Changeset 53821 in vbox

Timestamp:

Jan 15, 2015 1:53:02 PM (10 years ago)

Author:

vboxsync

Message:

SUPR3HardenedMain-win.cpp: Handle the case where someone uses LdrLoadDll/LoadLibary to find a DLL that has already been loaded.

Location:

trunk/src/VBox/HostDrivers/Support/win

Files:

• SUPR3HardenedMain-win.cpp (modified) (4 diffs)
• import-template-ntdll.h (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -1797 +1797 @@
     NTSTATUS        rcNtResolve     = STATUS_SUCCESS;
     bool            fSkipValidation = false;
+    bool            fCheckIfLoaded  = false;
     WCHAR           wszPath[260];
     static UNICODE_STRING const s_DefaultSuffix = RTNT_CONSTANT_UNISTR(L".dll");
@@ -1933 +1934 @@
              * Search for the DLL.  Only System32 is allowed as the target of
              * a search on the API level, all VBox calls will have full paths.
+             * If the DLL is not in System32, we will resort to check if it's
+             * refering to an already loaded DLL (fCheckIfLoaded).
              */
             AssertCompile(sizeof(g_System32WinPath.awcBuffer) <= sizeof(wszPath));
@@ -1955 +1958 @@
                 cwc += 4;
             }
+            fCheckIfLoaded = true;
         }
 
@@ -2031 +2035 @@
         {
             DWORD dwErr = RtlGetLastWin32Error();
-            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: error opening '%ls': %u (NtPath=%.*ls; Input=%.*ls)\n",
+
+            /*
+             * Deal with special case where the caller (first case was MS LifeCam)
+             * is using LoadLibrary instead of GetModuleHandle to find a loaded DLL.
+             */
+            NTSTATUS rcNtGetDll = STATUS_SUCCESS;
+            if (   fCheckIfLoaded
+                 && (   rcNt == STATUS_OBJECT_NAME_NOT_FOUND
+                     || rcNt == STATUS_OBJECT_PATH_NOT_FOUND))
+            {
+                rcNtGetDll = LdrGetDllHandle(NULL /*DllPath*/, NULL /*pfFlags*/, pOrgName, phMod);
+                if (NT_SUCCESS(rcNtGetDll))
+                {
+                    RtlRestoreLastWin32Error(dwSavedLastError);
+                    return rcNtGetDll;
+                }
+            }
+
+            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: error opening '%ls': %u (NtPath=%.*ls; Input=%.*ls; rcNtGetDll=%#x\n",
                          wszPath, dwErr, NtPathUniStr.Length / sizeof(RTUTF16), NtPathUniStr.Buffer,
-                         pOrgName->Length / sizeof(WCHAR), pOrgName->Buffer));
+                         pOrgName->Length / sizeof(WCHAR), pOrgName->Buffer, rcNtGetDll));
         }
         RTNtPathFree(&NtPathUniStr, &hRootDir);

trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h

@@ -61 +61 @@
 SUPHARNT_IMPORT_STDCALL_EARLY(LdrInitializeThunk, 12)
 SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(LdrRegisterDllNotification, 16)
+SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(LdrGetDllHandle, 16)
 
 SUPHARNT_IMPORT_STDCALL(RtlAddAccessAllowedAce, 16)