Changeset 52656 in vbox

Timestamp:

Sep 9, 2014 2:06:16 PM (10 years ago)

Author:

vboxsync

Message:

SUP: Fixed for SEP issue where it would deadlock when we tried mapping the executable into the child process. Since it's hopefully not essential for any of the other anti-products tweaks, I've decided to disable that hack. the 2nd ntdll.dll mapping has been left in.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -3191 +3191 @@
     if (pvBase)
     {
+        /*SUP_DPRINTF(("supR3HardNtPuChUnmapDllFromChild: Calling NtUnmapViewOfSection on %p / %s\n", pvBase, pszShort));*/
         NTSTATUS rcNt = NtUnmapViewOfSection(pThis->hProcess, pvBase);
         if (!NT_SUCCESS(!rcNt))
@@ -3237 +3238 @@
         {
             SIZE_T cbView = 0;
+            SUP_DPRINTF(("supR3HardNtPuChTriggerInitialImageEvents: mapping view of %s\n", pszShort)); /* For SEP. */
             rcNt = NtMapViewOfSection(hSection, pThis->hProcess, &pvRet, 0 /*ZeroBits*/, 0 /*CommitSize*/,
                                       NULL /*pOffSect*/, &cbView, ViewShare, 0 /*AllocationType*/, PAGE_READWRITE);
@@ -3312 +3314 @@
      * a 2nd time into the process before we actually start executing the thread
      * and trigger the genuine image load events.
-     */
+     *
+     * Update: Turns out Symantec Endpoint Protection deadlocks when we map the
+     *         executable into the process like this.  The system only works
+     *         halfways after that Powerbutton, impossible to shutdown without
+     *         using the power or reset button. The order of the two mappings
+     *         below doesn't matter. Haven't had time to look at stack yet.
+     *         Observed on W7/64, SEP v12.1.4112.4156.
+     *
+     */
+#if 0
     PVOID pvExe2 = supR3HardNtPuChMapDllIntoChild(pThis, &g_SupLibHardenedExeNtPath.UniStr, "executable[2nd]");
-
+#else
+    PVOID pvExe2 = NULL;
+#endif
     UNICODE_STRING NtName1 = RTNT_CONSTANT_UNISTR(L"\\SystemRoot\\System32\\ntdll.dll");
     PVOID pvNtDll2 = supR3HardNtPuChMapDllIntoChild(pThis, &NtName1, "ntdll.dll[2nd]");