Changeset 54139 in vbox for trunk

Timestamp:

Feb 11, 2015 1:54:44 PM (10 years ago)

Author:

vboxsync

Message:

SUPR3HardenedMain-win.cpp: Workaround for a process deadlock caused by our favourite Symantec driver (SysPlant.sys) that would lead to the system getting stuck during reboot and shutdown.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -4108 +4108 @@
      * Apply anti debugger notification trick to the thread.  (Also done in
      * supR3HardenedWinInit.)  This may fail with STATUS_ACCESS_DENIED and
-     * maybe other errors.
-     */
-    rcNt = NtSetInformationThread(This.hThread, ThreadHideFromDebugger, NULL, 0);
-    if (!NT_SUCCESS(rcNt))
-        SUP_DPRINTF(("supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: %#x (harmless)\n", rcNt));
+     * maybe other errors.  (Unfortunately, recent (SEP 12.1) of symantec's
+     * sysplant.sys driver will cause process deadlocks and a shutdown/reboot
+     * denial of service problem if we hide the initial thread, so we postpone
+     * this action if we've detected SEP.)
+     */
+    if (!(g_fSupAdversaries & (SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT | SUPHARDNT_ADVERSARY_SYMANTEC_N360)))
+    {
+        rcNt = NtSetInformationThread(This.hThread, ThreadHideFromDebugger, NULL, 0);
+        if (!NT_SUCCESS(rcNt))
+            SUP_DPRINTF(("supR3HardenedWinReSpawn: NtSetInformationThread/ThreadHideFromDebugger failed: %#x (harmless)\n", rcNt));
+    }
 #endif
 
@@ -5101 +5107 @@
     } s_aDrivers[] =
     {
+        { SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT,    "SysPlant" },
+
         { SUPHARDNT_ADVERSARY_SYMANTEC_N360,        "SRTSPX" },
         { SUPHARDNT_ADVERSARY_SYMANTEC_N360,        "SymDS" },
@@ -5187 +5195 @@
     } s_aFiles[] =
     {
-        { SUPHARDNT_ADVERSARY_SYMANTEC_N360, L"\\SystemRoot\\System32\\drivers\\SysPlant.sys" },
-        { SUPHARDNT_ADVERSARY_SYMANTEC_N360, L"\\SystemRoot\\System32\\sysfer.dll" },
-        { SUPHARDNT_ADVERSARY_SYMANTEC_N360, L"\\SystemRoot\\System32\\sysferThunk.dll" },
+        { SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT, L"\\SystemRoot\\System32\\drivers\\SysPlant.sys" },
+        { SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT, L"\\SystemRoot\\System32\\sysfer.dll" },
+        { SUPHARDNT_ADVERSARY_SYMANTEC_SYSPLANT, L"\\SystemRoot\\System32\\sysferThunk.dll" },
 
         { SUPHARDNT_ADVERSARY_SYMANTEC_N360, L"\\SystemRoot\\System32\\drivers\\N360x64\\1505000.013\\ccsetx64.sys" },