VirtualBox

Ignore:
Timestamp:
Sep 19, 2014 3:02:04 PM (10 years ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
96187
Message:

SUP: Deal with comodo's ntdll export and getprocaddress modifications. Fixed bug in supHardNtLdrCacheOpen.

Location:
trunk/src/VBox/HostDrivers/Support
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h

    r52632 r52795  
    437437DECLHIDDEN(void)    supR3HardenedWinInitVersion(void);
    438438DECLHIDDEN(void)    supR3HardenedWinInitImports(void);
     439DECLHIDDEN(PFNRT)   supR3HardenedWinGetRealDllSymbol(const char *pszDll, const char *pszProcedure);
    439440DECLHIDDEN(void)    supR3HardenedWinVerifyProcess(void);
    440441DECLHIDDEN(void)    supR3HardenedWinEnableThreadCreation(void);

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

    r52690 r52795  
    21612161        switch (hrc)
    21622162        {
    2163             case TRUST_E_SYSTEM_ERROR:             pszErrConst = "TRUST_E_SYSTEM_ERROR";          break;
    2164             case TRUST_E_NO_SIGNER_CERT:           pszErrConst = "TRUST_E_NO_SIGNER_CERT";        break;
    2165             case TRUST_E_COUNTER_SIGNER:           pszErrConst = "TRUST_E_COUNTER_SIGNER";        break;
    2166             case TRUST_E_CERT_SIGNATURE:           pszErrConst = "TRUST_E_CERT_SIGNATURE";        break;
    2167             case TRUST_E_TIME_STAMP:               pszErrConst = "TRUST_E_TIME_STAMP";            break;
    2168             case TRUST_E_BAD_DIGEST:               pszErrConst = "TRUST_E_BAD_DIGEST";            break;
    2169             case TRUST_E_BASIC_CONSTRAINTS:        pszErrConst = "TRUST_E_BASIC_CONSTRAINTS";     break;
    2170             case TRUST_E_FINANCIAL_CRITERIA:       pszErrConst = "TRUST_E_FINANCIAL_CRITERIA";    break;
    2171             case TRUST_E_PROVIDER_UNKNOWN:         pszErrConst = "TRUST_E_PROVIDER_UNKNOWN";      break;
    2172             case TRUST_E_ACTION_UNKNOWN:           pszErrConst = "TRUST_E_ACTION_UNKNOWN";        break;
    2173             case TRUST_E_SUBJECT_FORM_UNKNOWN:     pszErrConst = "TRUST_E_SUBJECT_FORM_UNKNOWN";  break;
    2174             case TRUST_E_SUBJECT_NOT_TRUSTED:      pszErrConst = "TRUST_E_SUBJECT_NOT_TRUSTED";   break;
    2175             case TRUST_E_NOSIGNATURE:              pszErrConst = "TRUST_E_NOSIGNATURE";           break;
    2176             case TRUST_E_FAIL:                     pszErrConst = "TRUST_E_FAIL";                  break;
    2177             case TRUST_E_EXPLICIT_DISTRUST:        pszErrConst = "TRUST_E_EXPLICIT_DISTRUST";     break;
    2178             case CERT_E_CHAINING:                  pszErrConst = "CERT_E_CHAINING";               break;
    2179             case CERT_E_REVOCATION_FAILURE:        pszErrConst = "CERT_E_REVOCATION_FAILURE";     break;
     2163            case TRUST_E_SYSTEM_ERROR:            pszErrConst = "TRUST_E_SYSTEM_ERROR";         break;
     2164            case TRUST_E_NO_SIGNER_CERT:          pszErrConst = "TRUST_E_NO_SIGNER_CERT";       break;
     2165            case TRUST_E_COUNTER_SIGNER:          pszErrConst = "TRUST_E_COUNTER_SIGNER";       break;
     2166            case TRUST_E_CERT_SIGNATURE:          pszErrConst = "TRUST_E_CERT_SIGNATURE";       break;
     2167            case TRUST_E_TIME_STAMP:              pszErrConst = "TRUST_E_TIME_STAMP";           break;
     2168            case TRUST_E_BAD_DIGEST:              pszErrConst = "TRUST_E_BAD_DIGEST";           break;
     2169            case TRUST_E_BASIC_CONSTRAINTS:       pszErrConst = "TRUST_E_BASIC_CONSTRAINTS";    break;
     2170            case TRUST_E_FINANCIAL_CRITERIA:      pszErrConst = "TRUST_E_FINANCIAL_CRITERIA";   break;
     2171            case TRUST_E_PROVIDER_UNKNOWN:        pszErrConst = "TRUST_E_PROVIDER_UNKNOWN";     break;
     2172            case TRUST_E_ACTION_UNKNOWN:          pszErrConst = "TRUST_E_ACTION_UNKNOWN";       break;
     2173            case TRUST_E_SUBJECT_FORM_UNKNOWN:    pszErrConst = "TRUST_E_SUBJECT_FORM_UNKNOWN"; break;
     2174            case TRUST_E_SUBJECT_NOT_TRUSTED:     pszErrConst = "TRUST_E_SUBJECT_NOT_TRUSTED";  break;
     2175            case TRUST_E_NOSIGNATURE:             pszErrConst = "TRUST_E_NOSIGNATURE";          break;
     2176            case TRUST_E_FAIL:                    pszErrConst = "TRUST_E_FAIL";                 break;
     2177            case TRUST_E_EXPLICIT_DISTRUST:       pszErrConst = "TRUST_E_EXPLICIT_DISTRUST";    break;
     2178            case CERT_E_CHAINING:                 pszErrConst = "CERT_E_CHAINING";              break;
     2179            case CERT_E_REVOCATION_FAILURE:       pszErrConst = "CERT_E_REVOCATION_FAILURE";    break;
     2180            case CRYPT_E_FILE_ERROR:              pszErrConst = "CRYPT_E_FILE_ERROR";           break;
     2181            case CRYPT_E_REVOKED:                 pszErrConst = "CRYPT_E_REVOKED";              break;
    21802182        }
    21812183        if (pszErrConst)

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

    r52634 r52795  
    17871787     */
    17881788    uint32_t i = 0;
    1789     while (i < RT_ELEMENTS(g_apszSupNtVpAllowedDlls))
    1790         if (!strcmp(pszName, g_apszSupNtVpAllowedDlls[i]))
    1791             break;
     1789    while (   i < RT_ELEMENTS(g_apszSupNtVpAllowedDlls)
     1790           && strcmp(pszName, g_apszSupNtVpAllowedDlls[i]))
     1791        i++;
    17921792    if (i >= RT_ELEMENTS(g_apszSupNtVpAllowedDlls))
    17931793        return VERR_FILE_NOT_FOUND;

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

    r52744 r52795  
    253253/** Microsoft Security Essentials. */
    254254#define SUPHARDNT_ADVERSARY_MSE                     RT_BIT_32(9)
     255/** Comodo. */
     256#define SUPHARDNT_ADVERSARY_COMODO                  RT_BIT_32(10)
    255257/** Unknown adversary detected while waiting on child. */
    256258#define SUPHARDNT_ADVERSARY_UNKNOWN                 RT_BIT_32(31)
    … …  
    22072209     * Locate the routines first so we can allocate memory that's near enough.
    22082210     */
    2209     HMODULE hmodNtDll = GetModuleHandleW(L"NTDLL");
    2210     SUPR3HARDENED_ASSERT(hmodNtDll != NULL);
    2211 
    2212     FARPROC pfnNtCreateSection = GetProcAddress(hmodNtDll, "NtCreateSection");
     2211    PFNRT pfnNtCreateSection = supR3HardenedWinGetRealDllSymbol("ntdll.dll", "NtCreateSection");
    22132212    SUPR3HARDENED_ASSERT(pfnNtCreateSection != NULL);
    22142213    //SUPR3HARDENED_ASSERT(pfnNtCreateSection == (FARPROC)NtCreateSection);
    22152214
    2216     FARPROC pfnLdrLoadDll = GetProcAddress(hmodNtDll, "LdrLoadDll");
     2215    PFNRT pfnLdrLoadDll = supR3HardenedWinGetRealDllSymbol("ntdll.dll", "LdrLoadDll");
    22172216    SUPR3HARDENED_ASSERT(pfnLdrLoadDll != NULL);
    22182217    //SUPR3HARDENED_ASSERT(pfnLdrLoadDll == (FARPROC)LdrLoadDll);
    … …  
    31903189    /* Cannot use the imported NtTerminateThread as it's pointing to our own
    31913190       syscall assembly code. */
    3192     FARPROC pfnNtTerminateThread = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtTerminateThread");
    3193     SUPR3HARDENED_ASSERT(pfnNtTerminateThread);
     3191    static PFNRT s_pfnNtTerminateThread = NULL;
     3192    if (s_pfnNtTerminateThread == NULL)
     3193        s_pfnNtTerminateThread = supR3HardenedWinGetRealDllSymbol("ntdll.dll", "NtTerminateThread");
     3194    SUPR3HARDENED_ASSERT(s_pfnNtTerminateThread);
    31943195
    31953196    int rc = supR3HardNtDisableThreadCreationEx(NtCurrentProcess(),
    31963197                                                (void *)(uintptr_t)&LdrInitializeThunk,
    3197                                                 (void *)(uintptr_t)pfnNtTerminateThread,
     3198                                                (void *)(uintptr_t)s_pfnNtTerminateThread,
    31983199                                                g_abLdrInitThunkSelfBackup, sizeof(g_abLdrInitThunkSelfBackup),
    31993200                                                NULL /* pErrInfo*/);
    … …  
    48494850
    48504851        { SUPHARDNT_ADVERSARY_MSE,                  "NisDrv" },
     4852
     4853        /*{ SUPHARDNT_ADVERSARY_COMODO, "cmdguard" }, file system */
     4854        { SUPHARDNT_ADVERSARY_COMODO, "inspect" },
     4855        { SUPHARDNT_ADVERSARY_COMODO, "cmdHlp" },
     4856
    48514857    };
    48524858
    … …  
    49444950        { SUPHARDNT_ADVERSARY_MSE, L"\\SystemRoot\\System32\\drivers\\MpFilter.sys" },
    49454951        { SUPHARDNT_ADVERSARY_MSE, L"\\SystemRoot\\System32\\drivers\\NisDrvWFP.sys" },
     4952
     4953        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\cmdguard.sys" },
     4954        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\cmderd.sys" },
     4955        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\inspect.sys" },
     4956        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\cmdhlp.sys" },
     4957        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\cfrmd.sys" },
     4958        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\drivers\\hmd.sys" },
     4959        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\guard64.dll" },
     4960        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\cmdvrt64.dll" },
     4961        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\cmdkbd64.dll" },
     4962        { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\cmdcsr.dll" },
    49464963    };
    49474964

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainImports-win.cpp

    r52416 r52795  
    139139    uint16_t const         *pau16NameOrdinals;
    140140
     141    /** Number of patched export table entries. */
     142    uint32_t                cPatchedExports;
     143
    141144} SUPHNTIMPDLL;
    142145/** Pointer to an import DLL entry. */
    … …  
    365368            {
    366369                uint32_t offExport = pDll->paoffExports[iExpOrdinal];
    367                 if (offExport < pDll->cbImage)
     370
     371                /* detect export table patching. */
     372                if (offExport >= pDll->cbImage)
     373                    pDll->cPatchedExports++;
     374
     375                if (offExport - pDll->offExportDir >= pDll->cbExportDir)
    368376                {
    369                     if (offExport - pDll->offExportDir >= pDll->cbExportDir)
    370                     {
    371                         *pImport->ppfnImport = (PFNRT)&pDll->pbImageBase[offExport];
    372                         return NULL;
    373                     }
    374 
    375                     /* Forwarder. */
    376                     return (const char *)&pDll->pbImageBase[offExport];
     377                    *pImport->ppfnImport = (PFNRT)&pDll->pbImageBase[offExport];
     378                    return NULL;
    377379                }
    378                 SUPHNTIMP_ERROR(13, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_BAD_EXE_FORMAT,
    379                                 "%ls: The export RVA for '%s' is out of bounds: %#x (SizeOfImage %#x)",
    380                                  pDll->pwszName, offExport, pDll->cbImage);
     380
     381                /* Forwarder. */
     382                return (const char *)&pDll->pbImageBase[offExport];
    381383            }
    382384            SUPHNTIMP_ERROR(14, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_BAD_EXE_FORMAT,
    … …  
    601603        }
    602604
     605    /*
     606     * Use the on disk image to avoid export table patching.  Currently
     607     * ignoring errors here as can live normally without this step.
     608     */
     609    for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
     610        if (g_aSupNtImpDlls[iDll].cPatchedExports > 0)
     611        {
     612            PSUPHNTLDRCACHEENTRY pLdrEntry;
     613            int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry);
     614            if (RT_SUCCESS(rc))
     615            {
     616                uint8_t *pbBits;
     617                rc = supHardNtLdrCacheEntryAllocBits(pLdrEntry, &pbBits, NULL);
     618                if (RT_SUCCESS(rc))
     619                    for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
     620                    {
     621                        RTLDRADDR uValue;
     622                        rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
     623                                              UINT32_MAX, g_aSupNtImpDlls[iDll].paImports[i].pszName, &uValue);
     624                        if (RT_SUCCESS(rc))
     625                            *g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = (PFNRT)(uintptr_t)uValue;
     626                    }
     627            }
     628        }
     629
     630
    603631#if 0 /* Win7/32 ntdll!LdrpDebugFlags. */
    604632    *(uint8_t *)&g_aSupNtImpDlls[0].pbImageBase[0xdd770] = 0x3;
    … …  
    606634}
    607635
     636
     637/**
     638 * Gets the address of a procedure in a DLL, ignoring our own syscall
     639 * implementations.
     640 *
     641 * Currently restricted to NTDLL and KERNEL32
     642 *
     643 * @returns The procedure address.
     644 * @param   pszDll          The DLL name.
     645 * @param   pszProcedure    The procedure name.
     646 */
     647DECLHIDDEN(PFNRT) supR3HardenedWinGetRealDllSymbol(const char *pszDll, const char *pszProcedure)
     648{
     649    /*
     650     * Look the DLL up in the import DLL table.
     651     */
     652    for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
     653        if (RTStrICmp(g_aSupNtImpDlls[iDll].pszName, pszDll) == 0)
     654        {
     655            PSUPHNTLDRCACHEENTRY pLdrEntry;
     656            int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry);
     657            if (RT_SUCCESS(rc))
     658            {
     659                uint8_t *pbBits;
     660                rc = supHardNtLdrCacheEntryAllocBits(pLdrEntry, &pbBits, NULL);
     661                if (RT_SUCCESS(rc))
     662                {
     663                    RTLDRADDR uValue;
     664                    rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
     665                                          UINT32_MAX, pszProcedure, &uValue);
     666                    if (RT_SUCCESS(rc))
     667                        return (PFNRT)(uintptr_t)uValue;
     668                    SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: Error getting %s in %s -> %Rrc\n", pszProcedure, pszDll, rc));
     669                }
     670                else
     671                    SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheEntryAllocBits failed on %s: %Rrc\n",
     672                                 pszDll, rc));
     673            }
     674            else
     675                SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheOpen failed on %s: %Rrc\n",
     676                             pszDll, rc));
     677
     678            /* Complications, just call GetProcAddress. */
     679            return (PFNRT)GetProcAddress(GetModuleHandleW(g_aSupNtImpDlls[iDll].pwszName), pszProcedure);
     680        }
     681
     682    supR3HardenedFatal("supR3HardenedWinGetRealDllSymbol: Unknown DLL %s (proc: %s)\n", pszDll, pszProcedure);
     683    return NULL;
     684}
     685
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette