Changeset 52205 in vbox

Timestamp:

Jul 26, 2014 11:58:18 AM (11 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

95265

Message:

VBox/err.h: four VERR_SUP_VP_* status codes for the latest SUP changes.

Location:

trunk

Files:

• include/VBox/err.h (modified) (1 diff)
• src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp (modified) (4 diffs)

trunk/include/VBox/err.h

@@ -2493 +2493 @@
  * http://www.symantec.com/connect/articles/creating-application-control-exclusions-symantec-endpoint-protection-121 */
 #define VERR_SUP_VP_SYSFER_DLL                      (-5662)
-
+/** Process Purification Failure: KERNE32.DLL already mapped into the initial
+ *  process (suspended). */
+#define VERR_SUP_VP_KERNEL32_ALREADY_MAPPED         (-5663)
+/** Process Purification Failure: NtFreeVirtualMemory failed on a chunk of
+ *  executable memory which shouldn't be present in the process. */
+#define VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED      (-5664)
+/** Process Purification Failure: Both NtUnmapViewOfSetion and
+ *  NtProtectVirtualMemory failed to get rid of or passify an non-image
+ *  exectuable mapping. */
+#define VERR_SUP_VP_UNMAP_AND_PROTECT_FAILED        (-5665)
+/** Process Purification Failure: Unknown memory type of executable memory.   */
+#define VERR_SUP_VP_UNKOWN_MEM_TYPE                 (-5666)
 
 /** @} */

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

@@ -1266 +1266 @@
                     rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
                     if (!NT_SUCCESS(rcNt))
-                        supHardNtVpSetInfo2(pThis, VERR_GENERAL_FAILURE,
+                        supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
                                             "NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
                                             MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
@@ -1286 +1286 @@
                             rcNt2 = NtProtectVirtualMemory(pThis->hProcess, &pvCopy, &cbCopy, PAGE_READONLY, NULL);
                         if (!NT_SUCCESS(rcNt2))
-                            supHardNtVpSetInfo2(pThis, VERR_GENERAL_FAILURE,
+                            supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNMAP_AND_PROTECT_FAILED,
                                                 "NtUnmapViewOfSection (%p/%p LB %#zx) failed: %#x (%#x)",
                                                 MemInfo.AllocationBase, MemInfo.BaseAddress, MemInfo.RegionSize, rcNt, rcNt2);
@@ -1292 +1292 @@
                 }
                 else
-                    supHardNtVpSetInfo2(pThis, VERR_GENERAL_FAILURE,
+                    supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNKOWN_MEM_TYPE,
                                         "Unknown executable memory type %#x at %p/%p LB %#zx",
                                         MemInfo.Type, MemInfo.AllocationBase, MemInfo.BaseAddress, MemInfo.RegionSize);
@@ -1559 +1559 @@
                                    "The process has no KERNEL32.DLL.");
     else if (iKernel32 != UINT32_MAX && pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION)
-        return supHardNtVpSetInfo2(pThis, VERR_GENERAL_FAILURE,
+        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_KERNEL32_ALREADY_MAPPED,
                                    "The process already has KERNEL32.DLL loaded.");