Changeset 52169 in vbox

Timestamp:

Jul 24, 2014 2:12:57 PM (11 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

95213

Message:

SUP: Added logging capabilities to the hardened stub.

Location:

trunk/src/VBox/HostDrivers/Support

Files:

• Makefile.kmk (modified) (1 diff)
• SUPLibInternal.h (modified) (3 diffs)
• SUPR3HardenedMain.cpp (modified) (14 diffs)
• win/SUPHardenedVerifyProcess-win.cpp (modified) (4 diffs)
• win/SUPR3HardenedMain-win.cpp (modified) (14 diffs)

trunk/src/VBox/HostDrivers/Support/Makefile.kmk

@@ -363 +363 @@
 endif
 
+SUPR3HardenedMain.cpp_DEFS = VBOX_SVN_REV=$(VBOX_SVN_REV)
+
 
 #

trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h

@@ -89 +89 @@
 # define supR3HardenedErrorV               supR3HardenedStaticErrorV
 # define supR3HardenedError                supR3HardenedStaticError
+# define supR3HardenedOpenLog              supR3HardenedStaticOpenLog
+# define supR3HardenedLogV                 supR3HardenedStaticLogV
+# define supR3HardenedLog                  supR3HardenedStaticLog
 # define supR3HardenedVerifyAll            supR3HardenedStaticVerifyAll
 # define supR3HardenedVerifyFixedDir       supR3HardenedStaticVerifyFixedDir
@@ -131 +134 @@
 
 /** Debug output macro. */
-#ifdef DEBUG_bird
-# ifdef IN_SUP_HARDENED_R3
-#  define SUP_DPRINTF(a)    suplibHardenedPrintF a
+#ifdef IN_SUP_HARDENED_R3
+# if defined(DEBUG_bird) && defined(RT_OS_WINDOWS)
+#  define SUP_DPRINTF(a)    do { supR3HardenedStaticLog a; suplibHardenedPrintF a; } while (0)
 # else
+#  define SUP_DPRINTF(a)    do { supR3HardenedStaticLog a; } while (0)
+# endif
+#else
+# if defined(DEBUG_bird) && defined(RT_OS_WINDOWS)
 #  define SUP_DPRINTF(a)    RTLogPrintf a
+# else
+#  define SUP_DPRINTF(a)    do { } while (0)
 # endif
-#else
-# define SUP_DPRINTF(a)     do { } while (0)
 #endif
 
@@ -401 +408 @@
 DECLHIDDEN(int)     supR3HardenedError(int rc, bool fFatal, const char *pszFormat, ...);
 
+/**
+ * Open any startup log file specified in the argument.
+ */
+DECLHIDDEN(void)    supR3HardenedOpenLog(int *pcArgs, char **papszArgs);
+
+/**
+ * Write to the startup log file.
+ */
+DECLHIDDEN(void)    supR3HardenedLogV(const char *pszFormat, va_list va);
+
+/**
+ * Write to the startup log file.
+ */
+DECLHIDDEN(void)    supR3HardenedLog(const char *pszFormat, ...);
+
+
 DECLHIDDEN(int)     supR3HardenedVerifyAll(bool fFatal, const char *pszProgName);
 DECLHIDDEN(int)     supR3HardenedVerifyFixedDir(SUPINSTDIR enmDir, bool fFatal);

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -78 +78 @@
 #include <VBox/sup.h>
 #include <VBox/err.h>
+#ifdef RT_OS_WINDOWS
+# include <VBox/version.h>
+#endif
 #include <iprt/ctype.h>
 #include <iprt/string.h>
@@ -141 +144 @@
 static uint32_t         g_uCaps;
 # endif
+#endif
+
+/** The startup log file. */
+#ifdef RT_OS_WINDOWS
+static HANDLE           g_hStartupLog = NULL;
+#else
+static int              g_hStartupLog = -1;
 #endif
 
@@ -235 +245 @@
         IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
         NtWriteFile(hStdOut, NULL /*Event*/, NULL /*ApcRoutine*/, NULL /*ApcContext*/,
-                    &Ios, (PVOID)pch, cch, NULL /*ByteOffset*/, NULL /*Key*/);
+                    &Ios, (PVOID)pch, (ULONG)cch, NULL /*ByteOffset*/, NULL /*Key*/);
     }
 #else
@@ -920 +930 @@
 
 
+#ifdef RT_OS_WINDOWS
+extern "C" uint32_t g_uNtVerCombined;
+#endif
+
+DECLHIDDEN(void) supR3HardenedOpenLog(int *pcArgs, char **papszArgs)
+{
+    static const char s_szLogOption[] = "--sup-startup-log=";
+
+    /*
+     * Scan the argument vector.
+     */
+    int cArgs = *pcArgs;
+    for (int iArg = 1; iArg < cArgs; iArg++)
+        if (strncmp(papszArgs[iArg], s_szLogOption, sizeof(s_szLogOption) - 1) == 0)
+        {
+            const char *pszLogFile = &papszArgs[iArg][sizeof(s_szLogOption) - 1];
+
+            /*
+             * Drop the argument from the vector (has trailing NULL entry).
+             */
+            memmove(&papszArgs[iArg], &papszArgs[iArg + 1], (cArgs - iArg) * sizeof(papszArgs[0]));
+            *pcArgs -= 1;
+            cArgs   -= 1;
+
+            /*
+             * Open the log file, unless we've already opened one.
+             * First argument takes precedence
+             */
+#ifdef RT_OS_WINDOWS
+            if (g_hStartupLog == NULL)
+            {
+                PRTUTF16 pwszPath;
+                int rc = RTStrToUtf16(pszLogFile, &pwszPath);
+                if (RT_SUCCESS(rc))
+                {
+                    g_hStartupLog = CreateFileW(pwszPath,
+                                                GENERIC_WRITE,
+                                                FILE_SHARE_READ | FILE_SHARE_WRITE,
+                                                NULL,
+                                                OPEN_ALWAYS,
+                                                FILE_ATTRIBUTE_NORMAL | FILE_FLAG_WRITE_THROUGH,
+                                                NULL);
+                    RTUtf16Free(pwszPath);
+                }
+                SUP_DPRINTF(("Log file opened: " VBOX_VERSION_STRING "r%u g_hStartupLog=%p g_uNtVerCombined=%#x\n",
+                             VBOX_SVN_REV, g_hStartupLog, g_uNtVerCombined));
+            }
+#else
+            //g_hStartupLog = open()
+#endif
+        }
+}
+
+
+DECLHIDDEN(void) supR3HardenedLogV(const char *pszFormat, va_list va)
+{
+#ifdef RT_OS_WINDOWS
+    if (g_hStartupLog)
+    {
+        char szBuf[5120];
+        PCLIENT_ID pSelfId = &((PTEB)NtCurrentTeb())->ClientId;
+        size_t cchPrefix = RTStrPrintf(szBuf, sizeof(szBuf), "%x.%x: ", pSelfId->UniqueProcess, pSelfId->UniqueThread);
+        size_t cch = RTStrPrintfV(&szBuf[cchPrefix], sizeof(szBuf) - cchPrefix, pszFormat, va) + cchPrefix;
+
+        if ((size_t)cch >= sizeof(szBuf))
+            cch = sizeof(szBuf) - 1;
+
+        if (!cch || szBuf[cch - 1] != '\n')
+            szBuf[cch++] = '\n';
+
+        IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
+        LARGE_INTEGER   Offset;
+        Offset.QuadPart = -1; /* Write to end of file. */
+        NtWriteFile(g_hStartupLog, NULL /*Event*/, NULL /*ApcRoutine*/, NULL /*ApcContext*/,
+                    &Ios, szBuf, (ULONG)cch, &Offset, NULL /*Key*/);
+    }
+#else
+    /* later */
+#endif
+}
+
+
+DECLHIDDEN(void) supR3HardenedLog(const char *pszFormat,  ...)
+{
+    va_list va;
+    va_start(va, pszFormat);
+    supR3HardenedLogV(pszFormat, va);
+    va_end(va);
+}
+
+
 /**
  * Prints the message prefix.
@@ -934 +1035 @@
 {
     /*
-     * To the console first, like supR3HardenedFatalV.
+     * First to the log.
+     */
+    supR3HardenedLog("Error %d in %s! (enmWhat=%d)\n", rc, pszWhere, enmWhat);
+    va_list vaCopy;
+    va_copy(vaCopy, va);
+    supR3HardenedLogV(pszMsgFmt, vaCopy);
+    va_end(vaCopy);
+
+    /*
+     * Then to the console.
      */
     suplibHardenedPrintPrefix();
@@ -940 +1050 @@
 
     suplibHardenedPrintPrefix();
-    va_list vaCopy;
     va_copy(vaCopy, va);
     suplibHardenedPrintFV(pszMsgFmt, vaCopy);
@@ -1018 +1127 @@
 DECLHIDDEN(void) supR3HardenedFatalV(const char *pszFormat, va_list va)
 {
+    supR3HardenedLog("Fatal error:\n");
+    va_list vaCopy;
+    va_copy(vaCopy, va);
+    supR3HardenedLogV(pszFormat, vaCopy);
+    va_end(vaCopy);
+
     suplibHardenedPrintPrefix();
     suplibHardenedPrintFV(pszFormat, va);
@@ -1037 +1152 @@
     if (fFatal)
         supR3HardenedFatalV(pszFormat, va);
+
+    supR3HardenedLog("Error (rc=%d):\n", rc);
+    va_list vaCopy;
+    va_copy(vaCopy, va);
+    supR3HardenedLogV(pszFormat, vaCopy);
+    va_end(vaCopy);
 
     suplibHardenedPrintPrefix();
@@ -1052 +1173 @@
     return rc;
 }
+
 
 
@@ -1512 +1634 @@
 DECLHIDDEN(int) SUPR3HardenedMain(const char *pszProgName, uint32_t fFlags, int argc, char **argv, char **envp)
 {
+    SUP_DPRINTF(("SUPR3HardenedMain: pszProgName=%s fFlags=%#x\n", pszProgName, fFlags));
+
     /*
      * Note! At this point there is no IPRT, so we will have to stick
@@ -1556 +1680 @@
         && supR3HardenedWinIsReSpawnNeeded(1 /*iWhich*/, argc, argv))
     {
+        SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
         supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV);
         supR3HardenedVerifyAll(true /* fFatal */, pszProgName);
@@ -1591 +1716 @@
          */
         if (supR3HardenedWinIsReSpawnNeeded(2 /* iWhich*/, argc, argv))
+        {
+            SUP_DPRINTF(("SUPR3HardenedMain: Respawn #2\n"));
             return supR3HardenedWinReSpawn(2 /* iWhich*/);
+        }
+        SUP_DPRINTF(("SUPR3HardenedMain: Final process, opening VBoxDrv...\n"));
 #endif /* RT_OS_WINDOWS */
 
@@ -1624 +1753 @@
      * call RTR3InitEx.
      */
+    SUP_DPRINTF(("SUPR3HardenedMain: Load Runtime...\n"));
     g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_INIT_RUNTIME;
     supR3HardenedMainInitRuntime(fFlags);
@@ -1631 +1761 @@
      * and pass control to it.
      */
+    SUP_DPRINTF(("SUPR3HardenedMain: Load TrustedMain...\n"));
     g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_GET_TRUSTED_MAIN;
     PFNSUPTRUSTEDMAIN pfnTrustedMain = supR3HardenedMainGetTrustedMain(pszProgName);
+
+    SUP_DPRINTF(("SUPR3HardenedMain: Calling TrustedMain (%p)...\n", pfnTrustedMain));
     g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_CALLED_TRUSTED_MAIN;
     return pfnTrustedMain(argc, argv, envp);

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

@@ -998 +998 @@
 static int supHardNtVpScanVirtualMemory(PSUPHNTVPSTATE pThis, HANDLE hProcess)
 {
+    SUP_DPRINTF(("supHardNtVpScanVirtualMemory:\n"));
+
     uint32_t    cXpExceptions = 0;
     uintptr_t   cbAdvance = 0;
@@ -1037 +1039 @@
                                            "NtQueryVirtualMemory/MemorySectionName failed for %p: %#x", uPtrWhere, rcNt);
             pThis->aImages[iImg].Name.UniStr.Buffer[pThis->aImages[iImg].Name.UniStr.Length / sizeof(WCHAR)] = '\0';
+            SUP_DPRINTF((MemInfo.AllocationBase == MemInfo.BaseAddress
+                         ? " *%p-%p %#06x/%#06x %#09x  %ls\n"
+                         : "  %p-%p %#06x/%#06x %#09x  %ls\n",
+                         MemInfo.BaseAddress, (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1, MemInfo.Protect,
+                         MemInfo.AllocationProtect, MemInfo.Type, pThis->aImages[iImg].Name.UniStr.Buffer));
 
             /* New or existing image? */
@@ -1082 +1089 @@
                  /* && MemInfo.BaseAddress == pPeb->ReadOnlySharedMemoryBase */
                  && g_uNtVerCombined < SUP_MAKE_NT_VER_SIMPLE(6, 0) )
+        {
             cXpExceptions++;
+            SUP_DPRINTF(("  %p-%p %#06x/%#06x %#09x  XP CSRSS read-only region\n", MemInfo.BaseAddress,
+                         (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1, MemInfo.Protect,
+                         MemInfo.AllocationProtect, MemInfo.Type));
+        }
         /*
          * Executable memory?
@@ -1106 +1118 @@
         }
 #endif
+        else
+            SUP_DPRINTF((MemInfo.AllocationBase == MemInfo.BaseAddress
+                         ? " *%p-%p %#06x/%#06x %#09x\n"
+                         : "  %p-%p %#06x/%#06x %#09x\n",
+                         MemInfo.BaseAddress, (uintptr_t)MemInfo.BaseAddress - MemInfo.RegionSize - 1,
+                         MemInfo.Protect, MemInfo.AllocationProtect, MemInfo.Type));
 
         /*

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -1543 +1543 @@
     PVOID pvLdrInitThunk      = (PVOID)((uintptr_t)LdrInitializeThunk + pThis->uNtDllAddr - pThis->uNtDllParentAddr);
     PVOID pvNtTerminateThread = (PVOID)((uintptr_t)NtTerminateThread  + pThis->uNtDllAddr - pThis->uNtDllParentAddr);
+    SUP_DPRINTF(("supR3HardNtPuChTriggerInitialImageEvents: pvLdrInitThunk=%p pvNtTerminateThread=%p\n",
+                 pvLdrInitThunk, pvNtTerminateThread));
 
     /*
@@ -1787 +1789 @@
                              "NtQueryVirtualMemory/MemorySectionName failed for %p: %#x", pMemInfo->BaseAddress, rcNt);
     uBuf.UniStr.Buffer[uBuf.UniStr.Length / sizeof(WCHAR)] = '\0';
+    SUP_DPRINTF(("supR3HardNtPuChSanitizeImage: %p '%ls'\n", pMemInfo->BaseAddress, uBuf.UniStr.Buffer));
+
 
     /*
@@ -2042 +2046 @@
                         {
                             pThis->uNtDllAddr = (uintptr_t)MemInfo.AllocationBase;
+                            SUP_DPRINTF(("supR3HardNtPuChFindNtdll: uNtDllParentAddr=%p uNtDllChildAddr=%p\n",
+                                         pThis->uNtDllParentAddr, pThis->uNtDllAddr));
                             return;
                         }
@@ -2094 +2100 @@
     else
         This.cbPeb = PEB_SIZE_W81;
+
+    SUP_DPRINTF(("supR3HardenedWinPurifyChild: PebBaseAddress=%p cbPeb=%#x\n", This.BasicInfo.PebBaseAddress, This.cbPeb));
 
     SIZE_T cbActualMem;
@@ -2189 +2197 @@
                               GetLastError(), pwszCmdLine);
 
+    SUP_DPRINTF(("supR3HardenedWinDoReSpawn(%d): New child %x.%x [kernel32].\n",
+                 iWhich, ProcessInfoW32.dwProcessId, ProcessInfoW32.dwThreadId));
     HANDLE hProcess = ProcessInfoW32.hProcess;
     HANDLE hThread  = ProcessInfoW32.hThread;
@@ -2242 +2252 @@
                               rcNt, CmdLine.Buffer);
 
+    SUP_DPRINTF(("supR3HardenedWinDoReSpawn(%d): New child %x.%x [ntdll].\n",
+                 iWhich, ProcessInfo.ClientId.UniqueProcess, ProcessInfo.ClientId.UniqueThread));
     RtlDestroyProcessParameters(pProcParams);
 
@@ -2247 +2259 @@
     HANDLE hThread  = ProcessInfoNt.ThreadHandle;
 #endif
+
 
     /*
@@ -2288 +2301 @@
     {
         /* Failure is unacceptable, kill the process. */
-        DWORD dwErr = GetLastError();
         NtTerminateProcess(hProcess, RTEXITCODE_FAILURE);
-        supR3HardenedError(dwErr, false /*fFatal*/, "NtDuplicateObject failed on child process handle: %u\n", dwErr);
+        supR3HardenedError(rcNt, false /*fFatal*/, "NtDuplicateObject failed on child process handle: %#x\n", rcNt);
 
         NTSTATUS rcNtExit = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), NULL);
@@ -2314 +2326 @@
                      && GetTickCount() - dwStartTick < 60 * 1000);
             if (fExitOk)
-                supR3HardenedError(dwErr, false /*fFatal*/,
+                supR3HardenedError(rcNt, false /*fFatal*/,
                                    "NtDuplicateObject failed and we failed to kill child: rcNt=%u rcNtWait=%u hProcess=%p\n",
                                    rcNt, rcNtWait, hProcess);
@@ -2387 +2399 @@
      * Proxy the termination code of the child, if it exited already.
      */
-    rcNt = NtQueryInformationProcess(hProcWait, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), NULL);
-    if (   !NT_SUCCESS(rcNt)
+    NTSTATUS rcNt2 = NtQueryInformationProcess(hProcWait, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), NULL);
+    if (   !NT_SUCCESS(rcNt2)
         || BasicInfo.ExitStatus == STATUS_PENDING)
         BasicInfo.ExitStatus = RTEXITCODE_FAILURE;
 
     NtClose(hProcWait);
+    SUP_DPRINTF(("supR3HardenedWinDoReSpawn(%d): Quitting: ExitCode=%#x rcNt=%#x\n", BasicInfo.ExitStatus, rcNt));
     suplibHardenedExit((RTEXITCODE)BasicInfo.ExitStatus);
 }
@@ -2749 +2762 @@
 extern "C" void __stdcall suplibHardenedWindowsMain(void)
 {
-    RTEXITCODE  rcExit = RTEXITCODE_FAILURE;
+    RTEXITCODE rcExit = RTEXITCODE_FAILURE;
 
     g_cSuplibHardenedWindowsMainCalls++;
@@ -2758 +2771 @@
      */
     supR3HardenedWinInitVersion();
+
+    /*
+     * Convert the arguments to UTF-8 and open the log file if specified.
+     * This must be done as early as possible since the code below may fail.
+     */
+    PUNICODE_STRING pCmdLineStr = &NtCurrentPeb()->ProcessParameters->CommandLine;
+    int    cArgs;
+    char **papszArgs = suplibCommandLineToArgvWStub(pCmdLineStr->Buffer, pCmdLineStr->Length / sizeof(WCHAR), &cArgs);
+
+    supR3HardenedOpenLog(&cArgs, papszArgs);
 
     /*
@@ -2790 +2813 @@
 
     /*
-     * Convert the arguments to UTF-8 and call the C/C++ main function.
-     */
-    PUNICODE_STRING pCmdLineStr = &NtCurrentPeb()->ProcessParameters->CommandLine;
-    int             cArgs;
-    char **papszArgs = suplibCommandLineToArgvWStub(pCmdLineStr->Buffer, pCmdLineStr->Length / sizeof(WCHAR), &cArgs);
-
+     * Call the C/C++ main function.
+     */
+    SUP_DPRINTF(("Calling main()\n"));
     rcExit = (RTEXITCODE)main(cArgs, papszArgs, NULL);
 
@@ -2801 +2821 @@
      * Exit the process (never return).
      */
+    SUP_DPRINTF(("Terminating the normal way: rcExit=%d\n", rcExit));
     suplibHardenedExit(rcExit);
 }