VirtualBox

Changeset 52949 in vbox


Ignore:
Timestamp:
Oct 5, 2014 9:43:10 PM (10 years ago)
Author:
vboxsync
Message:

SUP: Do the early init thing on the stub process too.

Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/nt/nt.h

    r52947 r52949  
    390390typedef CLIENT_ID *PCLIENT_ID;
    391391#endif
     392
     393/** @name User Shared Data
     394 * @{ */
     395
     396#ifdef IPRT_NT_USE_WINTERNL
     397typedef struct _KSYSTEM_TIME
     398{
     399    ULONG                   LowPart;
     400    LONG                    High1Time;
     401    LONG                    High2Time;
     402} KSYSTEM_TIME;
     403typedef KSYSTEM_TIME *PKSYSTEM_TIME;
     404
     405typedef enum _NT_PRODUCT_TYPE
     406{
     407    NtProductWinNt = 1,
     408    NtProductLanManNt,
     409    NtProductServer
     410} NT_PRODUCT_TYPE;
     411
     412#define PROCESSOR_FEATURE_MAX       64
     413
     414typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
     415{
     416    StandardDesign = 0,
     417    NEC98x86,
     418    EndAlternatives
     419} ALTERNATIVE_ARCHITECTURE_TYPE;
     420
     421# if 0
     422typedef struct _XSTATE_FEATURE
     423{
     424    ULONG                   Offset;
     425    ULONG                   Size;
     426} XSTATE_FEATURE;
     427typedef XSTATE_FEATURE *PXSTATE_FEATURE;
     428
     429#define MAXIMUM_XSTATE_FEATURES     64
     430
     431typedef struct _XSTATE_CONFIGURATION
     432{
     433    ULONG64                 EnabledFeatures;
     434    ULONG                   Size;
     435    ULONG                   OptimizedSave  : 1;
     436    XSTATE_FEATURE          Features[MAXIMUM_XSTATE_FEATURES];
     437} XSTATE_CONFIGURATION;
     438typedef XSTATE_CONFIGURATION *PXSTATE_CONFIGURATION;
     439# endif
     440
     441typedef struct _KUSER_SHARED_DATA
     442{
     443    ULONG                   TickCountLowDeprecated;
     444    ULONG                   TickCountMultiplier;
     445    KSYSTEM_TIME volatile   InterruptTime;
     446    KSYSTEM_TIME volatile   SystemTime;
     447    KSYSTEM_TIME volatile   TimeZoneBias;
     448    USHORT                  ImageNumberLow;
     449    USHORT                  ImageNumberHigh;
     450    WCHAR                   NtSystemRoot[260];
     451    ULONG                   MaxStackTraceDepth;
     452    ULONG                   CryptoExponent;
     453    ULONG                   TimeZoneId;
     454    ULONG                   LargePageMinimum;
     455    ULONG                   AitSamplingValue;
     456    ULONG                   AppCompatFlag;
     457    ULONGLONG               RNGSeedVersion;
     458    ULONG                   GlobalValidationRunlevel;
     459    LONG volatile           TimeZoneBiasStamp;
     460    ULONG                   Reserved2;
     461    NT_PRODUCT_TYPE         NtProductType;
     462    BOOLEAN                 ProductTypeIsValid;
     463    BOOLEAN                 Reserved0[1];
     464    USHORT                  NativeProcessorArchitecture;
     465    ULONG                   NtMajorVersion;
     466    ULONG                   NtMinorVersion;
     467    BOOLEAN                 ProcessorFeatures[PROCESSOR_FEATURE_MAX];
     468    ULONG                   Reserved1;
     469    ULONG                   Reserved3;
     470    ULONG volatile          TimeSlip;
     471    ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
     472    ULONG                   AltArchitecturePad[1];
     473    LARGE_INTEGER           SystemExpirationDate;
     474    ULONG                   SuiteMask;
     475    BOOLEAN                 KdDebuggerEnabled;
     476    union
     477    {
     478        UCHAR               MitigationPolicies;
     479        struct
     480        {
     481            UCHAR           NXSupportPolicy  : 2;
     482            UCHAR           SEHValidationPolicy  : 2;
     483            UCHAR           CurDirDevicesSkippedForDlls  : 2;
     484            UCHAR           Reserved  : 2;
     485        };
     486    };
     487    UCHAR                   Reserved6[2];
     488    ULONG volatile          ActiveConsoleId;
     489    ULONG volatile          DismountCount;
     490    ULONG                   ComPlusPackage;
     491    ULONG                   LastSystemRITEventTickCount;
     492    ULONG                   NumberOfPhysicalPages;
     493    BOOLEAN                 SafeBootMode;
     494    UCHAR                   Reserved12[3];
     495    union
     496    {
     497        ULONG               SharedDataFlags;
     498        struct
     499        {
     500            ULONG           DbgErrorPortPresent  : 1;
     501            ULONG           DbgElevationEnabled  : 1;
     502            ULONG           DbgVirtEnabled  : 1;
     503            ULONG           DbgInstallerDetectEnabled  : 1;
     504            ULONG           DbgLkgEnabled  : 1;
     505            ULONG           DbgDynProcessorEnabled  : 1;
     506            ULONG           DbgConsoleBrokerEnabled  : 1;
     507            ULONG           DbgSecureBootEnabled  : 1;
     508            ULONG           SpareBits  : 24;
     509        };
     510    };
     511    ULONG                   DataFlagsPad[1];
     512    ULONGLONG               TestRetInstruction;
     513    LONGLONG                QpcFrequency;
     514    ULONGLONG               SystemCallPad[3];
     515    union
     516    {
     517        ULONG64 volatile    TickCountQuad;
     518        KSYSTEM_TIME volatile TickCount;
     519        struct
     520        {
     521            ULONG           ReservedTickCountOverlay[3];
     522            ULONG           TickCountPad[1];
     523        };
     524    };
     525    ULONG                   Cookie;
     526    ULONG                   CookiePad[1];
     527    LONGLONG                ConsoleSessionForegroundProcessId;
     528    ULONGLONG               TimeUpdateLock;
     529    ULONGLONG               BaselineSystemTimeQpc;
     530    ULONGLONG               BaselineInterruptTimeQpc;
     531    ULONGLONG               QpcSystemTimeIncrement;
     532    ULONGLONG               QpcInterruptTimeIncrement;
     533    ULONG                   QpcSystemTimeIncrement32;
     534    ULONG                   QpcInterruptTimeIncrement32;
     535    UCHAR                   QpcSystemTimeIncrementShift;
     536    UCHAR                   QpcInterruptTimeIncrementShift;
     537    UCHAR                   Reserved8[14];
     538    USHORT                  UserModeGlobalLogger[16];
     539    ULONG                   ImageFileExecutionOptions;
     540    ULONG                   LangGenerationCount;
     541    ULONGLONG               Reserved4;
     542    ULONGLONG volatile      InterruptTimeBias;
     543    ULONGLONG volatile      QpcBias;
     544    ULONG volatile          ActiveProcessorCount;
     545    UCHAR volatile          ActiveGroupCount;
     546    UCHAR                   Reserved9;
     547    union
     548    {
     549        USHORT              QpcData;
     550        struct
     551        {
     552            BOOLEAN volatile QpcBypassEnabled;
     553            UCHAR           QpcShift;
     554        };
     555    };
     556    LARGE_INTEGER           TimeZoneBiasEffectiveStart;
     557    LARGE_INTEGER           TimeZoneBiasEffectiveEnd;
     558    XSTATE_CONFIGURATION    XState;
     559} KUSER_SHARED_DATA;
     560typedef KUSER_SHARED_DATA *PKUSER_SHARED_DATA;
     561#endif /* IPRT_NT_USE_WINTERNL */
     562/** @} */
     563
    392564
    393565/** @name Process And Thread Environment Blocks

  • trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h

    r52943 r52949  
    313313{
    314314    SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED = 0,
    315     SUPR3HARDENEDMAINSTATE_WIN_VM_INIT_CALLED,
     315    SUPR3HARDENEDMAINSTATE_WIN_EARLY_INIT_CALLED,
    316316    SUPR3HARDENEDMAINSTATE_WIN_EARLY_IMPORTS_RESOLVED,
    317317    SUPR3HARDENEDMAINSTATE_WIN_EARLY_DEVICE_OPENED,
    … …  
    342342extern DECLHIDDEN(SUPR3HARDENEDMAINSTATE) g_enmSupR3HardenedMainState;
    343343#ifdef RT_OS_WINDOWS
    344 extern DECLHIDDEN(bool)                 g_fSupEarlyVmProcessInit;
     344extern DECLHIDDEN(bool)                 g_fSupEarlyProcessInit;
    345345#endif
    346346

  • trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

    r52947 r52949  
    17131713    g_SupPreInitData.u32EndMagic  = SUPPREINITDATA_MAGIC;
    17141714#ifdef RT_OS_WINDOWS
    1715     if (!g_fSupEarlyVmProcessInit)
     1715    if (!g_fSupEarlyProcessInit)
    17161716#endif
    17171717        g_SupPreInitData.Data.hDevice = SUP_HDEVICE_NIL;
    … …  
    17481748     * at dropping compatibility layers and process "security" solutions.
    17491749     */
    1750     if (   !g_fSupEarlyVmProcessInit
     1750    if (   !g_fSupEarlyProcessInit
    17511751        && !(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV)
    17521752        && supR3HardenedWinIsReSpawnNeeded(1 /*iWhich*/, argc, argv))
    17531753    {
    17541754        SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
    1755         supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV, true /*fAvastKludge*/);
     1755        supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV, false /*fAvastKludge*/);
    17561756        supR3HardenedVerifyAll(true /* fFatal */, pszProgName);
    17571757        return supR3HardenedWinReSpawn(1 /*iWhich*/);
    … …  
    17641764     * by early VM process init.)
    17651765     */
    1766     if (!g_fSupEarlyVmProcessInit)
     1766    if (!g_fSupEarlyProcessInit)
    17671767        supR3HardenedWinInit(fFlags, true /*fAvastKludge*/);
    17681768#endif /* RT_OS_WINDOWS */
    … …  
    17771777     * driver.  (Already done by early VM process init.)
    17781778     */
     1779    if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
     1780    {
    17791781#ifdef RT_OS_WINDOWS
    1780     if (!g_fSupEarlyVmProcessInit)
    1781 #endif
    1782         if (!(fFlags & SUPSECMAIN_FLAGS_DONT_OPEN_DEV))
     1782        /*
     1783         * Windows: Verify the process (repeated by the kernel later).
     1784         */
     1785        if (!g_fSupEarlyProcessInit)
     1786            supR3HardenedWinVerifyProcess();
     1787
     1788        /*
     1789         * Windows: The second respawn.  This time we make a special arrangement
     1790         * with vboxdrv to monitor access to the new process from its inception.
     1791         */
     1792        if (supR3HardenedWinIsReSpawnNeeded(2 /* iWhich*/, argc, argv))
    17831793        {
     1794            SUP_DPRINTF(("SUPR3HardenedMain: Respawn #2\n"));
     1795            return supR3HardenedWinReSpawn(2 /* iWhich*/);
     1796        }
     1797        SUP_DPRINTF(("SUPR3HardenedMain: Final process, opening VBoxDrv...\n"));
     1798        supR3HardenedWinFlushLoaderCache();
     1799#endif /* RT_OS_WINDOWS */
     1800
     1801        /*
     1802         * Open the vboxdrv device.
     1803         */
    17841804#ifdef RT_OS_WINDOWS
    1785             /*
    1786              * Windows: Verify the process (repeated by the kernel later.
    1787              */
    1788             supR3HardenedWinVerifyProcess();
    1789 
    1790             /*
    1791              * Windows: The second respawn.  This time we make a special arrangement
    1792              * with vboxdrv to monitor access to the new process from its inception.
    1793              */
    1794             if (supR3HardenedWinIsReSpawnNeeded(2 /* iWhich*/, argc, argv))
    1795             {
    1796                 SUP_DPRINTF(("SUPR3HardenedMain: Respawn #2\n"));
    1797                 return supR3HardenedWinReSpawn(2 /* iWhich*/);
    1798             }
    1799             SUP_DPRINTF(("SUPR3HardenedMain: Final process, opening VBoxDrv...\n"));
    1800             supR3HardenedWinFlushLoaderCache();
    1801 #endif /* RT_OS_WINDOWS */
    1802 
    1803             /*
    1804              * Open the vboxdrv device.
    1805              */
     1805        if (!g_fSupEarlyProcessInit)
     1806#endif
    18061807            supR3HardenedMainOpenDevice();
    1807         }
     1808    }
    18081809
    18091810#ifdef RT_OS_WINDOWS

  • trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

    r52908 r52949  
    35783578        if (pHandleInfo->Object == pProtectedProcess)
    35793579        {
    3580             /* Handles within the protected process is fine. */
     3580            /* Handles within the protected process are fine. */
    35813581            if (   !(pHandleInfo->GrantedAccess & SUPDRV_NT_EVIL_PROCESS_RIGHTS)
    35823582                || pHandleInfo->UniqueProcessId == hProtectedPid)

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

    r52947 r52949  
    200200 *  supR3HardenedVmProcessInit. */
    201201static SUPR3WINPROCPARAMS   g_ProcParams = { NULL, NULL, 0, 0 };
    202 /** Set if supR3HardenedVmProcessInit was invoked. */
    203 bool                        g_fSupEarlyVmProcessInit = false;
     202/** Set if supR3HardenedEarlyProcessInit was invoked. */
     203bool                        g_fSupEarlyProcessInit = false;
     204/** Set if the stub device has been opened (stub process only). */
     205bool                        g_fSupStubOpened = false;
    204206
    205207/** @name Global variables initialized by suplibHardenedWindowsMain.
    … …  
    311313#endif
    312314
    313 DECLASM(void) supR3HardenedVmProcessInitThunk(void);
     315DECLASM(void) supR3HardenedEarlyProcessInitThunk(void);
    314316
    315317
    … …  
    351353    return pwszCur - pwsz;
    352354}
     355
     356
     357/**
     358 * Our version of GetTickCount.
     359 * @returns Millisecond timestamp.
     360 */
     361static uint64_t supR3HardenedWinGetMilliTS(void)
     362{
     363    PKUSER_SHARED_DATA pUserSharedData = (PKUSER_SHARED_DATA)(uintptr_t)0x7ffe0000;
     364
     365    /* use interrupt time */
     366    LARGE_INTEGER Time;
     367    do
     368    {
     369        Time.HighPart = pUserSharedData->InterruptTime.High1Time;
     370        Time.LowPart  = pUserSharedData->InterruptTime.LowPart;
     371    } while (pUserSharedData->InterruptTime.High2Time != Time.HighPart);
     372
     373    return (uint64_t)Time.QuadPart / 10000;
     374}
     375
    353376
    354377
    … …  
    35103533     * process asynchronously.
    35113534     */
    3512     DWORD    dwStart = GetTickCount();
     3535    uint64_t uMsTsStart = supR3HardenedWinGetMilliTS();
    35133536    uint32_t cMsKludge = (g_fSupAdversaries & SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT) ? 256 : g_fSupAdversaries ? 64 : 16;
    35143537    do
    … …  
    35183541        Time.QuadPart = -8000000 / 100; /* 8ms in 100ns units, relative time. */
    35193542        NtDelayExecution(FALSE, &Time);
    3520     } while (GetTickCount() - dwStart < cMsKludge);
    3521     SUP_DPRINTF(("supR3HardNtPuChTriggerInitialImageEvents: Startup delay kludge #1: %u ms\n", GetTickCount() - dwStart));
     3543    } while (supR3HardenedWinGetMilliTS() - uMsTsStart < cMsKludge);
     3544    SUP_DPRINTF(("supR3HardNtPuChTriggerInitialImageEvents: Startup delay kludge #1: %u ms\n",
     3545                 supR3HardenedWinGetMilliTS() - uMsTsStart));
    35223546
    35233547    /*
    … …  
    37783802    {
    37793803        NTSTATUS rcNtWait;
    3780         DWORD dwStartTick = GetTickCount();
     3804        uint64_t uMsTsStart = supR3HardenedWinGetMilliTS();
    37813805        do
    37823806        {
    … …  
    37933817                     || rcNtWait == STATUS_USER_APC
    37943818                     || rcNtWait == STATUS_ALERTED)
    3795                  && GetTickCount() - dwStartTick < 60 * 1000);
     3819                 && supR3HardenedWinGetMilliTS() - uMsTsStart < 60 * 1000);
    37963820        if (fExitOk)
    37973821            supR3HardenedError(rc, false /*fFatal*/,
    … …  
    38223846 *                          close the event semaphore and set it to NULL.
    38233847 */
    3824 static void supR3HardenedWinCheckVmChild(HANDLE hProcWait, uintptr_t uChildExeAddr, HANDLE *phEvtParent, HANDLE *phEvtChild)
     3848static void supR3HardenedWinCheckChild(HANDLE hProcWait, uintptr_t uChildExeAddr, HANDLE *phEvtParent, HANDLE *phEvtChild)
    38253849{
    38263850    /*
    … …  
    38283852     */
    38293853    uintptr_t           uChildAddr = uChildExeAddr + ((uintptr_t)&g_ProcParams - (uintptr_t)NtCurrentPeb()->ImageBaseAddress);
    3830     SIZE_T              cbIgnored;
     3854    SIZE_T              cbIgnored = 0;
    38313855    SUPR3WINPROCPARAMS  ChildProcParams;
    38323856    RT_ZERO(ChildProcParams);
    38333857    NTSTATUS rcNt = NtReadVirtualMemory(hProcWait, (PVOID)uChildAddr, &ChildProcParams, sizeof(ChildProcParams), &cbIgnored);
    38343858    if (!NT_SUCCESS(rcNt))
    3835         supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckVmChild", rcNt,
     3859        supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckChild", rcNt,
    38363860                                  "NtReadVirtualMemory(,%p,) failed reading child process status: %#x\n", uChildAddr, rcNt);
    38373861
    … …  
    38413865    rcNt = NtSetEvent(*phEvtChild, NULL);
    38423866    if (!NT_SUCCESS(rcNt))
    3843         supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckVmChild", rcNt, "NtSetEvent failed: %#x\n", rcNt);
     3867        supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckChild", rcNt, "NtSetEvent failed: %#x\n", rcNt);
    38443868
    38453869    /*
    … …  
    38503874        rcNt = NtClose(*phEvtChild);
    38513875    if (!NT_SUCCESS(rcNt))
    3852         supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckVmChild", rcNt, "NtClose failed on event sem: %#x\n", rcNt);
     3876        supR3HardenedWinKillChild(hProcWait, "supR3HardenedWinCheckChild", rcNt, "NtClose failed on event sem: %#x\n", rcNt);
    38533877    *phEvtChild = NULL;
    38543878    *phEvtParent = NULL;
    … …  
    38623886    /* An error occurred, report it. */
    38633887    ChildProcParams.szErrorMsg[sizeof(ChildProcParams.szErrorMsg) - 1] = '\0';
    3864     supR3HardenedFatalMsg("supR3HardenedWinCheckVmChild", kSupInitOp_Misc, ChildProcParams.rc, "%s", ChildProcParams.szErrorMsg);
    3865 }
    3866 
    3867 
    3868 static void supR3HardenedWinInitVmChild(HANDLE hProcess, HANDLE hThread, uintptr_t uChildNtDllAddr, uintptr_t uChildExeAddr,
    3869                                         HANDLE hEvtChild, HANDLE hEvtParent)
     3888    supR3HardenedFatalMsg("supR3HardenedWinCheckChild", kSupInitOp_Misc, ChildProcParams.rc, "%s", ChildProcParams.szErrorMsg);
     3889}
     3890
     3891
     3892static void supR3HardenedWinSetupChildInit(HANDLE hProcess, HANDLE hThread, uintptr_t uChildNtDllAddr, uintptr_t uChildExeAddr,
     3893                                           HANDLE hEvtChild, HANDLE hEvtParent)
    38703894{
    38713895    /*
    … …  
    38843908    NTSTATUS  rcNt = NtWriteVirtualMemory(hProcess, (PVOID)uChildAddr, &ChildProcParams, sizeof(ChildProcParams), &cbIgnored);
    38853909    if (!NT_SUCCESS(rcNt))
    3886         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rcNt,
     3910        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rcNt,
    38873911                                  "NtWriteVirtualMemory(,%p,) failed writing child process parameters: %#x\n", uChildAddr, rcNt);
    38883912
    … …  
    38943918    int rc = supHardNtLdrCacheOpen("ntdll.dll", &pLdrEntry);
    38953919    if (RT_FAILURE(rc))
    3896         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rc,
     3920        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rc,
    38973921                                  "supHardNtLdrCacheOpen failed on NTDLL: %Rrc\n", rc);
    38983922
    … …  
    39003924    rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbChildNtDllBits, uChildNtDllAddr, NULL, NULL, NULL /*pErrInfo*/);
    39013925    if (RT_FAILURE(rc))
    3902         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rc,
     3926        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rc,
    39033927                                  "supHardNtLdrCacheEntryGetBits failed on NTDLL: %Rrc\n", rc);
    39043928
    … …  
    39073931                          "LdrInitializeThunk", &uLdrInitThunk);
    39083932    if (RT_FAILURE(rc))
    3909         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rc,
     3933        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rc,
    39103934                                  "Error locating LdrInitializeThunk in NTDLL: %Rrc", rc);
    39113935    PVOID pvLdrInitThunk = (PVOID)(uintptr_t)uLdrInitThunk;
    3912     SUP_DPRINTF(("supR3HardenedWinInitVmChild: uLdrInitThunk=%p\n", (uintptr_t)uLdrInitThunk));
     3936    SUP_DPRINTF(("supR3HardenedWinSetupChildInit: uLdrInitThunk=%p\n", (uintptr_t)uLdrInitThunk));
    39133937
    39143938    /*
    39153939     * Calculate the address of our code in the child process.
    39163940     */
    3917     uintptr_t uEarlyVmProcInitEP = uChildExeAddr + (  (uintptr_t)&supR3HardenedVmProcessInitThunk
    3918                                                     - (uintptr_t)NtCurrentPeb()->ImageBaseAddress);
     3941    uintptr_t uEarlyProcInitEP = uChildExeAddr + (  (uintptr_t)&supR3HardenedEarlyProcessInitThunk
     3942                                                  - (uintptr_t)NtCurrentPeb()->ImageBaseAddress);
    39193943
    39203944    /*
    39213945     * Compose the LdrInitializeThunk replacement bytes.
     3946     * Note! The amount of code we replace here must be less or equal to what
     3947     *       the process verification code ignores.
    39223948     */
    39233949    uint8_t abNew[16];
    … …  
    39273953    abNew[1] = 0x25;
    39283954    *(uint32_t *)&abNew[2] = 0;
    3929     *(uint64_t *)&abNew[6] = uEarlyVmProcInitEP;
     3955    *(uint64_t *)&abNew[6] = uEarlyProcInitEP;
    39303956#elif defined(RT_ARCH_X86)
    39313957    abNew[0] = 0xe9;
    3932     *(uint32_t *)&abNew[1] = uEarlyVmProcInitEP - ((uint32_t)uLdrInitThunk + 5);
     3958    *(uint32_t *)&abNew[1] = uEarlyProcInitEP - ((uint32_t)uLdrInitThunk + 5);
    39333959#else
    39343960# error "Unsupported arch."
    … …  
    39433969    rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, PAGE_EXECUTE_READWRITE, &fOldProt);
    39443970    if (!NT_SUCCESS(rcNt))
    3945         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rcNt,
     3971        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rcNt,
    39463972                                  "NtProtectVirtualMemory/LdrInitializeThunk failed: %#x", rcNt);
    39473973
    39483974    rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, abNew, sizeof(abNew), &cbIgnored);
    39493975    if (!NT_SUCCESS(rcNt))
    3950         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rcNt,
     3976        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rcNt,
    39513977                                  "NtWriteVirtualMemory/LdrInitializeThunk failed: %#x", rcNt);
    39523978
    … …  
    39553981    rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, fOldProt, &fOldProt);
    39563982    if (!NT_SUCCESS(rcNt))
    3957         supR3HardenedWinKillChild(hProcess, "supR3HardenedWinInitVmChild", rcNt,
     3983        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinSetupChildInit", rcNt,
    39583984                                  "NtProtectVirtualMemory/LdrInitializeThunk[restore] failed: %#x", rcNt);
    39593985
    39603986    /* Caller starts child execution. */
    3961     SUP_DPRINTF(("supR3HardenedWinInitVmChild: Start child.\n"));
     3987    SUP_DPRINTF(("supR3HardenedWinSetupChildInit: Start child.\n"));
    39623988}
    39633989
    … …  
    39834009     * Set up VM child communication event semaphores.
    39844010     */
     4011    OBJECT_ATTRIBUTES ObjAttrs;
    39854012    HANDLE hEvtChild = NULL;
     4013    InitializeObjectAttributes(&ObjAttrs, NULL /*pName*/, OBJ_INHERIT, NULL /*hRootDir*/, NULL /*pSecDesc*/);
     4014    SUPR3HARDENED_ASSERT_NT_SUCCESS(NtCreateEvent(&hEvtChild, EVENT_ALL_ACCESS, &ObjAttrs, NotificationEvent, FALSE));
     4015
    39864016    HANDLE hEvtParent = NULL;
    3987     if (iWhich >= 2)
    3988     {
    3989         OBJECT_ATTRIBUTES ObjAttrs;
    3990         InitializeObjectAttributes(&ObjAttrs, NULL /*pName*/, OBJ_INHERIT, NULL /*hRootDir*/, NULL /*pSecDesc*/);
    3991         SUPR3HARDENED_ASSERT_NT_SUCCESS(NtCreateEvent(&hEvtChild, EVENT_ALL_ACCESS, &ObjAttrs, NotificationEvent, FALSE));
    3992         InitializeObjectAttributes(&ObjAttrs, NULL /*pName*/, OBJ_INHERIT, NULL /*hRootDir*/, NULL /*pSecDesc*/);
    3993         SUPR3HARDENED_ASSERT_NT_SUCCESS(NtCreateEvent(&hEvtParent, EVENT_ALL_ACCESS, &ObjAttrs, NotificationEvent, FALSE));
    3994     }
     4017    InitializeObjectAttributes(&ObjAttrs, NULL /*pName*/, OBJ_INHERIT, NULL /*hRootDir*/, NULL /*pSecDesc*/);
     4018    SUPR3HARDENED_ASSERT_NT_SUCCESS(NtCreateEvent(&hEvtParent, EVENT_ALL_ACCESS, &ObjAttrs, NotificationEvent, FALSE));
    39954019
    39964020    /*
    … …  
    41404164     * Start the process execution.
    41414165     */
    4142     if (iWhich >= 2)
    4143         supR3HardenedWinInitVmChild(hProcess, hThread, uChildNtDllAddr, uChildExeAddr, hEvtChild, hEvtParent);
     4166    supR3HardenedWinSetupChildInit(hProcess, hThread, uChildNtDllAddr, uChildExeAddr, hEvtChild, hEvtParent);
    41444167
    41454168    ULONG cSuspendCount = 0;
    … …  
    41554178    PROCESS_BASIC_INFORMATION BasicInfo;
    41564179    HANDLE hProcWait;
    4157     ULONG fRights = SYNCHRONIZE | PROCESS_TERMINATE;
     4180    ULONG fRights = SYNCHRONIZE | PROCESS_TERMINATE | PROCESS_VM_READ;
    41584181    if (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0)) /* Introduced in Vista. */
    41594182        fRights |= PROCESS_QUERY_LIMITED_INFORMATION;
    41604183    else
    41614184        fRights |= PROCESS_QUERY_INFORMATION;
    4162     if (iWhich == 2)
    4163         fRights |= PROCESS_VM_READ;
    41644185    rcNt = NtDuplicateObject(NtCurrentProcess(), hProcess,
    41654186                             NtCurrentProcess(), &hProcWait,
    41664187                             fRights, 0 /*HandleAttributes*/, 0);
    41674188    if (rcNt == STATUS_ACCESS_DENIED)
     4189    {
     4190        supR3HardenedError(rcNt, false /*fFatal*/,
     4191                           "supR3HardenedWinDoReSpawn: NtDuplicateObject(,,,,%#x,,) -> %#x, retrying with only %#x...\n",
     4192                           fRights, rcNt, SYNCHRONIZE);
    41684193        rcNt = NtDuplicateObject(NtCurrentProcess(), hProcess,
    41694194                                 NtCurrentProcess(), &hProcWait,
    41704195                                 SYNCHRONIZE, 0 /*HandleAttributes*/, 0);
     4196    }
    41714197    if (!NT_SUCCESS(rcNt))
    41724198        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinReSpawn", VERR_INVALID_NAME,
    … …  
    41774203
    41784204    /*
    4179      * Signal the VM child that we've closed the unrestricted handles.
    4180      */
    4181     if (iWhich >= 2)
    4182     {
    4183         rcNt = NtSetEvent(hEvtChild, NULL);
    4184         if (!NT_SUCCESS(rcNt))
    4185             supR3HardenedWinKillChild(hProcess, "supR3HardenedWinReSpawn", VERR_INVALID_NAME,
    4186                                       "NtSetEvent failed on child process handle: %#x\n", rcNt);
    4187     }
     4205     * Signal the child that we've closed the unrestricted handles.
     4206     */
     4207    rcNt = NtSetEvent(hEvtChild, NULL);
     4208    if (!NT_SUCCESS(rcNt))
     4209        supR3HardenedWinKillChild(hProcess, "supR3HardenedWinReSpawn", VERR_INVALID_NAME,
     4210                                  "NtSetEvent failed on child process handle: %#x\n", rcNt);
    41884211
    41894212    /*
    … …  
    42334256        rcNt = NtWaitForMultipleObjects(cHandles, &ahHandles[0], WaitAnyObject, TRUE /*Alertable*/, NULL /*pTimeout*/);
    42344257        if (rcNt == STATUS_WAIT_0 + 1 && hEvtParent != NULL)
    4235             supR3HardenedWinCheckVmChild(hProcWait, uChildExeAddr, &hEvtParent, &hEvtChild);
     4258            supR3HardenedWinCheckChild(hProcWait, uChildExeAddr, &hEvtParent, &hEvtChild);
    42364259        else if (   (ULONG)rcNt - (ULONG)STATUS_WAIT_0           < cHandles
    42374260                 || (ULONG)rcNt - (ULONG)STATUS_ABANDONED_WAIT_0 < cHandles)
    … …  
    44184441static void supR3HardenedWinOpenStubDevice(void)
    44194442{
     4443    if (g_fSupStubOpened)
     4444        return;
     4445
    44204446    /*
    44214447     * Retry if we think driver might still be initializing (STATUS_NO_SUCH_DEVICE + \Drivers\VBoxDrv).
    44224448     */
    44234449    static const WCHAR  s_wszName[] = L"\\Device\\VBoxDrvStub";
    4424     DWORD const         uStartTick = GetTickCount();
     4450    uint64_t const      uMsTsStart = supR3HardenedWinGetMilliTS();
    44254451    NTSTATUS            rcNt;
    44264452    uint32_t            iTry;
    … …  
    44574483        if (rcNt != STATUS_NO_SUCH_DEVICE)
    44584484            break;
    4459         if (iTry > 0 && GetTickCount() - uStartTick > 5000)  /* 5 sec, at least two tries */
     4485        if (iTry > 0 && supR3HardenedWinGetMilliTS() - uMsTsStart > 5000)  /* 5 sec, at least two tries */
    44604486            break;
    44614487        if (!supR3HardenedWinDriverExists("VBoxDrv"))
    … …  
    44764502    }
    44774503
    4478     if (!NT_SUCCESS(rcNt))
     4504    if (NT_SUCCESS(rcNt))
     4505        g_fSupStubOpened = true;
     4506    else
    44794507    {
    44804508        /*
    … …  
    45424570             * suggestions accordingly.
    45434571             */
     4572/** @todo don't fail during early init, wait till later and try load the driver if missing or at least query the service manager for additional information. */
    45444573            if (   rcNt == STATUS_NO_SUCH_DEVICE
    45454574                || rcNt == STATUS_OBJECT_NAME_NOT_FOUND)
    … …  
    45794608    /*
    45804609     * Before the 2nd respawn we set up a child protection deal with the
    4581      * support driver via /Devices/VBoxDrvStub.
     4610     * support driver via /Devices/VBoxDrvStub.  (We tried to do this
     4611     * during the early init, but in case we had trouble accessing vboxdrv we
     4612     * retry it here where we have kernel32.dll and others to pull in for
     4613     * better diagnostics.)
    45824614     */
    45834615    if (iWhich == 2)
    … …  
    46874719            for (uint32_t iLoop = 0; iLoop < 16; iLoop++)
    46884720            {
    4689                 uint32_t    cSleeps = 0;
    4690                 DWORD       dwStart = GetTickCount();
     4721                uint32_t cSleeps = 0;
     4722                uint64_t uMsTsStart = supR3HardenedWinGetMilliTS();
    46914723                do
    46924724                {
    … …  
    46964728                    NtDelayExecution(FALSE, &Time);
    46974729                    cSleeps++;
    4698                 } while (   GetTickCount() - dwStart <= cMsFudge
     4730                } while (   supR3HardenedWinGetMilliTS() - uMsTsStart <= cMsFudge
    46994731                         || cSleeps < 8);
    47004732                SUP_DPRINTF(("supR3HardenedWinInit: Startup delay kludge #2/%u: %u ms, %u sleeps\n",
    4701                              iLoop, GetTickCount() - dwStart, cSleeps));
     4733                             iLoop, supR3HardenedWinGetMilliTS() - uMsTsStart, cSleeps));
    47024734
    47034735                cFixes = 0;
    … …  
    53645396    if (g_ProcParams.hEvtParent || g_ProcParams.hEvtChild)
    53655397    {
    5366         SUPR3HARDENED_ASSERT(g_fSupEarlyVmProcessInit);
     5398        SUPR3HARDENED_ASSERT(g_fSupEarlyProcessInit);
    53675399        NtSetEvent(g_ProcParams.hEvtParent, NULL);
    53685400        NtClose(g_ProcParams.hEvtParent);
    … …  
    53725404    }
    53735405    else
    5374         SUPR3HARDENED_ASSERT(!g_fSupEarlyVmProcessInit);
     5406        SUPR3HARDENED_ASSERT(!g_fSupEarlyProcessInit);
    53755407
    53765408    /*
    … …  
    54795511
    54805512/**
    5481  * Routine called by the supR3HardenedVmProcessInitThunk assembly routine when
    5482  * LdrInitializeThunk is executed in during process initialization.
    5483  *
    5484  * This initializes the VM process, hooking NTDLL APIs and opening the device
    5485  * driver before any other DLLs gets loaded into the process.  This greately
    5486  * reduces and controls the trusted code base of the process compared to the
    5487  * opening it from SUPR3HardenedMain, avoid issues with so call protection
    5488  * software that is in the habit of patching half of the ntdll and kernel32
    5489  * APIs in the process, making it almost indistinguishable from software that is
    5490  * up to no good.  Once we've opened vboxdrv, the process should be locked down
    5491  * so thighly that only kernel software and csrss can mess with the process.
    5492  */
    5493 DECLASM(uintptr_t) supR3HardenedVmProcessInit(void)
     5513 * Routine called by the supR3HardenedEarlyProcessInitThunk assembly routine
     5514 * when LdrInitializeThunk is executed in during process initialization.
     5515 *
     5516 * This initializes the Stub and VM processes, hooking NTDLL APIs and opening
     5517 * the device driver before any other DLLs gets loaded into the process.  This
     5518 * greately reduces and controls the trusted code base of the process compared
     5519 * to opening the driver from SUPR3HardenedMain.  It also avoids issues with so
     5520 * call protection software that is in the habit of patching half of the ntdll
     5521 * and kernel32 APIs in the process, making it almost indistinguishable from
     5522 * software that is up to no good.  Once we've opened vboxdrv, the process
     5523 * should be locked down so thighly that only kernel software and csrss can mess
     5524 * with the process.
     5525 */
     5526DECLASM(uintptr_t) supR3HardenedEarlyProcessInit(void)
    54945527{
    54955528    /*
    … …  
    54975530     */
    54985531    if (!ASMAtomicCmpXchgU32((uint32_t volatile *)&g_enmSupR3HardenedMainState,
    5499                              SUPR3HARDENEDMAINSTATE_WIN_VM_INIT_CALLED,
     5532                             SUPR3HARDENEDMAINSTATE_WIN_EARLY_INIT_CALLED,
    55005533                             SUPR3HARDENEDMAINSTATE_NOT_YET_CALLED))
    55015534    {
    … …  
    55035536        return 0x22;  /* crash */
    55045537    }
    5505     g_fSupEarlyVmProcessInit = true;
     5538    g_fSupEarlyProcessInit = true;
    55065539
    55075540    /*
    … …  
    55245557    Timeout.QuadPart = -600000000; /* 60 second */
    55255558    NTSTATUS rcNt = NtWaitForSingleObject(g_ProcParams.hEvtChild, FALSE /*Alertable*/, &Timeout);
    5526     if (NT_SUCCESS(rcNt))
     5559    if (rcNt != STATUS_SUCCESS)
    55275560        rcNt = NtClearEvent(g_ProcParams.hEvtChild);
    55285561    if (!NT_SUCCESS(rcNt))
    … …  
    55685601     * Open the driver.
    55695602     */
    5570     SUP_DPRINTF(("supR3HardenedVmProcessInit: Opening vboxdrv...\n"));
    5571     supR3HardenedMainOpenDevice();
     5603    if (cArgs >= 1 && suplibHardenedStrCmp(papszArgs[0], SUPR3_RESPAWN_1_ARG0) == 0)
     5604    {
     5605        SUP_DPRINTF(("supR3HardenedVmProcessInit: Opening vboxdrv stub...\n"));
     5606        supR3HardenedWinOpenStubDevice();
     5607    }
     5608    else if (cArgs >= 1 && suplibHardenedStrCmp(papszArgs[0], SUPR3_RESPAWN_2_ARG0) == 0)
     5609    {
     5610        SUP_DPRINTF(("supR3HardenedVmProcessInit: Opening vboxdrv...\n"));
     5611        supR3HardenedMainOpenDevice();
     5612    }
     5613    else
     5614        supR3HardenedFatal("Unexpected first argument '%s'!\n", papszArgs[0]);
    55725615    g_enmSupR3HardenedMainState = SUPR3HARDENEDMAINSTATE_WIN_EARLY_DEVICE_OPENED;
    55735616

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainA-win.asm

    r52945 r52949  
    3636
    3737; External code.
    38 extern NAME(supR3HardenedVmProcessInit)
     38extern NAME(supR3HardenedEarlyProcessInit)
    3939
    4040
    … …  
    8383
    8484;;
    85 ; Alternative code for LdrInitializeThunk that performs the VM process startup.
     85; Alternative code for LdrInitializeThunk that performs the early process startup
     86; for the Stub and VM processes.
    8687;
    8788; This does not concern itself with any arguments on stack or in registers that
    … …  
    8990; them all before we restart the restored LdrInitializeThunk routine.
    9091;
    91 BEGINPROC supR3HardenedVmProcessInitThunk
     92; @sa supR3HardenedEarlyProcessInit
     93;
     94BEGINPROC supR3HardenedEarlyProcessInitThunk
    9295        ;
    9396        ; Prologue.
    … …  
    123126        ; resume address in xAX, which we put in the "return" stack position.
    124127        ;
    125         call    NAME(supR3HardenedVmProcessInit)
     128        call    NAME(supR3HardenedEarlyProcessInit)
    126129        mov     [xBP + xCB], xAX
    127130
    … …  
    145148        leave
    146149        ret
    147 ENDPROC   supR3HardenedVmProcessInitThunk
     150ENDPROC   supR3HardenedEarlyProcessInitThunk
    148151
    149152

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedNoCrt-win.cpp

    r52947 r52949  
    269269    if (!hHeap)
    270270    {
    271         if (   g_fSupEarlyVmProcessInit
     271        if (   g_fSupEarlyProcessInit
    272272            && g_enmSupR3HardenedMainState <= SUPR3HARDENEDMAINSTATE_WIN_EP_CALLED)
    273273            return supR3HardenedEarlyAlloc(cb, false /*fZero*/);
    … …  
    287287    if (!hHeap)
    288288    {
    289         if (   g_fSupEarlyVmProcessInit
     289        if (   g_fSupEarlyProcessInit
    290290            && g_enmSupR3HardenedMainState <= SUPR3HARDENEDMAINSTATE_WIN_EP_CALLED)
    291291            return supR3HardenedEarlyAlloc(cb, true /*fZero*/);
    … …  
    328328
    329329    void *pv;
    330     if (g_fSupEarlyVmProcessInit)
     330    if (g_fSupEarlyProcessInit)
    331331    {
    332332        uint32_t iHeap = supR3HardenedEarlyFind(pvOld);
    … …  
    387387    if (pv)
    388388    {
    389         if (g_fSupEarlyVmProcessInit)
     389        if (g_fSupEarlyProcessInit)
    390390        {
    391391            uint32_t iHeap = supR3HardenedEarlyFind(pv);

  • trunk/src/VBox/HostDrivers/Support/win/import-template-ntdll.h

    r52947 r52949  
    6464SUPHARNT_IMPORT_STDCALL(RtlAddAccessAllowedAce, 16)
    6565SUPHARNT_IMPORT_STDCALL(RtlAddAccessDeniedAce, 16)
    66 SUPHARNT_IMPORT_STDCALL_EARLY(RtlAllocateHeap, 12)
     66SUPHARNT_IMPORT_STDCALL(RtlAllocateHeap, 12)
    6767SUPHARNT_IMPORT_STDCALL(RtlCompactHeap, 8)
    6868SUPHARNT_IMPORT_STDCALL(RtlCopySid, 12)
    6969SUPHARNT_IMPORT_STDCALL(RtlCreateAcl, 12)
    70 SUPHARNT_IMPORT_STDCALL_EARLY(RtlCreateHeap, 24)
     70SUPHARNT_IMPORT_STDCALL(RtlCreateHeap, 24)
    7171SUPHARNT_IMPORT_STDCALL(RtlCreateProcessParameters, 40)
    7272SUPHARNT_IMPORT_STDCALL(RtlCreateSecurityDescriptor, 8)
    … …  
    7979SUPHARNT_IMPORT_STDCALL_EARLY(RtlExitUserThread, 4)
    8080SUPHARNT_IMPORT_STDCALL(RtlExpandEnvironmentStrings_U, 16)
    81 SUPHARNT_IMPORT_STDCALL_EARLY(RtlFreeHeap, 12)
     81SUPHARNT_IMPORT_STDCALL(RtlFreeHeap, 12)
    8282SUPHARNT_IMPORT_STDCALL_EARLY(RtlFreeUnicodeString, 4)
    8383SUPHARNT_IMPORT_STDCALL_EARLY(RtlGetLastNtStatus, 0)
    … …  
    9191SUPHARNT_IMPORT_STDCALL_EARLY(RtlSetLastWin32Error, 4)
    9292SUPHARNT_IMPORT_STDCALL_EARLY(RtlSetLastWin32ErrorAndNtStatusFromNtStatus, 4)
    93 SUPHARNT_IMPORT_STDCALL_EARLY(RtlSizeHeap, 12)
     93SUPHARNT_IMPORT_STDCALL(RtlSizeHeap, 12)
    9494SUPHARNT_IMPORT_STDCALL_EARLY(RtlSubAuthoritySid, 8)
    9595
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette