[52356] | 1 | /* $Id: SUPR3HardenedMainImports-win.cpp 62677 2016-07-29 12:39:44Z vboxsync $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * VirtualBox Support Library - Hardened Main, Windows Import Trickery.
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | /*
|
---|
[62490] | 7 | * Copyright (C) 2006-2016 Oracle Corporation
|
---|
[52356] | 8 | *
|
---|
| 9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
| 10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
| 11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
| 12 | * General Public License (GPL) as published by the Free Software
|
---|
| 13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
| 14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
| 15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
| 16 | *
|
---|
| 17 | * The contents of this file may alternatively be used under the terms
|
---|
| 18 | * of the Common Development and Distribution License Version 1.0
|
---|
| 19 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
---|
| 20 | * VirtualBox OSE distribution, in which case the provisions of the
|
---|
| 21 | * CDDL are applicable instead of those of the GPL.
|
---|
| 22 | *
|
---|
| 23 | * You may elect to license modified versions of this file under the
|
---|
| 24 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
| 25 | */
|
---|
| 26 |
|
---|
[57358] | 27 |
|
---|
| 28 | /*********************************************************************************************************************************
|
---|
| 29 | * Header Files *
|
---|
| 30 | *********************************************************************************************************************************/
|
---|
[52356] | 31 | #include <iprt/nt/nt-and-windows.h>
|
---|
| 32 |
|
---|
| 33 | #include <VBox/sup.h>
|
---|
| 34 | #include <VBox/err.h>
|
---|
| 35 | #include <iprt/ctype.h>
|
---|
| 36 | #include <iprt/string.h>
|
---|
| 37 | #include <iprt/initterm.h>
|
---|
| 38 | #include <iprt/param.h>
|
---|
| 39 |
|
---|
| 40 | #include "SUPLibInternal.h"
|
---|
[52373] | 41 | #include "SUPHardenedVerify-win.h"
|
---|
[52356] | 42 |
|
---|
| 43 |
|
---|
[57358] | 44 | /*********************************************************************************************************************************
|
---|
| 45 | * Defined Constants And Macros *
|
---|
| 46 | *********************************************************************************************************************************/
|
---|
[52356] | 47 | #define SUPHARNT_COMMENT(a_Blah) /* nothing */
|
---|
| 48 |
|
---|
| 49 | #define VBOX_HARDENED_STUB_WITHOUT_IMPORTS
|
---|
| 50 | #ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
|
---|
[52967] | 51 | # define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
|
---|
| 52 | do { \
|
---|
| 53 | if (a_fReportErrors) supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__); \
|
---|
| 54 | else { static const char s_szWhere[] = a_szWhere; *(char *)(uintptr_t)(a_id) += 1; __debugbreak(); } \
|
---|
| 55 | } while (0)
|
---|
[52356] | 56 | #else
|
---|
[52967] | 57 | # define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
|
---|
[52356] | 58 | supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__)
|
---|
| 59 |
|
---|
| 60 | #endif
|
---|
| 61 |
|
---|
| 62 |
|
---|
[57358] | 63 | /*********************************************************************************************************************************
|
---|
| 64 | * Defined Constants And Macros *
|
---|
| 65 | *********************************************************************************************************************************/
|
---|
[52373] | 66 | /**
|
---|
| 67 | * Import function entry.
|
---|
| 68 | */
|
---|
[52356] | 69 | typedef struct SUPHNTIMPFUNC
|
---|
| 70 | {
|
---|
[52373] | 71 | /** The name of the function we're importing. */
|
---|
[52356] | 72 | const char *pszName;
|
---|
[52373] | 73 | /** Where to store the function address (think __imp_ApiName). */
|
---|
[52356] | 74 | PFNRT *ppfnImport;
|
---|
[52940] | 75 | /** Pointer to an early dummy function for imports that aren't available
|
---|
| 76 | * during early process initialization. */
|
---|
| 77 | PFNRT pfnEarlyDummy;
|
---|
[52941] | 78 | /** Indicates whether this is an optional import and failure to locate it
|
---|
| 79 | * should set it to NULL instead of freaking out. */
|
---|
| 80 | bool fOptional;
|
---|
[52356] | 81 | } SUPHNTIMPFUNC;
|
---|
[52373] | 82 | /** Pointer to an import table entry. */
|
---|
[52356] | 83 | typedef SUPHNTIMPFUNC const *PCSUPHNTIMPFUNC;
|
---|
| 84 |
|
---|
[52373] | 85 | /**
|
---|
| 86 | * Information for constructing a direct system call.
|
---|
| 87 | */
|
---|
[52356] | 88 | typedef struct SUPHNTIMPSYSCALL
|
---|
| 89 | {
|
---|
[52373] | 90 | /** Where to store the system call number.
|
---|
| 91 | * NULL if this import doesn't stupport direct system call. */
|
---|
| 92 | uint32_t *puApiNo;
|
---|
| 93 | /** Assembly system call routine, type 1. */
|
---|
| 94 | PFNRT pfnType1;
|
---|
| 95 | /** Assembly system call routine, type 2. */
|
---|
| 96 | PFNRT pfnType2;
|
---|
[57650] | 97 | #ifdef RT_ARCH_X86
|
---|
[52373] | 98 | /** The parameter size in bytes for a standard call. */
|
---|
| 99 | uint32_t cbParams;
|
---|
| 100 | #endif
|
---|
[52356] | 101 | } SUPHNTIMPSYSCALL;
|
---|
[52373] | 102 | /** Pointer to a system call entry. */
|
---|
[52356] | 103 | typedef SUPHNTIMPSYSCALL const *PCSUPHNTIMPSYSCALL;
|
---|
| 104 |
|
---|
[52373] | 105 | /**
|
---|
| 106 | * Import DLL.
|
---|
| 107 | *
|
---|
| 108 | * This contains both static (like name & imports) and runtime information (like
|
---|
| 109 | * load and export table locations).
|
---|
| 110 | */
|
---|
[52356] | 111 | typedef struct SUPHNTIMPDLL
|
---|
| 112 | {
|
---|
| 113 | /** @name Static data.
|
---|
| 114 | * @{ */
|
---|
| 115 | const wchar_t *pwszName;
|
---|
| 116 | const char *pszName;
|
---|
| 117 | size_t cImports;
|
---|
| 118 | PCSUPHNTIMPFUNC paImports;
|
---|
| 119 | /** Array running parallel to paImports if present. */
|
---|
| 120 | PCSUPHNTIMPSYSCALL paSyscalls;
|
---|
| 121 | /** @} */
|
---|
| 122 |
|
---|
| 123 |
|
---|
| 124 | /** The image base. */
|
---|
| 125 | uint8_t const *pbImageBase;
|
---|
| 126 | /** The NT headers. */
|
---|
| 127 | PIMAGE_NT_HEADERS pNtHdrs;
|
---|
| 128 | /** The NT header offset/RVA. */
|
---|
| 129 | uint32_t offNtHdrs;
|
---|
| 130 | /** The end of the section headers. */
|
---|
| 131 | uint32_t offEndSectHdrs;
|
---|
| 132 | /** The end of the image. */
|
---|
| 133 | uint32_t cbImage;
|
---|
| 134 | /** Offset of the export directory. */
|
---|
| 135 | uint32_t offExportDir;
|
---|
| 136 | /** Size of the export directory. */
|
---|
| 137 | uint32_t cbExportDir;
|
---|
| 138 |
|
---|
| 139 | /** Exported functions and data by ordinal (RVAs). */
|
---|
| 140 | uint32_t const *paoffExports;
|
---|
| 141 | /** The number of exports. */
|
---|
| 142 | uint32_t cExports;
|
---|
| 143 | /** The number of exported names. */
|
---|
| 144 | uint32_t cNamedExports;
|
---|
| 145 | /** Pointer to the array of exported names (RVAs to strings). */
|
---|
| 146 | uint32_t const *paoffNamedExports;
|
---|
| 147 | /** Array parallel to paoffNamedExports with the corresponding ordinals
|
---|
| 148 | * (indexes into paoffExports). */
|
---|
| 149 | uint16_t const *pau16NameOrdinals;
|
---|
| 150 |
|
---|
[52795] | 151 | /** Number of patched export table entries. */
|
---|
| 152 | uint32_t cPatchedExports;
|
---|
| 153 |
|
---|
[52356] | 154 | } SUPHNTIMPDLL;
|
---|
[52373] | 155 | /** Pointer to an import DLL entry. */
|
---|
[52356] | 156 | typedef SUPHNTIMPDLL *PSUPHNTIMPDLL;
|
---|
| 157 |
|
---|
| 158 |
|
---|
| 159 |
|
---|
| 160 | /*
|
---|
| 161 | * Declare assembly symbols.
|
---|
| 162 | */
|
---|
[52940] | 163 | #define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
|
---|
[52356] | 164 | extern PFNRT RT_CONCAT(g_pfn, a_Name);
|
---|
[52941] | 165 | #define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86)
|
---|
[52356] | 166 | #define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
|
---|
[52940] | 167 | SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
|
---|
[52356] | 168 | extern uint32_t RT_CONCAT(g_uApiNo, a_Name); \
|
---|
| 169 | extern FNRT RT_CONCAT(a_Name, _SyscallType1); \
|
---|
| 170 | extern FNRT RT_CONCAT(a_Name, _SyscallType2);
|
---|
[52940] | 171 | #define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
|
---|
| 172 | extern PFNRT RT_CONCAT(g_pfn, a_Name); \
|
---|
| 173 | extern FNRT RT_CONCAT(a_Name, _Early);
|
---|
[56732] | 174 | #define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
|
---|
[52356] | 175 |
|
---|
| 176 | RT_C_DECLS_BEGIN
|
---|
| 177 | #include "import-template-ntdll.h"
|
---|
| 178 | #include "import-template-kernel32.h"
|
---|
| 179 | RT_C_DECLS_END
|
---|
| 180 |
|
---|
| 181 | /*
|
---|
| 182 | * Import functions.
|
---|
| 183 | */
|
---|
| 184 | #undef SUPHARNT_IMPORT_SYSCALL
|
---|
[52940] | 185 | #undef SUPHARNT_IMPORT_STDCALL_EARLY
|
---|
[52941] | 186 | #undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
|
---|
[52356] | 187 | #undef SUPHARNT_IMPORT_STDCALL
|
---|
[56732] | 188 | #undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
|
---|
[52941] | 189 | #define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
|
---|
| 190 | { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
|
---|
| 191 | #define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
|
---|
| 192 | { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
|
---|
| 193 | #define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) \
|
---|
| 194 | { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, true },
|
---|
| 195 | #define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
|
---|
| 196 | { #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), false },
|
---|
[56732] | 197 | #define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) \
|
---|
| 198 | { #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), true },
|
---|
[52356] | 199 | static const SUPHNTIMPFUNC g_aSupNtImpNtDllFunctions[] =
|
---|
| 200 | {
|
---|
| 201 | #include "import-template-ntdll.h"
|
---|
| 202 | };
|
---|
| 203 |
|
---|
| 204 | static const SUPHNTIMPFUNC g_aSupNtImpKernel32Functions[] =
|
---|
| 205 | {
|
---|
| 206 | #include "import-template-kernel32.h"
|
---|
| 207 | };
|
---|
| 208 |
|
---|
| 209 |
|
---|
| 210 |
|
---|
| 211 | /*
|
---|
| 212 | * Syscalls in ntdll.
|
---|
| 213 | */
|
---|
| 214 | #undef SUPHARNT_IMPORT_SYSCALL
|
---|
[52940] | 215 | #undef SUPHARNT_IMPORT_STDCALL_EARLY
|
---|
[52941] | 216 | #undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
|
---|
[56732] | 217 | #undef SUPHARNT_IMPORT_STDCALL
|
---|
| 218 | #undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
|
---|
[52356] | 219 | #ifdef RT_ARCH_AMD64
|
---|
[52373] | 220 | # define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
|
---|
| 221 | { NULL, NULL },
|
---|
| 222 | # define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
|
---|
[57650] | 223 | { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name, _SyscallType1), &RT_CONCAT(a_Name, _SyscallType2) },
|
---|
[52373] | 224 | #elif defined(RT_ARCH_X86)
|
---|
| 225 | # define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
|
---|
| 226 | { NULL, NULL, NULL, 0 },
|
---|
| 227 | # define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
|
---|
| 228 | { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name,_SyscallType1), &RT_CONCAT(a_Name, _SyscallType2), a_cbParamsX86 },
|
---|
[52356] | 229 | #endif
|
---|
[56732] | 230 | #define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
|
---|
[52941] | 231 | #define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
|
---|
| 232 | #define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
|
---|
[52373] | 233 | static const SUPHNTIMPSYSCALL g_aSupNtImpNtDllSyscalls[] =
|
---|
| 234 | {
|
---|
[52356] | 235 | #include "import-template-ntdll.h"
|
---|
| 236 | };
|
---|
| 237 |
|
---|
| 238 |
|
---|
| 239 | /**
|
---|
| 240 | * All the DLLs we import from.
|
---|
[52943] | 241 | * @remarks Code ASSUMES that ntdll is the first entry.
|
---|
[52356] | 242 | */
|
---|
| 243 | static SUPHNTIMPDLL g_aSupNtImpDlls[] =
|
---|
| 244 | {
|
---|
| 245 | { L"ntdll.dll", "ntdll.dll", RT_ELEMENTS(g_aSupNtImpNtDllFunctions), g_aSupNtImpNtDllFunctions, g_aSupNtImpNtDllSyscalls },
|
---|
| 246 | { L"kernelbase.dll", "kernelbase.dll", 0 /* optional module, forwarders only */, NULL, NULL },
|
---|
| 247 | { L"kernel32.dll", "kernel32.dll", RT_ELEMENTS(g_aSupNtImpKernel32Functions), g_aSupNtImpKernel32Functions, NULL },
|
---|
| 248 | };
|
---|
| 249 |
|
---|
| 250 |
|
---|
| 251 | static void supR3HardenedFindOrLoadModule(PSUPHNTIMPDLL pDll)
|
---|
| 252 | {
|
---|
| 253 | #ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
|
---|
| 254 | uint32_t const cbName = (uint32_t)RTUtf16Len(pDll->pwszName) * sizeof(WCHAR);
|
---|
| 255 | PPEB_LDR_DATA pLdrData = NtCurrentPeb()->Ldr;
|
---|
| 256 | LIST_ENTRY *pList = &pLdrData->InMemoryOrderModuleList;
|
---|
| 257 | LIST_ENTRY *pListEntry = pList->Flink;
|
---|
| 258 | uint32_t cLoops = 0;
|
---|
| 259 | while (pListEntry != pList && cLoops < 1024)
|
---|
| 260 | {
|
---|
| 261 | PLDR_DATA_TABLE_ENTRY pLdrEntry = RT_FROM_MEMBER(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
|
---|
| 262 |
|
---|
| 263 | if ( pLdrEntry->FullDllName.Length > cbName + sizeof(WCHAR)
|
---|
| 264 | && ( pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '\\'
|
---|
| 265 | || pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '/')
|
---|
| 266 | && RTUtf16ICmpAscii(&pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR)],
|
---|
| 267 | pDll->pszName) == 0)
|
---|
| 268 | {
|
---|
| 269 | pDll->pbImageBase = (uint8_t *)pLdrEntry->DllBase;
|
---|
| 270 | return;
|
---|
| 271 | }
|
---|
| 272 |
|
---|
| 273 | pListEntry = pListEntry->Flink;
|
---|
| 274 | cLoops++;
|
---|
| 275 | }
|
---|
| 276 |
|
---|
| 277 | if (!pDll->cImports)
|
---|
| 278 | pDll->pbImageBase = NULL; /* optional */
|
---|
| 279 | else
|
---|
[52967] | 280 | SUPHNTIMP_ERROR(false, 1, "supR3HardenedFindOrLoadModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
[52356] | 281 | "Failed to locate %ls", pDll->pwszName);
|
---|
| 282 | #else
|
---|
| 283 | HMODULE hmod = GetModuleHandleW(pDll->pwszName);
|
---|
| 284 | if (RT_UNLIKELY(!hmod && pDll->cImports))
|
---|
[52967] | 285 | SUPHNTIMP_ERROR(true, 1, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
[52356] | 286 | "Failed to locate %ls", pDll->pwszName);
|
---|
| 287 | pDll->pbImageBase = (uint8_t *)hmod;
|
---|
| 288 | #endif
|
---|
| 289 | }
|
---|
| 290 |
|
---|
| 291 |
|
---|
| 292 | static void supR3HardenedParseModule(PSUPHNTIMPDLL pDll)
|
---|
| 293 | {
|
---|
| 294 | /*
|
---|
| 295 | * Locate the PE header, do some basic validations.
|
---|
| 296 | */
|
---|
| 297 | IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pDll->pbImageBase;
|
---|
| 298 | uint32_t offNtHdrs = 0;
|
---|
| 299 | PIMAGE_NT_HEADERS pNtHdrs;
|
---|
| 300 | if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
|
---|
| 301 | {
|
---|
| 302 | offNtHdrs = pMzHdr->e_lfanew;
|
---|
| 303 | if (offNtHdrs > _2K)
|
---|
[52967] | 304 | SUPHNTIMP_ERROR(false, 2, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
[52356] | 305 | "%ls: e_lfanew=%#x, expected a lower value", pDll->pwszName, offNtHdrs);
|
---|
| 306 | }
|
---|
| 307 | pDll->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pDll->pbImageBase[offNtHdrs];
|
---|
| 308 |
|
---|
| 309 | if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
|
---|
[52967] | 310 | SUPHNTIMP_ERROR(false, 3, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 311 | "%ls: Invalid PE signature: %#x", pDll->pwszName, pNtHdrs->Signature);
|
---|
| 312 | if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
|
---|
[52967] | 313 | SUPHNTIMP_ERROR(false, 4, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 314 | "%ls: Unexpected optional header size: %#x", pDll->pwszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
|
---|
| 315 | if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
|
---|
[52967] | 316 | SUPHNTIMP_ERROR(false, 5, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 317 | "%ls: Unexpected optional header magic: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.Magic);
|
---|
| 318 | if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
|
---|
[52967] | 319 | SUPHNTIMP_ERROR(false, 6, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 320 | "%ls: Unexpected number of RVA and sizes: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
|
---|
| 321 |
|
---|
| 322 | pDll->offNtHdrs = offNtHdrs;
|
---|
| 323 | pDll->offEndSectHdrs = offNtHdrs
|
---|
| 324 | + sizeof(*pNtHdrs)
|
---|
| 325 | + pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
|
---|
| 326 | pDll->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
|
---|
| 327 |
|
---|
| 328 | /*
|
---|
| 329 | * Find the export directory.
|
---|
| 330 | */
|
---|
| 331 | IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
---|
| 332 | if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
|
---|
| 333 | || ExpDir.VirtualAddress < pDll->offEndSectHdrs
|
---|
| 334 | || ExpDir.VirtualAddress >= pNtHdrs->OptionalHeader.SizeOfImage
|
---|
| 335 | || ExpDir.VirtualAddress + ExpDir.Size > pNtHdrs->OptionalHeader.SizeOfImage)
|
---|
[52967] | 336 | SUPHNTIMP_ERROR(false, 7, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 337 | "%ls: Missing or invalid export directory: %#lx LB %#x", pDll->pwszName, ExpDir.VirtualAddress, ExpDir.Size);
|
---|
| 338 | pDll->offExportDir = ExpDir.VirtualAddress;
|
---|
| 339 | pDll->cbExportDir = ExpDir.Size;
|
---|
| 340 |
|
---|
| 341 | IMAGE_EXPORT_DIRECTORY const *pExpDir = (IMAGE_EXPORT_DIRECTORY const *)&pDll->pbImageBase[ExpDir.VirtualAddress];
|
---|
| 342 |
|
---|
| 343 | if ( pExpDir->NumberOfFunctions >= _1M
|
---|
| 344 | || pExpDir->NumberOfFunctions < 1
|
---|
| 345 | || pExpDir->NumberOfNames >= _1M
|
---|
| 346 | || pExpDir->NumberOfNames < 1)
|
---|
[52967] | 347 | SUPHNTIMP_ERROR(false, 8, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 348 | "%ls: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
|
---|
| 349 | pDll->pwszName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
|
---|
| 350 | pDll->cNamedExports = pExpDir->NumberOfNames;
|
---|
| 351 | pDll->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
|
---|
| 352 |
|
---|
| 353 | if ( pExpDir->AddressOfFunctions < pDll->offEndSectHdrs
|
---|
| 354 | || pExpDir->AddressOfFunctions >= pNtHdrs->OptionalHeader.SizeOfImage
|
---|
| 355 | || pExpDir->AddressOfFunctions + pDll->cExports * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
|
---|
[52967] | 356 | SUPHNTIMP_ERROR(false, 9, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 357 | "%ls: Bad AddressOfFunctions: %#x\n", pDll->pwszName, pExpDir->AddressOfFunctions);
|
---|
| 358 | pDll->paoffExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfFunctions];
|
---|
| 359 |
|
---|
| 360 | if ( pExpDir->AddressOfNames < pDll->offEndSectHdrs
|
---|
| 361 | || pExpDir->AddressOfNames >= pNtHdrs->OptionalHeader.SizeOfImage
|
---|
| 362 | || pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
|
---|
[52967] | 363 | SUPHNTIMP_ERROR(false, 10, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 364 | "%ls: Bad AddressOfNames: %#x\n", pDll->pwszName, pExpDir->AddressOfNames);
|
---|
| 365 | pDll->paoffNamedExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfNames];
|
---|
| 366 |
|
---|
| 367 | if ( pExpDir->AddressOfNameOrdinals < pDll->offEndSectHdrs
|
---|
| 368 | || pExpDir->AddressOfNameOrdinals >= pNtHdrs->OptionalHeader.SizeOfImage
|
---|
| 369 | || pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
|
---|
[52967] | 370 | SUPHNTIMP_ERROR(false, 11, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
|
---|
[52356] | 371 | "%ls: Bad AddressOfNameOrdinals: %#x\n", pDll->pwszName, pExpDir->AddressOfNameOrdinals);
|
---|
| 372 | pDll->pau16NameOrdinals = (uint16_t const *)&pDll->pbImageBase[pExpDir->AddressOfNameOrdinals];
|
---|
| 373 | }
|
---|
| 374 |
|
---|
| 375 |
|
---|
[52967] | 376 | static const char *supR3HardenedResolveImport(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, bool fReportErrors)
|
---|
[52356] | 377 | {
|
---|
| 378 | /*
|
---|
| 379 | * Binary search.
|
---|
| 380 | */
|
---|
| 381 | uint32_t iStart = 0;
|
---|
| 382 | uint32_t iEnd = pDll->cNamedExports;
|
---|
| 383 | while (iStart < iEnd)
|
---|
| 384 | {
|
---|
| 385 | uint32_t iCur = iStart + (iEnd - iStart) / 2;
|
---|
| 386 | uint32_t offExpName = pDll->paoffNamedExports[iCur];
|
---|
| 387 | if (RT_UNLIKELY(offExpName < pDll->offEndSectHdrs || offExpName >= pDll->cbImage))
|
---|
[52967] | 388 | SUPHNTIMP_ERROR(fReportErrors, 12, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
|
---|
[52356] | 389 | "%ls: Bad export name entry: %#x (iCur=%#x)", pDll->pwszName, offExpName, iCur);
|
---|
| 390 |
|
---|
| 391 | const char *pszExpName = (const char *)&pDll->pbImageBase[offExpName];
|
---|
| 392 | int iDiff = strcmp(pszExpName, pImport->pszName);
|
---|
| 393 | if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
|
---|
| 394 | iEnd = iCur;
|
---|
| 395 | else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
|
---|
| 396 | iStart = iCur + 1;
|
---|
| 397 | else /* pszExpName == pszSymbol */
|
---|
| 398 | {
|
---|
| 399 | uint16_t iExpOrdinal = pDll->pau16NameOrdinals[iCur];
|
---|
| 400 | if (iExpOrdinal < pDll->cExports)
|
---|
| 401 | {
|
---|
| 402 | uint32_t offExport = pDll->paoffExports[iExpOrdinal];
|
---|
[52795] | 403 |
|
---|
| 404 | /* detect export table patching. */
|
---|
| 405 | if (offExport >= pDll->cbImage)
|
---|
| 406 | pDll->cPatchedExports++;
|
---|
| 407 |
|
---|
| 408 | if (offExport - pDll->offExportDir >= pDll->cbExportDir)
|
---|
[52356] | 409 | {
|
---|
[52795] | 410 | *pImport->ppfnImport = (PFNRT)&pDll->pbImageBase[offExport];
|
---|
| 411 | return NULL;
|
---|
| 412 | }
|
---|
[52356] | 413 |
|
---|
[52795] | 414 | /* Forwarder. */
|
---|
| 415 | return (const char *)&pDll->pbImageBase[offExport];
|
---|
[52356] | 416 | }
|
---|
[52967] | 417 | SUPHNTIMP_ERROR(fReportErrors, 14, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_BAD_EXE_FORMAT,
|
---|
[52356] | 418 | "%ls: Name ordinal for '%s' is out of bounds: %#x (max %#x)",
|
---|
| 419 | pDll->pwszName, iExpOrdinal, pDll->cExports);
|
---|
| 420 | return NULL;
|
---|
| 421 | }
|
---|
| 422 | }
|
---|
| 423 |
|
---|
[52941] | 424 | if (!pImport->fOptional)
|
---|
[52967] | 425 | SUPHNTIMP_ERROR(fReportErrors, 15, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
|
---|
[52941] | 426 | "%ls: Failed to resolve '%s'.", pDll->pwszName, pImport->pszName);
|
---|
| 427 | *pImport->ppfnImport = NULL;
|
---|
[52356] | 428 | return NULL;
|
---|
| 429 | }
|
---|
| 430 |
|
---|
| 431 |
|
---|
[52373] | 432 | static void supR3HardenedDirectSyscall(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, PCSUPHNTIMPSYSCALL pSyscall,
|
---|
[52967] | 433 | PSUPHNTLDRCACHEENTRY pLdrEntry, uint8_t *pbBits, bool fReportErrors)
|
---|
[52373] | 434 | {
|
---|
| 435 | /*
|
---|
| 436 | * Skip non-syscall entries.
|
---|
| 437 | */
|
---|
| 438 | if (!pSyscall->puApiNo)
|
---|
| 439 | return;
|
---|
[52356] | 440 |
|
---|
[52373] | 441 | /*
|
---|
| 442 | * Locate the virgin bits.
|
---|
| 443 | */
|
---|
| 444 | RTLDRADDR uValue;
|
---|
| 445 | int rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)pDll->pbImageBase, UINT32_MAX, pImport->pszName, &uValue);
|
---|
| 446 | if (RT_FAILURE(rc))
|
---|
| 447 | {
|
---|
[52967] | 448 | SUPHNTIMP_ERROR(fReportErrors, 16, "supR3HardenedDirectSyscall", kSupInitOp_Misc, rc,
|
---|
[52373] | 449 | "%s: RTLdrGetSymbolEx failed on %s: %Rrc", pDll->pszName, pImport->pszName, rc);
|
---|
| 450 | return;
|
---|
| 451 | }
|
---|
| 452 | uintptr_t offSymbol = (uintptr_t)uValue - (uintptr_t)pDll->pbImageBase;
|
---|
| 453 | uint8_t const *pbFunction = &pbBits[offSymbol];
|
---|
| 454 |
|
---|
| 455 | /*
|
---|
| 456 | * Parse the code and extract the API call number.
|
---|
| 457 | */
|
---|
| 458 | #ifdef RT_ARCH_AMD64
|
---|
[57650] | 459 | /* Pattern #1: XP64/W2K3-64 thru Windows 10 build 10240.
|
---|
| 460 | 0:000> u ntdll!NtCreateSection
|
---|
| 461 | ntdll!NtCreateSection:
|
---|
| 462 | 00000000`779f1750 4c8bd1 mov r10,rcx
|
---|
| 463 | 00000000`779f1753 b847000000 mov eax,47h
|
---|
| 464 | 00000000`779f1758 0f05 syscall
|
---|
| 465 | 00000000`779f175a c3 ret
|
---|
| 466 | 00000000`779f175b 0f1f440000 nop dword ptr [rax+rax]
|
---|
| 467 |
|
---|
| 468 | Pattern #2: Windows 10 build 10525+.
|
---|
| 469 | 0:000> u ntdll_7ffc26300000!NtCreateSection
|
---|
| 470 | ntdll_7ffc26300000!ZwCreateSection:
|
---|
| 471 | 00007ffc`263943e0 4c8bd1 mov r10,rcx
|
---|
| 472 | 00007ffc`263943e3 b84a000000 mov eax,4Ah
|
---|
| 473 | 00007ffc`263943e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
|
---|
| 474 | 00007ffc`263943f0 7503 jne ntdll_7ffc26300000!ZwCreateSection+0x15 (00007ffc`263943f5)
|
---|
| 475 | 00007ffc`263943f2 0f05 syscall
|
---|
| 476 | 00007ffc`263943f4 c3 ret
|
---|
| 477 | 00007ffc`263943f5 cd2e int 2Eh
|
---|
| 478 | 00007ffc`263943f7 c3 ret
|
---|
| 479 | */
|
---|
[52373] | 480 | if ( pbFunction[ 0] == 0x4c /* mov r10, rcx */
|
---|
| 481 | && pbFunction[ 1] == 0x8b
|
---|
| 482 | && pbFunction[ 2] == 0xd1
|
---|
| 483 | && pbFunction[ 3] == 0xb8 /* mov eax, 0000yyzzh */
|
---|
| 484 | //&& pbFunction[ 4] == 0xZZ
|
---|
| 485 | //&& pbFunction[ 5] == 0xYY
|
---|
| 486 | && pbFunction[ 6] == 0x00
|
---|
[57650] | 487 | && pbFunction[ 7] == 0x00)
|
---|
[52373] | 488 | {
|
---|
[57650] | 489 | if ( pbFunction[ 8] == 0x0f /* syscall */
|
---|
| 490 | && pbFunction[ 9] == 0x05
|
---|
| 491 | && pbFunction[10] == 0xc3 /* ret */ )
|
---|
| 492 | {
|
---|
| 493 | *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
|
---|
| 494 | *pImport->ppfnImport = pSyscall->pfnType1;
|
---|
| 495 | return;
|
---|
| 496 | }
|
---|
| 497 | if ( pbFunction[ 8] == 0xf6 /* test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 */
|
---|
| 498 | && pbFunction[ 9] == 0x04
|
---|
| 499 | && pbFunction[10] == 0x25
|
---|
| 500 | && pbFunction[11] == 0x08
|
---|
| 501 | && pbFunction[12] == 0x03
|
---|
| 502 | && pbFunction[13] == 0xfe
|
---|
| 503 | && pbFunction[14] == 0x7f
|
---|
| 504 | && pbFunction[15] == 0x01
|
---|
| 505 | && pbFunction[16] == 0x75 /* jnz +3 */
|
---|
| 506 | && pbFunction[17] == 0x03
|
---|
| 507 | && pbFunction[18] == 0x0f /* syscall*/
|
---|
| 508 | && pbFunction[19] == 0x05
|
---|
| 509 | && pbFunction[20] == 0xc3 /* ret */
|
---|
| 510 | && pbFunction[21] == 0xcd /* int 2eh */
|
---|
| 511 | && pbFunction[22] == 0x2e
|
---|
| 512 | && pbFunction[23] == 0xc3 /* ret */ )
|
---|
| 513 | {
|
---|
| 514 | *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
|
---|
| 515 | *pImport->ppfnImport = pSyscall->pfnType2;
|
---|
| 516 | return;
|
---|
| 517 | }
|
---|
[52373] | 518 | }
|
---|
| 519 | #else
|
---|
| 520 | /* Pattern #1: XP thru Windows 7
|
---|
| 521 | kd> u ntdll!NtCreateSection
|
---|
| 522 | ntdll!NtCreateSection:
|
---|
| 523 | 7c90d160 b832000000 mov eax,32h
|
---|
| 524 | 7c90d165 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
|
---|
| 525 | 7c90d16a ff12 call dword ptr [edx]
|
---|
| 526 | 7c90d16c c21c00 ret 1Ch
|
---|
| 527 | 7c90d16f 90 nop
|
---|
| 528 | The variable bit is the value loaded into eax: XP=32h, W2K3=34h, Vista=4bh, W7=54h
|
---|
| 529 |
|
---|
| 530 | Pattern #2: Windows 8.1
|
---|
| 531 | 0:000:x86> u ntdll_6a0f0000!NtCreateSection
|
---|
| 532 | ntdll_6a0f0000!NtCreateSection:
|
---|
| 533 | 6a15eabc b854010000 mov eax,154h
|
---|
| 534 | 6a15eac1 e803000000 call ntdll_6a0f0000!NtCreateSection+0xd (6a15eac9)
|
---|
| 535 | 6a15eac6 c21c00 ret 1Ch
|
---|
| 536 | 6a15eac9 8bd4 mov edx,esp
|
---|
| 537 | 6a15eacb 0f34 sysenter
|
---|
| 538 | 6a15eacd c3 ret
|
---|
| 539 | The variable bit is the value loaded into eax: W81=154h
|
---|
| 540 | Note! One nice thing here is that we can share code pattern #1. */
|
---|
| 541 |
|
---|
| 542 | if ( pbFunction[ 0] == 0xb8 /* mov eax, 0000yyzzh*/
|
---|
| 543 | //&& pbFunction[ 1] <= 0xZZ
|
---|
| 544 | //&& pbFunction[ 2] <= 0xYY
|
---|
| 545 | && pbFunction[ 3] == 0x00
|
---|
| 546 | && pbFunction[ 4] == 0x00)
|
---|
| 547 | {
|
---|
[52374] | 548 | *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[1], pbFunction[2]);
|
---|
[52373] | 549 | if ( pbFunction[5] == 0xba /* mov edx, offset SharedUserData!SystemCallStub */
|
---|
| 550 | && pbFunction[ 6] == 0x00
|
---|
| 551 | && pbFunction[ 7] == 0x03
|
---|
| 552 | && pbFunction[ 8] == 0xfe
|
---|
| 553 | && pbFunction[ 9] == 0x7f
|
---|
| 554 | && pbFunction[10] == 0xff /* call [edx] */
|
---|
| 555 | && pbFunction[11] == 0x12
|
---|
[52374] | 556 | && ( ( pbFunction[12] == 0xc2 /* ret 1ch */
|
---|
| 557 | && pbFunction[13] == pSyscall->cbParams
|
---|
| 558 | && pbFunction[14] == 0x00)
|
---|
| 559 | || ( pbFunction[12] == 0xc3 /* ret */
|
---|
| 560 | && pSyscall->cbParams == 0)
|
---|
| 561 | )
|
---|
| 562 | )
|
---|
[52373] | 563 | {
|
---|
| 564 | *pImport->ppfnImport = pSyscall->pfnType1;
|
---|
| 565 | return;
|
---|
| 566 | }
|
---|
| 567 |
|
---|
| 568 | if ( pbFunction[ 5] == 0xe8 /* call [$+3] */
|
---|
| 569 | && RT_ABS(*(int32_t *)&pbFunction[6]) < 0x10
|
---|
[52374] | 570 | && ( ( pbFunction[10] == 0xc2 /* ret 1ch */
|
---|
| 571 | && pbFunction[11] == pSyscall->cbParams
|
---|
| 572 | && pbFunction[12] == 0x00)
|
---|
[52416] | 573 | || ( pbFunction[10] == 0xc3 /* ret */
|
---|
[52374] | 574 | && pSyscall->cbParams == 0)
|
---|
| 575 | )
|
---|
| 576 | )
|
---|
[52373] | 577 | {
|
---|
| 578 | *pImport->ppfnImport = pSyscall->pfnType2;
|
---|
| 579 | return;
|
---|
| 580 | }
|
---|
| 581 | }
|
---|
| 582 | #endif
|
---|
| 583 |
|
---|
| 584 | /*
|
---|
| 585 | * Failed to parse it.
|
---|
| 586 | */
|
---|
[52416] | 587 | volatile uint8_t abCopy[16];
|
---|
| 588 | memcpy((void *)&abCopy[0], pbFunction, sizeof(abCopy));
|
---|
[52967] | 589 | SUPHNTIMP_ERROR(fReportErrors, 17, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
|
---|
[60700] | 590 | "%ls: failed to parse syscall: '%s': %.16Rhxs",
|
---|
[52967] | 591 | pDll->pwszName, pImport->pszName, &abCopy[0]);
|
---|
[52373] | 592 | }
|
---|
| 593 |
|
---|
| 594 |
|
---|
[52943] | 595 | /**
|
---|
[52967] | 596 | * Check out system calls and do the directly instead of via NtDll.
|
---|
| 597 | *
|
---|
| 598 | * We need to have access to the on disk NTDLL.DLL file as we do not trust the
|
---|
| 599 | * stuff we find in memory. Too early to verify signatures though.
|
---|
| 600 | *
|
---|
| 601 | * @param fReportErrors Whether we've got the machinery for reporting
|
---|
| 602 | * errors going already.
|
---|
[60700] | 603 | * @param pErrInfo Buffer for gathering additional error info. This
|
---|
| 604 | * is mainly to avoid consuming lots of stacks with
|
---|
| 605 | * RTERRINFOSTATIC structures.
|
---|
[52967] | 606 | */
|
---|
[60700] | 607 | DECLHIDDEN(void) supR3HardenedWinInitSyscalls(bool fReportErrors, PRTERRINFO pErrInfo)
|
---|
[52967] | 608 | {
|
---|
| 609 | for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 610 | if (g_aSupNtImpDlls[iDll].paSyscalls)
|
---|
| 611 | {
|
---|
| 612 | PSUPHNTLDRCACHEENTRY pLdrEntry;
|
---|
[60700] | 613 | int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, pErrInfo);
|
---|
[52967] | 614 | if (RT_SUCCESS(rc))
|
---|
| 615 | {
|
---|
| 616 | uint8_t *pbBits;
|
---|
[60700] | 617 | rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
|
---|
| 618 | NULL, NULL, pErrInfo);
|
---|
[52967] | 619 | if (RT_SUCCESS(rc))
|
---|
| 620 | {
|
---|
| 621 | for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
|
---|
| 622 | supR3HardenedDirectSyscall(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
|
---|
| 623 | &g_aSupNtImpDlls[iDll].paSyscalls[i], pLdrEntry, pbBits, fReportErrors);
|
---|
| 624 | }
|
---|
| 625 | else
|
---|
| 626 | SUPHNTIMP_ERROR(fReportErrors, 20, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
|
---|
[60700] | 627 | "%ls: supHardNtLdrCacheEntryGetBits failed: %Rrc %s",
|
---|
| 628 | g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
|
---|
[52967] | 629 | }
|
---|
| 630 | else
|
---|
| 631 | SUPHNTIMP_ERROR(fReportErrors, 21, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
|
---|
[60700] | 632 | "%ls: supHardNtLdrCacheOpen failed: %Rrc %s",
|
---|
| 633 | g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
|
---|
[52967] | 634 | }
|
---|
| 635 | }
|
---|
| 636 |
|
---|
| 637 |
|
---|
[52969] | 638 | /**
|
---|
| 639 | * Resolves a few NtDll functions we need before child purification is executed.
|
---|
| 640 | *
|
---|
| 641 | * We must not permanently modify any global data here.
|
---|
| 642 | *
|
---|
[58339] | 643 | * @param uNtDllAddr The address of the NTDLL.
|
---|
| 644 | * @param ppfnNtWaitForSingleObject Where to store the NtWaitForSingleObject
|
---|
| 645 | * address.
|
---|
| 646 | * @param ppfnNtSetEvent Where to store the NtSetEvent address.
|
---|
[52969] | 647 | */
|
---|
| 648 | DECLHIDDEN(void) supR3HardenedWinGetVeryEarlyImports(uintptr_t uNtDllAddr,
|
---|
| 649 | PFNNTWAITFORSINGLEOBJECT *ppfnNtWaitForSingleObject,
|
---|
| 650 | PFNNTSETEVENT *ppfnNtSetEvent)
|
---|
| 651 | {
|
---|
| 652 | /*
|
---|
| 653 | * NTDLL is the first entry in the list. Save it and do the parsing.
|
---|
| 654 | */
|
---|
| 655 | SUPHNTIMPDLL SavedDllEntry = g_aSupNtImpDlls[0];
|
---|
[52967] | 656 |
|
---|
[52969] | 657 | g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
|
---|
| 658 | supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
|
---|
| 659 |
|
---|
| 660 | /*
|
---|
| 661 | * Create a temporary import table for the requested APIs and resolve them.
|
---|
| 662 | */
|
---|
| 663 | SUPHNTIMPFUNC aImports[] =
|
---|
| 664 | {
|
---|
| 665 | { "NtWaitForSingleObject", (PFNRT *)ppfnNtWaitForSingleObject, NULL, false },
|
---|
| 666 | { "NtSetEvent", (PFNRT *)ppfnNtSetEvent, NULL, false },
|
---|
| 667 | };
|
---|
| 668 |
|
---|
| 669 | for (uint32_t i = 0; i < RT_ELEMENTS(aImports); i++)
|
---|
[60700] | 670 | {
|
---|
| 671 | const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &aImports[i], false);
|
---|
| 672 | if (pszForwarder)
|
---|
| 673 | SUPHNTIMP_ERROR(false, 31, "supR3HardenedWinGetVeryEarlyImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
| 674 | "ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
|
---|
| 675 | }
|
---|
[52969] | 676 |
|
---|
| 677 | /*
|
---|
| 678 | * Restore the NtDll entry.
|
---|
| 679 | */
|
---|
| 680 | g_aSupNtImpDlls[0] = SavedDllEntry;
|
---|
| 681 | }
|
---|
| 682 |
|
---|
| 683 |
|
---|
[52967] | 684 | /**
|
---|
[52943] | 685 | * Resolves NtDll functions we can trust calling before process init.
|
---|
| 686 | *
|
---|
| 687 | * @param uNtDllAddr The address of the NTDLL.
|
---|
| 688 | */
|
---|
| 689 | DECLHIDDEN(void) supR3HardenedWinInitImportsEarly(uintptr_t uNtDllAddr)
|
---|
| 690 | {
|
---|
| 691 | /*
|
---|
| 692 | * NTDLL is the first entry in the list.
|
---|
| 693 | */
|
---|
| 694 | g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
|
---|
| 695 | supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
|
---|
| 696 | for (uint32_t i = 0; i < g_aSupNtImpDlls[0].cImports; i++)
|
---|
| 697 | if (!g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy)
|
---|
| 698 | {
|
---|
[52967] | 699 | const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &g_aSupNtImpDlls[0].paImports[i], false);
|
---|
[52943] | 700 | if (pszForwarder)
|
---|
[52967] | 701 | SUPHNTIMP_ERROR(false, 32, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
[52943] | 702 | "ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
|
---|
| 703 | }
|
---|
| 704 | else
|
---|
| 705 | *g_aSupNtImpDlls[0].paImports[i].ppfnImport = g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy;
|
---|
[52373] | 706 |
|
---|
[52943] | 707 | /*
|
---|
[58363] | 708 | * Point the other imports at the early init stubs.
|
---|
[52943] | 709 | */
|
---|
| 710 | for (uint32_t iDll = 1; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 711 | for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
|
---|
| 712 | if (!g_aSupNtImpDlls[iDll].paImports[i].fOptional)
|
---|
| 713 | *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = g_aSupNtImpDlls[iDll].paImports[i].pfnEarlyDummy;
|
---|
| 714 | else
|
---|
| 715 | *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = NULL;
|
---|
| 716 | }
|
---|
| 717 |
|
---|
| 718 |
|
---|
[52356] | 719 | /**
|
---|
| 720 | * Resolves imported functions, esp. system calls from NTDLL.
|
---|
| 721 | *
|
---|
| 722 | * This crap is necessary because there are sandboxing products out there that
|
---|
| 723 | * will mess with system calls we make, just like any other wannabe userland
|
---|
| 724 | * rootkit. Kudos to microsoft for not providing a generic system call hook API
|
---|
| 725 | * in the kernel mode, which I guess is what forcing these kind of products to
|
---|
| 726 | * do ugly userland hacks that doesn't really hold water.
|
---|
| 727 | */
|
---|
| 728 | DECLHIDDEN(void) supR3HardenedWinInitImports(void)
|
---|
| 729 | {
|
---|
[60700] | 730 | RTERRINFOSTATIC ErrInfo;
|
---|
| 731 |
|
---|
[52356] | 732 | /*
|
---|
| 733 | * Find the DLLs we will be needing first (forwarders).
|
---|
| 734 | */
|
---|
| 735 | for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 736 | {
|
---|
| 737 | supR3HardenedFindOrLoadModule(&g_aSupNtImpDlls[iDll]);
|
---|
| 738 | if (g_aSupNtImpDlls[iDll].pbImageBase)
|
---|
| 739 | supR3HardenedParseModule(&g_aSupNtImpDlls[iDll]);
|
---|
| 740 | }
|
---|
| 741 |
|
---|
| 742 | /*
|
---|
| 743 | * Resolve the functions.
|
---|
| 744 | */
|
---|
| 745 | for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 746 | for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
|
---|
| 747 | {
|
---|
[52967] | 748 | const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
|
---|
| 749 | false);
|
---|
[52356] | 750 | if (pszForwarder)
|
---|
| 751 | {
|
---|
| 752 | const char *pszDot = strchr(pszForwarder, '.');
|
---|
| 753 | size_t cchDllName = pszDot - pszForwarder;
|
---|
| 754 | SUPHNTIMPFUNC Tmp = g_aSupNtImpDlls[iDll].paImports[i];
|
---|
| 755 | Tmp.pszName = pszDot + 1;
|
---|
| 756 | if (cchDllName == sizeof("ntdll") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("ntdll")) == 0)
|
---|
[52967] | 757 | supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &Tmp, false);
|
---|
[52356] | 758 | else if (cchDllName == sizeof("kernelbase") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("kernelbase")) == 0)
|
---|
[52967] | 759 | supR3HardenedResolveImport(&g_aSupNtImpDlls[1], &Tmp, false);
|
---|
[52356] | 760 | else
|
---|
[52967] | 761 | SUPHNTIMP_ERROR(false, 18, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
|
---|
[52356] | 762 | "%ls: Failed to resolve forwarder '%s'.", g_aSupNtImpDlls[iDll].pwszName, pszForwarder);
|
---|
| 763 | }
|
---|
| 764 | }
|
---|
[52373] | 765 |
|
---|
| 766 | /*
|
---|
[52967] | 767 | * Do system calls directly.
|
---|
[52373] | 768 | */
|
---|
[60700] | 769 | supR3HardenedWinInitSyscalls(false, RTErrInfoInitStatic(&ErrInfo));
|
---|
[52375] | 770 |
|
---|
[52795] | 771 | /*
|
---|
| 772 | * Use the on disk image to avoid export table patching. Currently
|
---|
| 773 | * ignoring errors here as can live normally without this step.
|
---|
| 774 | */
|
---|
| 775 | for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 776 | if (g_aSupNtImpDlls[iDll].cPatchedExports > 0)
|
---|
| 777 | {
|
---|
| 778 | PSUPHNTLDRCACHEENTRY pLdrEntry;
|
---|
[60700] | 779 | int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
|
---|
[52795] | 780 | if (RT_SUCCESS(rc))
|
---|
| 781 | {
|
---|
| 782 | uint8_t *pbBits;
|
---|
[52947] | 783 | rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
|
---|
[60700] | 784 | RTErrInfoInitStatic(&ErrInfo));
|
---|
[52795] | 785 | if (RT_SUCCESS(rc))
|
---|
| 786 | for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
|
---|
| 787 | {
|
---|
| 788 | RTLDRADDR uValue;
|
---|
| 789 | rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
|
---|
| 790 | UINT32_MAX, g_aSupNtImpDlls[iDll].paImports[i].pszName, &uValue);
|
---|
| 791 | if (RT_SUCCESS(rc))
|
---|
| 792 | *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = (PFNRT)(uintptr_t)uValue;
|
---|
| 793 | }
|
---|
| 794 | }
|
---|
| 795 | }
|
---|
| 796 |
|
---|
| 797 |
|
---|
[52375] | 798 | #if 0 /* Win7/32 ntdll!LdrpDebugFlags. */
|
---|
| 799 | *(uint8_t *)&g_aSupNtImpDlls[0].pbImageBase[0xdd770] = 0x3;
|
---|
| 800 | #endif
|
---|
[52356] | 801 | }
|
---|
| 802 |
|
---|
[52795] | 803 |
|
---|
| 804 | /**
|
---|
| 805 | * Gets the address of a procedure in a DLL, ignoring our own syscall
|
---|
| 806 | * implementations.
|
---|
| 807 | *
|
---|
| 808 | * Currently restricted to NTDLL and KERNEL32
|
---|
| 809 | *
|
---|
| 810 | * @returns The procedure address.
|
---|
| 811 | * @param pszDll The DLL name.
|
---|
| 812 | * @param pszProcedure The procedure name.
|
---|
| 813 | */
|
---|
| 814 | DECLHIDDEN(PFNRT) supR3HardenedWinGetRealDllSymbol(const char *pszDll, const char *pszProcedure)
|
---|
| 815 | {
|
---|
[60700] | 816 | RTERRINFOSTATIC ErrInfo;
|
---|
| 817 |
|
---|
[52795] | 818 | /*
|
---|
| 819 | * Look the DLL up in the import DLL table.
|
---|
| 820 | */
|
---|
| 821 | for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
|
---|
| 822 | if (RTStrICmp(g_aSupNtImpDlls[iDll].pszName, pszDll) == 0)
|
---|
| 823 | {
|
---|
[52947] | 824 |
|
---|
[52795] | 825 | PSUPHNTLDRCACHEENTRY pLdrEntry;
|
---|
[60700] | 826 | int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
|
---|
[52795] | 827 | if (RT_SUCCESS(rc))
|
---|
| 828 | {
|
---|
| 829 | uint8_t *pbBits;
|
---|
[52947] | 830 | rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
|
---|
[60700] | 831 | RTErrInfoInitStatic(&ErrInfo));
|
---|
[52795] | 832 | if (RT_SUCCESS(rc))
|
---|
| 833 | {
|
---|
| 834 | RTLDRADDR uValue;
|
---|
| 835 | rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
|
---|
| 836 | UINT32_MAX, pszProcedure, &uValue);
|
---|
| 837 | if (RT_SUCCESS(rc))
|
---|
| 838 | return (PFNRT)(uintptr_t)uValue;
|
---|
| 839 | SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: Error getting %s in %s -> %Rrc\n", pszProcedure, pszDll, rc));
|
---|
| 840 | }
|
---|
| 841 | else
|
---|
[60700] | 842 | SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheEntryAllocBits failed on %s: %Rrc %s\n",
|
---|
| 843 | pszDll, rc, ErrInfo.Core.pszMsg));
|
---|
[52795] | 844 | }
|
---|
| 845 | else
|
---|
[60700] | 846 | SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheOpen failed on %s: %Rrc %s\n",
|
---|
| 847 | pszDll, rc, ErrInfo.Core.pszMsg));
|
---|
[52795] | 848 |
|
---|
| 849 | /* Complications, just call GetProcAddress. */
|
---|
[52947] | 850 | if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
|
---|
| 851 | return (PFNRT)GetProcAddress(GetModuleHandleW(g_aSupNtImpDlls[iDll].pwszName), pszProcedure);
|
---|
| 852 | return NULL;
|
---|
[52795] | 853 | }
|
---|
| 854 |
|
---|
| 855 | supR3HardenedFatal("supR3HardenedWinGetRealDllSymbol: Unknown DLL %s (proc: %s)\n", pszDll, pszProcedure);
|
---|
[62677] | 856 | /* not reached */
|
---|
[52795] | 857 | }
|
---|
| 858 |
|
---|