VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h

Last change on this file was 104384, checked in by vboxsync, 2 weeks ago

/Config.kmk,SUPHardNt: s/VBOX_WITHOUT_HARDENING_INTEGRITY_CHECK/VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT/; s/SUPHNTVI_F_TRUSTED_INSTALLER_OWNER/SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER/; some more comments, a @todo and dialing back the changes a little. bugref:10657
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 12.9 KB
Line 
1/* $Id: SUPHardenedVerify-win.h 104384 2024-04-19 22:03:10Z vboxsync $ */
2/** @file
3 * VirtualBox Support Library/Driver - Hardened Verification, Windows.
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37#ifndef VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h
38#define VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h
39#ifndef RT_WITHOUT_PRAGMA_ONCE
40# pragma once
41#endif
42
43#include <iprt/types.h>
44#include <iprt/crypto/x509.h>
45#ifndef SUP_CERTIFICATES_ONLY
46# ifdef RT_OS_WINDOWS
47# include <iprt/ldr.h>
48# endif
49#endif
50
51
52RT_C_DECLS_BEGIN
53
54#ifndef SUP_CERTIFICATES_ONLY
55# ifdef RT_OS_WINDOWS
56DECLHIDDEN(int) supHardenedWinInitImageVerifier(PRTERRINFO pErrInfo);
57DECLHIDDEN(void) supHardenedWinTermImageVerifier(void);
58DECLHIDDEN(void) supR3HardenedWinVerifyCacheScheduleImports(RTLDRMOD hLdrMod, PCRTUTF16 pwszName);
59DECLHIDDEN(void) supR3HardenedWinVerifyCachePreload(PCRTUTF16 pwszName);
60
61
62typedef enum SUPHARDNTVPKIND
63{
64 SUPHARDNTVPKIND_VERIFY_ONLY = 1,
65 SUPHARDNTVPKIND_CHILD_PURIFICATION,
66 SUPHARDNTVPKIND_SELF_PURIFICATION,
67 SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED,
68 SUPHARDNTVPKIND_32BIT_HACK = 0x7fffffff
69} SUPHARDNTVPKIND;
70/** @name SUPHARDNTVP_F_XXX - Flags for supHardenedWinVerifyProcess
71 * @{ */
72/** Replace unwanted executable memory allocations with a new one that's filled
73 * with a safe read-write copy (default is just to free it).
74 *
75 * This is one way we attempt to work around buggy protection software that
76 * either result in host BSOD or VBox application malfunction. Here the current
77 * shit list:
78 * - Trend Micro's data protection software includes a buggy driver called
79 * sakfile.sys that has been observed crashing accessing user memory that we
80 * probably freed. I'd love to report this to Trend Micro, but unfortunately
81 * they doesn't advertise (or have?) an email address for reporting security
82 * vulnerabilities in the their software. Having wasted time looking and not
83 * very sorry for having to disclosing the bug here.
84 * - Maybe one more.
85 */
86#define SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW RT_BIT_32(0)
87/** @} */
88DECLHIDDEN(int) supHardenedWinVerifyProcess(HANDLE hProcess, HANDLE hThread, SUPHARDNTVPKIND enmKind,
89 uint32_t fFlags, uint32_t *pcFixes, PRTERRINFO pErrInfo);
90DECLHIDDEN(int) supHardNtVpThread(HANDLE hProcess, HANDLE hThread, PRTERRINFO pErrInfo);
91DECLHIDDEN(int) supHardNtVpDebugger(HANDLE hProcess, PRTERRINFO pErrInfo);
92
93DECLHIDDEN(bool) supHardViUtf16PathIsEqualEx(PCRTUTF16 pawcLeft, size_t cwcLeft, const char *pszRight);
94DECLHIDDEN(bool) supHardViUniStrPathStartsWithUniStr(UNICODE_STRING const *pUniStrLeft,
95 UNICODE_STRING const *pUniStrRight, bool fCheckSlash);
96DECLHIDDEN(bool) supHardViUtf16PathStartsWithEx(PCRTUTF16 pwszLeft, uint32_t cwcLeft,
97 PCRTUTF16 pwszRight, uint32_t cwcRight, bool fCheckSlash);
98DECLHIDDEN(bool) supHardViIsAppPatchDir(PCRTUTF16 pwszPath, uint32_t cwcName);
99
100
101/**
102 * SUP image verifier loader reader instance.
103 */
104typedef struct SUPHNTVIRDR
105{
106 /** The core reader structure. */
107 RTLDRREADER Core;
108 /** The file handle. */
109 HANDLE hFile;
110 /** Handle to event sempahore in case we're force to deal with asynchronous I/O. */
111 HANDLE hEvent;
112 /** Current file offset. */
113 RTFOFF off;
114 /** The file size. */
115 uint64_t cbFile;
116 /** Flags for the verification callback, SUPHNTVI_F_XXX. */
117 uint32_t fFlags;
118 /** Number of signatures that verified okay. */
119 uint16_t cOkaySignatures;
120 /** Number of signatures that couldn't be successfully verified (time stamp
121 * issues, no certificate path, etc) but weren't fatal. */
122 uint16_t cNokSignatures;
123 /** Total number of signatures. */
124 uint16_t cTotalSignatures;
125 /** The current signature (for passing to supHardNtViCertVerifyCallback). */
126 uint16_t iCurSignature;
127 /** The last non-fatal signature failure. */
128 int rcLastSignatureFailure;
129 /** Log name. */
130 char szFilename[1];
131} SUPHNTVIRDR;
132/** Pointer to an SUP image verifier loader reader instance. */
133typedef SUPHNTVIRDR *PSUPHNTVIRDR;
134DECLHIDDEN(int) supHardNtViRdrCreate(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PSUPHNTVIRDR *ppNtViRdr);
135DECLHIDDEN(bool) supHardenedWinIsWinVerifyTrustCallable(void);
136DECLHIDDEN(int) supHardenedWinVerifyImageTrust(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, int rc,
137 bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
138DECLHIDDEN(int) supHardenedWinVerifyImageByHandle(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags,
139 bool fAvoidWinVerifyTrust, bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
140DECLHIDDEN(int) supHardenedWinVerifyImageByHandleNoName(HANDLE hFile, uint32_t fFlags, PRTERRINFO pErrInfo);
141DECLHIDDEN(int) supHardenedWinVerifyImageByLdrMod(RTLDRMOD hLdrMod, PCRTUTF16 pwszName, PSUPHNTVIRDR pNtViRdr,
142 bool fAvoidWinVerifyTrust, bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
143/** @name SUPHNTVI_F_XXX - Flags for supHardenedWinVerifyImageByHandle.
144 * @{ */
145/** The signing certificate must be the same as the one the VirtualBox build
146 * was signed with. */
147# define SUPHNTVI_F_REQUIRE_BUILD_CERT RT_BIT(0)
148/** Require kernel code signing level. */
149# define SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING RT_BIT(1)
150/** Require the image to force the memory mapper to do signature checking. */
151# define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT RT_BIT(2)
152/** Whether to allow image verification by catalog file. */
153# define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION RT_BIT(3)
154/** The file owner must be TrustedInstaller, Builtin\\Administrators
155 * (S-1-5-32-544) or local system (S-1-5-21) on Vista+. */
156# define SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER RT_BIT(4)
157/** Ignore the image architecture (otherwise it must match the verification
158 * code). Used with resource images and such. */
159# define SUPHNTVI_F_IGNORE_ARCHITECTURE RT_BIT(30)
160/** Raw-mode context image, always 32-bit. */
161# define SUPHNTVI_F_RC_IMAGE RT_BIT(31)
162/** @} */
163
164/* Array in SUPHardenedVerifyImage-win.cpp */
165extern const RTSTRTUPLE g_aSupNtViBlacklistedDlls[];
166
167/**
168 * Loader cache entry.
169 *
170 * This is for avoiding loading and signature checking a file multiple times,
171 * due to multiple passes thru the process validation code (and syscall import
172 * code of NTDLL).
173 */
174typedef struct SUPHNTLDRCACHEENTRY
175{
176 /** The file name (from g_apszSupNtVpAllowedDlls or
177 * g_apszSupNtVpAllowedVmExes). */
178 const char *pszName;
179 /** Load module associated with the image during content verfication. */
180 RTLDRMOD hLdrMod;
181 /** The file reader. */
182 PSUPHNTVIRDR pNtViRdr;
183 /** The module file handle, if we've opened it.
184 * (pNtviRdr does not close the file handle on destruction.) */
185 HANDLE hFile;
186 /** Bits buffer. */
187 uint8_t *pbBits;
188 /** Set if verified. */
189 bool fVerified;
190 /** Whether we've got valid cacheable image bits. */
191 bool fValidBits;
192 /** The image base address. */
193 uintptr_t uImageBase;
194} SUPHNTLDRCACHEENTRY;
195/** Pointer to a loader cache entry. */
196typedef SUPHNTLDRCACHEENTRY *PSUPHNTLDRCACHEENTRY;
197DECLHIDDEN(int) supHardNtLdrCacheOpen(const char *pszName, PSUPHNTLDRCACHEENTRY *ppEntry, PRTERRINFO pErrInfo);
198DECLHIDDEN(int) supHardNtLdrCacheEntryVerify(PSUPHNTLDRCACHEENTRY pEntry, PCRTUTF16 pwszName, PRTERRINFO pErrInfo);
199DECLHIDDEN(int) supHardNtLdrCacheEntryGetBits(PSUPHNTLDRCACHEENTRY pEntry, uint8_t **ppbBits, RTLDRADDR uBaseAddress,
200 PFNRTLDRIMPORT pfnGetImport, void *pvUser, PRTERRINFO pErrInfo);
201
202
203/** Which directory under the system root to get. */
204typedef enum SUPHARDNTSYSROOTDIR
205{
206 kSupHardNtSysRootDir_System32 = 0,
207 kSupHardNtSysRootDir_WinSxS,
208} SUPHARDNTSYSROOTDIR;
209
210DECLHIDDEN(int) supHardNtGetSystemRootDir(void *pvBuf, uint32_t cbBuf, SUPHARDNTSYSROOTDIR enmDir, PRTERRINFO pErrInfo);
211
212# ifndef SUPHNTVI_NO_NT_STUFF
213
214/** Typical system root directory buffer. */
215typedef struct SUPSYSROOTDIRBUF
216{
217 UNICODE_STRING UniStr;
218 WCHAR awcBuffer[260];
219} SUPSYSROOTDIRBUF;
220extern SUPSYSROOTDIRBUF g_System32NtPath;
221extern SUPSYSROOTDIRBUF g_WinSxSNtPath;
222#if defined(IN_RING3) && !defined(VBOX_PERMIT_EVEN_MORE)
223extern SUPSYSROOTDIRBUF g_ProgramFilesNtPath;
224extern SUPSYSROOTDIRBUF g_CommonFilesNtPath;
225# if ARCH_BITS == 64
226extern SUPSYSROOTDIRBUF g_ProgramFilesX86NtPath;
227extern SUPSYSROOTDIRBUF g_CommonFilesX86NtPath;
228# endif
229#endif /* IN_RING3 && !VBOX_PERMIT_EVEN_MORE */
230extern SUPSYSROOTDIRBUF g_SupLibHardenedExeNtPath;
231extern SUPSYSROOTDIRBUF g_SupLibHardenedAppBinNtPath;
232
233# ifdef IN_RING0
234/** Pointer to NtQueryVirtualMemory. */
235typedef DECLCALLBACKPTR_EX(NTSTATUS, NTAPI, PFNNTQUERYVIRTUALMEMORY,(HANDLE, void const *, MEMORY_INFORMATION_CLASS,
236 PVOID, SIZE_T, PSIZE_T));
237extern PFNNTQUERYVIRTUALMEMORY g_pfnNtQueryVirtualMemory;
238# endif
239
240# endif /* SUPHNTVI_NO_NT_STUFF */
241
242/** Creates a combined NT version number for simple comparisons. */
243#define SUP_MAKE_NT_VER_COMBINED(a_uMajor, a_uMinor, a_uBuild, a_uSpMajor, a_uSpMinor) \
244 ( ((uint32_t)((a_uMajor) & UINT32_C(0xf)) << 28) \
245 | ((uint32_t)((a_uMinor) & UINT32_C(0xf)) << 24) \
246 | ((uint32_t)((a_uBuild) & UINT32_C(0xffff)) << 8) \
247 | ((uint32_t)((a_uSpMajor) & UINT32_C(0xf)) << 4) \
248 | (uint32_t)((a_uSpMinor) & UINT32_C(0xf)) )
249/** Simple version of SUP_MAKE_NT_VER_COMBINED. */
250#define SUP_MAKE_NT_VER_SIMPLE(a_uMajor, a_uMinor) SUP_MAKE_NT_VER_COMBINED(a_uMajor, a_uMinor, 0, 0, 0)
251extern uint32_t g_uNtVerCombined;
252
253/** @name NT version constants for less-than checks.
254 * @{ */
255/** Combined NT version number for XP. */
256#define SUP_NT_VER_XP SUP_MAKE_NT_VER_SIMPLE(5,1)
257/** Combined NT version number for Windows server 2003 & XP64. */
258#define SUP_NT_VER_W2K3 SUP_MAKE_NT_VER_SIMPLE(5,2)
259/** Combined NT version number for Vista. */
260#define SUP_NT_VER_VISTA SUP_MAKE_NT_VER_SIMPLE(6,0)
261/** Combined NT version number for Vista with SP1. */
262#define SUP_NT_VER_VISTA_SP1 SUP_MAKE_NT_VER_COMBINED(6,0,6001,1,0)
263/** Combined NT version number for Windows 7. */
264#define SUP_NT_VER_W70 SUP_MAKE_NT_VER_SIMPLE(6,1)
265/** Combined NT version number for Windows 8.0. */
266#define SUP_NT_VER_W80 SUP_MAKE_NT_VER_SIMPLE(6,2)
267/** Combined NT version number for Windows 8.1. */
268#define SUP_NT_VER_W81 SUP_MAKE_NT_VER_SIMPLE(6,3)
269/** @} */
270
271# endif
272
273# ifndef IN_SUP_HARDENED_R3
274# include <iprt/mem.h>
275# include <iprt/string.h>
276
277# define suplibHardenedMemComp memcmp
278# define suplibHardenedMemCopy memcpy
279# define suplibHardenedMemSet memset
280# define suplibHardenedStrCopy strcpy
281# define suplibHardenedStrLen strlen
282# define suplibHardenedStrCat strcat
283# define suplibHardenedStrCmp strcmp
284# define suplibHardenedStrNCmp strncmp
285# else /* IN_SUP_HARDENED_R3 */
286# include <iprt/mem.h>
287# if 0
288# define memcmp suplibHardenedMemComp
289# define memcpy suplibHardenedMemCopy
290# define memset suplibHardenedMemSet
291# define strcpy suplibHardenedStrCopy
292# define strlen suplibHardenedStrLen
293# define strcat suplibHardenedStrCat
294# define strcmp suplibHardenedStrCmp
295# define strncmp suplibHardenedStrNCmp
296# endif
297# endif /* IN_SUP_HARDENED_R3 */
298
299#endif /* SUP_CERTIFICATES_ONLY */
300
301RT_C_DECLS_END
302
303#endif /* !VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h */
304
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use