Changeset 53021 in vbox for trunk

Timestamp:

Oct 10, 2014 9:58:30 AM (10 years ago)

Author:

vboxsync

Message:

SUP: Revised the dgmaster.sys/sakfile.sys hack as it didn't quite work around the issues in dg at least.

Location:

trunk/src/VBox/HostDrivers/Support/win

Files:

• SUPHardenedVerify-win.h (modified) (2 diffs)
• SUPHardenedVerifyProcess-win.cpp (modified) (1 diff)
• SUPR3HardenedMain-win.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h

@@ -57 +57 @@
  * @{ */
 /** Replace unwanted executable memory allocations with a new one that's filled
- * with zeros (default is just to free it).
+ * with a safe read-write copy (default is just to free it).
  *
  * This is one way we attempt to work around buggy protection software that
@@ -70 +70 @@
  *  - Maybe one more.
  */
-#define SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_ZERO          RT_BIT_32(0)
+#define SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW        RT_BIT_32(0)
 /** @} */
 DECLHIDDEN(int)     supHardenedWinVerifyProcess(HANDLE hProcess, HANDLE hThread, SUPHARDNTVPKIND enmKind, uint32_t fFlags,

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

@@ -1493 +1493 @@
                 if (MemInfo.Type == MEM_PRIVATE)
                 {
-                    SUP_DPRINTF((pThis->fFlags & SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_ZERO
-                                 ? "supHardNtVpScanVirtualMemory: Replacing exec mem at %p (%p LB %#zx)\n"
-                                 : "supHardNtVpScanVirtualMemory: Freeing exec mem at %p (%p LB %#zx)\n",
-                                 uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize));
                     PVOID   pvFree = MemInfo.BaseAddress;
                     SIZE_T  cbFree = MemInfo.RegionSize;
-                    rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
-                    if (!NT_SUCCESS(rcNt))
-                        supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
-                                            "NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
-                                            MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
-                    /* The Trend Micro sakfile.sys BSOD kludge. */
-                    if (pThis->fFlags & SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_ZERO)
+                    if (!(pThis->fFlags & SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW))
                     {
-                        pvFree = MemInfo.BaseAddress;
-                        cbFree = MemInfo.RegionSize;
-                        rcNt = NtAllocateVirtualMemory(pThis->hProcess, &pvFree, 0, &cbFree, MEM_COMMIT, PAGE_READWRITE);
+                        SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Freeing exec mem at %p (%p LB %#zx)\n",
+                                     uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize));
+
+                        rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
                         if (!NT_SUCCESS(rcNt))
-                            supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
-                                                "NtAllocateVirtualMemory (%p LB %#zx) failed with rcNt=%#x allocating "
-                                                "replacement memory for working around buggy protection software. "
-                                                "See VBoxStartup.log for more details",
+                            supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
+                                                "NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
                                                 MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
-                        if (pvFree != MemInfo.BaseAddress)
-                            supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
-                                                "We wanted NtAllocateVirtualMemory to get us %p LB %#zx, but it returned %p LB %#zx.",
-                                                MemInfo.BaseAddress, MemInfo.RegionSize, pvFree, cbFree, rcNt);
+                    }
+                    else
+                    {
+                        /* The Trend Micro sakfile.sys and Digital Guardian dgmaster.sys BSOD kludge. */
+                        SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Replacing exec mem at %p (%p LB %#zx)\n",
+                                     uPtrWhere, MemInfo.BaseAddress, MemInfo.RegionSize));
+                        void *pvCopy = RTMemAllocZ(cbFree);
+                        if (pvCopy)
+                        {
+                            rcNt = supHardNtVpReadMem(pThis->hProcess, (uintptr_t)pvFree, pvCopy, cbFree);
+                            if (!NT_SUCCESS(rcNt))
+                                supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
+                                                    "Error reading data from original alloc: %#x (%p LB %#zx)",
+                                                    rcNt, MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
+
+                            rcNt = NtFreeVirtualMemory(pThis->hProcess, &pvFree, &cbFree, MEM_RELEASE);
+                            if (NT_SUCCESS(rcNt))
+                            {
+                                pvFree = MemInfo.BaseAddress;
+                                cbFree = MemInfo.RegionSize;
+                                rcNt = NtAllocateVirtualMemory(pThis->hProcess, &pvFree, 0, &cbFree, MEM_COMMIT, PAGE_READWRITE);
+                                if (!NT_SUCCESS(rcNt))
+                                    supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
+                                                        "NtAllocateVirtualMemory (%p LB %#zx) failed with rcNt=%#x allocating "
+                                                        "replacement memory for working around buggy protection software. "
+                                                        "See VBoxStartup.log for more details",
+                                                        MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
+                                else if (pvFree != MemInfo.BaseAddress)
+                                    supHardNtVpSetInfo2(pThis, VERR_SUP_VP_REPLACE_VIRTUAL_MEMORY_FAILED,
+                                                        "We wanted NtAllocateVirtualMemory to get us %p LB %#zx, but it returned %p LB %#zx.",
+                                                        MemInfo.BaseAddress, MemInfo.RegionSize, pvFree, cbFree, rcNt);
+                                else
+                                {
+                                    SIZE_T cbWritten;
+                                    rcNt = NtWriteVirtualMemory(pThis->hProcess, MemInfo.BaseAddress, pvCopy, MemInfo.RegionSize,
+                                                                &cbWritten);
+                                    if (!NT_SUCCESS(rcNt))
+                                        supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
+                                                            "NtWriteVirtualMemory (%p LB %#zx) failed: %#x",
+                                                            MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
+                                }
+                            }
+                            else
+                                supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
+                                                    "NtFreeVirtualMemory (%p LB %#zx) failed: %#x",
+                                                    MemInfo.BaseAddress, MemInfo.RegionSize, rcNt);
+                            RTMemFree(pvCopy);
+                        }
+                        else
+                            supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FREE_VIRTUAL_MEMORY_FAILED,
+                                                "RTMemAllocZ(%#zx) failed", MemInfo.RegionSize);
                     }
                 }

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -3523 +3523 @@
                                              g_fSupAdversaries & (  SUPHARDNT_ADVERSARY_TRENDMICRO_SAKFILE
                                                                   | SUPHARDNT_ADVERSARY_DIGITAL_GUARDIAN)
-                                             ? SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_ZERO : 0,
+                                             ? SUPHARDNTVP_F_EXEC_ALLOC_REPLACE_WITH_RW : 0,
                                              &cFixes, RTErrInfoInitStatic(&g_ErrInfoStatic));
         if (RT_FAILURE(rc))