VirtualBox

Ignore:
Timestamp:
Nov 12, 2024 2:41:36 AM (6 months ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
165871
Message:

SUPDrv,/Config.kmk,/Makefile.kmk: Implemented the simplified process validation for the VBOX_WITH_MINIMAL_HARDENING mode. jiraref:VBP-1449

Location:
trunk/src/VBox/HostDrivers/Support
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/HostDrivers/Support/Makefile.kmk

    r106925 r106945  
    807807   VBoxDrv_SOURCES.win   += \
    808808        win/SUPHardenedVerifyImage-win.cpp \
     809        win/SUPHardenedVerifyProcess-win.cpp \
    809810        $(VBOX_SUP_WIN_CERTS_FILE)
    810    ifdef VBOX_WITH_HARDENING
    811     VBoxDrv_SOURCES.win  += \
    812         win/SUPHardenedVerifyProcess-win.cpp
    813    endif
    814811   ifdef VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT
    815812    VBoxDrv_DEFS.win     += VBOX_WITHOUT_WINDOWS_KERNEL_CODE_SIGNING_CERT

  • trunk/src/VBox/HostDrivers/Support/testcase/Makefile.kmk

    r106061 r106945  
    7878SUPUninstall_LIBS     = $(LIB_RUNTIME)
    7979
    80 SUPLoggerCtl_TEMPLATE = VBoxR3Exe
     80SUPLoggerCtl_TEMPLATE = VBoxR3SignedExe
    8181SUPLoggerCtl_SOURCES  = SUPLoggerCtl.cpp
    8282SUPLoggerCtl_LIBS     = $(LIB_RUNTIME)
    8383
    84 tstInt_TEMPLATE       = VBoxR3Exe
     84tstInt_TEMPLATE       = VBoxR3SignedExe
    8585tstInt_DEFS           = $(VMM_COMMON_DEFS)
    8686tstInt_SOURCES        = tstInt.cpp
    8787tstInt_LIBS           = $(LIB_RUNTIME)
    8888
    89 tstContiguous_TEMPLATE = VBoxR3TstExe
     89tstContiguous_TEMPLATE = VBoxR3SignedTstExe
    9090tstContiguous_SOURCES = tstContiguous.cpp
    9191
    92 tstInit_TEMPLATE      = VBoxR3TstExe
     92tstInit_TEMPLATE      = VBoxR3SignedTstExe
    9393tstInit_SOURCES       = tstInit.cpp
    9494
    95 tstLow_TEMPLATE       = VBoxR3TstExe
     95tstLow_TEMPLATE       = VBoxR3SignedTstExe
    9696tstLow_SOURCES        = tstLow.cpp
    9797
    … …  
    100100tstNtQueryStuff_SOURCES  = tstNtQueryStuff.cpp
    101101
    102 tstPin_TEMPLATE       = VBoxR3TstExe
     102tstPin_TEMPLATE       = VBoxR3SignedTstExe
    103103tstPin_SOURCES        = tstPin.cpp
    104104
    105 tstPage_TEMPLATE      = VBoxR3TstExe
     105tstPage_TEMPLATE      = VBoxR3SignedTstExe
    106106tstPage_SOURCES       = tstPage.cpp
    107107
    … …  
    130130 tstGIP-2_TEMPLATE  := VBoxR3HardenedTstDll
    131131else
    132  tstGIP-2_TEMPLATE  := VBoxR3TstExe
     132 tstGIP-2_TEMPLATE  := VBoxR3SignedTstExe
    133133endif
    134134tstGIP-2_SOURCES = tstGIP-2.cpp
    135135
    136 tstGetPagingMode_TEMPLATE = VBoxR3TstExe
     136tstGetPagingMode_TEMPLATE = VBoxR3SignedTstExe
    137137tstGetPagingMode_SOURCES = tstGetPagingMode.cpp
    138138
    139 tstSupLoadModule_TEMPLATE = VBoxR3TstExe
     139tstSupLoadModule_TEMPLATE = VBoxR3SignedTstExe
    140140tstSupLoadModule_SOURCES  = tstSupLoadModule.cpp
    141141
    142 tstSupSem_TEMPLATE    = VBoxR3TstExe
     142tstSupSem_TEMPLATE    = VBoxR3SignedTstExe
    143143tstSupSem_SOURCES     = tstSupSem.cpp
    144144
    145 tstSupSem-Zombie_TEMPLATE = VBoxR3TstExe
     145tstSupSem-Zombie_TEMPLATE = VBoxR3SignedTstExe
    146146tstSupSem-Zombie_SOURCES  = tstSupSem-Zombie.cpp
    147147
    148 tstSupTscDelta_TEMPLATE = VBoxR3TstExe
     148tstSupTscDelta_TEMPLATE = VBoxR3SignedTstExe
    149149tstSupTscDelta_SOURCES  = tstSupTscDelta.cpp
    150150

  • trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

    r106930 r106945  
    347347static NTSTATUS _stdcall   VBoxDrvNtNotSupportedStub(PDEVICE_OBJECT pDevObj, PIRP pIrp);
    348348static NTSTATUS            VBoxDrvNtErr2NtStatus(int rc);
    349 #ifdef VBOX_WITH_HARDENING
     349#if defined(VBOX_WITH_HARDENING) || defined(VBOX_WITH_MINIMAL_HARDENING)
    350350static NTSTATUS             supdrvNtProtectInit(void);
    351351static void                 supdrvNtProtectTerm(void);
     352#endif
     353#ifdef VBOX_WITH_HARDENING
    352354static int                  supdrvNtProtectCreate(PSUPDRVNTPROTECT *ppNtProtect, HANDLE hPid,
    353355                                                  SUPDRVNTPROTECTKIND enmProcessKind, bool fLink);
    … …  
    708710        Log(("VBoxDrv::DriverEntry\n"));
    709711
    710 #ifdef VBOX_WITH_HARDENING
     712#if defined(VBOX_WITH_HARDENING) || defined(VBOX_WITH_MINIMAL_HARDENING)
    711713        /*
    712714         * Initialize process protection.
    … …  
    805807            }
    806808#endif
    807 #ifdef VBOX_WITH_HARDENING
     809#if defined(VBOX_WITH_HARDENING) || defined(VBOX_WITH_MINIMAL_HARDENING)
    808810            supdrvNtProtectTerm();
    809811#endif
    810812        }
    811 #ifdef VBOX_WITH_HARDENING
     813#if defined(VBOX_WITH_HARDENING) || defined(VBOX_WITH_MINIMAL_HARDENING)
    812814        else
    813815            DbgPrint("VBoxSup::DriverEntry: supdrvNtProtectInit failed with rcNt=%#x!\n", rcNt);
    … …  
    12601262
    12611263#else  /* !VBOX_WITH_HARDENING */
     1264# ifdef VBOX_WITH_MINIMAL_HARDENING
    12621265            /*
    1263              * Call common code to create a session.
     1266             * Check that the process is allowed to access the device, i.e. the
     1267             * process image is signed with the build certificate.
    12641268             */
    1265             pFileObj->FsContext = NULL;
    1266             PSUPDRVSESSION pSession;
    1267             rc = supdrvCreateSession(pDevExt, true /*fUser*/, pDevObj == g_pDevObjSys /*fUnrestricted*/, &pSession);
     1269            PRTERRINFOSTATIC pErrInfo = (PRTERRINFOSTATIC)RTMemAllocZ(sizeof(*pErrInfo));
     1270            rc = supHardenedWinVerifyProcess(NtCurrentProcess(), NtCurrentThread(), SUPHARDNTVPKIND_VERIFY_ONLY, 0 /*fFlags*/,
     1271                                             NULL, pErrInfo ? RTErrInfoInitStatic(pErrInfo) : NULL);
     1272            if (RT_FAILURE(rc))
     1273                SUPR0Printf("VBoxDrv: Checking process failed: %Rrc%#RTeim\n", rc, &pErrInfo->Core);
     1274            RTMemFree(pErrInfo);
     1275
    12681276            if (RT_SUCCESS(rc))
    1269             {
     1277# endif
     1278            {
     1279                /*
     1280                 * Call common code to create a session.
     1281                 */
     1282                pFileObj->FsContext = NULL;
     1283                PSUPDRVSESSION pSession;
     1284                rc = supdrvCreateSession(pDevExt, true /*fUser*/, pDevObj == g_pDevObjSys /*fUnrestricted*/, &pSession);
     1285                if (RT_SUCCESS(rc))
     1286                {
    12701287# ifdef VBOXDRV_WITH_SID_TO_UID_MAPPING
    1271                 rc = supdrvNtUserIdMakeForSession(pSession);
    1272                 if (RT_SUCCESS(rc))
     1288                    rc = supdrvNtUserIdMakeForSession(pSession);
     1289                    if (RT_SUCCESS(rc))
    12731290# endif
    1274                     rc = supdrvSessionHashTabInsert(pDevExt, pSession, (PSUPDRVSESSION *)&pFileObj->FsContext, NULL);
    1275                 supdrvSessionRelease(pSession);
    1276                 if (RT_SUCCESS(rc))
    1277                     return supdrvNtCompleteRequestEx(STATUS_SUCCESS, FILE_OPENED, pIrp);
    1278 
     1291                        rc = supdrvSessionHashTabInsert(pDevExt, pSession, (PSUPDRVSESSION *)&pFileObj->FsContext, NULL);
     1292                    supdrvSessionRelease(pSession);
     1293                    if (RT_SUCCESS(rc))
     1294                        return supdrvNtCompleteRequestEx(STATUS_SUCCESS, FILE_OPENED, pIrp);
     1295
     1296                }
    12791297            }
    12801298#endif /* !VBOX_WITH_HARDENING */
    … …  
    54545472
    54555473# ifndef VBOX_WITHOUT_DEBUGGER_CHECKS
    5456 
    54575474/**
    54585475 * Checks if the current process is being debugged.
    … …  
    54635480    return PsIsProcessBeingDebugged(PsGetCurrentProcess()) != FALSE;
    54645481}
    5465 
    54665482# endif /* !VBOX_WITHOUT_DEBUGGER_CHECKS */
    54675483
     5484#endif /* VBOX_WITH_HARDENING */
     5485#if defined(VBOX_WITH_HARDENING) || defined(VBOX_WITH_MINIMAL_HARDENING)
    54685486
    54695487/**
    … …  
    54725490static void supdrvNtProtectTerm(void)
    54735491{
     5492# ifdef VBOX_WITH_HARDENING
    54745493    /*
    54755494     * Stop intercepting process and thread handle creation calls.
    … …  
    55085527        RTMemFree(pCur);
    55095528    }
     5529# endif /* VBOX_WITH_HARDENING */
    55105530
    55115531    supHardenedWinTermImageVerifier();
    55125532}
    55135533
    5514 # ifdef RT_ARCH_X86
     5534# ifdef VBOX_WITH_HARDENING
     5535#  ifdef RT_ARCH_X86
    55155536DECLASM(void) supdrvNtQueryVirtualMemory_0xAF(void);
    55165537DECLASM(void) supdrvNtQueryVirtualMemory_0xB0(void);
    … …  
    55295550DECLASM(void) supdrvNtQueryVirtualMemory_0xBD(void);
    55305551DECLASM(void) supdrvNtQueryVirtualMemory_0xBE(void);
    5531 # elif defined(RT_ARCH_AMD64)
     5552#  elif defined(RT_ARCH_AMD64)
    55325553DECLASM(void) supdrvNtQueryVirtualMemory_0x1F(void);
    55335554DECLASM(void) supdrvNtQueryVirtualMemory_0x20(void);
    … …  
    55365557DECLASM(void) supdrvNtQueryVirtualMemory_0x23(void);
    55375558extern "C" NTSYSAPI NTSTATUS NTAPI ZwRequestWaitReplyPort(HANDLE, PVOID, PVOID);
    5538 # endif
     5559#  endif
     5560# endif /* VBOX_WITH_HARDENING */
    55395561
    55405562
    … …  
    55505572     */
    55515573
     5574# ifdef VBOX_WITH_HARDENING
    55525575    /* Resolve methods we want but isn't available everywhere. */
    55535576    UNICODE_STRING RoutineName;
    … …  
    55825605           ZwReadFile with a different eax value.  We figure the syscall number
    55835606           by inspecting ZwQueryVolumeInformationFile as it's the next number. */
    5584 # ifdef RT_ARCH_X86
     5607#  ifdef RT_ARCH_X86
    55855608        uint8_t const *pbCode = (uint8_t const *)(uintptr_t)ZwQueryVolumeInformationFile;
    55865609        if (*pbCode == 0xb8) /* mov eax, dword */
    … …  
    56045627                case 0xbf: g_pfnNtQueryVirtualMemory = (PFNNTQUERYVIRTUALMEMORY)supdrvNtQueryVirtualMemory_0xBE; break; /* just in case */
    56055628            }
    5606 # elif defined(RT_ARCH_AMD64)
     5629#  elif defined(RT_ARCH_AMD64)
    56075630        uint8_t const *pbCode = (uint8_t const *)(uintptr_t)ZwRequestWaitReplyPort;
    56085631        if (   pbCode[ 0] == 0x48   /* mov rax, rsp */
    … …  
    56465669            }
    56475670        }
    5648 # endif
     5671#  endif
    56495672    }
    56505673    if (!g_pfnNtQueryVirtualMemory)
    … …  
    56545677    }
    56555678
    5656 # ifdef VBOX_STRICT
     5679# else  /* !VBOX_WITH_HARDENING */
     5680    /* Always present on arm64 and more recent systems. */
     5681    g_pfnNtQueryVirtualMemory = (PFNNTQUERYVIRTUALMEMORY)ZwQueryVirtualMemory;
     5682# endif /* !VBOX_WITH_HARDENING */
     5683
     5684    NTSTATUS rcNt;
     5685    int      rc;
     5686
     5687# ifdef VBOX_WITH_HARDENING
     5688#  ifdef VBOX_STRICT
    56575689    if (   g_uNtVerCombined >= SUP_NT_VER_W70
    56585690        && (   g_pfnObGetObjectType == NULL
    … …  
    56625694        return STATUS_PROCEDURE_NOT_FOUND;
    56635695    }
    5664 # endif
     5696#  endif
    56655697
    56665698    /* LPC object type. */
    … …  
    56685700
    56695701    /* The spinlock protecting our structures. */
    5670     int rc = RTSpinlockCreate(&g_hNtProtectLock, RTSPINLOCK_FLAGS_INTERRUPT_UNSAFE, "NtProtectLock");
     5702    rc = RTSpinlockCreate(&g_hNtProtectLock, RTSPINLOCK_FLAGS_INTERRUPT_UNSAFE, "NtProtectLock");
    56715703    if (RT_FAILURE(rc))
    56725704        return VBoxDrvNtErr2NtStatus(rc);
    56735705    g_NtProtectTree = NULL;
    5674 
    5675     NTSTATUS rcNt;
    56765706
    56775707    /* The mutex protecting the error information. */
    … …  
    56805710    if (RT_SUCCESS(rc))
    56815711    {
     5712# endif /* VBOX_WITH_HARDENING */
    56825713        /* Image stuff + certificates. */
    56835714        rc = supHardenedWinInitImageVerifier(NULL);
    56845715        if (RT_SUCCESS(rc))
    56855716        {
     5717# ifdef VBOX_WITH_HARDENING
    56865718            /*
    56875719             * Intercept process creation and termination.
    … …  
    57455777                        if (NT_SUCCESS(rcNt))
    57465778                        {
     5779# endif /* VBOX_WITH_HARDENING */
    57475780                            /*
    57485781                             * Happy ending.
    57495782                             */
    57505783                            return STATUS_SUCCESS;
     5784# ifdef VBOX_WITH_HARDENING
    57515785                        }
    57525786                    }
    … …  
    58015835            }
    58025836            supHardenedWinTermImageVerifier();
     5837# endif /* VBOX_WITH_HARDENING */
    58035838        }
    58045839        else
    58055840            rcNt = VBoxDrvNtErr2NtStatus(rc);
    58065841
     5842# ifdef VBOX_WITH_HARDENING
    58075843        RTSemMutexDestroy(g_hErrorInfoLock);
    58085844        g_hErrorInfoLock = NIL_RTSEMMUTEX;
    … …  
    58135849    RTSpinlockDestroy(g_hNtProtectLock);
    58145850    g_NtProtectTree = NIL_RTSPINLOCK;
     5851# endif
    58155852    return rcNt;
    58165853}
    58175854
    5818 #endif /* VBOX_WITH_HARDENING */
    5819 
     5855#endif /* VBOX_WITH_HARDENING || VBOX_WITH_MINIMAL_HARDENING */
     5856

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

    r106893 r106945  
    7474#endif
    7575
     76#ifdef VBOX_WITH_MINIMAL_HARDENING
     77# define IMAGE_LOG_NAME_FMT         "%ls"
     78# define IMAGE_LOG_NAME(pImage)     ((pImage)->Name.awcBuffer)
     79#else
     80# define IMAGE_LOG_NAME_FMT         "%s"
     81# define IMAGE_LOG_NAME(pImage)     ((pImage)->pszName)
     82#endif
    7683
    7784
    … …  
    104111    uintptr_t       cbImage;
    105112
     113#ifndef VBOX_WITH_MINIMAL_HARDENING
    106114    /** The name from the allowed lists. */
    107115    const char     *pszName;
     116#endif
    108117    /** Name structure for NtQueryVirtualMemory/MemorySectionName. */
    109118    struct
    … …  
    256265    "tstRTR0TimerDriver.exe",
    257266    "tstSSM.exe",
     267    "tstInt.exe",
    258268};
    259269
    … …  
    484494        if (!NT_SUCCESS(rcNt))
    485495            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_READ_ERROR,
    486                                        "%s: Error reading %#x bytes at %p (rva %#x, #%u, %.8s) from memory: %#x",
    487                                        pImage->pszName, cbThis, pImage->uImageBase + uRva, uRva, iSh + 1,
     496                                       IMAGE_LOG_NAME_FMT ": Error reading %#x bytes at %p (rva %#x, #%u, %.8s) from memory: %#x",
     497                                       IMAGE_LOG_NAME(pImage), cbThis, pImage->uImageBase + uRva, uRva, iSh + 1,
    488498                                       iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers", rcNt);
    489499
    … …  
    492502        {
    493503            const char *pachSectNm = iSh >= 0 ? (char *)pThis->aSecHdrs[iSh].Name : "headers";
    494             SUP_DPRINTF(("%s: Differences in section #%u (%s) between file and memory:\n", pImage->pszName, iSh + 1, pachSectNm));
     504            SUP_DPRINTF((IMAGE_LOG_NAME_FMT ": Differences in section #%u (%s) between file and memory:\n",
     505                         IMAGE_LOG_NAME(pImage), iSh + 1, pachSectNm));
    495506
    496507            uint32_t off = 0;
    … …  
    521532                else
    522533                    return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
    523                                                "%s: Failed to restore %#x bytes at %p (%#x, #%u, %s): %#x (cDiffs=%#x, first=%#x)",
    524                                                pImage->pszName, cbThis, pvRestoreAddr, uRva, iSh + 1, pachSectNm, rcNt,
     534                                               IMAGE_LOG_NAME_FMT  ": Failed to restore %#x bytes at %p (%#x, #%u, %s): %#x (cDiffs=%#x, first=%#x)",
     535                                               IMAGE_LOG_NAME(pImage), cbThis, pvRestoreAddr, uRva, iSh + 1, pachSectNm, rcNt,
    525536                                               cDiffs, uRva + off);
    526537            }
    … …  
    528539#endif /* IN_RING3 */
    529540                return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH,
    530                                            "%s: %u differences between %#x and %#x in #%u (%.8s), first: %02x != %02x",
    531                                            pImage->pszName, cDiffs, uRva + off, uRva + offLast, iSh + 1,
     541                                           IMAGE_LOG_NAME_FMT ": %u differences between %#x and %#x in #%u (%.8s), first: %02x != %02x",
     542                                           IMAGE_LOG_NAME(pImage), cDiffs, uRva + off, uRva + offLast, iSh + 1,
    532543                                           pachSectNm, pbFile[off], pbMemory[off]);
    533544        }
    … …  
    567578                    || pImage->aRegions[i].fProt != PAGE_WRITECOPY))
    568579                return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_SECTION_PROTECTION_MISMATCH,
    569                                            "%s: RVA range %#x-%#x protection is %#x, expected %#x. (cb=%#x)",
    570                                            pImage->pszName, uRva, uRva + cbLeft - 1, pImage->aRegions[i].fProt, fProt, cb);
     580                                           IMAGE_LOG_NAME_FMT ": RVA range %#x-%#x protection is %#x, expected %#x. (cb=%#x)",
     581                                           IMAGE_LOG_NAME(pImage), uRva, uRva + cbLeft - 1, pImage->aRegions[i].fProt, fProt, cb);
    571582            if (cbLeft >= cb)
    572583                return VINF_SUCCESS;
    … …  
    589600
    590601    return supHardNtVpSetInfo2(pThis, cbOrg == cb ? VERR_SUP_VP_SECTION_NOT_MAPPED : VERR_SUP_VP_SECTION_NOT_FULLY_MAPPED,
    591                                "%s: RVA range %#x-%#x is not mapped?", pImage->pszName, uRva, uRva + cb - 1);
    592 }
    593 
     602                               IMAGE_LOG_NAME_FMT ": RVA range %#x-%#x is not mapped?", IMAGE_LOG_NAME(pImage), uRva, uRva + cb - 1);
     603}
     604
     605#ifndef VBOX_WITH_MINIMAL_HARDENING
    594606
    595607DECLINLINE(bool) supHardNtVpIsModuleNameMatch(PSUPHNTVPIMAGE pImage, const char *pszModule)
    … …  
    658670}
    659671
     672#endif /* !VBOX_WITH_MINIMAL_HARDENING */
     673
    660674
    661675/**
    … …  
    665679                                              PRTLDRADDR pValue, void *pvUser)
    666680{
     681    /*SUP_DPRINTF(("supHardNtVpGetImport: %s / %#x / %s.\n", pszModule, uSymbol, pszSymbol));*/
     682    PSUPHNTVPSTATE const pThis = (PSUPHNTVPSTATE)pvUser;
     683
     684#ifndef VBOX_WITH_MINIMAL_HARDENING
    667685    RT_NOREF1(hLdrMod);
    668     /*SUP_DPRINTF(("supHardNtVpGetImport: %s / %#x / %s.\n", pszModule, uSymbol, pszSymbol));*/
    669     PSUPHNTVPSTATE pThis = (PSUPHNTVPSTATE)pvUser;
    670686
    671687    int rc = VERR_MODULE_NOT_FOUND;
    … …  
    738754                     uSymbol, pszSymbol, pszModule, rc));
    739755    return rc;
     756
     757#else  /* VBOX_WITH_MINIMAL_HARDENING */
     758    /*
     759     * We don't care about correct imports here, as we will skip the import
     760     * table while comparing image bits.  (If we wanted to produce correct
     761     * imports, we'd have to track all the DLLs in the process, which would be
     762     * bothersome and expensive while not really gaining any better certainty
     763     * that we are actually executing the image we're looking at.)
     764     */
     765    RT_NOREF(hLdrMod, pszModule, pszSymbol, uSymbol);
     766    *pValue = pThis->aImages[0].uImageBase - PAGE_SIZE;
     767    return VINF_SUCCESS;
     768#endif /* VBOX_WITH_MINIMAL_HARDENING */
    740769}
    741770
    … …  
    759788    if (RT_FAILURE(rc))
    760789        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_IMAGE_HDR_READ_ERROR,
    761                                    "%s: Error reading image header: %Rrc", pImage->pszName, rc);
     790                                   IMAGE_LOG_NAME_FMT ": Error reading image header: %Rrc", IMAGE_LOG_NAME(pImage), rc);
    762791
    763792    uint32_t offNtHdrs = 0;
    … …  
    768797        if (offNtHdrs > 512 || offNtHdrs < sizeof(*pDosHdr))
    769798            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_MZ_OFFSET,
    770                                        "%s: Unexpected e_lfanew value: %#x", pImage->pszName, offNtHdrs);
     799                                       IMAGE_LOG_NAME_FMT ": Unexpected e_lfanew value: %#x", IMAGE_LOG_NAME(pImage), offNtHdrs);
    771800    }
    772801    PIMAGE_NT_HEADERS   pNtHdrs   = (PIMAGE_NT_HEADERS)&pThis->abFile[offNtHdrs];
    … …  
    774803    if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
    775804        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIGNATURE,
    776                                    "%s: No PE signature at %#x: %#x", pImage->pszName, offNtHdrs, pNtHdrs->Signature);
     805                                   IMAGE_LOG_NAME_FMT ": No PE signature at %#x: %#x", IMAGE_LOG_NAME(pImage), offNtHdrs, pNtHdrs->Signature);
    777806
    778807    /*
    … …  
    794823#endif
    795824        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_IMAGE_MACHINE,
    796                                    "%s: Unexpected machine: %#x (expected %#x)",
    797                                    pImage->pszName, pNtHdrs->FileHeader.Machine, uExpectedMachine);
     825                                   IMAGE_LOG_NAME_FMT ": Unexpected machine: %#x (expected %#x)",
     826                                   IMAGE_LOG_NAME(pImage), pNtHdrs->FileHeader.Machine, uExpectedMachine);
    798827    bool const fIs32Bit = pNtHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386;
    799828
    800829    if (pNtHdrs->FileHeader.SizeOfOptionalHeader != (fIs32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
    801830        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
    802                                    "%s: Unexpected optional header size: %#x",
    803                                    pImage->pszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
     831                                   IMAGE_LOG_NAME_FMT ": Unexpected optional header size: %#x",
     832                                   IMAGE_LOG_NAME(pImage), pNtHdrs->FileHeader.SizeOfOptionalHeader);
    804833
    805834    if (pNtHdrs->OptionalHeader.Magic != (fIs32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
    806835        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
    807                                    "%s: Unexpected optional header magic: %#x", pImage->pszName, pNtHdrs->OptionalHeader.Magic);
     836                                   IMAGE_LOG_NAME_FMT ": Unexpected optional header magic: %#x", IMAGE_LOG_NAME(pImage), pNtHdrs->OptionalHeader.Magic);
    808837
    809838    uint32_t cDirs = (fIs32Bit ? pNtHdrs32->OptionalHeader.NumberOfRvaAndSizes : pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
    810839    if (cDirs != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
    811840        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_OPTIONAL_HEADER,
    812                                    "%s: Unexpected data dirs: %#x", pImage->pszName, cDirs);
     841                                   IMAGE_LOG_NAME_FMT ": Unexpected data dirs: %#x", IMAGE_LOG_NAME(pImage), cDirs);
    813842
    814843    /*
    … …  
    818847    if (cSections > RT_ELEMENTS(pThis->aSecHdrs))
    819848        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_SECTIONS,
    820                                    "%s: Too many section headers: %#x", pImage->pszName, cSections);
     849                                   IMAGE_LOG_NAME_FMT ": Too many section headers: %#x", IMAGE_LOG_NAME(pImage), cSections);
    821850    suplibHardenedMemCopy(pThis->aSecHdrs, (fIs32Bit ? (void *)(pNtHdrs32 + 1) : (void *)(pNtHdrs + 1)),
    822851                          cSections * sizeof(IMAGE_SECTION_HEADER));
    … …  
    825854    if (uImageBase & PAGE_OFFSET_MASK)
    826855        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_BASE,
    827                                    "%s: Invalid image base: %p", pImage->pszName, uImageBase);
     856                                   IMAGE_LOG_NAME_FMT ": Invalid image base: %p", IMAGE_LOG_NAME(pImage), uImageBase);
    828857
    829858    uint32_t  const cbImage    = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfImage : pNtHdrs->OptionalHeader.SizeOfImage;
    … …  
    840869        if (pImage->cbImage < cbImagePgAligned)
    841870            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    842                                        "%s: SizeOfImage (%#x) is larger than the mapping size (%#x)",
    843                                        pImage->pszName, cbImage, pImage->cbImage);
     871                                       IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) is larger than the mapping size (%#x)",
     872                                       IMAGE_LOG_NAME(pImage), cbImage, pImage->cbImage);
    844873
    845874        /* This code has to be paranoid, so we must put some kind of limit on this extra
    … …  
    847876        if (pImage->cbImage > cbImagePgAligned + _64K)
    848877            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    849                                        "%s: SizeOfImage (%#x) isn't close enough to the mapping size (%#x) - diff %#x bytes; max expected is 64KB",
    850                                        pImage->pszName, cbImage, pImage->cbImage, pImage->cbImage - cbImage);
     878                                       IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) isn't close enough to the mapping size (%#x) - diff %#x bytes; max expected is 64KB",
     879                                       IMAGE_LOG_NAME(pImage), cbImage, pImage->cbImage, pImage->cbImage - cbImage);
    851880
    852881        /* Locate the mapping region for the extra pages: */
    853882        if (pImage->cRegions <= 1)
    854883            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    855                                        "%s: SizeOfImage (%#x) is smaller than the mapping size (%#x) and there are less than two mapping regions!",
    856                                        pImage->pszName, cbImage, pImage->cbImage);
     884                                       IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) is smaller than the mapping size (%#x) and there are less than two mapping regions!",
     885                                       IMAGE_LOG_NAME(pImage), cbImage, pImage->cbImage);
    857886        uint32_t iRegion = pImage->cRegions - 1;
    858887        while (iRegion > 0 && pImage->aRegions[iRegion].uRva > cbImagePgAligned)
    … …  
    860889        if (pImage->aRegions[iRegion].uRva != cbImagePgAligned)
    861890            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    862                                        "%s: SizeOfImage (%#x) is smaller than the mapping size (%#x) and we cannot locate the region(s) for the extra space! (iRegion=%d: uRva=%#x, expected %#x)",
    863                                        pImage->pszName, cbImage, pImage->cbImage, iRegion, pImage->aRegions[iRegion].uRva,
     891                                       IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) is smaller than the mapping size (%#x) and we cannot locate the region(s) for the extra space! (iRegion=%d: uRva=%#x, expected %#x)",
     892                                       IMAGE_LOG_NAME(pImage), cbImage, pImage->cbImage, iRegion, pImage->aRegions[iRegion].uRva,
    864893                                       cbImagePgAligned);
    865894
    … …  
    868897            if (pImage->aRegions[i].fProt & PAGE_EXECUTE_READWRITE)
    869898                return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    870                                            "%s: SizeOfImage (%#x) is smaller than the mapping size (%#x) and extra page %#x LB %#x are RWX (%#x)!",
    871                                            pImage->pszName, cbImage, pImage->cbImage,
     899                                           IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) is smaller than the mapping size (%#x) and extra page %#x LB %#x are RWX (%#x)!",
     900                                           IMAGE_LOG_NAME(pImage), cbImage, pImage->cbImage,
    872901                                           pImage->aRegions[i].uRva, pImage->aRegions[i].cb, pImage->aRegions[i].fProt);
    873902        /** @todo more restrictions on this? */
    … …  
    876905    if (cbImage != RTLdrSize(pImage->pCacheEntry->hLdrMod))
    877906        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_IMAGE_SIZE,
    878                                    "%s: SizeOfImage (%#x) differs from what RTLdrSize returns (%#zx)",
    879                                    pImage->pszName, cbImage, RTLdrSize(pImage->pCacheEntry->hLdrMod));
     907                                   IMAGE_LOG_NAME_FMT ": SizeOfImage (%#x) differs from what RTLdrSize returns (%#zx)",
     908                                   IMAGE_LOG_NAME(pImage), cbImage, RTLdrSize(pImage->pCacheEntry->hLdrMod));
    880909
    881910    uint32_t const cbSectAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.SectionAlignment : pNtHdrs->OptionalHeader.SectionAlignment;
    … …  
    884913        || cbSectAlign > (pImage->fApiSetSchemaOnlySection1 ? _64K : (uint32_t)PAGE_SIZE) )
    885914        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_ALIGNMENT_VALUE,
    886                                    "%s: Unexpected SectionAlignment value: %#x", pImage->pszName, cbSectAlign);
     915                                   IMAGE_LOG_NAME_FMT ": Unexpected SectionAlignment value: %#x", IMAGE_LOG_NAME(pImage), cbSectAlign);
    887916
    888917    uint32_t const cbFileAlign = fIs32Bit ? pNtHdrs32->OptionalHeader.FileAlignment : pNtHdrs->OptionalHeader.FileAlignment;
    889918    if (!RT_IS_POWER_OF_TWO(cbFileAlign) || cbFileAlign < 512 || cbFileAlign > PAGE_SIZE || cbFileAlign > cbSectAlign)
    890919        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_FILE_ALIGNMENT_VALUE,
    891                                    "%s: Unexpected FileAlignment value: %#x (cbSectAlign=%#x)",
    892                                    pImage->pszName, cbFileAlign, cbSectAlign);
     920                                   IMAGE_LOG_NAME_FMT ": Unexpected FileAlignment value: %#x (cbSectAlign=%#x)",
     921                                   IMAGE_LOG_NAME(pImage), cbFileAlign, cbSectAlign);
    893922
    894923    uint32_t  const cbHeaders  = fIs32Bit ? pNtHdrs32->OptionalHeader.SizeOfHeaders : pNtHdrs->OptionalHeader.SizeOfHeaders;
    … …  
    897926    if (cbHeaders < cbMinHdrs)
    898927        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
    899                                    "%s: Headers are too small: %#x < %#x (cSections=%#x)",
    900                                    pImage->pszName, cbHeaders, cbMinHdrs, cSections);
     928                                   IMAGE_LOG_NAME_FMT ": Headers are too small: %#x < %#x (cSections=%#x)",
     929                                   IMAGE_LOG_NAME(pImage), cbHeaders, cbMinHdrs, cSections);
    901930    uint32_t  const cbHdrsFile = RT_ALIGN_32(cbHeaders, cbFileAlign);
    902931    if (cbHdrsFile > sizeof(pThis->abFile))
    903932        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SIZE_OF_HEADERS,
    904                                    "%s: Headers are larger than expected: %#x/%#x (expected max %zx)",
    905                                    pImage->pszName, cbHeaders, cbHdrsFile, sizeof(pThis->abFile));
     933                                   IMAGE_LOG_NAME_FMT ": Headers are larger than expected: %#x/%#x (expected max %zx)",
     934                                   IMAGE_LOG_NAME(pImage), cbHeaders, cbHdrsFile, sizeof(pThis->abFile));
    906935
    907936    /*
    … …  
    948977    uint32_t         cSkipAreas = 0;
    949978    SUPHNTVPSKIPAREA aSkipAreas[7];
     979#ifndef VBOX_WITH_MINIMAL_HARDENING
    950980    if (pImage->fNtCreateSectionPatch)
    951981    {
    … …  
    9821012        aSkipAreas[cSkipAreas++].cb = 14;
    9831013
    984 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING
     1014# ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING
    9851015        /* Ignore our patched KiUserExceptionDispatcher hack. */
    9861016        rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "KiUserExceptionDispatcher", &uValue);
    … …  
    9891019        aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue + (HC_ARCH_BITS == 64);
    9901020        aSkipAreas[cSkipAreas++].cb = HC_ARCH_BITS == 64 ? 13 : 12;
    991 #endif
     1021# endif
    9921022
    9931023        /* LdrSystemDllInitBlock is filled in by the kernel. It mainly contains addresses of 32-bit ntdll method for wow64. */
    … …  
    10011031        Assert(cSkipAreas <= RT_ELEMENTS(aSkipAreas));
    10021032    }
     1033
     1034#else  /* VBOX_WITH_MINIMAL_HARDENING */
     1035# if 0 /* This is .rdata stuff, which it turns out contains more random stuff modified via the loadcfg. So, skipping it .rdata. */
     1036    /* Skip the IAT as we don't process fixups correctly. */
     1037    uint32_t const offAfterHdrs = offNtHdrs
     1038                                + (!fIs32Bit ? pNtHdrs->OptionalHeader.SizeOfHeaders : pNtHdrs32->OptionalHeader.SizeOfHeaders);
     1039    aSkipAreas[cSkipAreas].uRva = !fIs32Bit
     1040                                ? pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress
     1041                                : pNtHdrs32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
     1042    aSkipAreas[cSkipAreas].cb   = !fIs32Bit
     1043                                ? pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size
     1044                                : pNtHdrs32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size;
     1045    if (   aSkipAreas[cSkipAreas].cb   > 0
     1046        && aSkipAreas[cSkipAreas].cb   < pImage->cbImage / 4
     1047        && aSkipAreas[cSkipAreas].uRva > offAfterHdrs
     1048        && aSkipAreas[cSkipAreas].uRva < pImage->cbImage
     1049        && aSkipAreas[cSkipAreas].uRva + aSkipAreas[cSkipAreas].cb <= pImage->cbImage)
     1050        cSkipAreas++;
     1051# endif
     1052#endif /* VBOX_WITH_MINIMAL_HARDENING */
    10031053
    10041054    /*
    … …  
    10301080        if (uSectRva < uRva || uSectRva > cbImage || RT_ALIGN_32(uSectRva, cbSectAlign) != uSectRva)
    10311081            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_RVA,
    1032                                        "%s: Section %u: Invalid virtual address: %#x (uRva=%#x, cbImage=%#x, cbSectAlign=%#x)",
    1033                                        pImage->pszName, i, uSectRva, uRva, cbImage, cbSectAlign);
     1082                                       IMAGE_LOG_NAME_FMT ": Section %u: Invalid virtual address: %#x (uRva=%#x, cbImage=%#x, cbSectAlign=%#x)",
     1083                                       IMAGE_LOG_NAME(pImage), i, uSectRva, uRva, cbImage, cbSectAlign);
    10341084        uint32_t cbMap  = pThis->aSecHdrs[i].Misc.VirtualSize;
    10351085        if (cbMap > cbImage || uRva + cbMap > cbImage)
    10361086            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_VIRTUAL_SIZE,
    1037                                        "%s: Section %u: Invalid virtual size: %#x (uSectRva=%#x, uRva=%#x, cbImage=%#x)",
    1038                                        pImage->pszName, i, cbMap, uSectRva, uRva, cbImage);
     1087                                       IMAGE_LOG_NAME_FMT ": Section %u: Invalid virtual size: %#x (uSectRva=%#x, uRva=%#x, cbImage=%#x)",
     1088                                       IMAGE_LOG_NAME(pImage), i, cbMap, uSectRva, uRva, cbImage);
    10391089        uint32_t cbFile = pThis->aSecHdrs[i].SizeOfRawData;
    10401090        if (cbFile != RT_ALIGN_32(cbFile, cbFileAlign) || cbFile > RT_ALIGN_32(cbMap, cbSectAlign))
    10411091            return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_BAD_SECTION_FILE_SIZE,
    1042                                        "%s: Section %u: Invalid file size: %#x (cbMap=%#x, uSectRva=%#x)",
    1043                                        pImage->pszName, i, cbFile, cbMap, uSectRva);
     1092                                       IMAGE_LOG_NAME_FMT ": Section %u: Invalid file size: %#x (cbMap=%#x, uSectRva=%#x)",
     1093                                       IMAGE_LOG_NAME(pImage), i, cbFile, cbMap, uSectRva);
    10441094
    10451095        /* Validate the protection and bits. */
    … …  
    10781128                default:
    10791129                    return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_SECTION_FLAGS,
    1080                                                "%s: Section %u: Unexpected characteristics: %#x (uSectRva=%#x, cbMap=%#x)",
    1081                                                pImage->pszName, i, pThis->aSecHdrs[i].Characteristics, uSectRva, cbMap);
     1130                                               IMAGE_LOG_NAME_FMT ": Section %u: Unexpected characteristics: %#x (uSectRva=%#x, cbMap=%#x)",
     1131                                               IMAGE_LOG_NAME(pImage), i, pThis->aSecHdrs[i].Characteristics, uSectRva, cbMap);
    10821132            }
    10831133
    … …  
    10871137            if (   (   (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_CODE))
    10881138                    && !(pThis->aSecHdrs[i].Characteristics & IMAGE_SCN_MEM_WRITE))
     1139#ifndef VBOX_WITH_MINIMAL_HARDENING /* only executable segments */
    10891140                || (pThis->aSecHdrs[i].Characteristics & (IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE)) == IMAGE_SCN_MEM_READ
    10901141                || (pThis->enmKind == SUPHARDNTVPKIND_VERIFY_ONLY && pImage->fDll)
    1091                 || pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
     1142                || pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
     1143#endif
     1144               )
    10921145            {
    10931146                rc = VINF_SUCCESS;
    … …  
    13761429        cwcDirName--;
    13771430
     1431#ifndef VBOX_WITH_MINIMAL_HARDENING
    13781432    /*
    13791433     * Match it against known DLLs.
    … …  
    13861440            pImage->fDll    = true;
    13871441
    1388 #ifndef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
     1442# ifndef VBOX_PERMIT_VISUAL_STUDIO_PROFILING
    13891443            /* The directory name must match the one we've got for System32. */
    13901444            if (   (   cwcDirName * sizeof(WCHAR) != g_System32NtPath.UniStr.Length
    13911445                    || suplibHardenedMemComp(pLongName->Buffer, g_System32NtPath.UniStr.Buffer, cwcDirName * sizeof(WCHAR)) )
    1392 # ifdef VBOX_PERMIT_MORE
     1446#  ifdef VBOX_PERMIT_MORE
    13931447                && (   pImage->pszName[0] != 'a'
    13941448                    || pImage->pszName[1] != 'c'
    13951449                    || !supHardViIsAppPatchDir(pLongName->Buffer, pLongName->Length / sizeof(WCHAR)) )
    1396 # endif
     1450#  endif
    13971451                )
    13981452                return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NON_SYSTEM32_DLL,
    13991453                                           "Expected %ls to be loaded from %ls.",
    14001454                                           pLongName->Buffer, g_System32NtPath.UniStr.Buffer);
    1401 # ifdef VBOX_PERMIT_MORE
     1455#  ifdef VBOX_PERMIT_MORE
    14021456            if (g_uNtVerCombined < SUP_NT_VER_W70 && i >= VBOX_PERMIT_MORE_FIRST_IDX)
    14031457                pImage->pszName = NULL; /* hard limit: user32.dll is unwanted prior to w7. */
    1404 # endif
    1405 
    1406 #endif /* VBOX_PERMIT_VISUAL_STUDIO_PROFILING */
     1458#  endif
     1459
     1460# endif /* VBOX_PERMIT_VISUAL_STUDIO_PROFILING */
    14071461            break;
    14081462        }
    14091463    if (!pImage->pszName)
     1464#endif /* !VBOX_WITH_MINIMAL_HARDENING */
    14101465    {
    14111466        /*
    14121467         * Not a known DLL, is it a known executable?
    14131468         */
     1469#ifdef VBOX_WITH_MINIMAL_HARDENING
     1470        pImage->fDll = true;
     1471#endif
    14141472        for (uint32_t i = 0; i < RT_ELEMENTS(g_apszSupNtVpAllowedVmExes); i++)
    14151473            if (supHardNtVpAreNamesEqual(g_apszSupNtVpAllowedVmExes[i], pwszFilename))
    14161474            {
     1475#ifndef VBOX_WITH_MINIMAL_HARDENING
    14171476                pImage->pszName = g_apszSupNtVpAllowedVmExes[i];
     1477#endif
    14181478                pImage->fDll    = false;
    14191479                break;
    14201480            }
    14211481    }
     1482#ifndef VBOX_WITH_MINIMAL_HARDENING
    14221483    if (!pImage->pszName)
    14231484    {
    … …  
    14291490         * as in "may you live in interesting times".
    14301491         */
    1431 #ifdef IN_RING3
     1492# ifdef IN_RING3
    14321493        if (   pMemInfo->AllocationBase == pMemInfo->BaseAddress
    14331494            && pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
    … …  
    14471508            return VINF_OBJECT_DESTROYED;
    14481509        }
    1449 #endif
     1510# endif
    14501511        /*
    14511512         * Special error message if we can.
    … …  
    14791540                                       "Duplicate image entries for %s: %ls and %ls",
    14801541                                       pImage->pszName, pImage->Name.UniStr.Buffer, pThis->aImages[i].Name.UniStr.Buffer);
     1542#endif /* !VBOX_WITH_MINIMAL_HARDENING */
    14811543
    14821544    /*
    … …  
    14851547    if (pMemInfo->AllocationBase != pMemInfo->BaseAddress)
    14861548        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_IMAGE_MAPPING_BASE_ERROR,
    1487                                    "Invalid AllocationBase/BaseAddress for %s: %p vs %p.",
    1488                                    pImage->pszName, pMemInfo->AllocationBase, pMemInfo->BaseAddress);
     1549                                   "Invalid AllocationBase/BaseAddress for " IMAGE_LOG_NAME_FMT ": %p vs %p.",
     1550                                   IMAGE_LOG_NAME(pImage), pMemInfo->AllocationBase, pMemInfo->BaseAddress);
    14891551
    14901552    /*
    … …  
    14931555    if (pMemInfo->RegionSize >= _2G)
    14941556        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_LARGE_REGION,
    1495                                    "Region 0 of image %s is too large: %p.", pImage->pszName, pMemInfo->RegionSize);
     1557                                   "Region 0 of image " IMAGE_LOG_NAME_FMT " is too large: %p.",
     1558                                   IMAGE_LOG_NAME(pImage), pMemInfo->RegionSize);
    14961559
    14971560    /*
    … …  
    15061569    pImage->aRegions[0].fProt   = pMemInfo->Protect;
    15071570
     1571#ifndef VBOX_WITH_MINIMAL_HARDENING
    15081572    if (suplibHardenedStrCmp(pImage->pszName, "ntdll.dll") == 0)
    15091573        pImage->fNtCreateSectionPatch = true;
    15101574    else if (suplibHardenedStrCmp(pImage->pszName, "apisetschema.dll") == 0)
    15111575        pImage->fApiSetSchemaOnlySection1 = true; /** @todo Check the ApiSetMap field in the PEB. */
    1512 #ifdef VBOX_PERMIT_MORE
     1576# ifdef VBOX_PERMIT_MORE
    15131577    else if (suplibHardenedStrCmp(pImage->pszName, "acres.dll") == 0)
    15141578        pImage->f32bitResourceDll = true;
    1515 #endif
     1579# endif
     1580#endif /* !VBOX_WITH_MINIMAL_HARDENING */
    15161581
    15171582    return VINF_SUCCESS;
    … …  
    15341599    if (pImage->uImageBase != (uintptr_t)pMemInfo->AllocationBase)
    15351600        return supHardNtVpSetInfo2(pThis, VERR_SUPLIB_NT_PROCESS_UNTRUSTED_3,
    1536                                    "Base address mismatch for %s: have %p, found %p for region %p LB %#zx.",
    1537                                    pImage->pszName, pImage->uImageBase, pMemInfo->AllocationBase,
     1601                                   "Base address mismatch for " IMAGE_LOG_NAME_FMT ": have %p, found %p for region %p LB %#zx.",
     1602                                   IMAGE_LOG_NAME(pImage), pImage->uImageBase, pMemInfo->AllocationBase,
    15381603                                   pMemInfo->BaseAddress, pMemInfo->RegionSize);
    15391604
    … …  
    15441609    if (pMemInfo->RegionSize >= _2G)
    15451610        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_LARGE_REGION,
    1546                                    "Region %u of image %s is too large: %p/%p.", pImage->pszName, pMemInfo->RegionSize, uRva);
     1611                                   "Region %u of image " IMAGE_LOG_NAME_FMT " is too large: %p/%p.",
     1612                                   IMAGE_LOG_NAME(pImage), pMemInfo->RegionSize, uRva);
    15471613    if (uRva >= _2G)
    15481614        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_HIGH_REGION_RVA,
    1549                                    "Region %u of image %s is too high: %p/%p.", pImage->pszName, pMemInfo->RegionSize, uRva);
     1615                                   "Region %u of image " IMAGE_LOG_NAME_FMT " is too high: %p/%p.",
     1616                                   IMAGE_LOG_NAME(pImage), pMemInfo->RegionSize, uRva);
    15501617
    15511618
    … …  
    15561623    if (iRegion + 1 >= RT_ELEMENTS(pImage->aRegions))
    15571624        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_TOO_MANY_IMAGE_REGIONS,
    1558                                    "Too many regions for %s.", pImage->pszName);
     1625                                   "Too many regions for " IMAGE_LOG_NAME_FMT ".", IMAGE_LOG_NAME(pImage));
    15591626    pImage->aRegions[iRegion].uRva  = (uint32_t)uRva;
    15601627    pImage->aRegions[iRegion].cb    = (uint32_t)pMemInfo->RegionSize;
    … …  
    18181885    uintptr_t   cbAdvance = 0;
    18191886    uintptr_t   uPtrWhere = 0;
    1820 #ifdef VBOX_PERMIT_VERIFIER_DLL
     1887#if defined(VBOX_PERMIT_VERIFIER_DLL) || defined(VBOX_WITH_MINIMAL_HARDENING)
    18211888    for (uint32_t i = 0; i < 10240; i++)
    18221889#else
    … …  
    18821949            if (fNew)
    18831950            {
     1951#ifdef VBOX_WITH_MINIMAL_HARDENING
     1952                /* Prune non-executable images before trying to add another. We only want the executable. */
     1953                if (iImg > 0 && pThis->aImages[iImg - 1].fDll)
     1954                {
     1955                    pThis->cImages = --iImg;
     1956                    RT_ZERO(pThis->aImages[iImg]);
     1957                    pThis->aImages[iImg].Name = pThis->aImages[iImg + 1].Name;
     1958                    pThis->aImages[iImg].Name.UniStr.Buffer = pThis->aImages[iImg].Name.awcBuffer;
     1959                }
     1960#endif
    18841961                int rc = supHardNtVpNewImage(pThis, &pThis->aImages[iImg], &MemInfo);
    18851962                if (RT_SUCCESS(rc))
    … …  
    23362413        PSUPHNTVPIMAGE pImage = &pThis->aImages[i];
    23372414
     2415#ifdef VBOX_WITH_MINIMAL_HARDENING
     2416        /* Only the process executable image is verified here, so don't bother open all the other ones. */
     2417        if (pImage->fDll)
     2418            continue;
     2419#endif
     2420
    23382421#ifdef IN_RING3
    23392422        /*
    … …  
    23582441#endif
    23592442
    2360         int rc = supHardNtLdrCacheNewEntry(pImage->pCacheEntry, pImage->pszName, &pImage->Name.UniStr,
     2443#ifndef VBOX_WITH_MINIMAL_HARDENING
     2444        const char * const pszName = pImage->pszName;
     2445#else
     2446        const char * const pszName = "ignored.exe";
     2447#endif
     2448        int rc = supHardNtLdrCacheNewEntry(pImage->pCacheEntry, pszName, &pImage->Name.UniStr,
    23612449                                           pImage->fDll, pImage->f32bitResourceDll, pThis->pErrInfo);
    23622450        if (RT_FAILURE(rc))
    … …  
    24862574
    24872575
     2576#ifndef VBOX_WITH_MINIMAL_HARDENING
    24882577/**
    24892578 * Check the integrity of the DLLs found in the process.
    … …  
    25482637    return VINF_SUCCESS;
    25492638}
     2639#endif /* !VBOX_WITH_MINIMAL_HARDENING */
    25502640
    25512641
    … …  
    26832773                                            uint32_t *pcFixes, PRTERRINFO pErrInfo)
    26842774{
     2775    RT_NOREF(hThread);
    26852776    if (pcFixes)
    26862777        *pcFixes = 0;
    … …  
    26912782     */
    26922783    int rc = VINF_SUCCESS;
     2784#ifndef VBOX_WITH_MINIMAL_HARDENING
    26932785    if (   enmKind != SUPHARDNTVPKIND_CHILD_PURIFICATION
    26942786        && enmKind != SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
    … …  
    26972789        rc = supHardNtVpDebugger(hProcess, pErrInfo);
    26982790    if (RT_SUCCESS(rc))
     2791#endif /* !VBOX_WITH_MINIMAL_HARDENING */
    26992792    {
    27002793        /*
    … …  
    27182811            if (RT_SUCCESS(rc))
    27192812                rc = supHardNtVpCheckExe(pThis);
     2813#ifndef VBOX_WITH_MINIMAL_HARDENING
    27202814            if (RT_SUCCESS(rc))
    27212815                rc = supHardNtVpCheckDlls(pThis);
    2722 #ifdef IN_RING3
     2816# ifdef IN_RING3
    27232817            if (enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
    27242818                rc = supHardNtVpCheckHandles(pThis);
    2725 #endif
     2819# endif
     2820#endif /* !VBOX_WITH_MINIMAL_HARDENING */
     2821
    27262822
    27272823            if (pcFixes)
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette