SUPHardenedVerifyProcess-win.cpp revision f81115e612ee8fa2bc082db9d4c8879e33babc5a
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * VirtualBox Support Library/Driver - Hardened Process Verification, Windows.
aae8a6a38fd27661046ab1d06cb2cb5c096c40edvboxsync * Copyright (C) 2006-2014 Oracle Corporation
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * available from http://www.virtualbox.org. This file is free software;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * you can redistribute it and/or modify it under the terms of the GNU
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * General Public License (GPL) as published by the Free Software
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * The contents of this file may alternatively be used under the terms
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * of the Common Development and Distribution License Version 1.0
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * VirtualBox OSE distribution, in which case the provisions of the
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * CDDL are applicable instead of those of the GPL.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * You may elect to license modified versions of this file under the
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * terms and conditions of either the GPL or the CDDL or both.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/*******************************************************************************
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync* Header Files *
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync*******************************************************************************/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/*******************************************************************************
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync* Structures and Typedefs *
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync*******************************************************************************/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Virtual address space region.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The RVA of the region. */
b1ac43a82a2e4114bc44feb83007a10c99077085vboxsync /** The size of the region. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The protection of the region. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/** Pointer to a virtual address space region. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Virtual address space image information.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The base address of the image. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The size of the image mapping. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The name from the allowed lists. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync const char *pszName;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Name structure for NtQueryVirtualMemory/MemorySectionName. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The full unicode name. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Buffer space. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The number of mapping regions. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Mapping regions. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The image characteristics from the FileHeader. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The DLL characteristics from the OptionalHeader. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Set if this is the DLL. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Set if the image is NTDLL an the verficiation code needs to watch out for
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * the NtCreateSection patch. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Whether the API set schema hack needs to be applied when verifying memory
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * content. The hack means that we only check if the 1st section is mapped. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** This may be a 32-bit resource DLL. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Pointer to the loader cache entry for the image. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** In ring-0 we don't currently cache images, so put it here. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/** Pointer to image info from the virtual address space scan. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Virtual address space scanning state.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Type of verification to perform. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The result. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Number of fixes we've done.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Only applicable in the purification modes. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Number of images in aImages. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The index of the last image we looked up. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** The process handle. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Images found in the process.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * The array is large enough to hold the executable, all allowed DLLs, and one
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * more so we can get the image name of the first unwanted DLL. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Memory compare scratch buffer.*/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** File compare scratch buffer.*/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Section headers for use when comparing file and loaded image. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /** Pointer to the error info. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/** Pointer to stat information of a virtual address space scan. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/*******************************************************************************
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync* Global Variables *
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync*******************************************************************************/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * System DLLs allowed to be loaded into the process.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @remarks supHardNtVpCheckDlls assumes these are lower case.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic const char *g_apszSupNtVpAllowedDlls[] =
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "ntdll.dll",
6a0359b8230a1b91fe49967c124a75191c3dfbf9vboxsync "kernel32.dll",
01544e93c5127d1ebf3e207716321ee9bab12c08vboxsync "kernelbase.dll",
9f22c692723a5d3cb78b91896c48cf681c4fb608vboxsync "apphelp.dll",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "apisetschema.dll",
6a0359b8230a1b91fe49967c124a75191c3dfbf9vboxsync "verifier.dll",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "sfc_os.dll",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "user32.dll",
1e0e13b23ace43d2fe93d45953b123f63b7e547cvboxsync "acres.dll",
1e0e13b23ace43d2fe93d45953b123f63b7e547cvboxsync "acgenral.dll",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "psapi.dll",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "msvcrt.dll",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "advapi32.dll",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync "sechost.dll",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync "rpcrt4.dll",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync "SamplingRuntime.dll",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * VBox executables allowed to start VMs.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @remarks Remember to keep in sync with SUPR3HardenedVerify.cpp.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic const char *g_apszSupNtVpAllowedVmExes[] =
6a0359b8230a1b91fe49967c124a75191c3dfbf9vboxsync "VBoxHeadless.exe",
6a0359b8230a1b91fe49967c124a75191c3dfbf9vboxsync "VirtualBox.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "VBoxSDL.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "VBoxNetDHCP.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "VBoxNetNAT.exe",
01544e93c5127d1ebf3e207716321ee9bab12c08vboxsync "tstMicro.exe",
01544e93c5127d1ebf3e207716321ee9bab12c08vboxsync "tstPDMAsyncCompletion.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "tstPDMAsyncCompletionStress.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "tstVMM.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "tstVMREQ.exe",
9f22c692723a5d3cb78b91896c48cf681c4fb608vboxsync "tstCFGM.exe",
9f22c692723a5d3cb78b91896c48cf681c4fb608vboxsync "tstIntNet-1.exe",
9f22c692723a5d3cb78b91896c48cf681c4fb608vboxsync "tstMMHyperHeap.exe",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "tstR0ThreadPreemptionDriver.exe",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "tstRTR0MemUserKernelDriver.exe",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "tstRTR0SemMutexDriver.exe",
83d61602c6968041692aa7203ee51c4085c7e460vboxsync "tstRTR0TimerDriver.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "tstSSM.exe",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync/** Pointer to NtQueryVirtualMemory. Initialized by SUPDrv-win.cpp in
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * ring-0, in ring-3 it's just a slightly confusing define. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncPFNNTQUERYVIRTUALMEMORY g_pfnNtQueryVirtualMemory = NULL;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync# define g_pfnNtQueryVirtualMemory NtQueryVirtualMemory
83d61602c6968041692aa7203ee51c4085c7e460vboxsync/** The number of valid entries in the loader cache.. */
83d61602c6968041692aa7203ee51c4085c7e460vboxsync/** The loader cache entries. */
1e0e13b23ace43d2fe93d45953b123f63b7e547cvboxsyncstatic SUPHNTLDRCACHEENTRY g_aSupNtVpLdrCacheEntries[RT_ELEMENTS(g_apszSupNtVpAllowedDlls) + 1 + 3];
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Fills in error information.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @returns @a rc.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pErrInfo Pointer to the extended error info structure.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Can be NULL.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pszErr Where to return error details.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param cbErr Size of the buffer @a pszErr points to.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param rc The status to return.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pszMsg The format string for the message.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param ... The arguments for the format string.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic int supHardNtVpSetInfo1(PRTERRINFO pErrInfo, int rc, const char *pszMsg, ...)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync supR3HardenedError(rc, false /*fFatal*/, "%N\n", pszMsg, &va);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Fills in error information.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @returns @a rc.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pThis The process validator instance.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pszErr Where to return error details.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param cbErr Size of the buffer @a pszErr points to.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param rc The status to return.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pszMsg The format string for the message.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param ... The arguments for the format string.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic int supHardNtVpSetInfo2(PSUPHNTVPSTATE pThis, int rc, const char *pszMsg, ...)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync supR3HardenedError(rc, false /*fFatal*/, "%N\n", pszMsg, &va);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync RTErrInfoAddF(pThis->pErrInfo, rc, " \n[rc=%d] ", rc);
5fb8c92d14bd1abb521cde47c8cf1b79eb5622d0vboxsyncstatic int supHardNtVpReadImage(PSUPHNTVPIMAGE pImage, uint64_t off, void *pvBuf, size_t cbRead)
5fb8c92d14bd1abb521cde47c8cf1b79eb5622d0vboxsync return pImage->pCacheEntry->pNtViRdr->Core.pfnRead(&pImage->pCacheEntry->pNtViRdr->Core, pvBuf, cbRead, off);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic NTSTATUS supHardNtVpReadMem(HANDLE hProcess, uintptr_t uPtr, void *pvBuf, size_t cbRead)
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync /* ASSUMES hProcess is the current process. */
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync /** @todo use MmCopyVirtualMemory where available! */
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync NTSTATUS rcNt = NtReadVirtualMemory(hProcess, (PVOID)uPtr, pvBuf, cbRead, &cbIgn);
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsyncstatic NTSTATUS supHardNtVpFileMemRestore(PSUPHNTVPSTATE pThis, PVOID pvRestoreAddr, uint8_t const *pbFile, uint32_t cbToRestore,
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync NTSTATUS rcNt = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, PAGE_READWRITE, &fOldProt);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rcNt = NtWriteVirtualMemory(pThis->hProcess, pvRestoreAddr, pbFile, cbToRestore, &cbIgnored);
5fb8c92d14bd1abb521cde47c8cf1b79eb5622d0vboxsync NTSTATUS rcNt2 = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, fCorrectProtection, &fOldProt);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync#endif /* IN_RING3 */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic int supHardNtVpFileMemCompareSection(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync int32_t iSh, PSUPHNTVPSKIPAREA paSkipAreas, uint32_t cSkipAreas,
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync AssertCompileAdjacentMembers(SUPHNTVPSTATE, abMemory, abFile); /* Use both the memory and file buffers here. Parfait might hate me for this... */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t const cbMemory = sizeof(pThis->abMemory) + sizeof(pThis->abFile);
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync while (cb > 0)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Clipping. */
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync while (i-- > 0)
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync uint32_t uSkipEnd = paSkipAreas[i].uRva + paSkipAreas[i].cb;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Read the memory. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync NTSTATUS rcNt = supHardNtVpReadMem(pThis->hProcess, pImage->uImageBase + uRva, pbMemory, cbThis);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_READ_ERROR,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Error reading %#x bytes at %p (rva %#x, #%u, %.8s) from memory: %#x",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, cbThis, pImage->uImageBase + uRva, uRva, iSh + 1,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers", rcNt);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Do the compare. */
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync const char *pachSectNm = iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers";
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync SUP_DPRINTF(("%s: Differences in section #%u (%s) between file and memory:\n", pImage->pszName, iSh + 1, pachSectNm));
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync while (off < cbThis && pbFile[off] == pbMemory[off])
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->uImageBase + uRva + off, uRva + off, pbFile[off], pbMemory[off]));
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync for (uint32_t off2 = off + 1; off2 < cbThis; off2++)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->uImageBase + uRva + off2, uRva + off2, pbFile[off2], pbMemory[off2]));
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync if ( pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync PVOID pvRestoreAddr = (uint8_t *)pImage->uImageBase + uRva;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rcNt = supHardNtVpFileMemRestore(pThis, pvRestoreAddr, pbFile, cbThis, fCorrectProtection);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync SUP_DPRINTF((" Restored %#x bytes of original file content at %p\n", cbThis, pvRestoreAddr));
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Failed to restore %#x bytes at %p (%#x, #%u, %s): %#x (cDiffs=%#x, first=%#x)",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, cbThis, pvRestoreAddr, uRva, iSh + 1, pachSectNm, rcNt,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync#endif /* IN_RING3 */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: %u differences between %#x and %#x in #%u (%.8s), first: %02x != %02x",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, cDiffs, uRva + off, uRva + offLast, iSh + 1,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Advance. The clipping makes it a little bit complicated. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic int supHardNtVpCheckSectionProtection(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if ( pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t offRegion = uRva - pImage->aRegions[i].uRva;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t cbLeft = pImage->aRegions[i].cb - offRegion;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_SECTION_PROTECTION_MISMATCH,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: RVA range %#x-%#x protection is %#x, expected %#x. (cb=%#x)",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, uRva, uRva + cbLeft - 1, pImage->aRegions[i].fProt, fProt, cb);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync#if 0 /* This shouldn't ever be necessary. */
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync return supHardNtVpSetInfo2(pThis, cbOrg == cb ? VERR_SUP_VP_SECTION_NOT_MAPPED : VERR_SUP_VP_SECTION_NOT_FULLY_MAPPED,
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync "%s: RVA range %#x-%#x is not mapped?", pImage->pszName, uRva, uRva + cb - 1);
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsyncstatic DECLINLINE(bool) supHardNtVpIsModuleNameMatch(PSUPHNTVPIMAGE pImage, const char *pszModule)
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync return true;
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync return true;
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync return false;
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync * Worker for supHardNtVpGetImport that looks up a module in the module table.
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync * @returns Pointer to the module if found, NULL if not found.
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync * @param pThis The process validator instance.
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync * @param pszModule The name of the module we're looking for.
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsyncstatic PSUPHNTVPIMAGE supHardNtVpFindModule(PSUPHNTVPSTATE pThis, const char *pszModule)
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync * Check out the hint first.
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsync && supHardNtVpIsModuleNameMatch(&pThis->aImages[pThis->iImageHint], pszModule))
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync * Linear array search next.
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync while (i-- > 0)
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync if (supHardNtVpIsModuleNameMatch(&pThis->aImages[i], pszModule))
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync /* No cigar. */
9d7b020d79101e5c23c1f58a0ce5fa49488ccf73vboxsync * @callback_method_impl{FNRTLDRIMPORT}
6ea079037b825359aab1ba56bb4b9e202ecea648vboxsyncstatic DECLCALLBACK(int) supHardNtVpGetImport(RTLDRMOD hLdrMod, const char *pszModule, const char *pszSymbol, unsigned uSymbol,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /*SUP_DPRINTF(("supHardNtVpGetImport: %s / %#x / %s.\n", pszModule, uSymbol, pszSymbol));*/
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync PSUPHNTVPIMAGE pImage = supHardNtVpFindModule(pThis, pszModule);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * API set hacks.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync else if (!RTStrNICmp(pszModule, RT_STR_TUPLE("api-ms-win-")))
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync static const char * const s_apszDlls[] = { "ntdll.dll", "kernelbase.dll", "kernel32.dll" };
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync for (uint32_t i = 0; i < RT_ELEMENTS(s_apszDlls); i++)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage = supHardNtVpFindModule(pThis, s_apszDlls[i]);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * Deal with forwarders.
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * ASSUMES no forwarders thru any api-ms-win-core-*.dll.
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * ASSUMES forwarders are resolved after one redirection.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync size_t cbInfo = RT_MIN((uint32_t)*pValue, sizeof(RTLDRIMPORTINFO) + 32);
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync PRTLDRIMPORTINFO pInfo = (PRTLDRIMPORTINFO)alloca(cbInfo);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrQueryForwarderInfo(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync pImage = supHardNtVpFindModule(pThis, pInfo->szModule);
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pImage->pCacheEntry->pbBits,
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync pImage->uImageBase, pInfo->iOrdinal, pInfo->pszSymbol, pValue);
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync SUP_DPRINTF(("supHardNtVpGetImport: Failed to find symbol '%s' in '%s' (forwarded from %s / %s): %Rrc\n",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync pInfo->pszSymbol, pInfo->szModule, pszModule, pszSymbol, rc));
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync SUP_DPRINTF(("supHardNtVpGetImport: Failed to find forwarder module '%s' (%#x / %s; originally %s / %#x / %s): %Rrc\n",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync pInfo->szModule, pInfo->iOrdinal, pInfo->pszSymbol, pszModule, uSymbol, pszSymbol, rc));
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync SUP_DPRINTF(("supHardNtVpGetImport: RTLdrQueryForwarderInfo failed on symbol %#x/'%s' in '%s': %Rrc\n",
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync SUP_DPRINTF(("supHardNtVpGetImport: Failed to find symbol %#x / '%s' in '%s': %Rrc\n",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Compares process memory with the disk content.
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * @returns VBox status code.
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * @param pThis The process scanning state structure (for the
90ce7af4052f25f4a94d18c0ef86181971396cd3vboxsync * two scratch buffers).
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pImage The image data collected during the address
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * space scan.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param hProcess Handle to the process.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * @param pErrInfo Pointer to error info structure. Optional.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsyncstatic int supHardNtVpVerifyImageMemoryCompare(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, HANDLE hProcess, PRTERRINFO pErrInfo)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Read and find the file headers.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync int rc = supHardNtVpReadImage(pImage, 0 /*off*/, pThis->abFile, sizeof(pThis->abFile));
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_IMAGE_HDR_READ_ERROR,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Error reading image header: %Rrc", pImage->pszName, rc);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)&pThis->abFile[0];
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (offNtHdrs > 512 || offNtHdrs < sizeof(*pDosHdr))
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_MZ_OFFSET,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected e_lfanew value: %#x", pImage->pszName, offNtHdrs);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync PIMAGE_NT_HEADERS pNtHdrs = (PIMAGE_NT_HEADERS)&pThis->abFile[offNtHdrs];
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync PIMAGE_NT_HEADERS32 pNtHdrs32 = (PIMAGE_NT_HEADERS32)pNtHdrs;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIGNATURE,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: No PE signature at %#x: %#x", pImage->pszName, offNtHdrs, pNtHdrs->Signature);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Do basic header validation.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && !pImage->f32bitResourceDll)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_I386)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_IMAGE_MACHINE,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected machine: %#x", pImage->pszName, pNtHdrs->FileHeader.Machine);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync bool const fIs32Bit = pNtHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (pNtHdrs->FileHeader.SizeOfOptionalHeader != (fIs32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected optional header size: %#x",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (pNtHdrs->OptionalHeader.Magic != (fIs32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected optional header magic: %#x", pImage->pszName, pNtHdrs->OptionalHeader.Magic);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t cDirs = (fIs32Bit ? pNtHdrs32->OptionalHeader.NumberOfRvaAndSizes : pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected data dirs: %#x", pImage->pszName, cDirs);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Before we start comparing things, store what we need to know from the headers.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t const cSections = pNtHdrs->FileHeader.NumberOfSections;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_SECTIONS,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Too many section headers: %#x", pImage->pszName, cSections);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync suplibHardenedMemCopy(pThis->aSecHdrs, (fIs32Bit ? (void *)(pNtHdrs32 + 1) : (void *)(pNtHdrs + 1)),
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uintptr_t const uImageBase = fIs32Bit ? pNtHdrs32->OptionalHeader.ImageBase : pNtHdrs->OptionalHeader.ImageBase;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_BASE,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Invalid image base: %p", pImage->pszName, uImageBase);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t const cbImage = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfImage : pNtHdrs->OptionalHeader.SizeOfImage;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (RT_ALIGN_32(pImage->cbImage, PAGE_SIZE) != RT_ALIGN_32(cbImage, PAGE_SIZE) && !pImage->fApiSetSchemaOnlySection1)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync "%s: SizeOfImage (%#x) isn't close enough to the mapping size (%#x)",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (cbImage != RTLdrSize(pImage->pCacheEntry->hLdrMod))
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: SizeOfImage (%#x) differs from what RTLdrSize returns (%#zx)",
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->pszName, cbImage, RTLdrSize(pImage->pCacheEntry->hLdrMod));
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t const cbSectAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.SectionAlignment : pNtHdrs->OptionalHeader.SectionAlignment;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync || cbSectAlign > (pImage->fApiSetSchemaOnlySection1 ? _64K : (uint32_t)PAGE_SIZE) )
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_ALIGNMENT_VALUE,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync "%s: Unexpected SectionAlignment value: %#x", pImage->pszName, cbSectAlign);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync uint32_t const cbFileAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.FileAlignment : pNtHdrs->OptionalHeader.FileAlignment;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (!RT_IS_POWER_OF_TWO(cbFileAlign) || cbFileAlign < 512 || cbFileAlign > PAGE_SIZE || cbFileAlign > cbSectAlign)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_FILE_ALIGNMENT_VALUE,
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync "%s: Unexpected FileAlignment value: %#x (cbSectAlign=%#x)",
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync uint32_t const cbHeaders = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfHeaders : pNtHdrs->OptionalHeader.SizeOfHeaders;
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync uint32_t const cbMinHdrs = offNtHdrs + (fIs32Bit ? sizeof(*pNtHdrs32) : sizeof(*pNtHdrs) )
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync "%s: Headers are too small: %#x < %#x (cSections=%#x)",
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync uint32_t const cbHdrsFile = RT_ALIGN_32(cbHeaders, cbFileAlign);
7481bcc52798a04f39bb360635624df5658d2791vboxsync return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
7481bcc52798a04f39bb360635624df5658d2791vboxsync "%s: Headers are larger than expected: %#x/%#x (expected max %zx)",
7481bcc52798a04f39bb360635624df5658d2791vboxsync pImage->pszName, cbHeaders, cbHdrsFile, sizeof(pThis->abFile));
1bc6deb47f3874f8d1d7a7b6e01d7d7c314d808fvboxsync * Save some header fields we might be using later on.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->fImageCharecteristics = pNtHdrs->FileHeader.Characteristics;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->fDllCharecteristics = fIs32Bit ? pNtHdrs32->OptionalHeader.DllCharacteristics : pNtHdrs->OptionalHeader.DllCharacteristics;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Correct the apisetschema image base, size and region rva.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->uImageBase -= pThis->aSecHdrs[0].VirtualAddress;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->cbImage += pThis->aSecHdrs[0].VirtualAddress;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync pImage->aRegions[0].uRva = pThis->aSecHdrs[0].VirtualAddress;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Get relocated bits.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if (pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = supHardNtLdrCacheEntryGetBits(pImage->pCacheEntry, &pbBits, pImage->uImageBase, NULL /*pfnGetImport*/, pThis,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = supHardNtLdrCacheEntryGetBits(pImage->pCacheEntry, &pbBits, pImage->uImageBase, supHardNtVpGetImport, pThis,
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* XP SP3 does not set ImageBase to load address. It fixes up the image on load time though. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync ((PIMAGE_NT_HEADERS32)&pbBits[offNtHdrs])->OptionalHeader.ImageBase = (uint32_t)pImage->uImageBase;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync ((PIMAGE_NT_HEADERS)&pbBits[offNtHdrs])->OptionalHeader.ImageBase = pImage->uImageBase;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync * Figure out areas we should skip during comparison.
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Ignore our NtCreateSection hack. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "NtCreateSection", &uValue);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'NtCreateSection': %Rrc", pImage->pszName, rc);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync aSkipAreas[cSkipAreas++].cb = ARCH_BITS == 32 ? 5 : 12;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Ignore our LdrLoadDll hack. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrLoadDll", &uValue);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'LdrLoadDll': %Rrc", pImage->pszName, rc);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync aSkipAreas[cSkipAreas++].cb = ARCH_BITS == 32 ? 5 : 12;
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync if ( pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync /* Ignore our patched LdrInitializeThunk hack. */
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrInitializeThunk", &uValue);
41d680dd6eb0287afc200adc5b0d61b07a32b72dvboxsync return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'LdrInitializeThunk': %Rrc", pImage->pszName, rc);
/* LdrSystemDllInitBlock is filled in by the kernel. It mainly contains addresses of 32-bit ntdll method for wow64. */
rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "LdrSystemDllInitBlock", &uValue);
rc = supHardNtVpFileMemCompareSection(pThis, pImage, 0 /*uRva*/, cbHdrsFile, pbBits, -1, NULL, 0, PAGE_READONLY);
return rc;
return rc;
switch (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE))
case IMAGE_SCN_MEM_READ:
&& !suplibHardenedMemComp(pThis->aSecHdrs[i].Name, ".mrdata", 8)) /* w8.1, ntdll. Changed by proc init. */
case IMAGE_SCN_MEM_EXECUTE:
|| (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE)) == IMAGE_SCN_MEM_READ
return rc;
rc = supHardNtVpCheckSectionProtection(pThis, pImage, uSectRva, RT_ALIGN_32(cbMap, PAGE_SIZE), fProt);
return rc;
return VINF_SUCCESS;
int rc;
rc = supHardNtLdrCacheEntryVerify(pImage->pCacheEntry, pImage->Name.UniStr.Buffer, pThis->pErrInfo);
return rc;
NTSTATUS rcNt = NtQueryInformationThread(hThread, ThreadAmILastThread, &fAmI, sizeof(fAmI), &cbIgn);
if (!fAmI)
return VINF_SUCCESS;
#ifndef VBOX_WITHOUT_DEBUGGER_CHECKS
if (uPtr != 0)
return VINF_SUCCESS;
if (!ch1)
static int supHardNtVpNewImage(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, PMEMORY_BASIC_INFORMATION pMemInfo)
while ( cwcDirName > 0
pwszFilename--;
cwcDirName--;
if (!*pwszFilename)
while ( cwcDirName > 0
cwcDirName--;
# ifdef VBOX_PERMIT_MORE
|| !supHardViIsAppPatchDir(pImage->Name.UniStr.Buffer, pImage->Name.UniStr.Length / sizeof(WCHAR)) )
# ifdef VBOX_PERMIT_MORE
#ifdef IN_RING3
return VINF_OBJECT_DESTROYED;
SUP_DPRINTF(("supHardNtVpScanVirtualMemory: NtUnmapViewOfSection(,%p) failed: %#x\n", pMemInfo->AllocationBase, rcNt));
"See http://www.symantec.com/connect/articles/creating-application-control-exclusions-symantec-endpoint-protection-121"
return pThis->rcResult = VERR_SUP_VP_SYSFER_DLL; /* Try make sure this is what the user sees first! */
"Invalid AllocationBase/BaseAddress for %s: %p vs %p.",
#ifdef VBOX_PERMIT_MORE
return VINF_SUCCESS;
static int supHardNtVpAddRegion(PSUPHNTVPSTATE pThis, PSUPHNTVPIMAGE pImage, PMEMORY_BASIC_INFORMATION pMemInfo)
return VINF_SUCCESS;
pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION ? "CHILD_PURIFICATION" : "SELF_PURIFICATION"));
#ifdef VBOX_PERMIT_VERIFIER_DLL
(void const *)uPtrWhere,
&MemInfo,
sizeof(MemInfo),
&cbActual);
(void const *)uPtrWhere,
&cbActual);
pThis->aImages[iImg].Name.UniStr.Buffer[pThis->aImages[iImg].Name.UniStr.Length / sizeof(WCHAR)] = '\0';
bool fNew = true;
while (iSearch-- > 0)
if (supHardNtVpAreUniStringsEqual(&pThis->aImages[iSearch].Name.UniStr, &pThis->aImages[iImg].Name.UniStr))
return rc;
fNew = false;
if (fNew)
return rc;
return rc;
else if ( (MemInfo.Protect & (PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY))
&& cXpExceptions == 0
else if (MemInfo.Protect & (PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY))
# ifdef IN_RING3
* Free any private executable memory (sysplant.sys allocates executable memory).
# ifndef IN_RING3
DECLHIDDEN(int) supHardNtLdrCacheEntryVerify(PSUPHNTLDRCACHEENTRY pEntry, PCRTUTF16 pwszName, PRTERRINFO pErrInfo)
return rc;
int rc;
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_IMAGE_TOO_BIG, "Image %s is too large: %zu bytes (%#zx).",
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "Failed to allocate %zu bytes for image %s.",
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "RTLdrGetBits failed on image %s: %Rrc",
|| pfnGetImport)
return supHardNtVpSetInfo1(pErrInfo, VERR_SUP_VP_NO_MEMORY, "RTLdrGetBits failed on image %s: %Rrc",
return VINF_SUCCESS;
#ifdef IN_RING3
return &g_aSupNtVpLdrCacheEntries[i];
return NULL;
static int supHardNtLdrCacheNewEntry(PSUPHNTLDRCACHEENTRY pEntry, const char *pszName, PUNICODE_STRING pUniStrPath,
InitializeObjectAttributes(&ObjAttr, pUniStrPath, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/);
#ifdef IN_RING0
&ObjAttr,
&Ios,
if (f32bitResourceDll)
return rc;
#ifdef IN_SUP_HARDENED_R3
return VINF_SUCCESS;
#ifdef IN_RING3
uint32_t i = 0;
return VERR_FILE_NOT_FOUND;
if (*ppEntry)
return VINF_SUCCESS;
return VERR_INTERNAL_ERROR_3;
int rc = supHardNtLdrCacheNewEntry(&g_aSupNtVpLdrCacheEntries[g_cSupNtVpLdrCacheEntries], pszName, &UniStr,
return VINF_SUCCESS;
return rc;
#ifdef IN_RING3
return rc;
#ifdef IN_RING3
return VINF_SUCCESS;
unsigned cExecs = 0;
unsigned iExe = ~0U;
cExecs++;
iExe = i;
if (cExecs == 0)
int rc;
if (!pUniStr)
NTSTATUS rcNt = NtQueryInformationProcess(hProcess, ProcessImageFileName, pUniStr, cbUniStr - sizeof(WCHAR), &cbIgn);
return rc;
return rc;
rcNt = NtQueryInformationProcess(hProcess, ProcessImageInformation, &ImageInfo, sizeof(ImageInfo), NULL);
return VINF_SUCCESS;
return VINF_SUCCESS;
uint32_t j = i;
iNtDll = i;
iKernel32 = i;
return rc;
return VINF_SUCCESS;
DECLHIDDEN(int) supHardenedWinVerifyProcess(HANDLE hProcess, HANDLE hThread, SUPHARDNTVPKIND enmKind,
if (pcFixes)
*pcFixes = 0;
if (pThis)
if (pcFixes)
#ifdef IN_RING0
return rc;