Changeset 52365 in vbox
- Timestamp:
- Aug 13, 2014 6:11:50 AM (11 years ago)
- svn:sync-xref-src-repo-rev:
- 95497
- Location:
- trunk
- Files:
-
- 7 edited
-
include/VBox/err.h (modified) (1 diff)
-
src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h (modified) (2 diffs)
-
src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp (modified) (18 diffs)
-
src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp (modified) (1 diff)
-
src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (10 diffs)
-
src/VBox/HostDrivers/Support/win/import-template-kernel32.h (modified) (1 diff)
-
src/VBox/HostDrivers/Support/win/import-template-ntdll.h (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/include/VBox/err.h
r52205 r52365 2505 2505 /** Process Purification Failure: Unknown memory type of executable memory. */ 2506 2506 #define VERR_SUP_VP_UNKOWN_MEM_TYPE (-5666) 2507 /** The image file is not owned by TrustedInstaller is it should be. */ 2508 #define VERR_SUP_VP_NOT_OWNED_BY_TRUSTED_INSTALLER (-5667) 2507 2509 2508 2510 /** @} */ -
trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h
r52356 r52365 97 97 /** Whether to allow image verification by catalog file. */ 98 98 # define SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION RT_BIT(3) 99 /** The file owner must be TrustedInstaller on Vista+. */ 100 # define SUPHNTVI_F_TRUSTED_INSTALLER_OWNER RT_BIT(4) 99 101 /** Resource image, could be any bitness. */ 100 102 # define SUPHNTVI_F_RESOURCE_IMAGE RT_BIT(30) … … 122 124 extern SUPSYSROOTDIRBUF g_System32NtPath; 123 125 extern SUPSYSROOTDIRBUF g_WinSxSNtPath; 126 #ifdef IN_RING3 127 extern SUPSYSROOTDIRBUF g_ProgramFilesNtPath; 128 extern SUPSYSROOTDIRBUF g_CommonFilesNtPath; 129 # if ARCH_BITS == 64 130 extern SUPSYSROOTDIRBUF g_ProgramFilesX86NtPath; 131 extern SUPSYSROOTDIRBUF g_CommonFilesX86NtPath; 132 # endif 133 #endif 124 134 extern SUPSYSROOTDIRBUF g_SupLibHardenedExeNtPath; 125 135 extern uint32_t g_offSupLibHardenedExeNtName; -
trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp
r52356 r52365 117 117 /** The full \\SystemRoot\\WinSxS path. */ 118 118 SUPSYSROOTDIRBUF g_WinSxSNtPath; 119 #ifdef IN_RING3 120 /** The full 'Program Files' path. */ 121 SUPSYSROOTDIRBUF g_ProgramFilesNtPath; 122 # ifdef RT_ARCH_AMD64 123 /** The full 'Program Files (x86)' path. */ 124 SUPSYSROOTDIRBUF g_ProgramFilesX86NtPath; 125 # endif 126 /** The full 'Common Files' path. */ 127 SUPSYSROOTDIRBUF g_CommonFilesNtPath; 128 # ifdef RT_ARCH_AMD64 129 /** The full 'Common Files (x86)' path. */ 130 SUPSYSROOTDIRBUF g_CommonFilesX86NtPath; 131 # endif 132 #endif /* IN_RING3 */ 133 134 /** The TrustedInstaller SID (Vista+). */ 135 static union 136 { 137 SID Sid; 138 uint8_t abPadding[SECURITY_MAX_SID_SIZE]; 139 } g_TrustedInstallerSid; 119 140 120 141 /** Set after we've retrived other SPC root certificates from the system. */ … … 379 400 380 401 /** 402 * Checks if the file is owned by TrustedInstaller on Vista and later. 403 * 404 * @returns true if owned by TrustedInstaller of pre-Vista, false if not. 405 * 406 * @param hFile The handle to the file. 407 * @param pwszName The name of the file. 408 */ 409 static bool supHardNtViCheckIsOwnedByTrustedInstaller(HANDLE hFile, PCRTUTF16 pwszName) 410 { 411 if (g_uNtVerCombined < SUP_NT_VER_VISTA) 412 return true; 413 414 /* 415 * Get the ownership information. 416 */ 417 union 418 { 419 SECURITY_DESCRIPTOR_RELATIVE Rel; 420 SECURITY_DESCRIPTOR Abs; 421 uint8_t abView[256]; 422 } uBuf; 423 ULONG cbActual; 424 NTSTATUS rcNt = NtQuerySecurityObject(hFile, OWNER_SECURITY_INFORMATION, &uBuf.Abs, sizeof(uBuf), &cbActual); 425 SUP_DPRINTF(("NtQuerySecurityObject: rcNt=%#x on '%ls'\n", rcNt, pwszName)); 426 if (!NT_SUCCESS(rcNt)) 427 { 428 SUP_DPRINTF(("NtQuerySecurityObject failed with rcNt=%#x on '%ls'\n", rcNt, pwszName)); 429 return false; 430 } 431 432 /* 433 * Check the owner. 434 */ 435 PSID pOwner = uBuf.Rel.Control & SE_SELF_RELATIVE ? &uBuf.abView[uBuf.Rel.Owner] : uBuf.Abs.Owner; 436 Assert((uintptr_t)pOwner - (uintptr_t)&uBuf < sizeof(uBuf) - sizeof(SID)); 437 if (RtlEqualSid(pOwner, &g_TrustedInstallerSid)) 438 return true; 439 440 SUP_DPRINTF(("%ls: Owner is not trusted installer (%.*Rhxs)\n", 441 pwszName, ((uint8_t *)pOwner)[1] /*SubAuthorityCount*/ * sizeof(ULONG) + 8, pOwner)); 442 return false; 443 } 444 445 446 /** 381 447 * Simple case insensitive UTF-16 / ASCII path compare. 382 448 * … … 484 550 PCRTUTF16 pwszRight, uint32_t cwcRight, bool fCheckSlash) 485 551 { 486 if (cwcLeft < cwcRight )552 if (cwcLeft < cwcRight || !cwcRight || !pwszRight) 487 553 return false; 488 554 … … 586 652 * @param pwszName The NT name of the DLL/EXE. 587 653 * @param fFlags Flags. 654 * @param hFile The file handle. 588 655 * @param rc The status code.. 589 656 */ 590 static int supHardNtViCheckIfNotSignedOk(RTLDRMOD hLdrMod, PCRTUTF16 pwszName, uint32_t fFlags, int rc)657 static int supHardNtViCheckIfNotSignedOk(RTLDRMOD hLdrMod, PCRTUTF16 pwszName, uint32_t fFlags, HANDLE hFile, int rc) 591 658 { 592 659 if (fFlags & (SUPHNTVI_F_REQUIRE_BUILD_CERT | SUPHNTVI_F_REQUIRE_KERNEL_CODE_SIGNING)) … … 625 692 { 626 693 pwsz = pwszName + cwcOther + 1; 694 695 /* Must be owned by trusted installer. */ 696 if ( !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER) 697 && !supHardNtViCheckIsOwnedByTrustedInstaller(hFile, pwszName)) 698 return rc; 627 699 628 700 /* Core DLLs. */ … … 650 722 651 723 #ifndef IN_RING0 652 # if 0 /* Allow anything below System32 that WinVerifyTrust thinks is fine. */653 /* The ATI drivers load system drivers into the process, allow this,654 but reject anything else from a subdirectory. */655 uint32_t cSlashes = supHardViUtf16PathCountSlashes(pwsz);656 if (cSlashes > 0)657 {658 if ( cSlashes == 1659 && supHardViUtf16PathStartsWithAscii(pwsz, "drivers\\ati")660 && ( supHardViUtf16PathEndsWith(pwsz, ".sys")661 || supHardViUtf16PathEndsWith(pwsz, ".dll") ) )662 return VINF_LDRVI_NOT_SIGNED;663 return rc;664 }665 # endif666 667 724 /* Check that this DLL isn't supposed to be signed on this windows 668 725 version. If it should, it's likely to be a fake. */ 669 726 /** @todo list of signed dlls for various windows versions. */ 670 671 /** @todo check file permissions? TrustedInstaller is supposed to be involved 672 * with all of them. */ 727 SUP_DPRINTF(("supHardNtViCheckIfNotSignedOk: VINF_LDRVI_NOT_SIGNED\n")); 673 728 return VINF_LDRVI_NOT_SIGNED; 674 729 #else 675 730 return rc; 676 #endif 731 #endif /* IN_RING0 */ 677 732 } 678 733 … … 682 737 * 683 738 * Just like with System32 there are potentially a number of DLLs that 684 * could be required from WinSxS. However, so far only comctl32.dll 685 * variations have been required. So, we limit ourselves to explicit 686 * whitelisting of unsigned families of DLLs. 739 * could be required from WinSxS. 687 740 */ 688 741 cwcOther = g_WinSxSNtPath.UniStr.Length / sizeof(WCHAR); … … 697 750 return rc; 698 751 699 # if 0 /* See below */ 700 /* The common controls mess. */ 701 # ifdef RT_ARCH_AMD64 702 if (supHardViUtf16PathStartsWithAscii(pwsz, "amd64_microsoft.windows.common-controls_")) 703 # elif defined(RT_ARCH_X86) 704 if (supHardViUtf16PathStartsWithAscii(pwsz, "x86_microsoft.windows.common-controls_")) 705 # else 706 # error "Unsupported architecture" 707 # endif 708 { 709 if (supHardViUtf16PathEndsWith(pwsz, "\\comctl32.dll")) 710 return VINF_LDRVI_NOT_SIGNED; 711 } 712 # endif 713 714 /* Allow anything slightly microsoftish from WinSxS. W2K3 wanted winhttp.dll early on... */ 715 # ifdef RT_ARCH_AMD64 716 if (supHardViUtf16PathStartsWithAscii(pwsz, "amd64_microsoft.")) 717 # elif defined(RT_ARCH_X86) 718 if (supHardViUtf16PathStartsWithAscii(pwsz, "x86_microsoft.")) 719 # else 720 # error "Unsupported architecture" 721 # endif 722 { 752 if ( (fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER) 753 && supHardNtViCheckIsOwnedByTrustedInstaller(hFile, pwszName)) 723 754 return VINF_LDRVI_NOT_SIGNED; 724 }725 726 755 return rc; 727 756 } 728 #endif 757 #endif /* !IN_RING0 */ 729 758 730 759 #ifdef VBOX_PERMIT_MORE … … 736 765 cwcOther = g_System32NtPath.UniStr.Length / sizeof(WCHAR); /* ASSUMES System32 is called System32. */ 737 766 pwsz = pwszName + cwcOther + 1; 767 768 if ( !(fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER) 769 && !supHardNtViCheckIsOwnedByTrustedInstaller(hFile, pwszName)) 770 return rc; 738 771 739 772 if (supHardViUtf16PathIsEqual(pwsz, "acres.dll")) … … 748 781 # endif 749 782 783 # ifndef IN_RING0 784 return VINF_LDRVI_NOT_SIGNED; 785 # else 750 786 return rc; 751 } 752 #else 753 # error should not be here... 754 #endif 787 # endif 788 } 789 #endif /* VBOX_PERMIT_MORE */ 790 791 #if !defined(IN_RING0) && defined(VBOX_PERMIT_MORE) 792 /* 793 * Program files and common files. 794 * Permit anything that's signed and correctly installed. 795 */ 796 if ( supHardViUtf16PathStartsWithEx(pwszName, cwcName, 797 g_ProgramFilesNtPath.UniStr.Buffer, g_ProgramFilesNtPath.UniStr.Length, 798 true /*fCheckSlash*/) 799 || supHardViUtf16PathStartsWithEx(pwszName, cwcName, 800 g_CommonFilesNtPath.UniStr.Buffer, g_CommonFilesNtPath.UniStr.Length, 801 true /*fCheckSlash*/) 802 # ifdef RT_ARCH_AMD64 803 || supHardViUtf16PathStartsWithEx(pwszName, cwcName, 804 g_ProgramFilesX86NtPath.UniStr.Buffer, g_ProgramFilesX86NtPath.UniStr.Length, 805 true /*fCheckSlash*/) 806 || supHardViUtf16PathStartsWithEx(pwszName, cwcName, 807 g_CommonFilesX86NtPath.UniStr.Buffer, g_CommonFilesX86NtPath.UniStr.Length, 808 true /*fCheckSlash*/) 809 # endif 810 ) 811 { 812 if ( (fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER) 813 && supHardNtViCheckIsOwnedByTrustedInstaller(hFile, pwszName)) 814 return VINF_LDRVI_NOT_SIGNED; 815 return rc; 816 } 817 #endif /* !IN_RING0 && VBOX_PERMIT_MORE*/ 755 818 756 819 return rc; … … 940 1003 941 1004 /* 1005 * Check the trusted installer bit first, if requested as it's somewhat 1006 * cheaper than the rest. 1007 */ 1008 if ( (pNtViRdr->fFlags & SUPHNTVI_F_TRUSTED_INSTALLER_OWNER) 1009 && !supHardNtViCheckIsOwnedByTrustedInstaller(pNtViRdr->hFile, pwszName)) 1010 return RTErrInfoSetF(pErrInfo, VERR_SUP_VP_NOT_OWNED_BY_TRUSTED_INSTALLER, 1011 "supHardenedWinVerifyImageByHandle: TrustedInstaller is not the owner of '%ls'.", pwszName); 1012 1013 /* 942 1014 * Verify it. 943 1015 * … … 976 1048 */ 977 1049 if (rc == VERR_LDRVI_NOT_SIGNED) 978 rc = supHardNtViCheckIfNotSignedOk(hLdrMod, pwszName, pNtViRdr->fFlags, rc);1050 rc = supHardNtViCheckIfNotSignedOk(hLdrMod, pwszName, pNtViRdr->fFlags, pNtViRdr->hFile, rc); 979 1051 if (RT_FAILURE(rc)) 980 1052 RTErrInfoAddF(pErrInfo, rc, ": %ls", pwszName); … … 1307 1379 1308 1380 1381 1382 #ifdef IN_RING3 1383 /** 1384 * Initializes the windows paths. 1385 */ 1386 static void supHardenedWinInitImageVerifierWinPaths(void) 1387 { 1388 /* 1389 * Windows paths that we're interested in. 1390 */ 1391 static const struct 1392 { 1393 SUPSYSROOTDIRBUF *pNtPath; 1394 WCHAR const *pwszRegValue; 1395 const char *pszLogName; 1396 } s_aPaths[] = 1397 { 1398 { &g_ProgramFilesNtPath, L"ProgramFilesDir", "ProgDir" }, 1399 { &g_CommonFilesNtPath, L"CommonFilesDir", "ComDir" }, 1400 # ifdef RT_ARCH_AMD64 1401 { &g_ProgramFilesX86NtPath, L"ProgramFilesDir (x86)", "ProgDir32" }, 1402 { &g_CommonFilesX86NtPath, L"CommonFilesDir (x86)", "ComDir32" }, 1403 # endif 1404 }; 1405 1406 /* 1407 * Open the registry key containing the paths. 1408 */ 1409 UNICODE_STRING NtName = RTNT_CONSTANT_UNISTR(L"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion"); 1410 OBJECT_ATTRIBUTES ObjAttr; 1411 InitializeObjectAttributes(&ObjAttr, &NtName, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); 1412 HANDLE hKey; 1413 NTSTATUS rcNt = NtOpenKey(&hKey, KEY_QUERY_VALUE, &ObjAttr); 1414 if (NT_SUCCESS(rcNt)) 1415 { 1416 /* 1417 * Loop over the paths and resolve their NT paths. 1418 */ 1419 for (uint32_t i = 0; i < RT_ELEMENTS(s_aPaths); i++) 1420 { 1421 /* 1422 * Query the value first. 1423 */ 1424 UNICODE_STRING ValueName; 1425 ValueName.Buffer = (WCHAR *)s_aPaths[i].pwszRegValue; 1426 ValueName.Length = (USHORT)(RTUtf16Len(s_aPaths[i].pwszRegValue) * sizeof(WCHAR)); 1427 ValueName.MaximumLength = ValueName.Length + sizeof(WCHAR); 1428 1429 union 1430 { 1431 KEY_VALUE_PARTIAL_INFORMATION PartialInfo; 1432 uint8_t abPadding[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(WCHAR) * 128]; 1433 uint64_t uAlign; 1434 } uBuf; 1435 1436 ULONG cbActual = 0; 1437 rcNt = NtQueryValueKey(hKey, &ValueName, KeyValuePartialInformation, &uBuf, sizeof(uBuf) - sizeof(WCHAR), &cbActual); 1438 if (NT_SUCCESS(rcNt)) 1439 { 1440 /* 1441 * Must be a simple string value, terminate it. 1442 */ 1443 if ( uBuf.PartialInfo.Type == REG_EXPAND_SZ 1444 || uBuf.PartialInfo.Type == REG_SZ) 1445 { 1446 /* 1447 * Expand any environment variable references before opening it. 1448 * We use the result buffer as storage for the expaneded path, 1449 * reserving space for the windows name space prefix. 1450 */ 1451 UNICODE_STRING Src; 1452 Src.Buffer = (WCHAR *)uBuf.PartialInfo.Data; 1453 Src.Length = uBuf.PartialInfo.DataLength; 1454 if (Src.Length >= sizeof(WCHAR) && Src.Buffer[Src.Length / sizeof(WCHAR) - 1] == '\0') 1455 Src.Length -= sizeof(WCHAR); 1456 Src.MaximumLength = Src.Length + sizeof(WCHAR); 1457 Src.Buffer[uBuf.PartialInfo.DataLength / sizeof(WCHAR)] = '\0'; 1458 1459 s_aPaths[i].pNtPath->awcBuffer[0] = '\\'; 1460 s_aPaths[i].pNtPath->awcBuffer[1] = '?'; 1461 s_aPaths[i].pNtPath->awcBuffer[2] = '?'; 1462 s_aPaths[i].pNtPath->awcBuffer[3] = '\\'; 1463 UNICODE_STRING Dst; 1464 Dst.Buffer = &s_aPaths[i].pNtPath->awcBuffer[4]; 1465 Dst.MaximumLength = sizeof(s_aPaths[i].pNtPath->awcBuffer) - sizeof(WCHAR) * 5; 1466 Dst.Length = Dst.MaximumLength; 1467 1468 if (uBuf.PartialInfo.Type == REG_EXPAND_SZ) 1469 rcNt = RtlExpandEnvironmentStrings_U(NULL, &Src, &Dst, NULL); 1470 else 1471 { 1472 memcpy(Dst.Buffer, Src.Buffer, Src.Length); 1473 Dst.Length = Src.Length; 1474 } 1475 if (NT_SUCCESS(rcNt)) 1476 { 1477 Dst.Buffer[Dst.Length / sizeof(WCHAR)] = '\0'; 1478 1479 /* 1480 * Include the \\??\\ prefix in the result and open the path. 1481 */ 1482 Dst.Buffer -= 4; 1483 Dst.Length += 4 * sizeof(WCHAR); 1484 Dst.MaximumLength += 4 * sizeof(WCHAR); 1485 InitializeObjectAttributes(&ObjAttr, &Dst, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); 1486 HANDLE hFile = INVALID_HANDLE_VALUE; 1487 IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER; 1488 NTSTATUS rcNt = NtCreateFile(&hFile, 1489 FILE_READ_DATA | SYNCHRONIZE, 1490 &ObjAttr, 1491 &Ios, 1492 NULL /* Allocation Size*/, 1493 FILE_ATTRIBUTE_NORMAL, 1494 FILE_SHARE_READ | FILE_SHARE_WRITE, 1495 FILE_OPEN, 1496 FILE_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT 1497 | FILE_SYNCHRONOUS_IO_NONALERT, 1498 NULL /*EaBuffer*/, 1499 0 /*EaLength*/); 1500 if (NT_SUCCESS(rcNt)) 1501 rcNt = Ios.Status; 1502 if (NT_SUCCESS(rcNt)) 1503 { 1504 /* 1505 * Query the real NT name. 1506 */ 1507 ULONG cbIgn; 1508 rcNt = NtQueryObject(hFile, 1509 ObjectNameInformation, 1510 s_aPaths[i].pNtPath, 1511 sizeof(*s_aPaths[i].pNtPath) - sizeof(WCHAR), 1512 &cbIgn); 1513 if (NT_SUCCESS(rcNt)) 1514 { 1515 if (s_aPaths[i].pNtPath->UniStr.Length > 0) 1516 { 1517 /* Make sure it's terminated.*/ 1518 s_aPaths[i].pNtPath->UniStr.Buffer[s_aPaths[i].pNtPath->UniStr.Length / sizeof(WCHAR)] = '\0'; 1519 SUP_DPRINTF(("%s:%*s %ls\n", s_aPaths[i].pszLogName, 9 - strlen(s_aPaths[i].pszLogName), "", 1520 s_aPaths[i].pNtPath->UniStr.Buffer)); 1521 } 1522 else 1523 { 1524 SUP_DPRINTF(("%s: NtQueryObject returned empty string\n", s_aPaths[i].pszLogName)); 1525 rcNt = STATUS_INVALID_PARAMETER; 1526 } 1527 } 1528 else 1529 SUP_DPRINTF(("%s: NtQueryObject failed: %#x\n", s_aPaths[i].pszLogName, rcNt)); 1530 NtClose(hFile); 1531 } 1532 else 1533 SUP_DPRINTF(("%s: NtCreateFile failed: %#x (%ls)\n", 1534 s_aPaths[i].pszLogName, rcNt, Dst.Buffer)); 1535 } 1536 else 1537 SUP_DPRINTF(("%s: RtlExpandEnvironmentStrings_U failed: %#x (%ls)\n", 1538 s_aPaths[i].pszLogName, rcNt, Src.Buffer)); 1539 } 1540 else 1541 { 1542 SUP_DPRINTF(("%s: type mismatch: %#x\n", s_aPaths[i].pszLogName, uBuf.PartialInfo.Type)); 1543 rcNt = STATUS_INVALID_PARAMETER; 1544 } 1545 } 1546 else 1547 SUP_DPRINTF(("%s: NtQueryValueKey failed: %#x\n", s_aPaths[i].pszLogName, rcNt)); 1548 1549 /* Stub the entry on failure. */ 1550 if (!NT_SUCCESS(rcNt)) 1551 { 1552 s_aPaths[i].pNtPath->UniStr.Length = 0; 1553 s_aPaths[i].pNtPath->UniStr.Buffer = NULL; 1554 } 1555 } 1556 NtClose(hKey); 1557 } 1558 else 1559 { 1560 SUP_DPRINTF(("NtOpenKey(%ls) failed: %#x\n", NtName.Buffer, rcNt)); 1561 1562 /* Stub all the entries on failure. */ 1563 for (uint32_t i = 0; i < RT_ELEMENTS(s_aPaths); i++) 1564 { 1565 s_aPaths[i].pNtPath->UniStr.Length = 0; 1566 s_aPaths[i].pNtPath->UniStr.Buffer = NULL; 1567 } 1568 } 1569 } 1570 #endif /* IN_RING3 */ 1571 1572 1309 1573 /** 1310 1574 * This initializes the certificates globals so we don't have to reparse them … … 1326 1590 if (RT_SUCCESS(rc)) 1327 1591 { 1592 SUP_DPRINTF(("System32: %ls\n", g_System32NtPath.UniStr.Buffer)); 1593 SUP_DPRINTF(("WinSxS: %ls\n", g_WinSxSNtPath.UniStr.Buffer)); 1594 #ifdef IN_RING3 1595 supHardenedWinInitImageVerifierWinPaths(); 1596 #endif 1597 1328 1598 /* 1329 1599 * Initialize it, leaving the cleanup to the termination call. … … 1359 1629 1360 1630 if (RT_SUCCESS(rc)) 1361 return VINF_SUCCESS; 1631 { 1632 /* 1633 * Finally initialize known SIDs that we use. 1634 */ 1635 SID_IDENTIFIER_AUTHORITY s_NtAuth = SECURITY_NT_AUTHORITY; 1636 NTSTATUS rcNt = RtlInitializeSid(&g_TrustedInstallerSid, &s_NtAuth, SECURITY_SERVICE_ID_RID_COUNT); 1637 if (NT_SUCCESS(rcNt)) 1638 { 1639 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 0) = SECURITY_SERVICE_ID_BASE_RID; 1640 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 1) = 956008885; 1641 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 2) = 3418522649; 1642 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 3) = 1831038044; 1643 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 4) = 1853292631; 1644 *RtlSubAuthoritySid(&g_TrustedInstallerSid, 5) = 2271478464; 1645 return VINF_SUCCESS; 1646 } 1647 rc = RTErrConvertFromNtStatus(rcNt); 1648 } 1362 1649 supHardenedWinTermImageVerifier(); 1363 1650 } … … 1771 2058 rc = RTErrInfoSetF(pErrInfo, VERR_LDRVI_UNSUPPORTED_ARCH, 1772 2059 "WinVerifyTrust failed with hrc=%Rhrc on '%ls'", hrc, pwszName); 2060 SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrust: WinVerifyTrust failed with %#x (%s) on '%ls'\n", 2061 hrc, pszErrConst, pwszName)); 1773 2062 } 1774 2063 … … 1826 2115 1827 2116 NTSTATUS rcNt = NtCreateFile(&hFile, 1828 FILE_READ_DATA | SYNCHRONIZE,2117 FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, 1829 2118 &ObjAttr, 1830 2119 &Ios, … … 1961 2250 1962 2251 HRESULT hrc = pfnWinVerifyTrust(NULL /*hwnd*/, &s_aPolicies[iPolicy], &TrustData); 1963 SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => %#x; cat=%ls\n", hrc, CatInfo.wszCatalogFile)); 2252 SUP_DPRINTF(("supR3HardNtViCallWinVerifyTrustCatFile: WinVerifyTrust => %#x; cat='%ls'; file='%ls'\n", 2253 hrc, CatInfo.wszCatalogFile, pwszName)); 1964 2254 1965 2255 if (SUCCEEDED(hrc)) -
trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp
r52213 r52365 1535 1535 * for this image. 1536 1536 */ 1537 uint32_t fFlags = pImage->fDll ? 0 : SUPHNTVI_F_REQUIRE_BUILD_CERT; 1537 uint32_t fFlags = pImage->fDll 1538 ? SUPHNTVI_F_TRUSTED_INSTALLER_OWNER | SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION 1539 : SUPHNTVI_F_REQUIRE_BUILD_CERT; 1538 1540 if (pImage->f32bitResourceDll) 1539 1541 fFlags |= SUPHNTVI_F_RESOURCE_IMAGE; -
trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp
r52356 r52365 658 658 { 659 659 supR3HardenedError(VINF_SUCCESS, false, 660 " supR3HardenedMonitor_NtCreateSection: NtQueryObject -> %#x (fImage=%d fExecMap=%d fExecProt=%d)\n",660 "NtCreateSection: NtQueryObject -> %#x (fImage=%d fExecMap=%d fExecProt=%d)\n", 661 661 fImage, fExecMap, fExecProt); 662 662 return rcNt; … … 675 675 if (pCacheHit) 676 676 { 677 SUP_DPRINTF((" supR3HardenedMonitor_NtCreateSection: cache hit (%Rrc) on %ls\n", pCacheHit->rc, pCacheHit->wszPath));677 SUP_DPRINTF(("NtCreateSection: cache hit (%Rrc) on %ls\n", pCacheHit->rc, pCacheHit->wszPath)); 678 678 if (RT_SUCCESS(pCacheHit->rc)) 679 679 return g_pfnNtCreateSectionReal(phSection, fAccess, pObjAttribs, pcbSection, fProtect, fAttribs, hFile); 680 680 supR3HardenedError(VINF_SUCCESS, false, 681 " supR3HardenedMonitor_NtCreateSection: cached rc=%Rrc fImage=%d fExecMap=%d fExecProt=%d %ls\n",681 "NtCreateSection: cached rc=%Rrc fImage=%d fExecMap=%d fExecProt=%d %ls\n", 682 682 pCacheHit->rc, fImage, fExecMap, fExecProt, uBuf.UniStr.Buffer); 683 683 return STATUS_TRUST_FAILURE; … … 686 686 /* 687 687 * On XP the loader might hand us handles with just FILE_EXECUTE and 688 * SYNCRHONIZE, the means reading will fail later on. So, we might 689 * have to reopen the file here in order to validate it - annoying. 688 * SYNCHRONIZE, the means reading will fail later on. Also, we need 689 * READ_CONTROL access to check the file ownership later on, and non 690 * of the OS versions seems be giving us that. So, in effect we 691 * more or less always reopen the file here. 690 692 */ 691 693 HANDLE hMyFile = NULL; 692 694 rcNt = NtDuplicateObject(NtCurrentProcess(), hFile, NtCurrentProcess(), 693 695 &hMyFile, 694 FILE_READ_DATA | SYNCHRONIZE,696 FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, 695 697 0 /* Handle attributes*/, 0 /* Options */); 696 698 if (!NT_SUCCESS(rcNt)) … … 698 700 if (rcNt == STATUS_ACCESS_DENIED) 699 701 { 700 HANDLE hFile = RTNT_INVALID_HANDLE_VALUE;701 702 IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER; 702 703 703 OBJECT_ATTRIBUTES ObjAttr; 704 704 InitializeObjectAttributes(&ObjAttr, &uBuf.UniStr, OBJ_CASE_INSENSITIVE, NULL /*hRootDir*/, NULL /*pSecDesc*/); 705 705 706 706 rcNt = NtCreateFile(&hMyFile, 707 FILE_READ_DATA | SYNCHRONIZE,707 FILE_READ_DATA | READ_CONTROL | SYNCHRONIZE, 708 708 &ObjAttr, 709 709 &Ios, … … 712 712 FILE_SHARE_READ, 713 713 FILE_OPEN, 714 FILE_NON_DIRECTORY_FILE ,714 FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT, 715 715 NULL /*EaBuffer*/, 716 716 0 /*EaLength*/); … … 720 720 { 721 721 supR3HardenedError(VINF_SUCCESS, false, 722 " supR3HardenedMonitor_NtCreateSection: Failed to duplicate and open the file: rcNt=%#x hFile=%p %ls\n",722 "NtCreateSection: Failed to duplicate and open the file: rcNt=%#x hFile=%p %ls\n", 723 723 rcNt, hFile, uBuf.UniStr.Buffer); 724 724 return rcNt; 725 } 726 727 /* Check that we've got the same file. */ 728 LARGE_INTEGER idMyFile, idInFile; 729 bool fMyValid = supR3HardenedWinVerifyCacheGetIndexNumber(hMyFile, &idMyFile); 730 bool fInValid = supR3HardenedWinVerifyCacheGetIndexNumber(hFile, &idInFile); 731 if ( fMyValid 732 && ( fMyValid != fInValid 733 || idMyFile.QuadPart != idInFile.QuadPart)) 734 { 735 supR3HardenedError(VINF_SUCCESS, false, 736 "NtCreateSection: Re-opened has different ID that input: %#llx vx %#llx (%ls)\n", 737 rcNt, idMyFile.QuadPart, idInFile.QuadPart, uBuf.UniStr.Buffer); 738 NtClose(hMyFile); 739 return STATUS_TRUST_FAILURE; 725 740 } 726 741 } 727 742 else 728 743 { 744 SUP_DPRINTF(("supR3HardenedMonitor_NtCreateSection: NtDuplicateObject -> %#x\n", rcNt)); 729 745 #ifdef DEBUG 730 746 … … 757 773 fProtect = (fProtect & ~PAGE_EXECUTE) | PAGE_READONLY; 758 774 fProtect = (fProtect & ~UINT32_C(0xf0)) | ((fProtect & UINT32_C(0xe0)) >> 4); 775 if (hMyFile != hFile) 776 NtClose(hMyFile); 759 777 return g_pfnNtCreateSectionReal(phSection, fAccess, pObjAttribs, pcbSection, fProtect, fAttribs, hFile); 760 778 } … … 763 781 /* 764 782 * Check the path. We don't allow DLLs to be loaded from just anywhere: 765 * 1. System32 - normal code or cat signing. 766 * 2. WinSxS - normal code or cat signing. 767 * 3. VirtualBox - kernel code signing and integrity checks. 783 * 1. System32 - normal code or cat signing, owner TrustedInstaller. 784 * 2. WinSxS - normal code or cat signing, owner TrustedInstaller. 785 * 3. VirtualBox - kernel code signing and integrity checks. 786 * 4. AppPatchDir - normal code or cat signing, owner TrustedInstaller. 787 * 5. Program Files - normal code or cat signing, owner TrustedInstaller. 788 * 6. Common Files - normal code or cat signing, owner TrustedInstaller. 789 * 7. x86 variations of 4 & 5 - ditto. 768 790 */ 769 791 bool fSystem32 = false; … … 773 795 { 774 796 fSystem32 = true; 775 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION ;797 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 776 798 } 777 799 else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_WinSxSNtPath.UniStr, true /*fCheckSlash*/)) 778 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION ;800 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 779 801 else if (supHardViUtf16PathStartsWithEx(uBuf.UniStr.Buffer, uBuf.UniStr.Length / sizeof(WCHAR), 780 802 g_SupLibHardenedExeNtPath.UniStr.Buffer, … … 783 805 #ifdef VBOX_PERMIT_MORE 784 806 else if (supHardViIsAppPatchDir(uBuf.UniStr.Buffer, uBuf.UniStr.Length / sizeof(WCHAR))) 785 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION; 807 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 808 else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_ProgramFilesNtPath.UniStr, true /*fCheckSlash*/)) 809 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 810 else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_CommonFilesNtPath.UniStr, true /*fCheckSlash*/)) 811 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 812 # ifdef RT_ARCH_AMD64 813 else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_ProgramFilesX86NtPath.UniStr, true /*fCheckSlash*/)) 814 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 815 else if (supHardViUniStrPathStartsWithUniStr(&uBuf.UniStr, &g_CommonFilesX86NtPath.UniStr, true /*fCheckSlash*/)) 816 fFlags |= SUPHNTVI_F_ALLOW_CAT_FILE_VERIFICATION | SUPHNTVI_F_TRUSTED_INSTALLER_OWNER; 817 # endif 786 818 #endif 787 819 #ifdef VBOX_PERMIT_VISUAL_STUDIO_PROFILING -
trunk/src/VBox/HostDrivers/Support/win/import-template-kernel32.h
r52356 r52365 1 SUPHARNT_IMPORT_STDCALL(CloseHandle, 4) 2 SUPHARNT_IMPORT_STDCALL(CreateFileW, 28) 3 SUPHARNT_IMPORT_STDCALL(CreateProcessW, 40) 4 SUPHARNT_IMPORT_STDCALL(ExitProcess, 4) 5 SUPHARNT_IMPORT_STDCALL(GetCurrentThreadId, 0) 6 SUPHARNT_IMPORT_STDCALL(GetFullPathNameA, 16) 1 7 SUPHARNT_IMPORT_STDCALL(GetLastError, 0) 2 SUPHARNT_IMPORT_STDCALL(GetFullPathNameA, 16) 3 SUPHARNT_IMPORT_STDCALL(CloseHandle, 4) 8 SUPHARNT_IMPORT_STDCALL(GetModuleFileNameW, 12) 9 SUPHARNT_IMPORT_STDCALL(GetModuleHandleA, 4) 10 SUPHARNT_IMPORT_STDCALL(GetModuleHandleW, 4) 11 SUPHARNT_IMPORT_STDCALL(GetProcAddress, 8) 12 SUPHARNT_IMPORT_STDCALL(GetProcessHeap, 0) 13 SUPHARNT_IMPORT_STDCALL(GetTickCount, 0) 14 SUPHARNT_IMPORT_STDCALL(HeapAlloc, 12) 15 SUPHARNT_IMPORT_STDCALL(HeapFree, 8) 16 SUPHARNT_IMPORT_STDCALL(HeapReAlloc, 16) 17 SUPHARNT_IMPORT_STDCALL(LoadLibraryExW, 12) 18 SUPHARNT_IMPORT_STDCALL(OutputDebugStringA, 4) 19 SUPHARNT_IMPORT_STDCALL(Sleep, 4) 20 SUPHARNT_IMPORT_STDCALL(VirtualProtectEx, 20) 4 21 SUPHARNT_IMPORT_STDCALL(WriteFile, 20) 5 SUPHARNT_IMPORT_STDCALL(OutputDebugStringA, 4)6 SUPHARNT_IMPORT_STDCALL(ExitProcess, 4)7 SUPHARNT_IMPORT_STDCALL(GetModuleHandleA, 4)8 SUPHARNT_IMPORT_STDCALL(GetModuleFileNameW, 12)9 SUPHARNT_IMPORT_STDCALL(CreateFileW, 28)10 SUPHARNT_IMPORT_STDCALL(Sleep, 4)11 SUPHARNT_IMPORT_STDCALL(CreateProcessW, 40)12 SUPHARNT_IMPORT_STDCALL(GetTickCount, 0)13 SUPHARNT_IMPORT_STDCALL(GetModuleHandleW, 4)14 SUPHARNT_IMPORT_STDCALL(HeapAlloc, 12)15 SUPHARNT_IMPORT_STDCALL(GetProcessHeap, 0)16 SUPHARNT_IMPORT_STDCALL(HeapReAlloc, 16)17 SUPHARNT_IMPORT_STDCALL(HeapFree, 8)18 SUPHARNT_IMPORT_STDCALL(LoadLibraryExW, 12)19 SUPHARNT_IMPORT_STDCALL(VirtualProtectEx, 20)20 SUPHARNT_IMPORT_STDCALL(GetProcAddress, 8)21 -
trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h
r52356 r52365 9 9 SUPHARNT_IMPORT_SYSCALL(NtMapViewOfSection, 40) 10 10 SUPHARNT_IMPORT_SYSCALL(NtOpenDirectoryObject, 12) 11 SUPHARNT_IMPORT_SYSCALL(NtOpenKey, 12) 11 12 SUPHARNT_IMPORT_SYSCALL(NtOpenProcess, 16) 12 13 SUPHARNT_IMPORT_SYSCALL(NtOpenProcessToken, 12) … … 21 22 SUPHARNT_IMPORT_SYSCALL(NtQueryInformationToken, 20) 22 23 SUPHARNT_IMPORT_SYSCALL(NtQueryObject, 20) 24 SUPHARNT_IMPORT_SYSCALL(NtQuerySecurityObject, 20) 23 25 SUPHARNT_IMPORT_SYSCALL(NtQueryTimerResolution, 12) 26 SUPHARNT_IMPORT_SYSCALL(NtQueryValueKey, 24) 24 27 SUPHARNT_IMPORT_SYSCALL(NtQueryVirtualMemory, 24) 25 28 SUPHARNT_IMPORT_SYSCALL(NtReadFile, 36) … … 57 60 SUPHARNT_IMPORT_STDCALL(RtlCreateUserThread, 40) 58 61 SUPHARNT_IMPORT_STDCALL(RtlDestroyProcessParameters, 4) 62 SUPHARNT_IMPORT_STDCALL(RtlEqualSid, 8) 63 SUPHARNT_IMPORT_STDCALL(RtlExpandEnvironmentStrings_U, 16) 59 64 SUPHARNT_IMPORT_STDCALL(RtlGetVersion, 4) 60 65 SUPHARNT_IMPORT_STDCALL(RtlInitializeSid, 12)
Note:
See TracChangeset
for help on using the changeset viewer.
