Index: /trunk/include/iprt/nt/nt.h =================================================================== --- /trunk/include/iprt/nt/nt.h (revision 52626) +++ /trunk/include/iprt/nt/nt.h (revision 52627) @@ -54,4 +54,5 @@ * Hacks common to both base header sets. */ +#define RtlFreeUnicodeString WrongLinkage_RtlFreeUnicodeString #define NtQueryObject Incomplete_NtQueryObject #define ZwQueryObject Incomplete_ZwQueryObject @@ -72,4 +73,5 @@ + #ifdef IPRT_NT_USE_WINTERNL /* @@ -189,4 +191,5 @@ #endif +#undef RtlFreeUnicodeString #undef NtQueryObject #undef ZwQueryObject @@ -1879,4 +1882,14 @@ NTSYSAPI VOID NTAPI LdrInitializeThunk(PVOID, PVOID, PVOID); NTSYSAPI NTSTATUS NTAPI RtlExpandEnvironmentStrings_U(PVOID, PUNICODE_STRING, PUNICODE_STRING, PULONG); +NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG fFlags, + IN PCUNICODE_STRING pOrgName, + IN PUNICODE_STRING pDefaultSuffix, + IN OUT PUNICODE_STRING pStaticString, + IN OUT PUNICODE_STRING pDynamicString, + IN OUT PUNICODE_STRING *ppResultString, + IN PULONG pfNewFlags OPTIONAL, + IN PSIZE_T pcbFilename OPTIONAL, + IN PSIZE_T pcbNeeded OPTIONAL); +NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING); RT_C_DECLS_END Index: /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h =================================================================== --- /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h (revision 52626) +++ /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h (revision 52627) @@ -57,4 +57,5 @@ uint32_t *pcFixes, PRTERRINFO pErrInfo); +DECLHIDDEN(bool) supHardViUtf16PathIsEqualEx(PCRTUTF16 pawcLeft, size_t cwcLeft, const char *pszRight); DECLHIDDEN(bool) supHardViUniStrPathStartsWithUniStr(UNICODE_STRING const *pUniStrLeft, UNICODE_STRING const *pUniStrRight, bool fCheckSlash); Index: /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp =================================================================== --- /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp (revision 52626) +++ /trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp (revision 52627) @@ -473,12 +473,19 @@ * * @returns true if equal, false if not. - * @param pwszLeft The UTF-16 path string. + * @param pawcLeft The UTF-16 path string, not necessarily null + * terminated. + * @param cwcLeft The number of chars in the left string, + * RTSTR_MAX if unknown but terminated. * @param pszRight The ascii string. */ -static bool supHardViUtf16PathIsEqual(PCRTUTF16 pwszLeft, const char *pszRight) +DECLHIDDEN(bool) supHardViUtf16PathIsEqualEx(PCRTUTF16 pawcLeft, size_t cwcLeft, const char *pszRight) { for (;;) { - RTUTF16 wc = *pwszLeft++; + RTUTF16 wc; + if (cwcLeft-- > 0) + wc =*pawcLeft++; + else + wc = 0; uint8_t b = *pszRight++; if (b != wc) @@ -504,4 +511,17 @@ return true; } +} + + +/** + * Simple case insensitive UTF-16 / ASCII path compare. + * + * @returns true if equal, false if not. + * @param pwszLeft The UTF-16 path string. + * @param pszRight The ascii string. + */ +static bool supHardViUtf16PathIsEqual(PCRTUTF16 pwszLeft, const char *pszRight) +{ + return supHardViUtf16PathIsEqualEx(pwszLeft, RTSTR_MAX, pszRight); } Index: /trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp =================================================================== --- /trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (revision 52626) +++ /trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (revision 52627) @@ -803,65 +803,130 @@ RTUTF16 wszPath[260 + 260]; /* Assumes we've limited the import name length to 256. */ AssertCompile(sizeof(wszPath) > sizeof(g_System32NtPath)); - struct + + /* + * Check for DLL isolation / redirection / mapping. + */ + size_t cwcName = 260; + PRTUTF16 pwszName = &wszPath[0]; + int rc = RTStrToUtf16Ex(pCur->szName, RTSTR_MAX, &pwszName, cwcName, &cwcName); + if (RT_SUCCESS(rc)) { - PRTUTF16 pawcDir; - uint32_t cwcDir; - } Tmp, aDirs[] = + UNICODE_STRING UniStrName; + UniStrName.Buffer = wszPath; + UniStrName.Length = (USHORT)cwcName * sizeof(WCHAR); + UniStrName.MaximumLength = UniStrName.Length + sizeof(WCHAR); + + UNICODE_STRING UniStrStatic; + UniStrStatic.Buffer = &wszPath[cwcName + 1]; + UniStrStatic.Length = 0; + UniStrStatic.MaximumLength = (USHORT)sizeof(wszPath) - UniStrStatic.MaximumLength - sizeof(WCHAR); + + static UNICODE_STRING const s_DefaultSuffix = RTNT_CONSTANT_UNISTR(L".dll"); + UNICODE_STRING UniStrDynamic = { 0, 0, NULL }; + PUNICODE_STRING pUniStrResult = NULL; + + rcNt = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/, + &UniStrName, + (PUNICODE_STRING)&s_DefaultSuffix, + &UniStrStatic, + &UniStrDynamic, + &pUniStrResult, + NULL /*pNewFlags*/, + NULL /*pcbFilename*/, + NULL /*pcbNeeded*/); + if (NT_SUCCESS(rcNt)) + { + IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER; + OBJECT_ATTRIBUTES ObjAttr; + InitializeObjectAttributes(&ObjAttr, pUniStrResult, + OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); + rcNt = NtCreateFile(&hFile, + FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, + &ObjAttr, + &Ios, + NULL /* Allocation Size*/, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ, + FILE_OPEN, + FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, + NULL /*EaBuffer*/, + 0 /*EaLength*/); + if (NT_SUCCESS(rcNt)) + rcNt = Ios.Status; + if (!NT_SUCCESS(rcNt)) + hFile = INVALID_HANDLE_VALUE; + RtlFreeUnicodeString(&UniStrDynamic); + } + } + else + SUP_DPRINTF(("supR3HardenedWinVerifyCacheProcessImportTodos: RTStrToUtf16Ex #1 failed: %Rrc\n", rc)); + + /* + * If not something that gets remapped, do the half normal searching we need. + */ + if (hFile == INVALID_HANDLE_VALUE) { - { g_System32NtPath.UniStr.Buffer, g_System32NtPath.UniStr.Length / sizeof(WCHAR) }, - { g_SupLibHardenedExeNtPath.UniStr.Buffer, g_offSupLibHardenedExeNtName - 1 }, - { pCur->pwszAltSearchDir, pCur->cwcAltSearchDir }, - }; - - /* Search System32 first, unless it's a 'V*' or 'm*' name, the latter for msvcrt. */ - if ( pCur->szName[0] == 'v' - || pCur->szName[0] == 'V' - || pCur->szName[0] == 'm' - || pCur->szName[0] == 'M') - { - Tmp = aDirs[0]; - aDirs[0] = aDirs[1]; - aDirs[1] = Tmp; - } - - for (uint32_t i = 0; i < RT_ELEMENTS(aDirs); i++) - { - if (aDirs[i].pawcDir && aDirs[i].cwcDir && aDirs[i].cwcDir < RT_ELEMENTS(wszPath) / 3 * 2) + struct { - memcpy(wszPath, aDirs[i].pawcDir, aDirs[i].cwcDir * sizeof(RTUTF16)); - uint32_t cwc = aDirs[i].cwcDir; - wszPath[cwc++] = '\\'; - size_t cwcName = RT_ELEMENTS(wszPath) - cwc; - PRTUTF16 pwszName = &wszPath[cwc]; - int rc = RTStrToUtf16Ex(pCur->szName, RTSTR_MAX, &pwszName, cwcName, &cwcName); - if (RT_SUCCESS(rc)) + PRTUTF16 pawcDir; + uint32_t cwcDir; + } Tmp, aDirs[] = + { + { g_System32NtPath.UniStr.Buffer, g_System32NtPath.UniStr.Length / sizeof(WCHAR) }, + { g_SupLibHardenedExeNtPath.UniStr.Buffer, g_offSupLibHardenedExeNtName - 1 }, + { pCur->pwszAltSearchDir, pCur->cwcAltSearchDir }, + }; + + /* Search System32 first, unless it's a 'V*' or 'm*' name, the latter for msvcrt. */ + if ( pCur->szName[0] == 'v' + || pCur->szName[0] == 'V' + || pCur->szName[0] == 'm' + || pCur->szName[0] == 'M') + { + Tmp = aDirs[0]; + aDirs[0] = aDirs[1]; + aDirs[1] = Tmp; + } + + for (uint32_t i = 0; i < RT_ELEMENTS(aDirs); i++) + { + if (aDirs[i].pawcDir && aDirs[i].cwcDir && aDirs[i].cwcDir < RT_ELEMENTS(wszPath) / 3 * 2) { - IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER; - UNICODE_STRING NtName; - NtName.Buffer = wszPath; - NtName.Length = (USHORT)((cwc + cwcName) * sizeof(WCHAR)); - NtName.MaximumLength = NtName.Length + sizeof(WCHAR); - OBJECT_ATTRIBUTES ObjAttr; - InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); - - rcNt = NtCreateFile(&hFile, - FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, - &ObjAttr, - &Ios, - NULL /* Allocation Size*/, - FILE_ATTRIBUTE_NORMAL, - FILE_SHARE_READ, - FILE_OPEN, - FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, - NULL /*EaBuffer*/, - 0 /*EaLength*/); - if (NT_SUCCESS(rcNt)) - rcNt = Ios.Status; - if (NT_SUCCESS(rcNt)) - break; - hFile = INVALID_HANDLE_VALUE; + memcpy(wszPath, aDirs[i].pawcDir, aDirs[i].cwcDir * sizeof(RTUTF16)); + uint32_t cwc = aDirs[i].cwcDir; + wszPath[cwc++] = '\\'; + cwcName = RT_ELEMENTS(wszPath) - cwc; + pwszName = &wszPath[cwc]; + rc = RTStrToUtf16Ex(pCur->szName, RTSTR_MAX, &pwszName, cwcName, &cwcName); + if (RT_SUCCESS(rc)) + { + IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER; + UNICODE_STRING NtName; + NtName.Buffer = wszPath; + NtName.Length = (USHORT)((cwc + cwcName) * sizeof(WCHAR)); + NtName.MaximumLength = NtName.Length + sizeof(WCHAR); + OBJECT_ATTRIBUTES ObjAttr; + InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); + + rcNt = NtCreateFile(&hFile, + FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, + &ObjAttr, + &Ios, + NULL /* Allocation Size*/, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ, + FILE_OPEN, + FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, + NULL /*EaBuffer*/, + 0 /*EaLength*/); + if (NT_SUCCESS(rcNt)) + rcNt = Ios.Status; + if (NT_SUCCESS(rcNt)) + break; + hFile = INVALID_HANDLE_VALUE; + } + else + SUP_DPRINTF(("supR3HardenedWinVerifyCacheProcessImportTodos: RTStrToUtf16Ex #2 failed: %Rrc\n", rc)); } - else - SUP_DPRINTF(("supR3HardenedWinVerifyCacheProcessImportTodos: RTStrToUtf16Ex failed: %Rrc\n", rc)); } } @@ -1515,5 +1580,6 @@ supR3HardenedMonitor_LdrLoadDll(PWSTR pwszSearchPath, PULONG pfFlags, PUNICODE_STRING pName, PHANDLE phMod) { - DWORD dwSavedLastError = GetLastError(); + DWORD dwSavedLastError = GetLastError(); + NTSTATUS rcNt; /* @@ -1531,6 +1597,7 @@ return STATUS_INVALID_PARAMETER; } - SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: pName=%.*ls *pfFlags=%#x pwszSearchPath=%ls\n", - (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer, pfFlags ? *pfFlags : UINT32_MAX, pwszSearchPath)); + SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: pName=%.*ls *pfFlags=%#x pwszSearchPath=%p:%ls\n", + (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer, pfFlags ? *pfFlags : UINT32_MAX, pwszSearchPath, + !((uintptr_t)pwszSearchPath & 1) && (uintptr_t)pwszSearchPath >= 0x2000U ? pwszSearchPath : L"")); /* @@ -1562,5 +1629,6 @@ } /* - * Not an absolute path. Check if it's one of those special API set DLLs. + * Not an absolute path. Check if it's one of those special API set DLLs + * or something we're known to use but should be taken from WinSxS. */ else if (supHardViUtf16PathStartsWithEx(pName->Buffer, pName->Length / sizeof(WCHAR), @@ -1575,5 +1643,5 @@ * now, either there is no path at all or there is a relative path. We * will resolve it to an absolute path in either case, failing the call - * if we can't. If there isn't a path. + * if we can't. */ else @@ -1614,31 +1682,75 @@ /* - * Search for the DLL. Only System32 is allowed as the target of - * a search on the API level, all VBox calls will have full paths. + * Perform dll redirection to WinSxS such. We using an undocumented + * API here, which as always is a bit risky... ASSUMES that the API + * returns a full DOS path. */ - UINT cwc = GetSystemDirectoryW(wszPath, RT_ELEMENTS(wszPath) - 32); - if (!cwc) - { - supR3HardenedError(VINF_SUCCESS, false, - "supR3HardenedMonitor_LdrLoadDll: GetSystemDirectoryW failed: %u\n", GetLastError()); - SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x\n", STATUS_UNEXPECTED_IO_ERROR)); - return STATUS_UNEXPECTED_IO_ERROR; + UINT cwc; + static UNICODE_STRING const s_DefaultSuffix = RTNT_CONSTANT_UNISTR(L".dll"); + UNICODE_STRING UniStrStatic = { 0, (USHORT)sizeof(wszPath) - sizeof(WCHAR), wszPath }; + UNICODE_STRING UniStrDynamic = { 0, 0, NULL }; + PUNICODE_STRING pUniStrResult = NULL; + rcNt = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/, + pName, + (PUNICODE_STRING)&s_DefaultSuffix, + &UniStrStatic, + &UniStrDynamic, + &pUniStrResult, + NULL /*pNewFlags*/, + NULL /*pcbFilename*/, + NULL /*pcbNeeded*/); + if (NT_SUCCESS(rcNt)) + { + cwc = pUniStrResult->Length / sizeof(WCHAR); + if (pUniStrResult != &UniStrDynamic) + wszPath[cwc] = '\0'; + else + { + if (pUniStrResult->Length > sizeof(wszPath) - sizeof(WCHAR)) + { + supR3HardenedError(VINF_SUCCESS, false, + "supR3HardenedMonitor_LdrLoadDll: Name too long: %.*ls -> %.*ls (RtlDosApplyFileIoslationRedirection_Ustr)\n", + pName->Length / sizeof(WCHAR), pName->Buffer, + pUniStrResult->Length / sizeof(WCHAR), pUniStrResult->Buffer); + RtlFreeUnicodeString(&UniStrDynamic); + SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x\n", STATUS_NAME_TOO_LONG)); + return STATUS_NAME_TOO_LONG; + } + memcpy(&wszPath[0], pUniStrResult->Buffer, pUniStrResult->Length); + wszPath[cwc] = '\0'; + } + RtlFreeUnicodeString(&UniStrDynamic); } - if (cwc + 1 + cwcName + fNeedDllSuffix * 4 >= RT_ELEMENTS(wszPath)) - { - supR3HardenedError(VINF_SUCCESS, false, - "supR3HardenedMonitor_LdrLoadDll: Name too long (system32): %.*ls\n", cwcName, pawcName); - SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x\n", STATUS_NAME_TOO_LONG)); - return STATUS_NAME_TOO_LONG; - } - wszPath[cwc++] = '\\'; - memcpy(&wszPath[cwc], pawcName, cwcName * sizeof(WCHAR)); - cwc += cwcName; - if (!fNeedDllSuffix) - wszPath[cwc] = '\0'; else { - memcpy(&wszPath[cwc], L".dll", 5 * sizeof(WCHAR)); - cwc += 4; + /* + * Search for the DLL. Only System32 is allowed as the target of + * a search on the API level, all VBox calls will have full paths. + */ + cwc = GetSystemDirectoryW(wszPath, RT_ELEMENTS(wszPath) - 32); + if (!cwc) + { + supR3HardenedError(VINF_SUCCESS, false, + "supR3HardenedMonitor_LdrLoadDll: GetSystemDirectoryW failed: %u\n", GetLastError()); + SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x\n", STATUS_UNEXPECTED_IO_ERROR)); + return STATUS_UNEXPECTED_IO_ERROR; + } + if (cwc + 1 + cwcName + fNeedDllSuffix * 4 >= RT_ELEMENTS(wszPath)) + { + supR3HardenedError(VINF_SUCCESS, false, + "supR3HardenedMonitor_LdrLoadDll: Name too long (system32): %.*ls\n", cwcName, pawcName); + SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x\n", STATUS_NAME_TOO_LONG)); + return STATUS_NAME_TOO_LONG; + } + wszPath[cwc++] = '\\'; + memcpy(&wszPath[cwc], pawcName, cwcName * sizeof(WCHAR)); + cwc += cwcName; + if (!fNeedDllSuffix) + wszPath[cwc] = '\0'; + else + { + memcpy(&wszPath[cwc], L".dll", 5 * sizeof(WCHAR)); + cwc += 4; + } } @@ -1647,11 +1759,10 @@ ResolvedName.MaximumLength = ResolvedName.Length + sizeof(WCHAR); - SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: '%.*ls' -> '%.*ls'\n", + SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: '%.*ls' -> '%.*ls' [rcNt=%#x]\n", (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer, - ResolvedName.Length / sizeof(WCHAR), ResolvedName.Buffer)); + ResolvedName.Length / sizeof(WCHAR), ResolvedName.Buffer, rcNt)); pName = &ResolvedName; } - NTSTATUS rcNt; if (!fSkipValidation) { Index: /trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h =================================================================== --- /trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h (revision 52626) +++ /trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h (revision 52627) @@ -60,6 +60,8 @@ SUPHARNT_IMPORT_STDCALL(RtlCreateUserThread, 40) SUPHARNT_IMPORT_STDCALL(RtlDestroyProcessParameters, 4) +SUPHARNT_IMPORT_STDCALL(RtlDosApplyFileIsolationRedirection_Ustr, 36) SUPHARNT_IMPORT_STDCALL(RtlEqualSid, 8) SUPHARNT_IMPORT_STDCALL(RtlExpandEnvironmentStrings_U, 16) +SUPHARNT_IMPORT_STDCALL(RtlFreeUnicodeString, 4) SUPHARNT_IMPORT_STDCALL(RtlGetVersion, 4) SUPHARNT_IMPORT_STDCALL(RtlInitializeSid, 12) Index: /trunk/src/VBox/Runtime/r3/win/ntdll-mini-implib.def =================================================================== --- /trunk/src/VBox/Runtime/r3/win/ntdll-mini-implib.def (revision 52626) +++ /trunk/src/VBox/Runtime/r3/win/ntdll-mini-implib.def (revision 52627) @@ -93,6 +93,8 @@ RtlCreateUserThread ;;= _RtlCreateUserThread@40 RtlDestroyProcessParameters ;;= _RtlDestroyProcessParameters@4 + RtlDosApplyFileIsolationRedirection_Ustr ;;= _RtlDosApplyFileIsolationRedirection_Ustr@36 RtlEqualSid ;;= _RtlEqualSid@8 RtlExpandEnvironmentStrings_U ;;= _RtlExpandEnvironmentStrings_U@16 + RtlFreeUnicodeString ;;= _RtlFreeUnicodeString@4 RtlGetVersion ;;= _RtlGetVersion@4 RtlInitializeSid ;;= _RtlInitializeSid@12 @@ -101,2 +103,3 @@ RtlSubAuthoritySid ;;= _RtlSubAuthoritySid@8 +