Changeset 52387 in vbox for trunk/src/VBox/HostDrivers/Support/win

Timestamp:

Aug 14, 2014 8:06:14 PM (10 years ago)

Author:

vboxsync

Message:

supdrv-win.cpp: debugging aids.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp (modified) (5 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

@@ -2351 +2351 @@
 
 
+#ifdef VBOX_WITHOUT_DEBUGGER_CHECKS
+/**
+ * Checks if the given process is one of the whitelisted debuggers.
+ *
+ * @returns true / false.
+ * @param   pProcess            The process to check.
+ */
+static bool supdrvNtProtectIsWhitelistedDebugger(PEPROCESS pProcess)
+{
+    const char *pszImageFile = (const char *)PsGetProcessImageFileName(pProcess);
+    if (!pszImageFile)
+        return false;
+
+    if (pszImageFile[0] == 'w' || pszImageFile[0] == 'W')
+    {
+        if (RTStrICmp(pszImageFile, "windbg.exe") == 0)
+            return true;
+        if (RTStrICmp(pszImageFile, "werfault.exe") == 0)
+            return true;
+        if (RTStrICmp(pszImageFile, "werfaultsecure.exe") == 0)
+            return true;
+    }
+    else if (pszImageFile[0] == 'd' || pszImageFile[0] == 'D')
+    {
+        if (RTStrICmp(pszImageFile, "drwtsn32.exe") == 0)
+            return true;
+        if (RTStrICmp(pszImageFile, "dwwin.exe") == 0)
+            return true;
+    }
+
+    return false;
+}
+#endif /* VBOX_WITHOUT_DEBUGGER_CHECKS */
+
+
 /** @} */
 
@@ -2743 +2778 @@
                      PsGetProcessImageFileName(PsGetCurrentProcess()) ));
             }
+#ifdef VBOX_WITHOUT_DEBUGGER_CHECKS
+            /* Allow debuggers full access. */
+            else if (supdrvNtProtectIsWhitelistedDebugger(PsGetCurrentProcess()))
+            {
+                pOpInfo->CallContext = NULL; /* don't assert */
+                pNtProtect->fFirstProcessCreateHandle = false;
+
+                Log(("vboxdrv/ProcessHandlePre: ctx=%04zx/%p wants %#x to %p in pid=%04zx [%d] %s [debugger]\n",
+                     PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
+                     pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
+                     pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
+                     PsGetProcessImageFileName(PsGetCurrentProcess()) ));
+            }
+#endif
             else
             {
@@ -2980 +3029 @@
                 pNtProtect->fFirstThreadCreateHandle = false;
             }
+#ifdef VBOX_WITHOUT_DEBUGGER_CHECKS
+            /* Allow debuggers full access. */
+            else if (supdrvNtProtectIsWhitelistedDebugger(PsGetCurrentProcess()))
+            {
+                Log(("vboxdrv/ThreadHandlePre: ctx=%04zx/%p wants %#x to %p in pid=%04zx [%d] %s [debugger]\n",
+                     PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
+                     pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
+                     pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
+                     PsGetProcessImageFileName(PsGetCurrentProcess()) ));
+                pOpInfo->CallContext = NULL; /* don't assert */
+            }
+#endif
             else
             {
@@ -3290 +3351 @@
      */
     int rc = VINF_SUCCESS;
+# ifdef VBOX_WITHOUT_DEBUGGER_CHECKS
+    HANDLE   idLastDebugger = (HANDLE)~(uintptr_t)0;
+# endif
 
     uint32_t cCsrssProcessHandles  = 0;
@@ -3363 +3427 @@
         else
             continue;
+
+# ifdef VBOX_WITHOUT_DEBUGGER_CHECKS
+        /* Ignore whitelisted debuggers. */
+        if (pHandleInfo->UniqueProcessId == idLastDebugger)
+            continue;
+        PEPROCESS pDbgProc;
+        NTSTATUS rcNt = PsLookupProcessByProcessId(pHandleInfo->UniqueProcessId, &pDbgProc);
+        if (NT_SUCCESS(rcNt))
+        {
+            bool fIsDebugger = supdrvNtProtectIsWhitelistedDebugger(pDbgProc);
+            ObDereferenceObject(pDbgProc);
+            if (fIsDebugger)
+            {
+                idLastDebugger = pHandleInfo->UniqueProcessId;
+                continue;
+            }
+        }
+# endif
 
         /* Found evil handle. Currently ignoring on pre-Vista. */