Changeset 52528 in vbox for trunk/src/VBox/HostDrivers/Support/win

Timestamp:

Aug 29, 2014 9:55:38 AM (10 years ago)

Author:

vboxsync

Message:

SUP: Try reduce the number of error messages about the same DLL.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (10 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -137 +137 @@
     /** The verification result. */
     int                     rc;
+    /** Used for shutting up errors after a while. */
+    uint32_t volatile       cErrorHits;
     /** The validation flags (for WinVerifyTrust retry). */
     uint32_t                fFlags;
@@ -231 +233 @@
 *******************************************************************************/
 static NTSTATUS supR3HardenedScreenImage(HANDLE hFile, bool fImage, PULONG pfAccess, PULONG pfProtect,
-                                         bool *pfCallRealApi, const char *pszCaller, bool fAvoidWinVerifyTrust);
+                                         bool *pfCallRealApi, const char *pszCaller, bool fAvoidWinVerifyTrust,
+                                         bool *pfQuietFailure);
 
 #ifdef RT_ARCH_AMD64
@@ -514 +517 @@
         pEntry->pNextTodoWvt    = NULL;
         pEntry->hFile           = hFile;
+        pEntry->uHash           = supR3HardenedWinVerifyCacheHashPath(pUniStr);
         pEntry->rc              = rc;
-        pEntry->uHash           = supR3HardenedWinVerifyCacheHashPath(pUniStr);
         pEntry->fFlags          = fFlags;
+        pEntry->cErrorHits      = 0;
         pEntry->fWinVerifyTrust = fWinVerifyTrust;
         pEntry->cbPath          = pUniStr->Length;
@@ -874 +878 @@
                     bool  fCallRealApi = false;
                     rcNt = supR3HardenedScreenImage(hFile, true /*fImage*/, &fAccess, &fProtect, &fCallRealApi,
-                                                    "Imports", false /*fAvoidWinVerifyTrust*/);
+                                                    "Imports", false /*fAvoidWinVerifyTrust*/, NULL /*pfQuietFailure*/);
                     NtClose(hFile);
                 }
@@ -1097 +1101 @@
 
 static NTSTATUS supR3HardenedScreenImage(HANDLE hFile, bool fImage, PULONG pfAccess, PULONG pfProtect,
-                                         bool *pfCallRealApi, const char *pszCaller, bool fAvoidWinVerifyTrust)
+                                         bool *pfCallRealApi, const char *pszCaller, bool fAvoidWinVerifyTrust,
+                                         bool *pfQuietFailure)
 {
     *pfCallRealApi = false;
+    if (pfQuietFailure)
+        *pfQuietFailure = false;
 
     /*
@@ -1161 +1168 @@
                              pszCaller, pCacheHit->rc, pCacheHit->wszPath));
         }
-        else
+        else if (pCacheHit->cErrorHits < 16)
             SUP_DPRINTF(("supR3HardenedScreenImage/%s: cache hit (%Rrc) on %ls%s\n",
                          pszCaller, pCacheHit->rc, pCacheHit->wszPath, pCacheHit->fWinVerifyTrust ? "" : " [lacks WinVerifyTrust]"));
@@ -1171 +1178 @@
             return STATUS_SUCCESS;
         }
-        supR3HardenedError(VINF_SUCCESS, false,
-                           "supR3HardenedScreenImage/%s: cached rc=%Rrc fImage=%d fProtect=%#x fAccess=%#x %ls\n",
-                           pszCaller, pCacheHit->rc, fImage, *pfProtect, *pfAccess, uBuf.UniStr.Buffer);
+
+        uint32_t cErrorHits = ASMAtomicIncU32(&pCacheHit->cErrorHits);
+        if (   cErrorHits < 8
+            || RT_IS_POWER_OF_TWO(cErrorHits))
+            supR3HardenedError(VINF_SUCCESS, false,
+                               "supR3HardenedScreenImage/%s: cached rc=%Rrc fImage=%d fProtect=%#x fAccess=%#x cErrorHits=%u %ls\n",
+                               pszCaller, pCacheHit->rc, fImage, *pfProtect, *pfAccess, cErrorHits, uBuf.UniStr.Buffer);
+        else if (pfQuietFailure)
+            *pfQuietFailure = true;
+
         return STATUS_TRUST_FAILURE;
     }
@@ -1421 +1435 @@
     bool  fCallRealApi;
     //SUP_DPRINTF(("supR3HardenedWinVerifyCachePreload: scanning %ls\n", pwszName));
-    supR3HardenedScreenImage(hFile, false, &fAccess, &fProtect, &fCallRealApi, "preload", false /*fAvoidWinVerifyTrust*/);
+    supR3HardenedScreenImage(hFile, false, &fAccess, &fProtect, &fCallRealApi, "preload", false /*fAvoidWinVerifyTrust*/,
+                             NULL /*pfQuietFailure*/);
     //SUP_DPRINTF(("supR3HardenedWinVerifyCachePreload: done %ls\n", pwszName));
 
@@ -1459 +1474 @@
             //SUP_DPRINTF(("supR3HardenedMonitor_NtCreateSection: 1\n"));
             NTSTATUS rcNt = supR3HardenedScreenImage(hFile, fImage, &fAccess, &fProtect, &fCallRealApi,
-                                                     "NtCreateSection", true /*fAvoidWinVerifyTrust*/);
+                                                     "NtCreateSection", true /*fAvoidWinVerifyTrust*/, NULL /*pfQuietFailure*/);
             //SUP_DPRINTF(("supR3HardenedMonitor_NtCreateSection: 2 rcNt=%#x fCallRealApi=%#x\n", rcNt, fCallRealApi));
 
@@ -1653 +1668 @@
             ULONG fProtect = 0;
             bool  fCallRealApi = false;
+            bool  fQuietFailure = false;
             rcNt = supR3HardenedScreenImage(hFile, true /*fImage*/, &fAccess, &fProtect, &fCallRealApi,
-                                            "LdrLoadDll", false /*fAvoidWinVerifyTrust*/);
+                                            "LdrLoadDll", false /*fAvoidWinVerifyTrust*/, &fQuietFailure);
             NtClose(hFile);
             if (!NT_SUCCESS(rcNt))
             {
-                supR3HardenedError(VINF_SUCCESS, false, "supR3HardenedMonitor_LdrLoadDll: rejecting '%ls': rcNt=%#x\n", wszPath, rcNt);
-                SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x '%ls'\n", rcNt, wszPath));
+                if (!fQuietFailure)
+                {
+                    supR3HardenedError(VINF_SUCCESS, false, "supR3HardenedMonitor_LdrLoadDll: rejecting '%ls': rcNt=%#x\n",
+                                       wszPath, rcNt);
+                    SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x '%ls'\n", rcNt, wszPath));
+                }
                 return rcNt;
             }