[51770] | 1 | /* $Id: SUPHardenedVerify-win.h 104384 2024-04-19 22:03:10Z vboxsync $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * VirtualBox Support Library/Driver - Hardened Verification, Windows.
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | /*
|
---|
[98103] | 7 | * Copyright (C) 2006-2023 Oracle and/or its affiliates.
|
---|
[51770] | 8 | *
|
---|
[96407] | 9 | * This file is part of VirtualBox base platform packages, as
|
---|
| 10 | * available from https://www.virtualbox.org.
|
---|
[51770] | 11 | *
|
---|
[96407] | 12 | * This program is free software; you can redistribute it and/or
|
---|
| 13 | * modify it under the terms of the GNU General Public License
|
---|
| 14 | * as published by the Free Software Foundation, in version 3 of the
|
---|
| 15 | * License.
|
---|
| 16 | *
|
---|
| 17 | * This program is distributed in the hope that it will be useful, but
|
---|
| 18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
| 20 | * General Public License for more details.
|
---|
| 21 | *
|
---|
| 22 | * You should have received a copy of the GNU General Public License
|
---|
| 23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
| 24 | *
|
---|
[51770] | 25 | * The contents of this file may alternatively be used under the terms
|
---|
| 26 | * of the Common Development and Distribution License Version 1.0
|
---|
[96407] | 27 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
---|
| 28 | * in the VirtualBox distribution, in which case the provisions of the
|
---|
[51770] | 29 | * CDDL are applicable instead of those of the GPL.
|
---|
| 30 | *
|
---|
| 31 | * You may elect to license modified versions of this file under the
|
---|
| 32 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
[96407] | 33 | *
|
---|
| 34 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
---|
[51770] | 35 | */
|
---|
| 36 |
|
---|
[76568] | 37 | #ifndef VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h
|
---|
| 38 | #define VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h
|
---|
[76527] | 39 | #ifndef RT_WITHOUT_PRAGMA_ONCE
|
---|
| 40 | # pragma once
|
---|
| 41 | #endif
|
---|
[51770] | 42 |
|
---|
| 43 | #include <iprt/types.h>
|
---|
| 44 | #include <iprt/crypto/x509.h>
|
---|
[52204] | 45 | #ifndef SUP_CERTIFICATES_ONLY
|
---|
| 46 | # ifdef RT_OS_WINDOWS
|
---|
| 47 | # include <iprt/ldr.h>
|
---|
| 48 | # endif
|
---|
| 49 | #endif
|
---|
[51770] | 50 |
|
---|
[52204] | 51 |
|
---|
[51770] | 52 | RT_C_DECLS_BEGIN
|
---|
| 53 |
|
---|
| 54 | #ifndef SUP_CERTIFICATES_ONLY
|
---|
| 55 | # ifdef RT_OS_WINDOWS
|
---|
[85127] | 56 | DECLHIDDEN(int) supHardenedWinInitImageVerifier(PRTERRINFO pErrInfo);
|
---|
| 57 | DECLHIDDEN(void) supHardenedWinTermImageVerifier(void);
|
---|
| 58 | DECLHIDDEN(void) supR3HardenedWinVerifyCacheScheduleImports(RTLDRMOD hLdrMod, PCRTUTF16 pwszName);
|
---|
| 59 | DECLHIDDEN(void) supR3HardenedWinVerifyCachePreload(PCRTUTF16 pwszName);
|
---|
[51770] | 60 |
|
---|
[52403] | 61 |
|
---|
[52204] | 62 | typedef enum SUPHARDNTVPKIND
|
---|
| 63 | {
|
---|
| 64 | SUPHARDNTVPKIND_VERIFY_ONLY = 1,
|
---|
| 65 | SUPHARDNTVPKIND_CHILD_PURIFICATION,
|
---|
| 66 | SUPHARDNTVPKIND_SELF_PURIFICATION,
|
---|
[80216] | 67 | SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED,
|
---|
[52204] | 68 | SUPHARDNTVPKIND_32BIT_HACK = 0x7fffffff
|
---|
| 69 | } SUPHARDNTVPKIND;
|
---|
[53017] | 70 | /** @name SUPHARDNTVP_F_XXX - Flags for supHardenedWinVerifyProcess
|
---|
| 71 | * @{ */
|
---|
| 72 | /** Replace unwanted executable memory allocations with a new one that's filled
|
---|
[53021] | 73 | * with a safe read-write copy (default is just to free it).
|
---|
[53017] | 74 | *
|
---|
| 75 | * This is one way we attempt to work around buggy protection software that
|
---|
| 76 | * either result in host BSOD or VBox application malfunction. Here the current
|
---|
| 77 | * shit list:
|
---|
| 78 | * - Trend Micro's data protection software includes a buggy driver called
|
---|
| 79 | * sakfile.sys that has been observed crashing accessing user memory that we
|
---|
| 80 | * probably freed. I'd love to report this to Trend Micro, but unfortunately
|
---|
| 81 | * they doesn't advertise (or have?) an email address for reporting security
|
---|
| 82 | * vulnerabilities in the their software. Having wasted time looking and not
|
---|
| 83 | * very sorry for having to disclosing the bug here.
|
---|
| 84 | * - Maybe one more.
|
---|
| 85 | */
|
---|
[53021] | 86 | #define SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW RT_BIT_32(0)
|
---|
[53017] | 87 | /** @} */
|
---|
[85127] | 88 | DECLHIDDEN(int) supHardenedWinVerifyProcess(HANDLE hProcess, HANDLE hThread, SUPHARDNTVPKIND enmKind,
|
---|
| 89 | uint32_t fFlags, uint32_t *pcFixes, PRTERRINFO pErrInfo);
|
---|
| 90 | DECLHIDDEN(int) supHardNtVpThread(HANDLE hProcess, HANDLE hThread, PRTERRINFO pErrInfo);
|
---|
| 91 | DECLHIDDEN(int) supHardNtVpDebugger(HANDLE hProcess, PRTERRINFO pErrInfo);
|
---|
[52204] | 92 |
|
---|
[85127] | 93 | DECLHIDDEN(bool) supHardViUtf16PathIsEqualEx(PCRTUTF16 pawcLeft, size_t cwcLeft, const char *pszRight);
|
---|
| 94 | DECLHIDDEN(bool) supHardViUniStrPathStartsWithUniStr(UNICODE_STRING const *pUniStrLeft,
|
---|
| 95 | UNICODE_STRING const *pUniStrRight, bool fCheckSlash);
|
---|
| 96 | DECLHIDDEN(bool) supHardViUtf16PathStartsWithEx(PCRTUTF16 pwszLeft, uint32_t cwcLeft,
|
---|
| 97 | PCRTUTF16 pwszRight, uint32_t cwcRight, bool fCheckSlash);
|
---|
| 98 | DECLHIDDEN(bool) supHardViIsAppPatchDir(PCRTUTF16 pwszPath, uint32_t cwcName);
|
---|
[52204] | 99 |
|
---|
[52375] | 100 |
|
---|
[52204] | 101 | /**
|
---|
| 102 | * SUP image verifier loader reader instance.
|
---|
| 103 | */
|
---|
| 104 | typedef struct SUPHNTVIRDR
|
---|
| 105 | {
|
---|
| 106 | /** The core reader structure. */
|
---|
| 107 | RTLDRREADER Core;
|
---|
[53035] | 108 | /** The file handle. */
|
---|
[52204] | 109 | HANDLE hFile;
|
---|
[86549] | 110 | /** Handle to event sempahore in case we're force to deal with asynchronous I/O. */
|
---|
[53035] | 111 | HANDLE hEvent;
|
---|
[52204] | 112 | /** Current file offset. */
|
---|
| 113 | RTFOFF off;
|
---|
| 114 | /** The file size. */
|
---|
[77972] | 115 | uint64_t cbFile;
|
---|
[52204] | 116 | /** Flags for the verification callback, SUPHNTVI_F_XXX. */
|
---|
| 117 | uint32_t fFlags;
|
---|
[86549] | 118 | /** Number of signatures that verified okay. */
|
---|
| 119 | uint16_t cOkaySignatures;
|
---|
| 120 | /** Number of signatures that couldn't be successfully verified (time stamp
|
---|
| 121 | * issues, no certificate path, etc) but weren't fatal. */
|
---|
| 122 | uint16_t cNokSignatures;
|
---|
| 123 | /** Total number of signatures. */
|
---|
| 124 | uint16_t cTotalSignatures;
|
---|
[86610] | 125 | /** The current signature (for passing to supHardNtViCertVerifyCallback). */
|
---|
| 126 | uint16_t iCurSignature;
|
---|
[86549] | 127 | /** The last non-fatal signature failure. */
|
---|
| 128 | int rcLastSignatureFailure;
|
---|
[52204] | 129 | /** Log name. */
|
---|
| 130 | char szFilename[1];
|
---|
| 131 | } SUPHNTVIRDR;
|
---|
| 132 | /** Pointer to an SUP image verifier loader reader instance. */
|
---|
| 133 | typedef SUPHNTVIRDR *PSUPHNTVIRDR;
|
---|
[85127] | 134 | DECLHIDDEN(int) supHardNtViRdrCreate(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, PSUPHNTVIRDR *ppNtViRdr);
|
---|
| 135 | DECLHIDDEN(bool) supHardenedWinIsWinVerifyTrustCallable(void);
|
---|
| 136 | DECLHIDDEN(int) supHardenedWinVerifyImageTrust(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags, int rc,
|
---|
| 137 | bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
|
---|
| 138 | DECLHIDDEN(int) supHardenedWinVerifyImageByHandle(HANDLE hFile, PCRTUTF16 pwszName, uint32_t fFlags,
|
---|
| 139 | bool fAvoidWinVerifyTrust, bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
|
---|
| 140 | DECLHIDDEN(int) supHardenedWinVerifyImageByHandleNoName(HANDLE hFile, uint32_t fFlags, PRTERRINFO pErrInfo);
|
---|
| 141 | DECLHIDDEN(int) supHardenedWinVerifyImageByLdrMod(RTLDRMOD hLdrMod, PCRTUTF16 pwszName, PSUPHNTVIRDR pNtViRdr,
|
---|
| 142 | bool fAvoidWinVerifyTrust, bool *pfWinVerifyTrust, PRTERRINFO pErrInfo);
|
---|
[51770] | 143 | /** @name SUPHNTVI_F_XXX - Flags for supHardenedWinVerifyImageByHandle.
|
---|
| 144 | * @{ */
|
---|
| 145 | /** The signing certificate must be the same as the one the VirtualBox build
|
---|
| 146 | * was signed with. */
|
---|
| 147 | # define SUPHNTVI_F_REQUIRE_BUILD_CERT RT_BIT(0)
|
---|
| 148 | /** Require kernel code signing level. */
|
---|
| 149 | # define SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING RT_BIT(1)
|
---|
| 150 | /** Require the image to force the memory mapper to do signature checking. */
|
---|
[104384] | 151 | # define SUPHNTVI_F_REQUIRE_SIGNATURE_ENFORCEMENT RT_BIT(2)
|
---|
[51770] | 152 | /** Whether to allow image verification by catalog file. */
|
---|
| 153 | # define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION RT_BIT(3)
|
---|
[104384] | 154 | /** The file owner must be TrustedInstaller, Builtin\\Administrators
|
---|
| 155 | * (S-1-5-32-544) or local system (S-1-5-21) on Vista+. */
|
---|
| 156 | # define SUPHNTVI_F_TRUSTED_INSTALLER_OR_SIMILAR_OWNER RT_BIT(4)
|
---|
[53220] | 157 | /** Ignore the image architecture (otherwise it must match the verification
|
---|
| 158 | * code). Used with resource images and such. */
|
---|
| 159 | # define SUPHNTVI_F_IGNORE_ARCHITECTURE RT_BIT(30)
|
---|
[51770] | 160 | /** Raw-mode context image, always 32-bit. */
|
---|
| 161 | # define SUPHNTVI_F_RC_IMAGE RT_BIT(31)
|
---|
| 162 | /** @} */
|
---|
| 163 |
|
---|
[66525] | 164 | /* Array in SUPHardenedVerifyImage-win.cpp */
|
---|
| 165 | extern const RTSTRTUPLE g_aSupNtViBlacklistedDlls[];
|
---|
| 166 |
|
---|
[52366] | 167 | /**
|
---|
| 168 | * Loader cache entry.
|
---|
| 169 | *
|
---|
| 170 | * This is for avoiding loading and signature checking a file multiple times,
|
---|
| 171 | * due to multiple passes thru the process validation code (and syscall import
|
---|
| 172 | * code of NTDLL).
|
---|
| 173 | */
|
---|
| 174 | typedef struct SUPHNTLDRCACHEENTRY
|
---|
| 175 | {
|
---|
| 176 | /** The file name (from g_apszSupNtVpAllowedDlls or
|
---|
| 177 | * g_apszSupNtVpAllowedVmExes). */
|
---|
| 178 | const char *pszName;
|
---|
| 179 | /** Load module associated with the image during content verfication. */
|
---|
| 180 | RTLDRMOD hLdrMod;
|
---|
| 181 | /** The file reader. */
|
---|
| 182 | PSUPHNTVIRDR pNtViRdr;
|
---|
| 183 | /** The module file handle, if we've opened it.
|
---|
| 184 | * (pNtviRdr does not close the file handle on destruction.) */
|
---|
| 185 | HANDLE hFile;
|
---|
| 186 | /** Bits buffer. */
|
---|
| 187 | uint8_t *pbBits;
|
---|
| 188 | /** Set if verified. */
|
---|
| 189 | bool fVerified;
|
---|
[80242] | 190 | /** Whether we've got valid cacheable image bits. */
|
---|
[52947] | 191 | bool fValidBits;
|
---|
| 192 | /** The image base address. */
|
---|
| 193 | uintptr_t uImageBase;
|
---|
[52366] | 194 | } SUPHNTLDRCACHEENTRY;
|
---|
| 195 | /** Pointer to a loader cache entry. */
|
---|
| 196 | typedef SUPHNTLDRCACHEENTRY *PSUPHNTLDRCACHEENTRY;
|
---|
[85127] | 197 | DECLHIDDEN(int) supHardNtLdrCacheOpen(const char *pszName, PSUPHNTLDRCACHEENTRY *ppEntry, PRTERRINFO pErrInfo);
|
---|
| 198 | DECLHIDDEN(int) supHardNtLdrCacheEntryVerify(PSUPHNTLDRCACHEENTRY pEntry, PCRTUTF16 pwszName, PRTERRINFO pErrInfo);
|
---|
| 199 | DECLHIDDEN(int) supHardNtLdrCacheEntryGetBits(PSUPHNTLDRCACHEENTRY pEntry, uint8_t **ppbBits, RTLDRADDR uBaseAddress,
|
---|
| 200 | PFNRTLDRIMPORT pfnGetImport, void *pvUser, PRTERRINFO pErrInfo);
|
---|
[52366] | 201 |
|
---|
| 202 |
|
---|
[51770] | 203 | /** Which directory under the system root to get. */
|
---|
| 204 | typedef enum SUPHARDNTSYSROOTDIR
|
---|
| 205 | {
|
---|
| 206 | kSupHardNtSysRootDir_System32 = 0,
|
---|
| 207 | kSupHardNtSysRootDir_WinSxS,
|
---|
| 208 | } SUPHARDNTSYSROOTDIR;
|
---|
| 209 |
|
---|
[85127] | 210 | DECLHIDDEN(int) supHardNtGetSystemRootDir(void *pvBuf, uint32_t cbBuf, SUPHARDNTSYSROOTDIR enmDir, PRTERRINFO pErrInfo);
|
---|
[51770] | 211 |
|
---|
| 212 | # ifndef SUPHNTVI_NO_NT_STUFF
|
---|
| 213 |
|
---|
| 214 | /** Typical system root directory buffer. */
|
---|
| 215 | typedef struct SUPSYSROOTDIRBUF
|
---|
| 216 | {
|
---|
| 217 | UNICODE_STRING UniStr;
|
---|
| 218 | WCHAR awcBuffer[260];
|
---|
| 219 | } SUPSYSROOTDIRBUF;
|
---|
| 220 | extern SUPSYSROOTDIRBUF g_System32NtPath;
|
---|
| 221 | extern SUPSYSROOTDIRBUF g_WinSxSNtPath;
|
---|
[52943] | 222 | #if defined(IN_RING3) && !defined(VBOX_PERMIT_EVEN_MORE)
|
---|
[52365] | 223 | extern SUPSYSROOTDIRBUF g_ProgramFilesNtPath;
|
---|
| 224 | extern SUPSYSROOTDIRBUF g_CommonFilesNtPath;
|
---|
| 225 | # if ARCH_BITS == 64
|
---|
| 226 | extern SUPSYSROOTDIRBUF g_ProgramFilesX86NtPath;
|
---|
| 227 | extern SUPSYSROOTDIRBUF g_CommonFilesX86NtPath;
|
---|
| 228 | # endif
|
---|
[52943] | 229 | #endif /* IN_RING3 && !VBOX_PERMIT_EVEN_MORE */
|
---|
[51770] | 230 | extern SUPSYSROOTDIRBUF g_SupLibHardenedExeNtPath;
|
---|
[56733] | 231 | extern SUPSYSROOTDIRBUF g_SupLibHardenedAppBinNtPath;
|
---|
[51770] | 232 |
|
---|
[52356] | 233 | # ifdef IN_RING0
|
---|
[51770] | 234 | /** Pointer to NtQueryVirtualMemory. */
|
---|
[85121] | 235 | typedef DECLCALLBACKPTR_EX(NTSTATUS, NTAPI, PFNNTQUERYVIRTUALMEMORY,(HANDLE, void const *, MEMORY_INFORMATION_CLASS,
|
---|
| 236 | PVOID, SIZE_T, PSIZE_T));
|
---|
[51770] | 237 | extern PFNNTQUERYVIRTUALMEMORY g_pfnNtQueryVirtualMemory;
|
---|
[52356] | 238 | # endif
|
---|
[51770] | 239 |
|
---|
| 240 | # endif /* SUPHNTVI_NO_NT_STUFF */
|
---|
| 241 |
|
---|
| 242 | /** Creates a combined NT version number for simple comparisons. */
|
---|
| 243 | #define SUP_MAKE_NT_VER_COMBINED(a_uMajor, a_uMinor, a_uBuild, a_uSpMajor, a_uSpMinor) \
|
---|
[62677] | 244 | ( ((uint32_t)((a_uMajor) & UINT32_C(0xf)) << 28) \
|
---|
| 245 | | ((uint32_t)((a_uMinor) & UINT32_C(0xf)) << 24) \
|
---|
| 246 | | ((uint32_t)((a_uBuild) & UINT32_C(0xffff)) << 8) \
|
---|
| 247 | | ((uint32_t)((a_uSpMajor) & UINT32_C(0xf)) << 4) \
|
---|
| 248 | | (uint32_t)((a_uSpMinor) & UINT32_C(0xf)) )
|
---|
[51770] | 249 | /** Simple version of SUP_MAKE_NT_VER_COMBINED. */
|
---|
| 250 | #define SUP_MAKE_NT_VER_SIMPLE(a_uMajor, a_uMinor) SUP_MAKE_NT_VER_COMBINED(a_uMajor, a_uMinor, 0, 0, 0)
|
---|
| 251 | extern uint32_t g_uNtVerCombined;
|
---|
| 252 |
|
---|
[53022] | 253 | /** @name NT version constants for less-than checks.
|
---|
| 254 | * @{ */
|
---|
[51770] | 255 | /** Combined NT version number for XP. */
|
---|
| 256 | #define SUP_NT_VER_XP SUP_MAKE_NT_VER_SIMPLE(5,1)
|
---|
[52139] | 257 | /** Combined NT version number for Windows server 2003 & XP64. */
|
---|
| 258 | #define SUP_NT_VER_W2K3 SUP_MAKE_NT_VER_SIMPLE(5,2)
|
---|
[51770] | 259 | /** Combined NT version number for Vista. */
|
---|
| 260 | #define SUP_NT_VER_VISTA SUP_MAKE_NT_VER_SIMPLE(6,0)
|
---|
[53022] | 261 | /** Combined NT version number for Vista with SP1. */
|
---|
| 262 | #define SUP_NT_VER_VISTA_SP1 SUP_MAKE_NT_VER_COMBINED(6,0,6001,1,0)
|
---|
[51770] | 263 | /** Combined NT version number for Windows 7. */
|
---|
| 264 | #define SUP_NT_VER_W70 SUP_MAKE_NT_VER_SIMPLE(6,1)
|
---|
| 265 | /** Combined NT version number for Windows 8.0. */
|
---|
| 266 | #define SUP_NT_VER_W80 SUP_MAKE_NT_VER_SIMPLE(6,2)
|
---|
| 267 | /** Combined NT version number for Windows 8.1. */
|
---|
| 268 | #define SUP_NT_VER_W81 SUP_MAKE_NT_VER_SIMPLE(6,3)
|
---|
[53022] | 269 | /** @} */
|
---|
[51770] | 270 |
|
---|
| 271 | # endif
|
---|
| 272 |
|
---|
| 273 | # ifndef IN_SUP_HARDENED_R3
|
---|
| 274 | # include <iprt/mem.h>
|
---|
| 275 | # include <iprt/string.h>
|
---|
| 276 |
|
---|
| 277 | # define suplibHardenedMemComp memcmp
|
---|
| 278 | # define suplibHardenedMemCopy memcpy
|
---|
| 279 | # define suplibHardenedMemSet memset
|
---|
| 280 | # define suplibHardenedStrCopy strcpy
|
---|
| 281 | # define suplibHardenedStrLen strlen
|
---|
| 282 | # define suplibHardenedStrCat strcat
|
---|
| 283 | # define suplibHardenedStrCmp strcmp
|
---|
| 284 | # define suplibHardenedStrNCmp strncmp
|
---|
| 285 | # else /* IN_SUP_HARDENED_R3 */
|
---|
| 286 | # include <iprt/mem.h>
|
---|
[52940] | 287 | # if 0
|
---|
[51770] | 288 | # define memcmp suplibHardenedMemComp
|
---|
| 289 | # define memcpy suplibHardenedMemCopy
|
---|
| 290 | # define memset suplibHardenedMemSet
|
---|
| 291 | # define strcpy suplibHardenedStrCopy
|
---|
| 292 | # define strlen suplibHardenedStrLen
|
---|
| 293 | # define strcat suplibHardenedStrCat
|
---|
| 294 | # define strcmp suplibHardenedStrCmp
|
---|
| 295 | # define strncmp suplibHardenedStrNCmp
|
---|
[52940] | 296 | # endif
|
---|
[51770] | 297 | # endif /* IN_SUP_HARDENED_R3 */
|
---|
| 298 |
|
---|
| 299 | #endif /* SUP_CERTIFICATES_ONLY */
|
---|
| 300 |
|
---|
| 301 | RT_C_DECLS_END
|
---|
| 302 |
|
---|
[76568] | 303 | #endif /* !VBOX_INCLUDED_SRC_Support_win_SUPHardenedVerify_win_h */
|
---|
[51770] | 304 |
|
---|