,
"%s: Error reading %#x bytes at %p (rva %#x, #%u, %.8s) from memory: %#x",
pImage->pszName, cbThis, pImage->uImageBase + uRva, uRva, iSh + 1,
iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers", rcNt);
/* Do the compare. */
if (memcmp(pbFile, pbMemory, cbThis) != 0)
{
const char *pachSectNm = iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers";
SUP_DPRINTF(("%s: Differences in section #%u (%s) between file and memory:\n", pImage->pszName, iSh + 1, pachSectNm));
uint32_t off = 0;
while (off < cbThis && pbFile[off] == pbMemory[off])
off++;
SUP_DPRINTF((" %p / %#09x: %02x != %02x\n",
pImage->uImageBase + uRva + off, uRva + off, pbFile[off], pbMemory[off]));
uint32_t offLast = off;
uint32_t cDiffs = 1;
for (uint32_t off2 = off + 1; off2 < cbThis; off2++)
if (pbFile[off2] != pbMemory[off2])
{
SUP_DPRINTF((" %p / %#09x: %02x != %02x\n",
pImage->uImageBase + uRva + off2, uRva + off2, pbFile[off2], pbMemory[off2]));
cDiffs++;
offLast = off2;
}
#ifdef IN_RING3
if ( pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
|| pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
{
PVOID pvRestoreAddr = (uint8_t *)pImage->uImageBase + uRva;
rcNt = supHardNtVpFileMemRestore(pThis, pvRestoreAddr, pbFile, cbThis, fCorrectProtection);
if (NT_SUCCESS(rcNt))
SUP_DPRINTF((" Restored %#x bytes of original file content at %p\n", cbThis, pvRestoreAddr));
else
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
"%s: Failed to restore %#x bytes at %p (%#x, #%u, %s): %#x (cDiffs=%#x, first=%#x)",
pImage->pszName, cbThis, pvRestoreAddr, uRva, iSh + 1, pachSectNm, rcNt,
cDiffs, uRva + off);
}
else
#endif /* IN_RING3 */
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
"%s: %u differences between %#x and %#x in #%u (%.8s), first: %02x != %02x",
pImage->pszName, cDiffs, uRva + off, uRva + offLast, iSh + 1,
pachSectNm, pbFile[off], pbMemory[off]);
}
/* Advance. The clipping makes it a little bit complicated. */
cbThis = uNextRva - uRva;
if (cbThis >= cb)
break;
cb -= cbThis;
pbFile += cbThis;
uRva = uNextRva;
}
return VINF_SUCCESS;
}
static int supHardNtVpCheckSectionProtection(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage,
uint32_t uRva, uint32_t cb, uint32_t fProt)
{
uint32_t const cbOrg = cb;
if (!cb)
return VINF_SUCCESS;
if ( pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
|| pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
return VINF_SUCCESS;
for (uint32_t i = 0; i < pImage->cRegions; i++)
{
uint32_t offRegion = uRva - pImage->aRegions[i].uRva;
if (offRegion < pImage->aRegions[i].cb)
{
uint32_t cbLeft = pImage->aRegions[i].cb - offRegion;
if ( pImage->aRegions[i].fProt != fProt
&& ( fProt != PAGE_READWRITE
|| pImage->aRegions[i].fProt != PAGE_WRITECOPY))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_SECTION_PROTECTION_MISMATCH,
"%s: RVA range %#x-%#x protection is %#x, expected %#x. (cb=%#x)",
pImage->pszName, uRva, uRva + cbLeft - 1, pImage->aRegions[i].fProt, fProt, cb);
if (cbLeft >= cb)
return VINF_SUCCESS;
cb -= cbLeft;
uRva += cbLeft;
#if 0 /* This shouldn't ever be necessary. */
if ( i + 1 < pImage->cRegions
&& uRva < pImage->aRegions[i + 1].uRva)
{
cbLeft = pImage->aRegions[i + 1].uRva - uRva;
if (cbLeft >= cb)
return VINF_SUCCESS;
cb -= cbLeft;
uRva += cbLeft;
}
#endif
}
}
return supHardNtVpSetInfo2(pThis, cbOrg == cb ? VERR_SUP_VP_SECTION_NOT_MAPPED : VERR_SUP_VP_SECTION_NOT_FULLY_MAPPED,
"%s: RVA range %#x-%#x is not mapped?", pImage->pszName, uRva, uRva + cb - 1);
}
static DECLINLINE(bool) supHardNtVpIsModuleNameMatch(PSUPHNTVPIMAGE pImage, const char *pszModule)
{
if (pImage->fDll)
{
const char *pszImageNm = pImage->pszName;
for (;;)
{
char chLeft = *pszImageNm++;
char chRight = *pszModule++;
if (chLeft != chRight)
{
Assert(chLeft == RT_C_TO_LOWER(chLeft));
if (chLeft != RT_C_TO_LOWER(chRight))
{
if ( chRight == '\0'
&& chLeft == '.'
&& pszImageNm[0] == 'd'
&& pszImageNm[1] == 'l'
&& pszImageNm[2] == 'l'
&& pszImageNm[3] == '\0')
return true;
break;
}
}
if (chLeft == '\0')
return true;
}
}
return false;
}
/**
* Worker for supHardNtVpGetImport that looks up a module in the module table.
*
* @returns Pointer to the module if found, NULL if not found.
* @param pThis The process validator instance.
* @param pszModule The name of the module we're looking for.
*/
static PSUPHNTVPIMAGE supHardNtVpFindModule(PSUPHNTVPSTATE pThis, const char *pszModule)
{
/*
* Check out the hint first.
*/
if ( pThis->iImageHint < pThis->cImages
&& supHardNtVpIsModuleNameMatch(&pThis->aImages[pThis->iImageHint], pszModule))
return &pThis->aImages[pThis->iImageHint];
/*
* Linear array search next.
*/
uint32_t i = pThis->cImages;
while (i-- > 0)
if (supHardNtVpIsModuleNameMatch(&pThis->aImages[i], pszModule))
{
pThis->iImageHint = i;
return &pThis->aImages[i];
}
/* No cigar. */
return NULL;
}
/**
* @callback_method_impl{FNRTLDRIMPORT}
*/
static DECLCALLBACK(int) supHardNtVpGetImport(RTLDRMOD hLdrMod, const char *pszModule, const char *pszSymbol, unsigned uSymbol,
PRTLDRADDR pValue, void *pvUser)
{
/*SUP_DPRINTF(("supHardNtVpGetImport: %s / %#x / %s.\n", pszModule, uSymbol, pszSymbol));*/
PSUPHNTVPSTATE pThis = (PSUPHNTVPSTATE)pvUser;
int rc = VERR_MODULE_NOT_FOUND;
PSUPHNTVPIMAGE pImage = supHardNtVpFindModule(pThis, pszModule);
if (pImage)
{
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
pImage->uImageBase, uSymbol, pszSymbol, pValue);
if (RT_SUCCESS(rc))
return rc;
}
/*
* API set hacks.
*/
else if (!RTStrNICmp(pszModule, RT_STR_TUPLE("api-ms-win-")))
{
static const char * const s_apszDlls[] = { "ntdll.dll", "kernelbase.dll", "kernel32.dll" };
for (uint32_t i = 0; i < RT_ELEMENTS(s_apszDlls); i++)
{
pImage = supHardNtVpFindModule(pThis, s_apszDlls[i]);
if (pImage)
{
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
pImage->uImageBase, uSymbol, pszSymbol, pValue);
if (RT_SUCCESS(rc))
return rc;
if (rc != VERR_SYMBOL_NOT_FOUND)
break;
}
}
}
/*
* Deal with forwarders.
* ASSUMES no forwarders thru any api-ms-win-core-*.dll.
* ASSUMES forwarders are resolved after one redirection.
*/
if (rc == VERR_LDR_FORWARDER)
{
size_t cbInfo = RT_MIN((uint32_t)*pValue, sizeof(RTLDRIMPORTINFO) + 32);
PRTLDRIMPORTINFO pInfo = (PRTLDRIMPORTINFO)alloca(cbInfo);
rc = RTLdrQueryForwarderInfo(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
uSymbol, pszSymbol, pInfo, cbInfo);
if (RT_SUCCESS(rc))
{
rc = VERR_MODULE_NOT_FOUND;
pImage = supHardNtVpFindModule(pThis, pInfo->szModule);
if (pImage)
{
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
pImage->uImageBase, pInfo->iOrdinal, pInfo->pszSymbol, pValue);
if (RT_SUCCESS(rc))
return rc;
SUP_DPRINTF(("supHardNtVpGetImport: Failed to find symbol '%s' in '%s' (forwarded from %s / %s): %Rrc\n",
pInfo->pszSymbol, pInfo->szModule, pszModule, pszSymbol, rc));
if (rc == VERR_LDR_FORWARDER)
rc = VERR_LDR_FORWARDER_CHAIN_TOO_LONG;
}
else
SUP_DPRINTF(("supHardNtVpGetImport: Failed to find forwarder module '%s' (%#x / %s; originally %s / %#x / %s): %Rrc\n",
pInfo->szModule, pInfo->iOrdinal, pInfo->pszSymbol, pszModule, uSymbol, pszSymbol, rc));
}
else
SUP_DPRINTF(("supHardNtVpGetImport: RTLdrQueryForwarderInfo failed on symbol %#x/'%s' in '%s': %Rrc\n",
uSymbol, pszSymbol, pszModule, rc));
}
else
SUP_DPRINTF(("supHardNtVpGetImport: Failed to find symbol %#x / '%s' in '%s': %Rrc\n",
uSymbol, pszSymbol, pszModule, rc));
return rc;
}
/**
* Compares process memory with the disk content.
*
* @returns VBox status code.
* @param pThis The process scanning state structure (for the
* two scratch buffers).
* @param pImage The image data collected during the address
* space scan.
* @param hProcess Handle to the process.
* @param pErrInfo Pointer to error info structure. Optional.
*/
static int supHardNtVpVerifyImageMemoryCompare(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, HANDLE hProcess, PRTERRINFO pErrInfo)
{
/*
* Read and find the file headers.
*/
int rc = supHardNtVpReadImage(pImage, 0 /*off*/, pThis->abFile, sizeof(pThis->abFile));
if (RT_FAILURE(rc))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_IMAGE_HDR_READ_ERROR,
"%s: Error reading image header: %Rrc", pImage->pszName, rc);
uint32_t offNtHdrs = 0;
PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)&pThis->abFile[0];
if (pDosHdr->e_magic == IMAGE_DOS_SIGNATURE)
{
offNtHdrs = pDosHdr->e_lfanew;
if (offNtHdrs > 512 || offNtHdrs < sizeof(*pDosHdr))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_MZ_OFFSET,
"%s: Unexpected e_lfanew value: %#x", pImage->pszName, offNtHdrs);
}
PIMAGE_NT_HEADERS pNtHdrs = (PIMAGE_NT_HEADERS)&pThis->abFile[offNtHdrs];
PIMAGE_NT_HEADERS32 pNtHdrs32 = (PIMAGE_NT_HEADERS32)pNtHdrs;
if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIGNATURE,
"%s: No PE signature at %#x: %#x", pImage->pszName, offNtHdrs, pNtHdrs->Signature);
/*
* Do basic header validation.
*/
#ifdef RT_ARCH_AMD64
if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && !pImage->f32bitResourceDll)
#else
if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_I386)
#endif
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_IMAGE_MACHINE,
"%s: Unexpected machine: %#x", pImage->pszName, pNtHdrs->FileHeader.Machine);
bool const fIs32Bit = pNtHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386;
if (pNtHdrs->FileHeader.SizeOfOptionalHeader != (fIs32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
"%s: Unexpected optional header size: %#x",
pImage->pszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
if (pNtHdrs->OptionalHeader.Magic != (fIs32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
"%s: Unexpected optional header magic: %#x", pImage->pszName, pNtHdrs->OptionalHeader.Magic);
uint32_t cDirs = (fIs32Bit ? pNtHdrs32->OptionalHeader.NumberOfRvaAndSizes : pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
if (cDirs != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
"%s: Unexpected data dirs: %#x", pImage->pszName, cDirs);
/*
* Before we start comparing things, store what we need to know from the headers.
*/
uint32_t const cSections = pNtHdrs->FileHeader.NumberOfSections;
if (cSections > RT_ELEMENTS(pThis->aSecHdrs))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_SECTIONS,
"%s: Too many section headers: %#x", pImage->pszName, cSections);
suplibHardenedMemCopy(pThis->aSecHdrs, (fIs32Bit ? (void *)(pNtHdrs32 + 1) : (void *)(pNtHdrs + 1)),
cSections * sizeof(IMAGE_SECTION_HEADER));
uintptr_t const uImageBase = fIs32Bit ? pNtHdrs32->OptionalHeader.ImageBase : pNtHdrs->OptionalHeader.ImageBase;
if (uImageBase & PAGE_OFFSET_MASK)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_BASE,
"%s: Invalid image base: %p", pImage->pszName, uImageBase);
uint32_t const cbImage = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfImage : pNtHdrs->OptionalHeader.SizeOfImage;
if (RT_ALIGN_32(pImage->cbImage, PAGE_SIZE) != RT_ALIGN_32(cbImage, PAGE_SIZE) && !pImage->fApiSetSchemaOnlySection1)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
"%s: SizeOfImage (%#x) isn't close enough to the mapping size (%#x)",
pImage->pszName, cbImage, pImage->cbImage);
if (cbImage != RTLdrSize(pImage->pCacheEntry->hLdrMod))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
"%s: SizeOfImage (%#x) differs from what RTLdrSize returns (%#zx)",
pImage->pszName, cbImage, RTLdrSize(pImage->pCacheEntry->hLdrMod));
uint32_t const cbSectAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.SectionAlignment : pNtHdrs->OptionalHeader.SectionAlignment;
if ( !RT_IS_POWER_OF_TWO(cbSectAlign)
|| cbSectAlign < PAGE_SIZE
|| cbSectAlign > (pImage->fApiSetSchemaOnlySection1 ? _64K : (uint32_t)PAGE_SIZE) )
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_ALIGNMENT_VALUE,
"%s: Unexpected SectionAlignment value: %#x", pImage->pszName, cbSectAlign);
uint32_t const cbFileAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.FileAlignment : pNtHdrs->OptionalHeader.FileAlignment;
if (!RT_IS_POWER_OF_TWO(cbFileAlign) || cbFileAlign < 512 || cbFileAlign > PAGE_SIZE || cbFileAlign > cbSectAlign)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_FILE_ALIGNMENT_VALUE,
"%s: Unexpected FileAlignment value: %#x (cbSectAlign=%#x)",
pImage->pszName, cbFileAlign, cbSectAlign);
uint32_t const cbHeaders = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfHeaders : pNtHdrs->OptionalHeader.SizeOfHeaders;
uint32_t const cbMinHdrs = offNtHdrs + (fIs32Bit ? sizeof(*pNtHdrs32) : sizeof(*pNtHdrs) )
+ sizeof(IMAGE_SECTION_HEADER) * cSections;
if (cbHeaders < cbMinHdrs)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
"%s: Headers are too small: %#x < %#x (cSections=%#x)",
pImage->pszName, cbHeaders, cbMinHdrs, cSections);
uint32_t const cbHdrsFile = RT_ALIGN_32(cbHeaders, cbFileAlign);
if (cbHdrsFile > sizeof(pThis->abFile))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
"%s: Headers are larger than expected: %#x/%#x (expected max %zx)",
pImage->pszName, cbHeaders, cbHdrsFile, sizeof(pThis->abFile));
/*
* Save some header fields we might be using later on.
*/
pImage->fImageCharecteristics = pNtHdrs->FileHeader.Characteristics;
pImage->fDllCharecteristics = fIs32Bit ? pNtHdrs32->OptionalHeader.DllCharacteristics : pNtHdrs->OptionalHeader.DllCharacteristics;
/*
* Correct the apisetschema image base, size and region rva.
*/
if (pImage->fApiSetSchemaOnlySection1)
{
pImage->uImageBase -= pThis->aSecHdrs[0].VirtualAddress;
pImage->cbImage += pThis->aSecHdrs[0].VirtualAddress;
pImage->aRegions[0].uRva = pThis->aSecHdrs[0].VirtualAddress;
}
/*
* Get relocated bits.
*/
uint8_t *pbBits;
if (pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
rc = supHardNtLdrCacheEntryGetBits(pImage->pCacheEntry, &pbBits, pImage->uImageBase, NULL /*pfnGetImport*/, pThis,
pThis->pErrInfo);
else
rc = supHardNtLdrCacheEntryGetBits(pImage->pCacheEntry, &pbBits, pImage->uImageBase, supHardNtVpGetImport, pThis,
pThis->pErrInfo);
if (RT_FAILURE(rc))
return rc;
/* XP SP3 does not set ImageBase to load address. It fixes up the image on load time though. */
if (g_uNtVerCombined >= SUP_NT_VER_VISTA)
{
if (fIs32Bit)
((PIMAGE_NT_HEADERS32)&pbBits[offNtHdrs])->OptionalHeader.ImageBase = (uint32_t)pImage->uImageBase;
else
((PIMAGE_NT_HEADERS)&pbBits[offNtHdrs])->OptionalHeader.ImageBase = pImage->uImageBase;
}
/*
* Figure out areas we should skip during comparison.
*/
uint32_t cSkipAreas = 0;
SUPHNTVPSKIPAREA aSkipAreas[5];
if (pImage->fNtCreateSectionPatch)
{
RTLDRADDR uValue;
if (pThis->enmKind == SUPHARDNTVPKIND_VERIFY_ONLY)
{
/* Ignore our NtCreateSection hack. */
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "NtCreateSection", &uValue);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'NtCreateSection': %Rrc", pImage->pszName, rc);
aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue;
aSkipAreas[cSkipAreas++].cb = ARCH_BITS == 32 ? 5 : 12;
/* Ignore our LdrLoadDll hack. */
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrLoadDll", &uValue);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'LdrLoadDll': %Rrc", pImage->pszName, rc);
aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue;
aSkipAreas[cSkipAreas++].cb = ARCH_BITS == 32 ? 5 : 12;
}
/* Ignore our patched LdrInitializeThunk hack. */
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrInitializeThunk", &uValue);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'LdrInitializeThunk': %Rrc", pImage->pszName, rc);
aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue;
aSkipAreas[cSkipAreas++].cb = 14;
/* LdrSystemDllInitBlock is filled in by the kernel. It mainly contains addresses of 32-bit ntdll method for wow64. */
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrSystemDllInitBlock", &uValue);
if (RT_SUCCESS(rc))
{
aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue;
aSkipAreas[cSkipAreas++].cb = RT_MAX(pbBits[(uint32_t)uValue], 0x50);
}
Assert(cSkipAreas <= RT_ELEMENTS(aSkipAreas));
}
/*
* Compare the file header with the loaded bits. The loader will fiddle
* with image base, changing it to the actual load address.
*/
if (!pImage->fApiSetSchemaOnlySection1)
{
rc = supHardNtVpFileMemCompareSection(pThis, pImage, 0 /*uRva*/, cbHdrsFile, pbBits, -1, NULL, 0, PAGE_READONLY);
if (RT_FAILURE(rc))
return rc;
rc = supHardNtVpCheckSectionProtection(pThis, pImage, 0 /*uRva*/, cbHdrsFile, PAGE_READONLY);
if (RT_FAILURE(rc))
return rc;
}
/*
* Validate sections:
* - Check them against the mapping regions.
* - Check section bits according to enmKind.
*/
uint32_t fPrevProt = PAGE_READONLY;
uint32_t uRva = cbHdrsFile;
for (uint32_t i = 0; i < cSections; i++)
{
/* Validate the section. */
uint32_t uSectRva = pThis->aSecHdrs[i].VirtualAddress;
if (uSectRva < uRva || uSectRva > cbImage || RT_ALIGN_32(uSectRva, cbSectAlign) != uSectRva)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_RVA,
"%s: Section %u: Invalid virtual address: %#x (uRva=%#x, cbImage=%#x, cbSectAlign=%#x)",
pImage->pszName, i, uSectRva, uRva, cbImage, cbSectAlign);
uint32_t cbMap = pThis->aSecHdrs[i].Misc.VirtualSize;
if (cbMap > cbImage || uRva + cbMap > cbImage)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_VIRTUAL_SIZE,
"%s: Section %u: Invalid virtual size: %#x (uSectRva=%#x, uRva=%#x, cbImage=%#x)",
pImage->pszName, i, cbMap, uSectRva, uRva, cbImage);
uint32_t cbFile = pThis->aSecHdrs[i].SizeOfRawData;
if (cbFile != RT_ALIGN_32(cbFile, cbFileAlign) || cbFile > RT_ALIGN_32(cbMap, cbSectAlign))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_FILE_SIZE,
"%s: Section %u: Invalid file size: %#x (cbMap=%#x, uSectRva=%#x)",
pImage->pszName, i, cbFile, cbMap, uSectRva);
/* Validate the protection and bits. */
if (!pImage->fApiSetSchemaOnlySection1 || i == 0)
{
uint32_t fProt;
switch (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE))
{
case IMAGE_SCN_MEM_READ:
fProt = PAGE_READONLY;
break;
case IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE:
fProt = PAGE_READWRITE;
if ( pThis->enmKind != SUPHARDNTVPKIND_VERIFY_ONLY
&& pThis->enmKind != SUPHARDNTVPKIND_CHILD_PURIFICATION
&& !suplibHardenedMemComp(pThis->aSecHdrs[i].Name, ".mrdata", 8)) /* w8.1, ntdll. Changed by proc init. */
fProt = PAGE_READONLY;
break;
case IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_EXECUTE:
fProt = PAGE_EXECUTE_READ;
break;
case IMAGE_SCN_MEM_EXECUTE:
fProt = PAGE_EXECUTE;
break;
case IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE:
/* Only the executable is allowed to have this section,
and it's protected after we're done patching. */
if (!pImage->fDll)
{
if (pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
fProt = PAGE_EXECUTE_READWRITE;
else
fProt = PAGE_EXECUTE_READ;
break;
}
default:
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_SECTION_FLAGS,
"%s: Section %u: Unexpected characteristics: %#x (uSectRva=%#x, cbMap=%#x)",
pImage->pszName, i, pThis->aSecHdrs[i].Characteristics, uSectRva, cbMap);
}
/* The section bits. Child purification verifies all, normal
verification verifies all except where the executable is
concerned (due to opening vboxdrv during early process init). */
if ( ( (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_CODE))
&& !(pThis->aSecHdrs[i].Characteristics & IMAGE_SCN_MEM_WRITE))
|| (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE)) == IMAGE_SCN_MEM_READ
|| (pThis->enmKind == SUPHARDNTVPKIND_VERIFY_ONLY && pImage->fDll)
|| pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
{
rc = VINF_SUCCESS;
if (uRva < uSectRva && !pImage->fApiSetSchemaOnlySection1) /* Any gap worth checking? */
rc = supHardNtVpFileMemCompareSection(pThis, pImage, uRva, uSectRva - uRva, pbBits + uRva,
i - 1, NULL, 0, fPrevProt);
if (RT_SUCCESS(rc))
rc = supHardNtVpFileMemCompareSection(pThis, pImage, uSectRva, cbMap, pbBits + uSectRva,
i, aSkipAreas, cSkipAreas, fProt);
if (RT_SUCCESS(rc))
{
uint32_t cbMapAligned = i + 1 < cSections && !pImage->fApiSetSchemaOnlySection1
? RT_ALIGN_32(cbMap, cbSectAlign) : RT_ALIGN_32(cbMap, PAGE_SIZE);
if (cbMapAligned > cbMap)
rc = supHardNtVpFileMemCompareSection(pThis, pImage, uSectRva + cbMap, cbMapAligned - cbMap,
g_abRTZeroPage, i, NULL, 0, fProt);
}
if (RT_FAILURE(rc))
return rc;
}
/* The protection (must be checked afterwards!). */
rc = supHardNtVpCheckSectionProtection(pThis, pImage, uSectRva, RT_ALIGN_32(cbMap, PAGE_SIZE), fProt);
if (RT_FAILURE(rc))
return rc;
fPrevProt = fProt;
}
/* Advance the RVA. */
uRva = uSectRva + RT_ALIGN_32(cbMap, cbSectAlign);
}
return VINF_SUCCESS;
}
/**
* Verifies the signature of the given image on disk, then checks if the memory
* mapping matches what we verified.
*
* @returns VBox status code.
* @param pThis The process scanning state structure (for the
* two scratch buffers).
* @param pImage The image data collected during the address
* space scan.
* @param hProcess Handle to the process.
* @param hFile Handle to the image file.
*/
static int supHardNtVpVerifyImage(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, HANDLE hProcess)
{
/*
* Validate the file signature first, then do the memory compare.
*/
int rc;
if ( pImage->pCacheEntry != NULL
&& pImage->pCacheEntry->hLdrMod != NIL_RTLDRMOD)
{
rc = supHardNtLdrCacheEntryVerify(pImage->pCacheEntry, pImage->Name.UniStr.Buffer, pThis->pErrInfo);
if (RT_SUCCESS(rc))
rc = supHardNtVpVerifyImageMemoryCompare(pThis, pImage, hProcess, pThis->pErrInfo);
}
else
rc = supHardNtVpSetInfo2(pThis, VERR_OPEN_FAILED, "pCacheEntry/hLdrMod is NIL! Impossible!");
return rc;
}
/**
* Verifies that there is only one thread in the process.
*
* @returns VBox status code.
* @param hProcess The process.
* @param hThread The thread.
* @param pErrInfo Pointer to error info structure. Optional.
*/
DECLHIDDEN(int) supHardNtVpThread(HANDLE hProcess, HANDLE hThread, PRTERRINFO pErrInfo)
{
/*
* Use the ThreadAmILastThread request to check that there is only one
* thread in the process.
* Seems this isn't entirely reliable when hThread isn't the current thread?
*/
ULONG cbIgn = 0;
ULONG fAmI = 0;
NTSTATUS rcNt = NtQueryInformationThread(hThread, ThreadAmILastThread, &fAmI, sizeof(fAmI), &cbIgn);
if (!NT_SUCCESS(rcNt))
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NT_QI_THREAD_ERROR,
"NtQueryInformationThread/ThreadAmILastThread -> %#x", rcNt);
if (!fAmI)
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_THREAD_NOT_ALONE,
"More than one thread in process");
/** @todo Would be nice to verify the relation ship between hProcess and hThread
* as well... */
return VINF_SUCCESS;
}
/**
* Verifies that there isn't a debugger attached to the process.
*
* @returns VBox status code.
* @param hProcess The process.
* @param pErrInfo Pointer to error info structure. Optional.
*/
DECLHIDDEN(int) supHardNtVpDebugger(HANDLE hProcess, PRTERRINFO pErrInfo)
{
#ifndef VBOX_WITHOUT_DEBUGGER_CHECKS
/*
* Use the ProcessDebugPort request to check there is no debugger
* currently attached to the process.
*/
ULONG cbIgn = 0;
uintptr_t uPtr = ~(uintptr_t)0;
NTSTATUS rcNt = NtQueryInformationProcess(hProcess,
ProcessDebugPort,
&uPtr, sizeof(uPtr), &cbIgn);
if (!NT_SUCCESS(rcNt))
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NT_QI_PROCESS_DBG_PORT_ERROR,
"NtQueryInformationProcess/ProcessDebugPort -> %#x", rcNt);
if (uPtr != 0)
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_DEBUGGED,
"Debugger attached (%#zx)", uPtr);
#endif /* !VBOX_WITHOUT_DEBUGGER_CHECKS */
return VINF_SUCCESS;
}
/**
* Checks whether the path could be containing alternative 8.3 names generated
* by NTFS, FAT, or other similar file systems.
*
* @returns Pointer to the first component that might be an 8.3 name, NULL if
* not 8.3 path.
* @param pwszPath The path to check.
*
* @remarks This is making bad ASSUMPTION wrt to the naming scheme of 8.3 names,
* however, non-tilde 8.3 aliases are probably rare enough to not be
* worth all the extra code necessary to open each path component and
* check if we've got the short name or not.
*/
DECLHIDDEN(PRTUTF16) supHardNtVpIsPossible8dot3Path(PCRTUTF16 pwszPath)
{
PCRTUTF16 pwszName = pwszPath;
for (;;)
{
RTUTF16 wc = *pwszPath++;
if (wc == '~')
{
/* Could check more here before jumping to conclusions... */
if (pwszPath - pwszName <= 8+1+3)
return (PRTUTF16)pwszName;
}
else if (wc == '\\' || wc == '/' || wc == ':')
pwszName = pwszPath;
else if (wc == 0)
break;
}
return NULL;
}
/**
* Fixes up a path possibly containing one or more alternative 8-dot-3 style
* components.
*
* The path is fixed up in place. Errors are ignored.
*
* @param pUniStr The path to fix up. MaximumLength is the max buffer
* length.
*/
DECLHIDDEN(void) supHardNtVpFix8dot3Path(PUNICODE_STRING pUniStr, bool fPathOnly)
{
/*
* We could use FileNormalizedNameInformation here and slap the volume device
* path in front of the result, but it's only supported since windows 8.0
* according to some docs... So we expand all supicious names.
*/
union fix8dot3tmp
{
FILE_BOTH_DIR_INFORMATION Info;
uint8_t abBuffer[sizeof(FILE_BOTH_DIR_INFORMATION) + 2048 * sizeof(WCHAR)];
} *puBuf = NULL;
PRTUTF16 pwszFix = pUniStr->Buffer;
while (*pwszFix)
{
pwszFix = supHardNtVpIsPossible8dot3Path(pwszFix);
if (pwszFix == NULL)
break;
RTUTF16 wc;
PRTUTF16 pwszFixEnd = pwszFix;
while ((wc = *pwszFixEnd) != '\0' && wc != '\\' && wc != '/')
pwszFixEnd++;
if (wc == '\0' && fPathOnly)
break;
if (!puBuf)
{
puBuf = (union fix8dot3tmp *)RTMemAlloc(sizeof(*puBuf));
if (!puBuf)
break;
}
RTUTF16 const wcSaved = *pwszFix;
*pwszFix = '\0'; /* paranoia. */
UNICODE_STRING NtDir;
NtDir.Buffer = pUniStr->Buffer;
NtDir.Length = NtDir.MaximumLength = (USHORT)((pwszFix - pUniStr->Buffer) * sizeof(WCHAR));
HANDLE hDir = RTNT_INVALID_HANDLE_VALUE;
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
OBJECT_ATTRIBUTES ObjAttr;
InitializeObjectAttributes(&ObjAttr, &NtDir, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
#ifdef IN_RING0
ObjAttr.Attributes |= OBJ_KERNEL_HANDLE;
#endif
NTSTATUS rcNt = NtCreateFile(&hDir,
FILE_READ_DATA | SYNCHRONIZE,
&ObjAttr,
&Ios,
NULL /* Allocation Size*/,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OPEN,
FILE_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT | FILE_SYNCHRONOUS_IO_NONALERT,
NULL /*EaBuffer*/,
0 /*EaLength*/);
*pwszFix = wcSaved;
if (NT_SUCCESS(rcNt))
{
RT_ZERO(*puBuf);
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
UNICODE_STRING NtFilterStr;
NtFilterStr.Buffer = pwszFix;
NtFilterStr.Length = (USHORT)((uintptr_t)pwszFixEnd - (uintptr_t)pwszFix);
NtFilterStr.MaximumLength = NtFilterStr.Length;
rcNt = NtQueryDirectoryFile(hDir,
NULL /* Event */,
NULL /* ApcRoutine */,
NULL /* ApcContext */,
&Ios,
puBuf,
sizeof(*puBuf) - sizeof(WCHAR),
FileBothDirectoryInformation,
FALSE /*ReturnSingleEntry*/,
&NtFilterStr,
FALSE /*RestartScan */);
if (NT_SUCCESS(rcNt) && puBuf->Info.NextEntryOffset == 0) /* There shall only be one entry matching... */
{
uint32_t offName = puBuf->Info.FileNameLength / sizeof(WCHAR);
while (offName > 0 && puBuf->Info.FileName[offName - 1] != '\\' && puBuf->Info.FileName[offName - 1] != '/')
offName--;
uint32_t cwcNameNew = (puBuf->Info.FileNameLength / sizeof(WCHAR)) - offName;
uint32_t cwcNameOld = (uint32_t)(pwszFixEnd - pwszFix);
if (cwcNameOld == cwcNameNew)
memcpy(pwszFix, &puBuf->Info.FileName[offName], cwcNameNew * sizeof(WCHAR));
else if ( pUniStr->Length + cwcNameNew * sizeof(WCHAR) - cwcNameOld * sizeof(WCHAR) + sizeof(WCHAR)
<= pUniStr->MaximumLength)
{
size_t cwcLeft = pUniStr->Length - (pwszFixEnd - pUniStr->Buffer) * sizeof(WCHAR) + sizeof(WCHAR);
memmove(&pwszFix[cwcNameNew], pwszFixEnd, cwcLeft * sizeof(WCHAR));
pUniStr->Length -= (USHORT)(cwcNameOld * sizeof(WCHAR));
pUniStr->Length += (USHORT)(cwcNameNew * sizeof(WCHAR));
pwszFixEnd -= cwcNameOld;
pwszFixEnd -= cwcNameNew;
memcpy(pwszFix, &puBuf->Info.FileName[offName], cwcNameNew * sizeof(WCHAR));
}
/* else: ignore overflow. */
}
/* else: ignore failure. */
NtClose(hDir);
}
/* Advance */
pwszFix = pwszFixEnd;
}
if (puBuf)
RTMemFree(puBuf);
}
/**
* Matches two UNICODE_STRING structures in a case sensitive fashion.
*
* @returns true if equal, false if not.
* @param pUniStr1 The first unicode string.
* @param pUniStr2 The first unicode string.
*/
static bool supHardNtVpAreUniStringsEqual(PCUNICODE_STRING pUniStr1, PCUNICODE_STRING pUniStr2)
{
if (pUniStr1->Length != pUniStr2->Length)
return false;
return suplibHardenedMemComp(pUniStr1->Buffer, pUniStr2->Buffer, pUniStr1->Length) == 0;
}
/**
* Performs a case insensitive comparison of an ASCII and an UTF-16 file name.
*
* @returns true / false
* @param pszName1 The ASCII name.
* @param pwszName2 The UTF-16 name.
*/
static bool supHardNtVpAreNamesEqual(const char *pszName1, PCRTUTF16 pwszName2)
{
for (;;)
{
char ch1 = *pszName1++;
RTUTF16 wc2 = *pwszName2++;
if (ch1 != wc2)
{
ch1 = RT_C_TO_LOWER(ch1);
wc2 = wc2 < 0x80 ? RT_C_TO_LOWER(wc2) : wc2;
if (ch1 != wc2)
return false;
}
if (!ch1)
return true;
}
}
/**
* Records an additional memory region for an image.
*
* May trash pThis->abMemory.
*
* @returns VBox status code.
* @retval VINF_OBJECT_DESTROYED if we've unmapped the image (child
* purification only).
* @param pThis The process scanning state structure.
* @param pImage The new image structure. Only the unicode name
* buffer is valid (it's zero-terminated).
* @param pMemInfo The memory information for the image.
*/
static int supHardNtVpNewImage(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, PMEMORY_BASIC_INFORMATION pMemInfo)
{
/*
* If the filename or path contains short names, we have to get the long
* path so that we will recognize the DLLs and their location.
*/
PUNICODE_STRING pLongName = &pImage->Name.UniStr;
if (supHardNtVpIsPossible8dot3Path(pLongName->Buffer))
{
AssertCompile(sizeof(pThis->abMemory) > sizeof(pImage->Name));
PUNICODE_STRING pTmp = (PUNICODE_STRING)pThis->abMemory;
pTmp->MaximumLength = (USHORT)RT_MIN(_64K - 1, sizeof(pThis->abMemory) - sizeof(*pTmp)) - sizeof(RTUTF16);
pTmp->Length = pImage->Name.UniStr.Length;
pTmp->Buffer = (PRTUTF16)(pTmp + 1);
memcpy(pTmp->Buffer, pLongName->Buffer, pLongName->Length + sizeof(RTUTF16));
supHardNtVpFix8dot3Path(pTmp, false /*fPathOnly*/);
Assert(pTmp->Buffer[pTmp->Length / sizeof(RTUTF16)] == '\0');
pLongName = pTmp;
}
/*
* Extract the final component.
*/
RTUTF16 wc;
unsigned cwcDirName = pLongName->Length / sizeof(WCHAR);
PCRTUTF16 pwcDirName = &pLongName->Buffer[cwcDirName];
PCRTUTF16 pwszFilename = &pLongName->Buffer[cwcDirName];
while ( cwcDirName > 0
&& (wc = pwszFilename[-1]) != '\\'
&& wc != '/'
&& wc != ':')
{
pwszFilename--;
cwcDirName--;
}
if (!*pwszFilename)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_IMAGE_MAPPING_NAME,
"Empty filename (len=%u) for image at %p.", pLongName->Length, pMemInfo->BaseAddress);
/*
* Drop trailing slashes from the directory name.
*/
while ( cwcDirName > 0
&& ( pLongName->Buffer[cwcDirName - 1] == '\\'
|| pLongName->Buffer[cwcDirName - 1] == '/'))
cwcDirName--;
/*
* Match it against known DLLs.
*/
pImage->pszName = NULL;
for (uint32_t i = 0; i < RT_ELEMENTS(g_apszSupNtVpAllowedDlls); i++)
if (supHardNtVpAreNamesEqual(g_apszSupNtVpAllowedDlls[i], pwszFilename))
{
pImage->pszName = g_apszSupNtVpAllowedDlls[i];
pImage->fDll = true;
#ifndef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
/* The directory name must match the one we've got for System32. */
if ( ( cwcDirName * sizeof(WCHAR) != g_System32NtPath.UniStr.Length
|| suplibHardenedMemComp(pLongName->Buffer, g_System32NtPath.UniStr.Buffer, cwcDirName * sizeof(WCHAR)) )
# ifdef VBOX_PERMIT_MORE
&& ( pImage->pszName[0] != 'a'
|| pImage->pszName[1] != 'c'
|| !supHardViIsAppPatchDir(pLongName->Buffer, pLongName->Length / sizeof(WCHAR)) )
# endif
)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NON_SYSTEM32_DLL,
"Expected %ls to be loaded from %ls.",
pLongName->Buffer, g_System32NtPath.UniStr.Buffer);
# ifdef VBOX_PERMIT_MORE
if (g_uNtVerCombined < SUP_NT_VER_W70 && i >= VBOX_PERMIT_MORE_FIRST_IDX)
pImage->pszName = NULL; /* hard limit: user32.dll is unwanted prior to w7. */
# endif
#endif /* VBOX_PERMIT_VISUAL_STUDIO_PROFILING */
break;
}
if (!pImage->pszName)
{
/*
* Not a known DLL, is it a known executable?
*/
for (uint32_t i = 0; i < RT_ELEMENTS(g_apszSupNtVpAllowedVmExes); i++)
if (supHardNtVpAreNamesEqual(g_apszSupNtVpAllowedVmExes[i], pwszFilename))
{
pImage->pszName = g_apszSupNtVpAllowedVmExes[i];
pImage->fDll = false;
break;
}
}
if (!pImage->pszName)
{
/*
* Unknown image.
*
* If we're cleaning up a child process, we can unmap the offending
* DLL... Might have interesting side effects, or at least interesting
* as in "may you live in interesting times".
*/
#ifdef IN_RING3
if ( pMemInfo->AllocationBase == pMemInfo->BaseAddress
&& pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
{
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Unmapping image mem at %p (%p LB %#zx) - '%ls'\n",
pMemInfo->AllocationBase, pMemInfo->BaseAddress, pMemInfo->RegionSize, pwszFilename));
NTSTATUS rcNt = NtUnmapViewOfSection(pThis->hProcess, pMemInfo->AllocationBase);
if (NT_SUCCESS(rcNt))
return VINF_OBJECT_DESTROYED;
pThis->cFixes++;
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: NtUnmapViewOfSection(,%p) failed: %#x\n", pMemInfo->AllocationBase, rcNt));
}
#endif
/*
* Special error message if we can.
*/
if ( pMemInfo->AllocationBase == pMemInfo->BaseAddress
&& ( supHardNtVpAreNamesEqual("sysfer.dll", pwszFilename)
|| supHardNtVpAreNamesEqual("sysfer32.dll", pwszFilename)
|| supHardNtVpAreNamesEqual("sysfer64.dll", pwszFilename)
|| supHardNtVpAreNamesEqual("sysfrethunk.dll", pwszFilename)) )
{
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_SYSFER_DLL,
"Found %ls at %p - This is probably part of Symantec Endpoint Protection. \n"
"You or your admin need to add and exception to the Application and Device Control (ADC) "
"component (or disable it) to prevent ADC from injecting itself into the VirtualBox VM processes. "
"See http://www.symantec.com/connect/articles/creating-application-control-exclusions-symantec-endpoint-protection-121"
, pLongName->Buffer, pMemInfo->BaseAddress);
return pThis->rcResult = VERR_SUP_VP_SYSFER_DLL; /* Try make sure this is what the user sees first! */
}
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NOT_KNOWN_DLL_OR_EXE,
"Unknown image file %ls at %p.", pLongName->Buffer, pMemInfo->BaseAddress);
}
/*
* Checks for multiple mappings of the same DLL but with different image file paths.
*/
uint32_t i = pThis->cImages;
while (i-- > 1)
if (pImage->pszName == pThis->aImages[i].pszName)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_DUPLICATE_DLL_MAPPING,
"Duplicate image entries for %s: %ls and %ls",
pImage->pszName, pImage->Name.UniStr.Buffer, pThis->aImages[i].Name.UniStr.Buffer);
/*
* Since it's a new image, we expect to be at the start of the mapping now.
*/
if (pMemInfo->AllocationBase != pMemInfo->BaseAddress)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_IMAGE_MAPPING_BASE_ERROR,
"Invalid AllocationBase/BaseAddress for %s: %p vs %p.",
pImage->pszName, pMemInfo->AllocationBase, pMemInfo->BaseAddress);
/*
* Check for size/rva overflow.
*/
if (pMemInfo->RegionSize >= _2G)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_LARGE_REGION,
"Region 0 of image %s is too large: %p.", pImage->pszName, pMemInfo->RegionSize);
/*
* Fill in details from the memory info.
*/
pImage->uImageBase = (uintptr_t)pMemInfo->AllocationBase;
pImage->cbImage = pMemInfo->RegionSize;
pImage->pCacheEntry= NULL;
pImage->cRegions = 1;
pImage->aRegions[0].uRva = 0;
pImage->aRegions[0].cb = (uint32_t)pMemInfo->RegionSize;
pImage->aRegions[0].fProt = pMemInfo->Protect;
if (suplibHardenedStrCmp(pImage->pszName, "ntdll.dll") == 0)
pImage->fNtCreateSectionPatch = true;
else if (suplibHardenedStrCmp(pImage->pszName, "apisetschema.dll") == 0)
pImage->fApiSetSchemaOnlySection1 = true; /** @todo Check the ApiSetMap field in the PEB. */
#ifdef VBOX_PERMIT_MORE
else if (suplibHardenedStrCmp(pImage->pszName, "acres.dll") == 0)
pImage->f32bitResourceDll = true;
#endif
return VINF_SUCCESS;
}
/**
* Records an additional memory region for an image.
*
* @returns VBox status code.
* @param pThis The process scanning state structure.
* @param pImage The image.
* @param pMemInfo The memory information for the region.
*/
static int supHardNtVpAddRegion(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, PMEMORY_BASIC_INFORMATION pMemInfo)
{
/*
* Make sure the base address matches.
*/
if (pImage->uImageBase != (uintptr_t)pMemInfo->AllocationBase)
return supHardNtVpSetInfo2(pThis, VERR_SUPLIB_NT_PROCESS_UNTRUSTED_3,
"Base address mismatch for %s: have %p, found %p for region %p LB %#zx.",
pImage->pszName, pImage->uImageBase, pMemInfo->AllocationBase,
pMemInfo->BaseAddress, pMemInfo->RegionSize);
/*
* Check for size and rva overflows.
*/
uintptr_t uRva = (uintptr_t)pMemInfo->BaseAddress - pImage->uImageBase;
if (pMemInfo->RegionSize >= _2G)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_LARGE_REGION,
"Region %u of image %s is too large: %p/%p.", pImage->pszName, pMemInfo->RegionSize, uRva);
if (uRva >= _2G)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_HIGH_REGION_RVA,
"Region %u of image %s is too high: %p/%p.", pImage->pszName, pMemInfo->RegionSize, uRva);
/*
* Record the region.
*/
uint32_t iRegion = pImage->cRegions;
if (iRegion + 1 >= RT_ELEMENTS(pImage->aRegions))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_IMAGE_REGIONS,
"Too many regions for %s.", pImage->pszName);
pImage->aRegions[iRegion].uRva = (uint32_t)uRva;
pImage->aRegions[iRegion].cb = (uint32_t)pMemInfo->RegionSize;
pImage->aRegions[iRegion].fProt = pMemInfo->Protect;
pImage->cbImage = pImage->aRegions[iRegion].uRva + pImage->aRegions[iRegion].cb;
pImage->cRegions++;
pImage->fApiSetSchemaOnlySection1 = false;
return VINF_SUCCESS;
}
/**
* Scans the virtual memory of the process.
*
* This collects the locations of DLLs and the EXE, and verifies that executable
* memory is only associated with these. May trash pThis->abMemory.
*
* @returns VBox status code.
* @param pThis The process scanning state structure. Details
* about images are added to this.
* @param hProcess The process to verify.
*/
static int supHardNtVpScanVirtualMemory(PSUPHNTVPSTATE pThis, HANDLE hProcess)
{
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: enmKind=%s\n",
pThis->enmKind == SUPHARDNTVPKIND_VERIFY_ONLY ? "VERIFY_ONLY" :
pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION ? "CHILD_PURIFICATION" : "SELF_PURIFICATION"));
uint32_t cXpExceptions = 0;
uintptr_t cbAdvance = 0;
uintptr_t uPtrWhere = 0;
#ifdef VBOX_PERMIT_VERIFIER_DLL
for (uint32_t i = 0; i < 10240; i++)
#else
for (uint32_t i = 0; i < 1024; i++)
#endif
{
SIZE_T cbActual = 0;
MEMORY_BASIC_INFORMATION MemInfo = { 0, 0, 0, 0, 0, 0, 0 };
NTSTATUS rcNt = g_pfnNtQueryVirtualMemory(hProcess,
(void const *)uPtrWhere,
MemoryBasicInformation,
&MemInfo,
sizeof(MemInfo),
&cbActual);
if (!NT_SUCCESS(rcNt))
{
if (rcNt == STATUS_INVALID_PARAMETER)
return pThis->rcResult;
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NT_QI_VIRTUAL_MEMORY_ERROR,
"NtQueryVirtualMemory failed for %p: %#x", uPtrWhere, rcNt);
}
/*
* Record images.
*/
if ( MemInfo.Type == SEC_IMAGE
|| MemInfo.Type == SEC_PROTECTED_IMAGE
|| MemInfo.Type == (SEC_IMAGE | SEC_PROTECTED_IMAGE))
{
uint32_t iImg = pThis->cImages;
rcNt = g_pfnNtQueryVirtualMemory(hProcess,
(void const *)uPtrWhere,
MemorySectionName,
&pThis->aImages[iImg].Name,
sizeof(pThis->aImages[iImg].Name) - sizeof(WCHAR),
&cbActual);
if (!NT_SUCCESS(rcNt))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NT_QI_VIRTUAL_MEMORY_NM_ERROR,
"NtQueryVirtualMemory/MemorySectionName failed for %p: %#x", uPtrWhere, rcNt);
pThis->aImages[iImg].Name.UniStr.Buffer[pThis->aImages[iImg].Name.UniStr.Length / sizeof(WCHAR)] = '\0';
SUP_DPRINTF((MemInfo.AllocationBase == MemInfo.BaseAddress
? " *%p-%p %#06x/%#06x %#09x %ls\n"
: " %p-%p %#06x/%#06x %#09x %ls\n",
MemInfo.BaseAddress, (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1, MemInfo.Protect,
MemInfo.AllocationProtect, MemInfo.Type, pThis->aImages[iImg].Name.UniStr.Buffer));
/* New or existing image? */
bool fNew = true;
uint32_t iSearch = iImg;
while (iSearch-- > 0)
if (supHardNtVpAreUniStringsEqual(&pThis->aImages[iSearch].Name.UniStr, &pThis->aImages[iImg].Name.UniStr))
{
int rc = supHardNtVpAddRegion(pThis, &pThis->aImages[iSearch], &MemInfo);
if (RT_FAILURE(rc))
return rc;
fNew = false;
break;
}
else if (pThis->aImages[iSearch].uImageBase == (uintptr_t)MemInfo.AllocationBase)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NT_MAPPING_NAME_CHANGED,
"Unexpected base address match");
if (fNew)
{
int rc = supHardNtVpNewImage(pThis, &pThis->aImages[iImg], &MemInfo);
if (RT_SUCCESS(rc))
{
if (rc != VINF_OBJECT_DESTROYED)
{
pThis->cImages++;
if (pThis->cImages >= RT_ELEMENTS(pThis->aImages))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_DLLS_LOADED,
"Internal error: aImages is full.\n");
}
}
#ifdef IN_RING3 /* Continue and add more information if unknown DLLs are found. */
else if (rc != VERR_SUP_VP_NOT_KNOWN_DLL_OR_EXE && rc != VERR_SUP_VP_NON_SYSTEM32_DLL)
return rc;
#else
else
return rc;
#endif
}
}
/*
* XP, W2K3: Ignore the CSRSS read-only region as best we can.
*/
else if ( (MemInfo.Protect & (PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY))
== PAGE_EXECUTE_READ
&& cXpExceptions == 0
&& (uintptr_t)MemInfo.BaseAddress >= UINT32_C(0x78000000)
/* && MemInfo.BaseAddress == pPeb->ReadOnlySharedMemoryBase */
&& g_uNtVerCombined < SUP_MAKE_NT_VER_SIMPLE(6, 0) )
{
cXpExceptions++;
SUP_DPRINTF((" %p-%p %#06x/%#06x %#09x XP CSRSS read-only region\n", MemInfo.BaseAddress,
(uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1, MemInfo.Protect,
MemInfo.AllocationProtect, MemInfo.Type));
}
/*
* Executable memory?
*/
#ifndef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
else if (MemInfo.Protect & (PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY))
{
SUP_DPRINTF((MemInfo.AllocationBase == MemInfo.BaseAddress
? " *%p-%p %#06x/%#06x %#09x !!\n"
: " %p-%p %#06x/%#06x %#09x !!\n",
MemInfo.BaseAddress, (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1,
MemInfo.Protect, MemInfo.AllocationProtect, MemInfo.Type));
# ifdef IN_RING3
if (pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
{
/*
* Free any private executable memory (sysplant.sys allocates executable memory).
*/
if (MemInfo.Type == MEM_PRIVATE)
{
PVOID pvFree = MemInfo.BaseAddress;
SIZE_T cbFree = MemInfo.RegionSize;
if (!(pThis->fFlags & SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW))
{
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Freeing exec mem at %p (%p LB %#zx)\n",
uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize));
rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
if (!NT_SUCCESS(rcNt))
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
"NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
}
else
{
/* The Trend Micro sakfile.sys and Digital Guardian dgmaster.sys BSOD kludge. */
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Replacing exec mem at %p (%p LB %#zx)\n",
uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize));
void *pvCopy = RTMemAllocZ(cbFree);
if (pvCopy)
{
rcNt = supHardNtVpReadMem(pThis->hProcess, (uintptr_t)pvFree, pvCopy, cbFree);
if (!NT_SUCCESS(rcNt))
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
"Error reading data from original alloc: %#x (%p LB %#zx)",
rcNt, MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
if (NT_SUCCESS(rcNt))
{
pvFree = MemInfo.BaseAddress; cbFree = MemInfo.RegionSize; /* fudge */
NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE); /* fudge */
pvFree = MemInfo.BaseAddress;
cbFree = MemInfo.RegionSize;
rcNt = NtAllocateVirtualMemory(pThis->hProcess, &pvFree, 0, &cbFree, MEM_COMMIT, PAGE_READWRITE);
if (!NT_SUCCESS(rcNt))
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
"NtAllocateVirtualMemory (%p LB %#zx) failed with rcNt=%#x allocating "
"replacement memory for working around buggy protection software. "
"See VBoxStartup.log for more details",
MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
else if (pvFree != MemInfo.BaseAddress)
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
"We wanted NtAllocateVirtualMemory to get us %p LB %#zx, but it returned %p LB %#zx.",
MemInfo.BaseAddress, MemInfo.RegionSize, pvFree, cbFree, rcNt);
else
{
SIZE_T cbWritten;
rcNt = NtWriteVirtualMemory(pThis->hProcess, MemInfo.BaseAddress, pvCopy, MemInfo.RegionSize,
&cbWritten);
if (!NT_SUCCESS(rcNt))
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
"NtWriteVirtualMemory (%p LB %#zx) failed: %#x",
MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
}
}
else
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
"NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
RTMemFree(pvCopy);
}
else
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
"RTMemAllocZ(%#zx) failed", MemInfo.RegionSize);
}
}
/*
* Unmap mapped memory, failing that, drop exec privileges.
*/
else if (MemInfo.Type == MEM_MAPPED)
{
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Unmapping exec mem at %p (%p/%p LB %#zx)\n",
uPtrWhere, MemInfo.AllocationBase, MemInfo.BaseAddress, MemInfo.RegionSize));
rcNt = NtUnmapViewOfSection(pThis->hProcess, MemInfo.AllocationBase);
if (!NT_SUCCESS(rcNt))
{
PVOID pvCopy = MemInfo.BaseAddress;
SIZE_T cbCopy = MemInfo.RegionSize;
NTSTATUS rcNt2 = NtProtectVirtualMemory(pThis->hProcess, &pvCopy, &cbCopy, PAGE_NOACCESS, NULL);
if (!NT_SUCCESS(rcNt2))
rcNt2 = NtProtectVirtualMemory(pThis->hProcess, &pvCopy, &cbCopy, PAGE_READONLY, NULL);
if (!NT_SUCCESS(rcNt2))
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNMAP_AND_PROTECT_FAILED,
"NtUnmapViewOfSection (%p/%p LB %#zx) failed: %#x (%#x)",
MemInfo.AllocationBase, MemInfo.BaseAddress, MemInfo.RegionSize, rcNt, rcNt2);
}
}
else
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNKOWN_MEM_TYPE,
"Unknown executable memory type %#x at %p/%p LB %#zx",
MemInfo.Type, MemInfo.AllocationBase, MemInfo.BaseAddress, MemInfo.RegionSize);
pThis->cFixes++;
}
else
# endif /* IN_RING3 */
supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FOUND_EXEC_MEMORY,
"Found executable memory at %p (%p LB %#zx): type=%#x prot=%#x state=%#x aprot=%#x abase=%p",
uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize, MemInfo.Type, MemInfo.Protect,
MemInfo.State, MemInfo.AllocationBase, MemInfo.AllocationProtect);
# ifndef IN_RING3
if (RT_FAILURE(pThis->rcResult))
return pThis->rcResult;
# endif
/* Continue add more information about the problematic process. */
}
#endif /* VBOX_PERMIT_VISUAL_STUDIO_PROFILING */
else
SUP_DPRINTF((MemInfo.AllocationBase == MemInfo.BaseAddress
? " *%p-%p %#06x/%#06x %#09x\n"
: " %p-%p %#06x/%#06x %#09x\n",
MemInfo.BaseAddress, (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1,
MemInfo.Protect, MemInfo.AllocationProtect, MemInfo.Type));
/*
* Advance.
*/
cbAdvance = MemInfo.RegionSize;
if (uPtrWhere + cbAdvance <= uPtrWhere)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EMPTY_REGION_TOO_LARGE,
"Empty region at %p.", uPtrWhere);
uPtrWhere += MemInfo.RegionSize;
}
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_MEMORY_REGIONS,
"Too many virtual memory regions.\n");
}
/**
* Verifies the loader image, i.e. check cryptographic signatures if present.
*
* @returns VBox status code.
* @param pEntry The loader cache entry.
* @param pwszName The filename to use in error messages.
* @param pErRInfo Where to return extened error information.
*/
DECLHIDDEN(int) supHardNtLdrCacheEntryVerify(PSUPHNTLDRCACHEENTRY pEntry, PCRTUTF16 pwszName, PRTERRINFO pErrInfo)
{
int rc = VINF_SUCCESS;
if (!pEntry->fVerified)
{
rc = supHardenedWinVerifyImageByLdrMod(pEntry->hLdrMod, pwszName, pEntry->pNtViRdr,
false /*fAvoidWinVerifyTrust*/, NULL /*pfWinVerifyTrust*/, pErrInfo);
pEntry->fVerified = RT_SUCCESS(rc);
}
return rc;
}
/**
* Allocates a image bits buffer and calls RTLdrGetBits on them.
*
* An assumption here is that there won't ever be concurrent use of the cache.
* It's currently 104% single threaded, non-reentrant. Thus, we can't reuse the
* pbBits allocation.
*
* @returns VBox status code
* @param pEntry The loader cache entry.
* @param ppbBits Where to return the pointer to the allocation.
* @param uBaseAddress The image base address, see RTLdrGetBits.
* @param pfnGetImport Import getter, see RTLdrGetBits.
* @param pvUser The user argument for @a pfnGetImport.
* @param pErrInfo Where to return extened error information.
*/
DECLHIDDEN(int) supHardNtLdrCacheEntryGetBits(PSUPHNTLDRCACHEENTRY pEntry, uint8_t **ppbBits,
RTLDRADDR uBaseAddress, PFNRTLDRIMPORT pfnGetImport, void *pvUser,
PRTERRINFO pErrInfo)
{
int rc;
/*
* First time around we have to allocate memory before we can get the image bits.
*/
if (!pEntry->pbBits)
{
size_t cbBits = RTLdrSize(pEntry->hLdrMod);
if (cbBits >= _1M*32U)
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_IMAGE_TOO_BIG, "Image %s is too large: %zu bytes (%#zx).",
pEntry->pszName, cbBits, cbBits);
pEntry->pbBits = (uint8_t *)RTMemAllocZ(cbBits);
if (!pEntry->pbBits)
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "Failed to allocate %zu bytes for image %s.",
cbBits, pEntry->pszName);
pEntry->fValidBits = false; /* paranoia */
rc = RTLdrGetBits(pEntry->hLdrMod, pEntry->pbBits, uBaseAddress, pfnGetImport, pvUser);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "RTLdrGetBits failed on image %s: %Rrc",
pEntry->pszName, rc);
pEntry->uImageBase = uBaseAddress;
pEntry->fValidBits = pfnGetImport == NULL;
}
/*
* Cache hit? No?
*
* Note! We cannot currently cache image bits for images with imports as we
* don't control the way they're resolved. Fortunately, NTDLL and
* the VM process images all have no imports.
*/
else if ( !pEntry->fValidBits
|| pEntry->uImageBase != uBaseAddress
|| pfnGetImport)
{
pEntry->fValidBits = false;
rc = RTLdrGetBits(pEntry->hLdrMod, pEntry->pbBits, uBaseAddress, pfnGetImport, pvUser);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "RTLdrGetBits failed on image %s: %Rrc",
pEntry->pszName, rc);
pEntry->uImageBase = uBaseAddress;
pEntry->fValidBits = pfnGetImport == NULL;
}
*ppbBits = pEntry->pbBits;
return VINF_SUCCESS;
}
/**
* Frees all resources associated with a cache entry and wipes the members
* clean.
*
* @param pEntry The entry to delete.
*/
static void supHardNTLdrCacheDeleteEntry(PSUPHNTLDRCACHEENTRY pEntry)
{
if (pEntry->pbBits)
{
RTMemFree(pEntry->pbBits);
pEntry->pbBits = NULL;
}
if (pEntry->hLdrMod != NIL_RTLDRMOD)
{
RTLdrClose(pEntry->hLdrMod);
pEntry->hLdrMod = NIL_RTLDRMOD;
pEntry->pNtViRdr = NULL;
}
else if (pEntry->pNtViRdr)
{
pEntry->pNtViRdr->Core.pfnDestroy(&pEntry->pNtViRdr->Core);
pEntry->pNtViRdr = NULL;
}
if (pEntry->hFile)
{
NtClose(pEntry->hFile);
pEntry->hFile = NULL;
}
pEntry->pszName = NULL;
pEntry->fVerified = false;
pEntry->fValidBits = false;
pEntry->uImageBase = 0;
}
#ifdef IN_RING3
/**
* Flushes the cache.
*
* This is called from one of two points in the hardened main code, first is
* after respawning and the second is when we open the vboxdrv device for
* unrestricted access.
*/
DECLHIDDEN(void) supR3HardenedWinFlushLoaderCache(void)
{
uint32_t i = g_cSupNtVpLdrCacheEntries;
while (i-- > 0)
supHardNTLdrCacheDeleteEntry(&g_aSupNtVpLdrCacheEntries[i]);
g_cSupNtVpLdrCacheEntries = 0;
}
/**
* Searches the cache for a loader image.
*
* @returns Pointer to the cache entry if found, NULL if not.
* @param pszName The name (from g_apszSupNtVpAllowedVmExes or
* g_apszSupNtVpAllowedDlls).
*/
static PSUPHNTLDRCACHEENTRY supHardNtLdrCacheLookupEntry(const char *pszName)
{
/*
* Since the caller is supplying us a pszName from one of the two tables,
* we can dispense with string compare and simply compare string pointers.
*/
uint32_t i = g_cSupNtVpLdrCacheEntries;
while (i-- > 0)
if (g_aSupNtVpLdrCacheEntries[i].pszName == pszName)
return &g_aSupNtVpLdrCacheEntries[i];
return NULL;
}
#endif /* IN_RING3 */
static int supHardNtLdrCacheNewEntry(PSUPHNTLDRCACHEENTRY pEntry, const char *pszName, PUNICODE_STRING pUniStrPath,
bool fDll, bool f32bitResourceDll, PRTERRINFO pErrInfo)
{
/*
* Open the image file.
*/
HANDLE hFile = RTNT_INVALID_HANDLE_VALUE;
IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
OBJECT_ATTRIBUTES ObjAttr;
InitializeObjectAttributes(&ObjAttr, pUniStrPath, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
#ifdef IN_RING0
ObjAttr.Attributes |= OBJ_KERNEL_HANDLE;
#endif
NTSTATUS rcNt = NtCreateFile(&hFile,
GENERIC_READ | SYNCHRONIZE,
&ObjAttr,
&Ios,
NULL /* Allocation Size*/,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
NULL /*EaBuffer*/,
0 /*EaLength*/);
if (NT_SUCCESS(rcNt))
rcNt = Ios.Status;
if (!NT_SUCCESS(rcNt))
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_IMAGE_FILE_OPEN_ERROR,
"Error opening image for scanning: %#x (name %ls)", rcNt, pUniStrPath->Buffer);
/*
* Figure out validation flags we'll be using and create the reader
* for this image.
*/
uint32_t fFlags = fDll
? SUPHNTVI_F_TRUSTED_INSTALLER_OWNER | SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION
: SUPHNTVI_F_REQUIRE_BUILD_CERT;
if (f32bitResourceDll)
fFlags |= SUPHNTVI_F_IGNORE_ARCHITECTURE;
PSUPHNTVIRDR pNtViRdr;
int rc = supHardNtViRdrCreate(hFile, pUniStrPath->Buffer, fFlags, &pNtViRdr);
if (RT_FAILURE(rc))
{
NtClose(hFile);
return rc;
}
/*
* Finally, open the image with the loader
*/
RTLDRMOD hLdrMod;
RTLDRARCH enmArch = fFlags & SUPHNTVI_F_RC_IMAGE ? RTLDRARCH_X86_32 : RTLDRARCH_HOST;
if (fFlags & SUPHNTVI_F_IGNORE_ARCHITECTURE)
enmArch = RTLDRARCH_WHATEVER;
rc = RTLdrOpenWithReader(&pNtViRdr->Core, RTLDR_O_FOR_VALIDATION, enmArch, &hLdrMod, pErrInfo);
if (RT_FAILURE(rc))
return supHardNtVpSetInfo1(pErrInfo, rc, "RTLdrOpenWithReader failed: %Rrc (Image='%ls').",
rc, pUniStrPath->Buffer);
/*
* Fill in the cache entry.
*/
pEntry->pszName = pszName;
pEntry->hLdrMod = hLdrMod;
pEntry->pNtViRdr = pNtViRdr;
pEntry->hFile = hFile;
pEntry->pbBits = NULL;
pEntry->fVerified = false;
pEntry->fValidBits = false;
pEntry->uImageBase = ~(uintptr_t)0;
#ifdef IN_SUP_HARDENED_R3
/*
* Log the image timestamp when in the hardened exe.
*/
uint64_t uTimestamp = 0;
rc = RTLdrQueryProp(hLdrMod, RTLDRPROP_TIMESTAMP_SECONDS, &uTimestamp, sizeof(uint64_t));
SUP_DPRINTF(("%s: timestamp %#llx (rc=%Rrc)\n", pszName, uTimestamp, rc));
#endif
return VINF_SUCCESS;
}
#ifdef IN_RING3
/**
* Opens a loader cache entry.
*
* Currently this is only used by the import code for getting NTDLL.
*
* @returns VBox status code.
* @param pszName The DLL name. Must be one from the
* g_apszSupNtVpAllowedDlls array.
* @param ppEntry Where to return the entry we've opened/found.
*/
DECLHIDDEN(int) supHardNtLdrCacheOpen(const char *pszName, PSUPHNTLDRCACHEENTRY *ppEntry)
{
/*
* Locate the dll.
*/
uint32_t i = 0;
while ( i < RT_ELEMENTS(g_apszSupNtVpAllowedDlls)
&& strcmp(pszName, g_apszSupNtVpAllowedDlls[i]))
i++;
if (i >= RT_ELEMENTS(g_apszSupNtVpAllowedDlls))
return VERR_FILE_NOT_FOUND;
pszName = g_apszSupNtVpAllowedDlls[i];
/*
* Try the cache.
*/
*ppEntry = supHardNtLdrCacheLookupEntry(pszName);
if (*ppEntry)
return VINF_SUCCESS;
/*
* Not in the cache, so open it.
* Note! We cannot assume that g_System32NtPath has been initialized at this point.
*/
if (g_cSupNtVpLdrCacheEntries >= RT_ELEMENTS(g_aSupNtVpLdrCacheEntries))
return VERR_INTERNAL_ERROR_3;
static WCHAR s_wszSystem32[] = L"\\SystemRoot\\System32\\";
WCHAR wszPath[64];
memcpy(wszPath, s_wszSystem32, sizeof(s_wszSystem32));
RTUtf16CatAscii(wszPath, sizeof(wszPath), pszName);
UNICODE_STRING UniStr;
UniStr.Buffer = wszPath;
UniStr.Length = (USHORT)(RTUtf16Len(wszPath) * sizeof(WCHAR));
UniStr.MaximumLength = UniStr.Length + sizeof(WCHAR);
int rc = supHardNtLdrCacheNewEntry(&g_aSupNtVpLdrCacheEntries[g_cSupNtVpLdrCacheEntries], pszName, &UniStr,
true /*fDll*/, false /*f32bitResourceDll*/, NULL /*pErrInfo*/);
if (RT_SUCCESS(rc))
{
*ppEntry = &g_aSupNtVpLdrCacheEntries[g_cSupNtVpLdrCacheEntries];
g_cSupNtVpLdrCacheEntries++;
return VINF_SUCCESS;
}
return rc;
}
#endif /* IN_RING3 */
/**
* Opens all the images with the IPRT loader, setting both, hFile, pNtViRdr and
* hLdrMod for each image.
*
* @returns VBox status code.
* @param pThis The process scanning state structure.
*/
static int supHardNtVpOpenImages(PSUPHNTVPSTATE pThis)
{
unsigned i = pThis->cImages;
while (i-- > 0)
{
PSUPHNTVPIMAGE pImage = &pThis->aImages[i];
#ifdef IN_RING3
/*
* Try the cache first.
*/
pImage->pCacheEntry = supHardNtLdrCacheLookupEntry(pImage->pszName);
if (pImage->pCacheEntry)
continue;
/*
* Not in the cache, so load it into the cache.
*/
if (g_cSupNtVpLdrCacheEntries >= RT_ELEMENTS(g_aSupNtVpLdrCacheEntries))
return supHardNtVpSetInfo2(pThis, VERR_INTERNAL_ERROR_3, "Loader cache overflow.");
pImage->pCacheEntry = &g_aSupNtVpLdrCacheEntries[g_cSupNtVpLdrCacheEntries];
#else
/*
* In ring-0 we don't have a cache at the moment (resource reasons), so
* we have a static cache entry in each image structure that we use instead.
*/
pImage->pCacheEntry = &pImage->CacheEntry;
#endif
int rc = supHardNtLdrCacheNewEntry(pImage->pCacheEntry, pImage->pszName, &pImage->Name.UniStr,
pImage->fDll, pImage->f32bitResourceDll, pThis->pErrInfo);
if (RT_FAILURE(rc))
return rc;
#ifdef IN_RING3
g_cSupNtVpLdrCacheEntries++;
#endif
}
return VINF_SUCCESS;
}
/**
* Check the integrity of the executable of the process.
*
* @returns VBox status code.
* @param pThis The process scanning state structure. Details
* about images are added to this.
* @param hProcess The process to verify.
*/
static int supHardNtVpCheckExe(PSUPHNTVPSTATE pThis, HANDLE hProcess)
{
/*
* Make sure there is exactly one executable image.
*/
unsigned cExecs = 0;
unsigned iExe = ~0U;
unsigned i = pThis->cImages;
while (i-- > 0)
{
if (!pThis->aImages[i].fDll)
{
cExecs++;
iExe = i;
}
}
if (cExecs == 0)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_FOUND_NO_EXE_MAPPING,
"No executable mapping found in the virtual address space.");
if (cExecs != 1)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FOUND_MORE_THAN_ONE_EXE_MAPPING,
"Found more than one executable mapping in the virtual address space.");
PSUPHNTVPIMAGE pImage = &pThis->aImages[iExe];
/*
* Check that it matches the executable image of the process.
*/
int rc;
ULONG cbUniStr = sizeof(UNICODE_STRING) + RTPATH_MAX * sizeof(RTUTF16);
PUNICODE_STRING pUniStr = (PUNICODE_STRING)RTMemAllocZ(cbUniStr);
if (!pUniStr)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_MEMORY,
"Error allocating %zu bytes for process name.", cbUniStr);
ULONG cbIgn = 0;
NTSTATUS rcNt = NtQueryInformationProcess(hProcess, ProcessImageFileName, pUniStr, cbUniStr - sizeof(WCHAR), &cbIgn);
if (NT_SUCCESS(rcNt))
{
if (supHardNtVpAreUniStringsEqual(pUniStr, &pImage->Name.UniStr))
rc = VINF_SUCCESS;
else
{
pUniStr->Buffer[pUniStr->Length / sizeof(WCHAR)] = '\0';
rc = supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_VS_PROC_NAME_MISMATCH,
"Process image name does not match the exectuable we found: %ls vs %ls.",
pUniStr->Buffer, pImage->Name.UniStr.Buffer);
}
}
else
rc = supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NT_QI_PROCESS_NM_ERROR,
"NtQueryInformationProcess/ProcessImageFileName failed: %#x", rcNt);
RTMemFree(pUniStr);
if (RT_FAILURE(rc))
return rc;
/*
* Validate the signing of the executable image.
* This will load the fDllCharecteristics and fImageCharecteristics members we use below.
*/
rc = supHardNtVpVerifyImage(pThis, pImage, hProcess);
if (RT_FAILURE(rc))
return rc;
/*
* Check linking requirements.
* This query is only available using the current process pseudo handle on
* older windows versions. The cut-off seems to be Vista.
*/
SECTION_IMAGE_INFORMATION ImageInfo;
rcNt = NtQueryInformationProcess(hProcess, ProcessImageInformation, &ImageInfo, sizeof(ImageInfo), NULL);
if (!NT_SUCCESS(rcNt))
{
if ( rcNt == STATUS_INVALID_PARAMETER
&& g_uNtVerCombined < SUP_NT_VER_VISTA
&& hProcess != NtCurrentProcess() )
return VINF_SUCCESS;
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NT_QI_PROCESS_IMG_INFO_ERROR,
"NtQueryInformationProcess/ProcessImageInformation failed: %#x hProcess=%#x", rcNt, hProcess);
}
if ( !(ImageInfo.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_MISSING_FORCE_INTEGRITY,
"EXE DllCharacteristics=%#x, expected IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY to be set.",
ImageInfo.DllCharacteristics);
if (!(ImageInfo.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_MISSING_DYNAMIC_BASE,
"EXE DllCharacteristics=%#x, expected IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE to be set.",
ImageInfo.DllCharacteristics);
if (!(ImageInfo.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NX_COMPAT))
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_MISSING_NX_COMPAT,
"EXE DllCharacteristics=%#x, expected IMAGE_DLLCHARACTERISTICS_NX_COMPAT to be set.",
ImageInfo.DllCharacteristics);
if (pImage->fDllCharecteristics != ImageInfo.DllCharacteristics)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_DLL_CHARECTERISTICS_MISMATCH,
"EXE Info.DllCharacteristics=%#x fDllCharecteristics=%#x.",
ImageInfo.DllCharacteristics, pImage->fDllCharecteristics);
if (pImage->fImageCharecteristics != ImageInfo.ImageCharacteristics)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_DLL_CHARECTERISTICS_MISMATCH,
"EXE Info.ImageCharacteristics=%#x fImageCharecteristics=%#x.",
ImageInfo.ImageCharacteristics, pImage->fImageCharecteristics);
return VINF_SUCCESS;
}
/**
* Check the integrity of the DLLs found in the process.
*
* @returns VBox status code.
* @param pThis The process scanning state structure. Details
* about images are added to this.
* @param hProcess The process to verify.
*/
static int supHardNtVpCheckDlls(PSUPHNTVPSTATE pThis, HANDLE hProcess)
{
/*
* Check for duplicate entries (paranoia).
*/
uint32_t i = pThis->cImages;
while (i-- > 1)
{
const char *pszName = pThis->aImages[i].pszName;
uint32_t j = i;
while (j-- > 0)
if (pThis->aImages[j].pszName == pszName)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_DUPLICATE_DLL_MAPPING,
"Duplicate image entries for %s: %ls and %ls",
pszName, pThis->aImages[i].Name.UniStr.Buffer, pThis->aImages[j].Name.UniStr.Buffer);
}
/*
* Check that both ntdll and kernel32 are present.
* ASSUMES the entries in g_apszSupNtVpAllowedDlls are all lower case.
*/
uint32_t iNtDll = UINT32_MAX;
uint32_t iKernel32 = UINT32_MAX;
i = pThis->cImages;
while (i-- > 0)
if (suplibHardenedStrCmp(pThis->aImages[i].pszName, "ntdll.dll") == 0)
iNtDll = i;
else if (suplibHardenedStrCmp(pThis->aImages[i].pszName, "kernel32.dll") == 0)
iKernel32 = i;
if (iNtDll == UINT32_MAX)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_NTDLL_MAPPING,
"The process has no NTDLL.DLL.");
if (iKernel32 == UINT32_MAX && pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_KERNEL32_MAPPING,
"The process has no KERNEL32.DLL.");
else if (iKernel32 != UINT32_MAX && pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_KERNEL32_ALREADY_MAPPED,
"The process already has KERNEL32.DLL loaded.");
/*
* Verify that the DLLs are correctly signed (by MS).
*/
i = pThis->cImages;
while (i-- > 0)
{
int rc = supHardNtVpVerifyImage(pThis, &pThis->aImages[i], hProcess);
if (RT_FAILURE(rc))
return rc;
}
return VINF_SUCCESS;
}
/**
* Verifies the given process.
*
* The following requirements are checked:
* - The process only has one thread, the calling thread.
* - The process has no debugger attached.
* - The executable image of the process is verified to be signed with
* certificate known to this code at build time.
* - The executable image is one of a predefined set.
* - The process has only a very limited set of system DLLs loaded.
* - The system DLLs signatures check out fine.
* - The only executable memory in the process belongs to the system DLLs and
* the executable image.
*
* @returns VBox status code.
* @param hProcess The process to verify.
* @param hThread A thread in the process (the caller).
* @param enmKind The kind of process verification to perform.
* @param fFlags Valid combination of SUPHARDNTVP_F_XXX flags.
* @param pErrInfo Pointer to error info structure. Optional.
* @param pcFixes Where to return the number of fixes made during
* purification. Optional.
*/
DECLHIDDEN(int) supHardenedWinVerifyProcess(HANDLE hProcess, HANDLE hThread, SUPHARDNTVPKIND enmKind, uint32_t fFlags,
uint32_t *pcFixes, PRTERRINFO pErrInfo)
{
if (pcFixes)
*pcFixes = 0;
/*
* Some basic checks regarding threads and debuggers. We don't need
* allocate any state memory for these.
*/
int rc = VINF_SUCCESS;
if (enmKind != SUPHARDNTVPKIND_CHILD_PURIFICATION)
rc = supHardNtVpThread(hProcess, hThread, pErrInfo);
if (RT_SUCCESS(rc))
rc = supHardNtVpDebugger(hProcess, pErrInfo);
if (RT_SUCCESS(rc))
{
/*
* Allocate and initialize memory for the state.
*/
PSUPHNTVPSTATE pThis = (PSUPHNTVPSTATE)RTMemAllocZ(sizeof(*pThis));
if (pThis)
{
pThis->enmKind = enmKind;
pThis->fFlags = fFlags;
pThis->rcResult = VINF_SUCCESS;
pThis->hProcess = hProcess;
pThis->pErrInfo = pErrInfo;
/*
* Perform the verification.
*/
rc = supHardNtVpScanVirtualMemory(pThis, hProcess);
if (RT_SUCCESS(rc))
rc = supHardNtVpOpenImages(pThis);
if (RT_SUCCESS(rc))
rc = supHardNtVpCheckExe(pThis, hProcess);
if (RT_SUCCESS(rc))
rc = supHardNtVpCheckDlls(pThis, hProcess);
if (pcFixes)
*pcFixes = pThis->cFixes;
/*
* Clean up the state.
*/
#ifdef IN_RING0
for (uint32_t i = 0; i < pThis->cImages; i++)
supHardNTLdrCacheDeleteEntry(&pThis->aImages[i].CacheEntry);
#endif
RTMemFree(pThis);
}
else
rc = supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY_STATE,
"Failed to allocate %zu bytes for state structures.", sizeof(*pThis));
}
return rc;
}