Changeset 52135 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Jul 22, 2014 7:14:54 PM (10 years ago)

Author:

vboxsync

Message:

SUPDrv-win.cpp: Don't get confused by early kernel handles opened by protection software in kernel process/thread/image callbacks. Fixes the -104 respawn problem.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp (modified) (8 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

@@ -2760 +2760 @@
                 if (   pNtProtect->enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed
                     && pNtProtect->fFirstProcessCreateHandle
+                    && pOpInfo->KernelHandle == 0
                     && pNtProtect->hParentPid == PsGetProcessId(PsGetCurrentProcess()))
                 {
@@ -2787 +2788 @@
                     && pNtProtect->enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed
                     && pNtProtect->fCsrssFirstProcessCreateHandle
-                    && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess())
-                   )
+                    && pOpInfo->KernelHandle == 0
+                    && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess()) )
                 {
                     pNtProtect->fCsrssFirstProcessCreateHandle = false;
@@ -2813 +2814 @@
                     && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == 0x1478 /* 6.1.7600.16385 (win7_rtm.090713-1255) */
                     && pNtProtect->fThemesFirstProcessCreateHandle
-                    && supdrvNtProtectIsFrigginThemesService(pNtProtect, PsGetCurrentProcess()))
+                    && pOpInfo->KernelHandle == 0
+                    && supdrvNtProtectIsFrigginThemesService(pNtProtect, PsGetCurrentProcess()) )
                 {
                     pNtProtect->fThemesFirstProcessCreateHandle = true; /* Only once! */
@@ -2854 +2856 @@
                     && pNtProtect->enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed
                     && pNtProtect->fCsrssFirstProcessDuplicateHandle
+                    && pOpInfo->KernelHandle == 0
                     &&    pNtProtect->hParentPid
                        == PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess)
                     && pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == PsGetCurrentProcess()
-                    && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess())
-                   )
+                    && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess()) )
                 {
                     pNtProtect->fCsrssFirstProcessDuplicateHandle = false;
@@ -2992 +2994 @@
                     && pNtProtect->enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed
                     && pNtProtect->fFirstThreadCreateHandle
-                    && pNtProtect->hParentPid == PsGetProcessId(PsGetCurrentProcess()))
+                    && pOpInfo->KernelHandle == 0
+                    && pNtProtect->hParentPid == PsGetProcessId(PsGetCurrentProcess()) )
                 {
                     if (   !pOpInfo->KernelHandle
@@ -3013 +3016 @@
                     && (   (enmProcessKind = pNtProtect->enmProcessKind) == kSupDrvNtProtectKind_VmProcessConfirmed
                         || enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed)
+                    && pOpInfo->KernelHandle == 0
                     && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess()) )
                 {
@@ -3056 +3060 @@
                         || enmProcessKind == kSupDrvNtProtectKind_VmProcessUnconfirmed)
                     && pOpInfo->Parameters->DuplicateHandleInformation.TargetProcess == PsGetCurrentProcess()
+                    && pOpInfo->KernelHandle == 0
                     && supdrvNtProtectIsAssociatedCsrss(pNtProtect, PsGetCurrentProcess()) )
                 {
@@ -3147 +3152 @@
             /* Duplicate entry, fail. */
             pNtProtect->u32Magic = SUPDRVNTPROTECT_MAGIC_DEAD;
+            LogRel(("supdrvNtProtectCreate: Duplicate (%#x).\n", pNtProtect->AvlCore.Key));
             RTMemFree(pNtProtect);
-            return VERR_ACCESS_DENIED;
+            return VERR_DUPLICATE;
         }
     }