Changeset 52092 in vbox

Timestamp:

Jul 18, 2014 7:14:33 AM (11 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

95099

Message:

SUP: Disable hard error popups from NtCreateSection failures.

Location:

trunk

Files:

• include/iprt/nt/nt.h (modified) (5 diffs)
• src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (2 diffs)
• src/VBox/Runtime/r3/win/ntdll-mini-implib.def (modified) (2 diffs)

trunk/include/iprt/nt/nt.h

@@ -83 +83 @@
 # define ProcessBreakOnTermination              IncompleteWinternl_ProcessBreakOnTermination
 
+# define RTL_USER_PROCESS_PARAMETERS            IncompleteWinternl_RTL_USER_PROCESS_PARAMETERS
+# define PRTL_USER_PROCESS_PARAMETERS           IncompleteWinternl_PRTL_USER_PROCESS_PARAMETERS
+# define _RTL_USER_PROCESS_PARAMETERS           IncompleteWinternl__RTL_USER_PROCESS_PARAMETERS
+
 # define NtQueryInformationThread               IncompleteWinternl_NtQueryInformationThread
 # define NtSetInformationThread                 IncompleteWinternl_NtSetInformationThread
@@ -129 +133 @@
 # undef ProcessImageFileName
 # undef ProcessBreakOnTermination
+
+# undef RTL_USER_PROCESS_PARAMETERS
+# undef PRTL_USER_PROCESS_PARAMETERS
+# undef _RTL_USER_PROCESS_PARAMETERS
 
 # undef NtQueryInformationThread
@@ -629 +637 @@
 NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryObject(HANDLE, PVOID, ULONG, BOOLEAN, BOOLEAN, PULONG, PULONG);
 
+NTSYSAPI NTSTATUS NTAPI NtSuspendProcess(HANDLE);
+NTSYSAPI NTSTATUS NTAPI NtResumeProcess(HANDLE);
+/** @name ProcessDefaultHardErrorMode bit definitions.
+ * @{ */
+#define PROCESS_HARDERR_CRITICAL_ERROR              UINT32_C(0x00000001) /**< Inverted from the win32 define. */
+#define PROCESS_HARDERR_NO_GP_FAULT_ERROR           UINT32_C(0x00000002)
+#define PROCESS_HARDERR_NO_ALIGNMENT_FAULT_ERROR    UINT32_C(0x00000004)
+#define PROCESS_HARDERR_NO_OPEN_FILE_ERROR          UINT32_C(0x00008000)
+/** @} */
+NTSYSAPI NTSTATUS NTAPI NtSetInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG);
+
 /** Retured by ProcessImageInformation as well as NtQuerySection. */
 typedef struct _SECTION_IMAGE_INFORMATION
@@ -678 +697 @@
 
 NTSYSAPI NTSTATUS NTAPI NtQueryInformationThread(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
+NTSYSAPI NTSTATUS NTAPI NtResumeThread(HANDLE, PULONG);
+NTSYSAPI NTSTATUS NTAPI NtSuspendThread(HANDLE, PULONG);
 
 #ifndef SEC_FILE
@@ -907 +928 @@
 NTSYSAPI NTSTATUS NTAPI RtlAddAccessDeniedAce(PACL, ULONG, ULONG, PSID);
 
+
+typedef struct _CURDIR
+{
+    UNICODE_STRING  DosPath;
+    HANDLE          Handle;
+} CURDIR;
+typedef CURDIR *PCURDIR;
+
+typedef struct _RTL_DRIVE_LETTER_CURDIR
+{
+    USHORT          Flags;
+    USHORT          Length;
+    ULONG           TimeStamp;
+    STRING          DosPath; /**< Yeah, it's STRING according to dt ntdll!_RTL_DRIVE_LETTER_CURDIR. */
+} RTL_DRIVE_LETTER_CURDIR;
+typedef RTL_DRIVE_LETTER_CURDIR *PRTL_DRIVE_LETTER_CURDIR;
+
+typedef struct _RTL_USER_PROCESS_PARAMETERS
+{
+    ULONG           MaximumLength;
+    ULONG           Length;
+    ULONG           Flags;
+    ULONG           DebugFlags;
+    HANDLE          ConsoleHandle;
+    ULONG           ConsoleFlags;
+    HANDLE          StandardInput;
+    HANDLE          StandardOutput;
+    HANDLE          StandardError;
+    CURDIR          CurrentDirectory;
+    UNICODE_STRING  DllPath;
+    UNICODE_STRING  ImagePathName;
+    UNICODE_STRING  CommandLine;
+    PWSTR           Environment;
+    ULONG           StartingX;
+    ULONG           StartingY;
+    ULONG           CountX;
+    ULONG           CountY;
+    ULONG           CountCharsX;
+    ULONG           CountCharsY;
+    ULONG           FillAttribute;
+    ULONG           WindowFlags;
+    ULONG           ShowWindowFlags;
+    UNICODE_STRING  WindowTitle;
+    UNICODE_STRING  DesktopInfo;
+    UNICODE_STRING  ShellInfo;
+    UNICODE_STRING  RuntimeInfo;
+    RTL_DRIVE_LETTER_CURDIR  CurrentDirectories[0x20];
+    SIZE_T          EnvironmentSize;        /**< Added in Vista */
+    SIZE_T          EnvironmentVersion;     /**< Added in Windows 7. */
+    PVOID           PackageDependencyData;  /**< Added Windows 8? */
+    ULONG           ProcessGroupId;         /**< Added Windows 8? */
+} RTL_USER_PROCESS_PARAMETERS;
+typedef RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
+#define RTL_USER_PROCESS_PARAMS_FLAG_NORMALIZED     1
+
+typedef struct _RTL_USER_PROCESS_INFORMATION
+{
+    ULONG           Size;
+    HANDLE          ProcessHandle;
+    HANDLE          ThreadHandle;
+    CLIENT_ID       ClientId;
+    SECTION_IMAGE_INFORMATION  ImageInformation;
+} RTL_USER_PROCESS_INFORMATION;
+typedef RTL_USER_PROCESS_INFORMATION *PRTL_USER_PROCESS_INFORMATION;
+
+
+NTSYSAPI NTSTATUS NTAPI RtlCreateUserProcess(PUNICODE_STRING, ULONG, PRTL_USER_PROCESS_PARAMETERS, PSECURITY_DESCRIPTOR,
+                                             PSECURITY_DESCRIPTOR, HANDLE, BOOLEAN, HANDLE, HANDLE, PRTL_USER_PROCESS_INFORMATION);
+NTSYSAPI NTSTATUS NTAPI RtlCreateProcessParameters(PRTL_USER_PROCESS_PARAMETERS *, PUNICODE_STRING ImagePathName,
+                                                   PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory,
+                                                   PUNICODE_STRING CommandLine, PUNICODE_STRING Environment,
+                                                   PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo,
+                                                   PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeInfo);
+NTSYSAPI VOID     NTAPI RtlDestroyProcessParameters(PRTL_USER_PROCESS_PARAMETERS);
+
 RT_C_DECLS_END
 /** @} */

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -947 +947 @@
 DECLHIDDEN(void) supR3HardenedWinInstallHooks(void)
 {
+    NTSTATUS rcNt;
+
 #ifndef VBOX_WITHOUT_DEBUGGER_CHECKS
     /*
@@ -952 +954 @@
      * notifications from ending up in the debugger.
      */
-    NTSTATUS rcNt = NtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, 0);
+    rcNt = NtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, 0);
     if (!NT_SUCCESS(rcNt))
-        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_NO_MEMORY,
+        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
                               "NtSetInformationThread/ThreadHideFromDebugger failed: %#x\n", rcNt);
 #endif
+
+    /*
+     * Disable hard error popups so we can quietly refuse images to be loaded.
+     */
+    ULONG fHardErr = 0;
+    rcNt = NtQueryInformationProcess(NtCurrentProcess(), ProcessDefaultHardErrorMode, &fHardErr, sizeof(fHardErr), NULL);
+    if (!NT_SUCCESS(rcNt))
+        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
+                              "NtQueryInformationProcess/ProcessDefaultHardErrorMode failed: %#x\n", rcNt);
+    if (fHardErr & PROCESS_HARDERR_CRITICAL_ERROR)
+    {
+        fHardErr &= ~PROCESS_HARDERR_CRITICAL_ERROR;
+        rcNt = NtSetInformationProcess(NtCurrentProcess(), ProcessDefaultHardErrorMode, &fHardErr, sizeof(fHardErr));
+        if (!NT_SUCCESS(rcNt))
+            supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
+                                  "NtSetInformationProcess/ProcessDefaultHardErrorMode failed: %#x\n", rcNt);
+    }
 
     /*

trunk/src/VBox/Runtime/r3/win/ntdll-mini-implib.def

@@ -51 +51 @@
     NtReadFile                            ;;= _NtReadFile@36
     NtReadVirtualMemory                   ;;= _NtReadVirtualMemory@20
+    NtResumeProcess                       ;;= _NtResumeProcess@4
+    NtResumeThread                        ;;= _NtResumeThread@8
     NtSetInformationFile                  ;;= _NtSetInformationFile@20
     NtSetInformationObject                ;;= _NtSetInformationObject@16
+    NtSetInformationProcess               ;;= _NtSetInformationProcess@16
     NtSetInformationThread                ;;= _NtSetInformationThread@16
     NtSetTimerResolution                  ;;= _NtSetTimerResolution@12
+    NtSuspendProcess                      ;;= _NtSuspendProcess@4
+    NtSuspendThread                       ;;= _NtSuspendThread@8
     NtWriteFile                           ;;= _NtWriteFile@36
     NtWriteVirtualMemory                  ;;= _NtWriteVirtualMemory@20
@@ -63 +68 @@
     RtlCopySid                            ;;= _RtlCopySid@12
     RtlCreateAcl                          ;;= _RtlCreateAcl@12
+    RtlCreateProcessParameters            ;;= _RtlCreateProcessParameters@40
     RtlCreateSecurityDescriptor           ;;= _RtlCreateSecurityDescriptor@8
+    RtlCreateUserProcess                  ;;= _RtlCreateUserProcess@40
+    RtlDestroyProcessParameters           ;;= _RtlDestroyProcessParameters@4
     RtlGetVersion                         ;;= _RtlGetVersion@4
     RtlInitializeSid                      ;;= _RtlInitializeSid@12