Changeset 53051 in vbox

Timestamp:

Oct 13, 2014 7:46:51 PM (10 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

96546

Message:

supR3HardenedMonitor_LdrLoadDll: Merged the name mapping log statement into the one before the actually loading, i.e. after we've checked whether to be quiet or not.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (8 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -1724 +1724 @@
 supR3HardenedMonitor_LdrLoadDll(PWSTR pwszSearchPath, PULONG pfFlags, PUNICODE_STRING pName, PHANDLE phMod)
 {
-    DWORD    dwSavedLastError = RtlGetLastWin32Error();
-    bool     fQuiet = false;
-    NTSTATUS rcNt;
+    DWORD                   dwSavedLastError = RtlGetLastWin32Error();
+    PUNICODE_STRING const   pOrgName = pName;
+    NTSTATUS                rcNt;
 
     /*
@@ -1771 +1771 @@
      * Absolute path?
      */
+    NTSTATUS        rcNtResolve     = STATUS_SUCCESS;
     bool            fSkipValidation = false;
     WCHAR           wszPath[260];
@@ -1787 +1788 @@
        )
     {
-        rcNt = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/,
-                                                        pName,
-                                                        (PUNICODE_STRING)&s_DefaultSuffix,
-                                                        &UniStrStatic,
-                                                        &UniStrDynamic,
-                                                        &pUniStrResult,
-                                                        NULL /*pNewFlags*/,
-                                                        NULL /*pcbFilename*/,
-                                                        NULL /*pcbNeeded*/);
-        if (NT_SUCCESS(rcNt))
+        rcNtResolve = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/,
+                                                               pName,
+                                                               (PUNICODE_STRING)&s_DefaultSuffix,
+                                                               &UniStrStatic,
+                                                               &UniStrDynamic,
+                                                               &pUniStrResult,
+                                                               NULL /*pNewFlags*/,
+                                                               NULL /*pcbFilename*/,
+                                                               NULL /*pcbNeeded*/);
+        if (NT_SUCCESS(rcNtResolve))
         {
             UINT cwc;
@@ -1883 +1884 @@
          */
         UINT cwc;
-        rcNt = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/,
-                                                        pName,
-                                                        (PUNICODE_STRING)&s_DefaultSuffix,
-                                                        &UniStrStatic,
-                                                        &UniStrDynamic,
-                                                        &pUniStrResult,
-                                                        NULL /*pNewFlags*/,
-                                                        NULL /*pcbFilename*/,
-                                                        NULL /*pcbNeeded*/);
-        if (NT_SUCCESS(rcNt))
+        rcNtResolve = RtlDosApplyFileIsolationRedirection_Ustr(1 /*fFlags*/,
+                                                               pName,
+                                                               (PUNICODE_STRING)&s_DefaultSuffix,
+                                                               &UniStrStatic,
+                                                               &UniStrDynamic,
+                                                               &pUniStrResult,
+                                                               NULL /*pNewFlags*/,
+                                                               NULL /*pcbFilename*/,
+                                                               NULL /*pcbNeeded*/);
+        if (NT_SUCCESS(rcNtResolve))
         {
             rcNt = supR3HardenedCopyRedirectionResult(wszPath, RT_ELEMENTS(wszPath), pUniStrResult, pName, &cwc);
@@ -1935 +1936 @@
         ResolvedName.Length = (USHORT)(cwc * sizeof(WCHAR));
         ResolvedName.MaximumLength = ResolvedName.Length + sizeof(WCHAR);
-
-/** @todo need to cache the translation so we can get at fQuiet here! */
-        SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: '%.*ls' -> '%.*ls' [rcNt=%#x]\n",
-                     (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer,
-                     ResolvedName.Length / sizeof(WCHAR), ResolvedName.Buffer, rcNt));
         pName = &ResolvedName;
     }
 
+    bool fQuiet = false;
     if (!fSkipValidation)
     {
@@ -1992 +1989 @@
                 if (!fQuiet)
                 {
-                    supR3HardenedError(VINF_SUCCESS, false, "supR3HardenedMonitor_LdrLoadDll: rejecting '%ls': rcNt=%#x\n",
-                                       wszPath, rcNt);
+                    if (pOrgName != pName)
+                        supR3HardenedError(VINF_SUCCESS, false, "supR3HardenedMonitor_LdrLoadDll: rejecting '%ls': rcNt=%#x\n",
+                                           wszPath, rcNt);
+                    else
+                        supR3HardenedError(VINF_SUCCESS, false, "supR3HardenedMonitor_LdrLoadDll: rejecting '%ls' (%.*ls): rcNt=%#x\n",
+                                           wszPath, pOrgName->Length / sizeof(WCHAR), pOrgName->Buffer, rcNt);
                     SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: returns rcNt=%#x '%ls'\n", rcNt, wszPath));
                 }
@@ -2005 +2006 @@
         {
             DWORD dwErr = RtlGetLastWin32Error();
-            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: error opening '%ls': %u (NtPath=%.*ls)\n",
-                         wszPath, dwErr, NtPathUniStr.Length / sizeof(RTUTF16), NtPathUniStr.Buffer));
+            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: error opening '%ls': %u (NtPath=%.*ls; Input=%.*ls)\n",
+                         wszPath, dwErr, NtPathUniStr.Length / sizeof(RTUTF16), NtPathUniStr.Buffer,
+                         pOrgName->Length / sizeof(WCHAR), pOrgName->Buffer));
         }
         RTNtPathFree(&NtPathUniStr, &hRootDir);
@@ -2015 +2017 @@
      */
     if (!fQuiet)
-        SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: pName=%.*ls *pfFlags=%#x pwszSearchPath=%p:%ls [calling]\n",
-                     (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer, pfFlags ? *pfFlags : UINT32_MAX, pwszSearchPath,
-                     !((uintptr_t)pwszSearchPath & 1) && (uintptr_t)pwszSearchPath >= 0x2000U ? pwszSearchPath : L"<flags>"));
+    {
+        if (pOrgName != pName)
+            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: pName=%.*ls (Input=%.*ls, rcNtResolve=%#x) *pfFlags=%#x pwszSearchPath=%p:%ls [calling]\n",
+                         (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer,
+                         (unsigned)pOrgName->Length / sizeof(WCHAR), pOrgName->Buffer, rcNtResolve,
+                         pfFlags ? *pfFlags : UINT32_MAX, pwszSearchPath,
+                         !((uintptr_t)pwszSearchPath & 1) && (uintptr_t)pwszSearchPath >= 0x2000U ? pwszSearchPath : L"<flags>"));
+        else
+            SUP_DPRINTF(("supR3HardenedMonitor_LdrLoadDll: pName=%.*ls (rcNtResolve=%#x) *pfFlags=%#x pwszSearchPath=%p:%ls [calling]\n",
+                         (unsigned)pName->Length / sizeof(WCHAR), pName->Buffer, rcNtResolve,
+                         pfFlags ? *pfFlags : UINT32_MAX, pwszSearchPath,
+                         !((uintptr_t)pwszSearchPath & 1) && (uintptr_t)pwszSearchPath >= 0x2000U ? pwszSearchPath : L"<flags>"));
+    }
+
     RtlRestoreLastWin32Error(dwSavedLastError);
     rcNt = g_pfnLdrLoadDllReal(pwszSearchPath, pfFlags, pName, phMod);