VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainImports-win.cpp@ 67954

Last change on this file since 67954 was 62677, checked in by vboxsync, 8 years ago

SUPHardNt: -Wall warnings.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 37.2 KB
Line 
1/* $Id: SUPR3HardenedMainImports-win.cpp 62677 2016-07-29 12:39:44Z vboxsync $ */
2/** @file
3 * VirtualBox Support Library - Hardened Main, Windows Import Trickery.
4 */
5
6/*
7 * Copyright (C) 2006-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#include <iprt/nt/nt-and-windows.h>
32
33#include <VBox/sup.h>
34#include <VBox/err.h>
35#include <iprt/ctype.h>
36#include <iprt/string.h>
37#include <iprt/initterm.h>
38#include <iprt/param.h>
39
40#include "SUPLibInternal.h"
41#include "SUPHardenedVerify-win.h"
42
43
44/*********************************************************************************************************************************
45* Defined Constants And Macros *
46*********************************************************************************************************************************/
47#define SUPHARNT_COMMENT(a_Blah) /* nothing */
48
49#define VBOX_HARDENED_STUB_WITHOUT_IMPORTS
50#ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
51# define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
52 do { \
53 if (a_fReportErrors) supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__); \
54 else { static const char s_szWhere[] = a_szWhere; *(char *)(uintptr_t)(a_id) += 1; __debugbreak(); } \
55 } while (0)
56#else
57# define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
58 supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__)
59
60#endif
61
62
63/*********************************************************************************************************************************
64* Defined Constants And Macros *
65*********************************************************************************************************************************/
66/**
67 * Import function entry.
68 */
69typedef struct SUPHNTIMPFUNC
70{
71 /** The name of the function we're importing. */
72 const char *pszName;
73 /** Where to store the function address (think __imp_ApiName). */
74 PFNRT *ppfnImport;
75 /** Pointer to an early dummy function for imports that aren't available
76 * during early process initialization. */
77 PFNRT pfnEarlyDummy;
78 /** Indicates whether this is an optional import and failure to locate it
79 * should set it to NULL instead of freaking out. */
80 bool fOptional;
81} SUPHNTIMPFUNC;
82/** Pointer to an import table entry. */
83typedef SUPHNTIMPFUNC const *PCSUPHNTIMPFUNC;
84
85/**
86 * Information for constructing a direct system call.
87 */
88typedef struct SUPHNTIMPSYSCALL
89{
90 /** Where to store the system call number.
91 * NULL if this import doesn't stupport direct system call. */
92 uint32_t *puApiNo;
93 /** Assembly system call routine, type 1. */
94 PFNRT pfnType1;
95 /** Assembly system call routine, type 2. */
96 PFNRT pfnType2;
97#ifdef RT_ARCH_X86
98 /** The parameter size in bytes for a standard call. */
99 uint32_t cbParams;
100#endif
101} SUPHNTIMPSYSCALL;
102/** Pointer to a system call entry. */
103typedef SUPHNTIMPSYSCALL const *PCSUPHNTIMPSYSCALL;
104
105/**
106 * Import DLL.
107 *
108 * This contains both static (like name & imports) and runtime information (like
109 * load and export table locations).
110 */
111typedef struct SUPHNTIMPDLL
112{
113 /** @name Static data.
114 * @{ */
115 const wchar_t *pwszName;
116 const char *pszName;
117 size_t cImports;
118 PCSUPHNTIMPFUNC paImports;
119 /** Array running parallel to paImports if present. */
120 PCSUPHNTIMPSYSCALL paSyscalls;
121 /** @} */
122
123
124 /** The image base. */
125 uint8_t const *pbImageBase;
126 /** The NT headers. */
127 PIMAGE_NT_HEADERS pNtHdrs;
128 /** The NT header offset/RVA. */
129 uint32_t offNtHdrs;
130 /** The end of the section headers. */
131 uint32_t offEndSectHdrs;
132 /** The end of the image. */
133 uint32_t cbImage;
134 /** Offset of the export directory. */
135 uint32_t offExportDir;
136 /** Size of the export directory. */
137 uint32_t cbExportDir;
138
139 /** Exported functions and data by ordinal (RVAs). */
140 uint32_t const *paoffExports;
141 /** The number of exports. */
142 uint32_t cExports;
143 /** The number of exported names. */
144 uint32_t cNamedExports;
145 /** Pointer to the array of exported names (RVAs to strings). */
146 uint32_t const *paoffNamedExports;
147 /** Array parallel to paoffNamedExports with the corresponding ordinals
148 * (indexes into paoffExports). */
149 uint16_t const *pau16NameOrdinals;
150
151 /** Number of patched export table entries. */
152 uint32_t cPatchedExports;
153
154} SUPHNTIMPDLL;
155/** Pointer to an import DLL entry. */
156typedef SUPHNTIMPDLL *PSUPHNTIMPDLL;
157
158
159
160/*
161 * Declare assembly symbols.
162 */
163#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
164 extern PFNRT RT_CONCAT(g_pfn, a_Name);
165#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86)
166#define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
167 SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
168 extern uint32_t RT_CONCAT(g_uApiNo, a_Name); \
169 extern FNRT RT_CONCAT(a_Name, _SyscallType1); \
170 extern FNRT RT_CONCAT(a_Name, _SyscallType2);
171#define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
172 extern PFNRT RT_CONCAT(g_pfn, a_Name); \
173 extern FNRT RT_CONCAT(a_Name, _Early);
174#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
175
176RT_C_DECLS_BEGIN
177#include "import-template-ntdll.h"
178#include "import-template-kernel32.h"
179RT_C_DECLS_END
180
181/*
182 * Import functions.
183 */
184#undef SUPHARNT_IMPORT_SYSCALL
185#undef SUPHARNT_IMPORT_STDCALL_EARLY
186#undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
187#undef SUPHARNT_IMPORT_STDCALL
188#undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
189#define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
190 { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
191#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
192 { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
193#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) \
194 { #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, true },
195#define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
196 { #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), false },
197#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) \
198 { #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), true },
199static const SUPHNTIMPFUNC g_aSupNtImpNtDllFunctions[] =
200{
201#include "import-template-ntdll.h"
202};
203
204static const SUPHNTIMPFUNC g_aSupNtImpKernel32Functions[] =
205{
206#include "import-template-kernel32.h"
207};
208
209
210
211/*
212 * Syscalls in ntdll.
213 */
214#undef SUPHARNT_IMPORT_SYSCALL
215#undef SUPHARNT_IMPORT_STDCALL_EARLY
216#undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
217#undef SUPHARNT_IMPORT_STDCALL
218#undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
219#ifdef RT_ARCH_AMD64
220# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
221 { NULL, NULL },
222# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
223 { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name, _SyscallType1), &RT_CONCAT(a_Name, _SyscallType2) },
224#elif defined(RT_ARCH_X86)
225# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
226 { NULL, NULL, NULL, 0 },
227# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
228 { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name,_SyscallType1), &RT_CONCAT(a_Name, _SyscallType2), a_cbParamsX86 },
229#endif
230#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
231#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
232#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
233static const SUPHNTIMPSYSCALL g_aSupNtImpNtDllSyscalls[] =
234{
235#include "import-template-ntdll.h"
236};
237
238
239/**
240 * All the DLLs we import from.
241 * @remarks Code ASSUMES that ntdll is the first entry.
242 */
243static SUPHNTIMPDLL g_aSupNtImpDlls[] =
244{
245 { L"ntdll.dll", "ntdll.dll", RT_ELEMENTS(g_aSupNtImpNtDllFunctions), g_aSupNtImpNtDllFunctions, g_aSupNtImpNtDllSyscalls },
246 { L"kernelbase.dll", "kernelbase.dll", 0 /* optional module, forwarders only */, NULL, NULL },
247 { L"kernel32.dll", "kernel32.dll", RT_ELEMENTS(g_aSupNtImpKernel32Functions), g_aSupNtImpKernel32Functions, NULL },
248};
249
250
251static void supR3HardenedFindOrLoadModule(PSUPHNTIMPDLL pDll)
252{
253#ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
254 uint32_t const cbName = (uint32_t)RTUtf16Len(pDll->pwszName) * sizeof(WCHAR);
255 PPEB_LDR_DATA pLdrData = NtCurrentPeb()->Ldr;
256 LIST_ENTRY *pList = &pLdrData->InMemoryOrderModuleList;
257 LIST_ENTRY *pListEntry = pList->Flink;
258 uint32_t cLoops = 0;
259 while (pListEntry != pList && cLoops < 1024)
260 {
261 PLDR_DATA_TABLE_ENTRY pLdrEntry = RT_FROM_MEMBER(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
262
263 if ( pLdrEntry->FullDllName.Length > cbName + sizeof(WCHAR)
264 && ( pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '\\'
265 || pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '/')
266 && RTUtf16ICmpAscii(&pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR)],
267 pDll->pszName) == 0)
268 {
269 pDll->pbImageBase = (uint8_t *)pLdrEntry->DllBase;
270 return;
271 }
272
273 pListEntry = pListEntry->Flink;
274 cLoops++;
275 }
276
277 if (!pDll->cImports)
278 pDll->pbImageBase = NULL; /* optional */
279 else
280 SUPHNTIMP_ERROR(false, 1, "supR3HardenedFindOrLoadModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
281 "Failed to locate %ls", pDll->pwszName);
282#else
283 HMODULE hmod = GetModuleHandleW(pDll->pwszName);
284 if (RT_UNLIKELY(!hmod && pDll->cImports))
285 SUPHNTIMP_ERROR(true, 1, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
286 "Failed to locate %ls", pDll->pwszName);
287 pDll->pbImageBase = (uint8_t *)hmod;
288#endif
289}
290
291
292static void supR3HardenedParseModule(PSUPHNTIMPDLL pDll)
293{
294 /*
295 * Locate the PE header, do some basic validations.
296 */
297 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pDll->pbImageBase;
298 uint32_t offNtHdrs = 0;
299 PIMAGE_NT_HEADERS pNtHdrs;
300 if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
301 {
302 offNtHdrs = pMzHdr->e_lfanew;
303 if (offNtHdrs > _2K)
304 SUPHNTIMP_ERROR(false, 2, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
305 "%ls: e_lfanew=%#x, expected a lower value", pDll->pwszName, offNtHdrs);
306 }
307 pDll->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pDll->pbImageBase[offNtHdrs];
308
309 if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
310 SUPHNTIMP_ERROR(false, 3, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
311 "%ls: Invalid PE signature: %#x", pDll->pwszName, pNtHdrs->Signature);
312 if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
313 SUPHNTIMP_ERROR(false, 4, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
314 "%ls: Unexpected optional header size: %#x", pDll->pwszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
315 if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
316 SUPHNTIMP_ERROR(false, 5, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
317 "%ls: Unexpected optional header magic: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.Magic);
318 if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
319 SUPHNTIMP_ERROR(false, 6, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
320 "%ls: Unexpected number of RVA and sizes: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
321
322 pDll->offNtHdrs = offNtHdrs;
323 pDll->offEndSectHdrs = offNtHdrs
324 + sizeof(*pNtHdrs)
325 + pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
326 pDll->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
327
328 /*
329 * Find the export directory.
330 */
331 IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
332 if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
333 || ExpDir.VirtualAddress < pDll->offEndSectHdrs
334 || ExpDir.VirtualAddress >= pNtHdrs->OptionalHeader.SizeOfImage
335 || ExpDir.VirtualAddress + ExpDir.Size > pNtHdrs->OptionalHeader.SizeOfImage)
336 SUPHNTIMP_ERROR(false, 7, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
337 "%ls: Missing or invalid export directory: %#lx LB %#x", pDll->pwszName, ExpDir.VirtualAddress, ExpDir.Size);
338 pDll->offExportDir = ExpDir.VirtualAddress;
339 pDll->cbExportDir = ExpDir.Size;
340
341 IMAGE_EXPORT_DIRECTORY const *pExpDir = (IMAGE_EXPORT_DIRECTORY const *)&pDll->pbImageBase[ExpDir.VirtualAddress];
342
343 if ( pExpDir->NumberOfFunctions >= _1M
344 || pExpDir->NumberOfFunctions < 1
345 || pExpDir->NumberOfNames >= _1M
346 || pExpDir->NumberOfNames < 1)
347 SUPHNTIMP_ERROR(false, 8, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
348 "%ls: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
349 pDll->pwszName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
350 pDll->cNamedExports = pExpDir->NumberOfNames;
351 pDll->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
352
353 if ( pExpDir->AddressOfFunctions < pDll->offEndSectHdrs
354 || pExpDir->AddressOfFunctions >= pNtHdrs->OptionalHeader.SizeOfImage
355 || pExpDir->AddressOfFunctions + pDll->cExports * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
356 SUPHNTIMP_ERROR(false, 9, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
357 "%ls: Bad AddressOfFunctions: %#x\n", pDll->pwszName, pExpDir->AddressOfFunctions);
358 pDll->paoffExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfFunctions];
359
360 if ( pExpDir->AddressOfNames < pDll->offEndSectHdrs
361 || pExpDir->AddressOfNames >= pNtHdrs->OptionalHeader.SizeOfImage
362 || pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
363 SUPHNTIMP_ERROR(false, 10, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
364 "%ls: Bad AddressOfNames: %#x\n", pDll->pwszName, pExpDir->AddressOfNames);
365 pDll->paoffNamedExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfNames];
366
367 if ( pExpDir->AddressOfNameOrdinals < pDll->offEndSectHdrs
368 || pExpDir->AddressOfNameOrdinals >= pNtHdrs->OptionalHeader.SizeOfImage
369 || pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
370 SUPHNTIMP_ERROR(false, 11, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
371 "%ls: Bad AddressOfNameOrdinals: %#x\n", pDll->pwszName, pExpDir->AddressOfNameOrdinals);
372 pDll->pau16NameOrdinals = (uint16_t const *)&pDll->pbImageBase[pExpDir->AddressOfNameOrdinals];
373}
374
375
376static const char *supR3HardenedResolveImport(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, bool fReportErrors)
377{
378 /*
379 * Binary search.
380 */
381 uint32_t iStart = 0;
382 uint32_t iEnd = pDll->cNamedExports;
383 while (iStart < iEnd)
384 {
385 uint32_t iCur = iStart + (iEnd - iStart) / 2;
386 uint32_t offExpName = pDll->paoffNamedExports[iCur];
387 if (RT_UNLIKELY(offExpName < pDll->offEndSectHdrs || offExpName >= pDll->cbImage))
388 SUPHNTIMP_ERROR(fReportErrors, 12, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
389 "%ls: Bad export name entry: %#x (iCur=%#x)", pDll->pwszName, offExpName, iCur);
390
391 const char *pszExpName = (const char *)&pDll->pbImageBase[offExpName];
392 int iDiff = strcmp(pszExpName, pImport->pszName);
393 if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
394 iEnd = iCur;
395 else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
396 iStart = iCur + 1;
397 else /* pszExpName == pszSymbol */
398 {
399 uint16_t iExpOrdinal = pDll->pau16NameOrdinals[iCur];
400 if (iExpOrdinal < pDll->cExports)
401 {
402 uint32_t offExport = pDll->paoffExports[iExpOrdinal];
403
404 /* detect export table patching. */
405 if (offExport >= pDll->cbImage)
406 pDll->cPatchedExports++;
407
408 if (offExport - pDll->offExportDir >= pDll->cbExportDir)
409 {
410 *pImport->ppfnImport = (PFNRT)&pDll->pbImageBase[offExport];
411 return NULL;
412 }
413
414 /* Forwarder. */
415 return (const char *)&pDll->pbImageBase[offExport];
416 }
417 SUPHNTIMP_ERROR(fReportErrors, 14, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_BAD_EXE_FORMAT,
418 "%ls: Name ordinal for '%s' is out of bounds: %#x (max %#x)",
419 pDll->pwszName, iExpOrdinal, pDll->cExports);
420 return NULL;
421 }
422 }
423
424 if (!pImport->fOptional)
425 SUPHNTIMP_ERROR(fReportErrors, 15, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
426 "%ls: Failed to resolve '%s'.", pDll->pwszName, pImport->pszName);
427 *pImport->ppfnImport = NULL;
428 return NULL;
429}
430
431
432static void supR3HardenedDirectSyscall(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, PCSUPHNTIMPSYSCALL pSyscall,
433 PSUPHNTLDRCACHEENTRY pLdrEntry, uint8_t *pbBits, bool fReportErrors)
434{
435 /*
436 * Skip non-syscall entries.
437 */
438 if (!pSyscall->puApiNo)
439 return;
440
441 /*
442 * Locate the virgin bits.
443 */
444 RTLDRADDR uValue;
445 int rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)pDll->pbImageBase, UINT32_MAX, pImport->pszName, &uValue);
446 if (RT_FAILURE(rc))
447 {
448 SUPHNTIMP_ERROR(fReportErrors, 16, "supR3HardenedDirectSyscall", kSupInitOp_Misc, rc,
449 "%s: RTLdrGetSymbolEx failed on %s: %Rrc", pDll->pszName, pImport->pszName, rc);
450 return;
451 }
452 uintptr_t offSymbol = (uintptr_t)uValue - (uintptr_t)pDll->pbImageBase;
453 uint8_t const *pbFunction = &pbBits[offSymbol];
454
455 /*
456 * Parse the code and extract the API call number.
457 */
458#ifdef RT_ARCH_AMD64
459 /* Pattern #1: XP64/W2K3-64 thru Windows 10 build 10240.
460 0:000> u ntdll!NtCreateSection
461 ntdll!NtCreateSection:
462 00000000`779f1750 4c8bd1 mov r10,rcx
463 00000000`779f1753 b847000000 mov eax,47h
464 00000000`779f1758 0f05 syscall
465 00000000`779f175a c3 ret
466 00000000`779f175b 0f1f440000 nop dword ptr [rax+rax]
467
468 Pattern #2: Windows 10 build 10525+.
469 0:000> u ntdll_7ffc26300000!NtCreateSection
470 ntdll_7ffc26300000!ZwCreateSection:
471 00007ffc`263943e0 4c8bd1 mov r10,rcx
472 00007ffc`263943e3 b84a000000 mov eax,4Ah
473 00007ffc`263943e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
474 00007ffc`263943f0 7503 jne ntdll_7ffc26300000!ZwCreateSection+0x15 (00007ffc`263943f5)
475 00007ffc`263943f2 0f05 syscall
476 00007ffc`263943f4 c3 ret
477 00007ffc`263943f5 cd2e int 2Eh
478 00007ffc`263943f7 c3 ret
479 */
480 if ( pbFunction[ 0] == 0x4c /* mov r10, rcx */
481 && pbFunction[ 1] == 0x8b
482 && pbFunction[ 2] == 0xd1
483 && pbFunction[ 3] == 0xb8 /* mov eax, 0000yyzzh */
484 //&& pbFunction[ 4] == 0xZZ
485 //&& pbFunction[ 5] == 0xYY
486 && pbFunction[ 6] == 0x00
487 && pbFunction[ 7] == 0x00)
488 {
489 if ( pbFunction[ 8] == 0x0f /* syscall */
490 && pbFunction[ 9] == 0x05
491 && pbFunction[10] == 0xc3 /* ret */ )
492 {
493 *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
494 *pImport->ppfnImport = pSyscall->pfnType1;
495 return;
496 }
497 if ( pbFunction[ 8] == 0xf6 /* test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 */
498 && pbFunction[ 9] == 0x04
499 && pbFunction[10] == 0x25
500 && pbFunction[11] == 0x08
501 && pbFunction[12] == 0x03
502 && pbFunction[13] == 0xfe
503 && pbFunction[14] == 0x7f
504 && pbFunction[15] == 0x01
505 && pbFunction[16] == 0x75 /* jnz +3 */
506 && pbFunction[17] == 0x03
507 && pbFunction[18] == 0x0f /* syscall*/
508 && pbFunction[19] == 0x05
509 && pbFunction[20] == 0xc3 /* ret */
510 && pbFunction[21] == 0xcd /* int 2eh */
511 && pbFunction[22] == 0x2e
512 && pbFunction[23] == 0xc3 /* ret */ )
513 {
514 *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
515 *pImport->ppfnImport = pSyscall->pfnType2;
516 return;
517 }
518 }
519#else
520 /* Pattern #1: XP thru Windows 7
521 kd> u ntdll!NtCreateSection
522 ntdll!NtCreateSection:
523 7c90d160 b832000000 mov eax,32h
524 7c90d165 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
525 7c90d16a ff12 call dword ptr [edx]
526 7c90d16c c21c00 ret 1Ch
527 7c90d16f 90 nop
528 The variable bit is the value loaded into eax: XP=32h, W2K3=34h, Vista=4bh, W7=54h
529
530 Pattern #2: Windows 8.1
531 0:000:x86> u ntdll_6a0f0000!NtCreateSection
532 ntdll_6a0f0000!NtCreateSection:
533 6a15eabc b854010000 mov eax,154h
534 6a15eac1 e803000000 call ntdll_6a0f0000!NtCreateSection+0xd (6a15eac9)
535 6a15eac6 c21c00 ret 1Ch
536 6a15eac9 8bd4 mov edx,esp
537 6a15eacb 0f34 sysenter
538 6a15eacd c3 ret
539 The variable bit is the value loaded into eax: W81=154h
540 Note! One nice thing here is that we can share code pattern #1. */
541
542 if ( pbFunction[ 0] == 0xb8 /* mov eax, 0000yyzzh*/
543 //&& pbFunction[ 1] <= 0xZZ
544 //&& pbFunction[ 2] <= 0xYY
545 && pbFunction[ 3] == 0x00
546 && pbFunction[ 4] == 0x00)
547 {
548 *pSyscall->puApiNo = RT_MAKE_U16(pbFunction[1], pbFunction[2]);
549 if ( pbFunction[5] == 0xba /* mov edx, offset SharedUserData!SystemCallStub */
550 && pbFunction[ 6] == 0x00
551 && pbFunction[ 7] == 0x03
552 && pbFunction[ 8] == 0xfe
553 && pbFunction[ 9] == 0x7f
554 && pbFunction[10] == 0xff /* call [edx] */
555 && pbFunction[11] == 0x12
556 && ( ( pbFunction[12] == 0xc2 /* ret 1ch */
557 && pbFunction[13] == pSyscall->cbParams
558 && pbFunction[14] == 0x00)
559 || ( pbFunction[12] == 0xc3 /* ret */
560 && pSyscall->cbParams == 0)
561 )
562 )
563 {
564 *pImport->ppfnImport = pSyscall->pfnType1;
565 return;
566 }
567
568 if ( pbFunction[ 5] == 0xe8 /* call [$+3] */
569 && RT_ABS(*(int32_t *)&pbFunction[6]) < 0x10
570 && ( ( pbFunction[10] == 0xc2 /* ret 1ch */
571 && pbFunction[11] == pSyscall->cbParams
572 && pbFunction[12] == 0x00)
573 || ( pbFunction[10] == 0xc3 /* ret */
574 && pSyscall->cbParams == 0)
575 )
576 )
577 {
578 *pImport->ppfnImport = pSyscall->pfnType2;
579 return;
580 }
581 }
582#endif
583
584 /*
585 * Failed to parse it.
586 */
587 volatile uint8_t abCopy[16];
588 memcpy((void *)&abCopy[0], pbFunction, sizeof(abCopy));
589 SUPHNTIMP_ERROR(fReportErrors, 17, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
590 "%ls: failed to parse syscall: '%s': %.16Rhxs",
591 pDll->pwszName, pImport->pszName, &abCopy[0]);
592}
593
594
595/**
596 * Check out system calls and do the directly instead of via NtDll.
597 *
598 * We need to have access to the on disk NTDLL.DLL file as we do not trust the
599 * stuff we find in memory. Too early to verify signatures though.
600 *
601 * @param fReportErrors Whether we've got the machinery for reporting
602 * errors going already.
603 * @param pErrInfo Buffer for gathering additional error info. This
604 * is mainly to avoid consuming lots of stacks with
605 * RTERRINFOSTATIC structures.
606 */
607DECLHIDDEN(void) supR3HardenedWinInitSyscalls(bool fReportErrors, PRTERRINFO pErrInfo)
608{
609 for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
610 if (g_aSupNtImpDlls[iDll].paSyscalls)
611 {
612 PSUPHNTLDRCACHEENTRY pLdrEntry;
613 int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, pErrInfo);
614 if (RT_SUCCESS(rc))
615 {
616 uint8_t *pbBits;
617 rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
618 NULL, NULL, pErrInfo);
619 if (RT_SUCCESS(rc))
620 {
621 for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
622 supR3HardenedDirectSyscall(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
623 &g_aSupNtImpDlls[iDll].paSyscalls[i], pLdrEntry, pbBits, fReportErrors);
624 }
625 else
626 SUPHNTIMP_ERROR(fReportErrors, 20, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
627 "%ls: supHardNtLdrCacheEntryGetBits failed: %Rrc %s",
628 g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
629 }
630 else
631 SUPHNTIMP_ERROR(fReportErrors, 21, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
632 "%ls: supHardNtLdrCacheOpen failed: %Rrc %s",
633 g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
634 }
635}
636
637
638/**
639 * Resolves a few NtDll functions we need before child purification is executed.
640 *
641 * We must not permanently modify any global data here.
642 *
643 * @param uNtDllAddr The address of the NTDLL.
644 * @param ppfnNtWaitForSingleObject Where to store the NtWaitForSingleObject
645 * address.
646 * @param ppfnNtSetEvent Where to store the NtSetEvent address.
647 */
648DECLHIDDEN(void) supR3HardenedWinGetVeryEarlyImports(uintptr_t uNtDllAddr,
649 PFNNTWAITFORSINGLEOBJECT *ppfnNtWaitForSingleObject,
650 PFNNTSETEVENT *ppfnNtSetEvent)
651{
652 /*
653 * NTDLL is the first entry in the list. Save it and do the parsing.
654 */
655 SUPHNTIMPDLL SavedDllEntry = g_aSupNtImpDlls[0];
656
657 g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
658 supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
659
660 /*
661 * Create a temporary import table for the requested APIs and resolve them.
662 */
663 SUPHNTIMPFUNC aImports[] =
664 {
665 { "NtWaitForSingleObject", (PFNRT *)ppfnNtWaitForSingleObject, NULL, false },
666 { "NtSetEvent", (PFNRT *)ppfnNtSetEvent, NULL, false },
667 };
668
669 for (uint32_t i = 0; i < RT_ELEMENTS(aImports); i++)
670 {
671 const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &aImports[i], false);
672 if (pszForwarder)
673 SUPHNTIMP_ERROR(false, 31, "supR3HardenedWinGetVeryEarlyImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
674 "ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
675 }
676
677 /*
678 * Restore the NtDll entry.
679 */
680 g_aSupNtImpDlls[0] = SavedDllEntry;
681}
682
683
684/**
685 * Resolves NtDll functions we can trust calling before process init.
686 *
687 * @param uNtDllAddr The address of the NTDLL.
688 */
689DECLHIDDEN(void) supR3HardenedWinInitImportsEarly(uintptr_t uNtDllAddr)
690{
691 /*
692 * NTDLL is the first entry in the list.
693 */
694 g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
695 supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
696 for (uint32_t i = 0; i < g_aSupNtImpDlls[0].cImports; i++)
697 if (!g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy)
698 {
699 const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &g_aSupNtImpDlls[0].paImports[i], false);
700 if (pszForwarder)
701 SUPHNTIMP_ERROR(false, 32, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
702 "ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
703 }
704 else
705 *g_aSupNtImpDlls[0].paImports[i].ppfnImport = g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy;
706
707 /*
708 * Point the other imports at the early init stubs.
709 */
710 for (uint32_t iDll = 1; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
711 for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
712 if (!g_aSupNtImpDlls[iDll].paImports[i].fOptional)
713 *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = g_aSupNtImpDlls[iDll].paImports[i].pfnEarlyDummy;
714 else
715 *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = NULL;
716}
717
718
719/**
720 * Resolves imported functions, esp. system calls from NTDLL.
721 *
722 * This crap is necessary because there are sandboxing products out there that
723 * will mess with system calls we make, just like any other wannabe userland
724 * rootkit. Kudos to microsoft for not providing a generic system call hook API
725 * in the kernel mode, which I guess is what forcing these kind of products to
726 * do ugly userland hacks that doesn't really hold water.
727 */
728DECLHIDDEN(void) supR3HardenedWinInitImports(void)
729{
730 RTERRINFOSTATIC ErrInfo;
731
732 /*
733 * Find the DLLs we will be needing first (forwarders).
734 */
735 for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
736 {
737 supR3HardenedFindOrLoadModule(&g_aSupNtImpDlls[iDll]);
738 if (g_aSupNtImpDlls[iDll].pbImageBase)
739 supR3HardenedParseModule(&g_aSupNtImpDlls[iDll]);
740 }
741
742 /*
743 * Resolve the functions.
744 */
745 for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
746 for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
747 {
748 const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
749 false);
750 if (pszForwarder)
751 {
752 const char *pszDot = strchr(pszForwarder, '.');
753 size_t cchDllName = pszDot - pszForwarder;
754 SUPHNTIMPFUNC Tmp = g_aSupNtImpDlls[iDll].paImports[i];
755 Tmp.pszName = pszDot + 1;
756 if (cchDllName == sizeof("ntdll") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("ntdll")) == 0)
757 supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &Tmp, false);
758 else if (cchDllName == sizeof("kernelbase") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("kernelbase")) == 0)
759 supR3HardenedResolveImport(&g_aSupNtImpDlls[1], &Tmp, false);
760 else
761 SUPHNTIMP_ERROR(false, 18, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
762 "%ls: Failed to resolve forwarder '%s'.", g_aSupNtImpDlls[iDll].pwszName, pszForwarder);
763 }
764 }
765
766 /*
767 * Do system calls directly.
768 */
769 supR3HardenedWinInitSyscalls(false, RTErrInfoInitStatic(&ErrInfo));
770
771 /*
772 * Use the on disk image to avoid export table patching. Currently
773 * ignoring errors here as can live normally without this step.
774 */
775 for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
776 if (g_aSupNtImpDlls[iDll].cPatchedExports > 0)
777 {
778 PSUPHNTLDRCACHEENTRY pLdrEntry;
779 int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
780 if (RT_SUCCESS(rc))
781 {
782 uint8_t *pbBits;
783 rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
784 RTErrInfoInitStatic(&ErrInfo));
785 if (RT_SUCCESS(rc))
786 for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
787 {
788 RTLDRADDR uValue;
789 rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
790 UINT32_MAX, g_aSupNtImpDlls[iDll].paImports[i].pszName, &uValue);
791 if (RT_SUCCESS(rc))
792 *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = (PFNRT)(uintptr_t)uValue;
793 }
794 }
795 }
796
797
798#if 0 /* Win7/32 ntdll!LdrpDebugFlags. */
799 *(uint8_t *)&g_aSupNtImpDlls[0].pbImageBase[0xdd770] = 0x3;
800#endif
801}
802
803
804/**
805 * Gets the address of a procedure in a DLL, ignoring our own syscall
806 * implementations.
807 *
808 * Currently restricted to NTDLL and KERNEL32
809 *
810 * @returns The procedure address.
811 * @param pszDll The DLL name.
812 * @param pszProcedure The procedure name.
813 */
814DECLHIDDEN(PFNRT) supR3HardenedWinGetRealDllSymbol(const char *pszDll, const char *pszProcedure)
815{
816 RTERRINFOSTATIC ErrInfo;
817
818 /*
819 * Look the DLL up in the import DLL table.
820 */
821 for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
822 if (RTStrICmp(g_aSupNtImpDlls[iDll].pszName, pszDll) == 0)
823 {
824
825 PSUPHNTLDRCACHEENTRY pLdrEntry;
826 int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
827 if (RT_SUCCESS(rc))
828 {
829 uint8_t *pbBits;
830 rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
831 RTErrInfoInitStatic(&ErrInfo));
832 if (RT_SUCCESS(rc))
833 {
834 RTLDRADDR uValue;
835 rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
836 UINT32_MAX, pszProcedure, &uValue);
837 if (RT_SUCCESS(rc))
838 return (PFNRT)(uintptr_t)uValue;
839 SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: Error getting %s in %s -> %Rrc\n", pszProcedure, pszDll, rc));
840 }
841 else
842 SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheEntryAllocBits failed on %s: %Rrc %s\n",
843 pszDll, rc, ErrInfo.Core.pszMsg));
844 }
845 else
846 SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheOpen failed on %s: %Rrc %s\n",
847 pszDll, rc, ErrInfo.Core.pszMsg));
848
849 /* Complications, just call GetProcAddress. */
850 if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
851 return (PFNRT)GetProcAddress(GetModuleHandleW(g_aSupNtImpDlls[iDll].pwszName), pszProcedure);
852 return NULL;
853 }
854
855 supR3HardenedFatal("supR3HardenedWinGetRealDllSymbol: Unknown DLL %s (proc: %s)\n", pszDll, pszProcedure);
856 /* not reached */
857}
858
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use