Changeset 77816 in vbox for trunk/src/VBox/HostDrivers/Support/win

Timestamp:

Mar 21, 2019 12:01:49 AM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

129490

Message:

SupHardNt: Made RTNtPathExpand8dot3Path() work correctly in kernel context (needs IPRT_NT_MAP_TO_ZW) and expand 8.3 names when comparing the executable image we found in the memory map with what NT returns for the process.

Location:

trunk/src/VBox/HostDrivers/Support/win

Files:

• SUPDrv-win.cpp (modified) (1 diff)
• SUPHardenedVerifyImage-win.cpp (modified) (1 diff)
• SUPHardenedVerifyProcess-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

@@ -29 +29 @@
 *   Header Files                                                                                                                 *
 *********************************************************************************************************************************/
-#define IPRT_NT_MAP_TO_ZW
+#ifndef IPRT_NT_MAP_TO_ZW
+# define IPRT_NT_MAP_TO_ZW
+#endif
 #define LOG_GROUP LOG_GROUP_SUP_DRV
 #include "../SUPDrvInternal.h"

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

@@ -30 +30 @@
 *********************************************************************************************************************************/
 #ifdef IN_RING0
-# define IPRT_NT_MAP_TO_ZW
+# ifndef IPRT_NT_MAP_TO_ZW
+#  define IPRT_NT_MAP_TO_ZW
+# endif
 # include <iprt/nt/nt.h>
 # include <ntimage.h>

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

@@ -30 +30 @@
 *********************************************************************************************************************************/
 #ifdef IN_RING0
-# define IPRT_NT_MAP_TO_ZW
+# ifndef IPRT_NT_MAP_TO_ZW
+#  define IPRT_NT_MAP_TO_ZW
+# endif
 # include <iprt/nt/nt.h>
 # include <ntimage.h>
@@ -1166 +1168 @@
             return true;
     }
+}
+
+
+/**
+ * Compares two paths, expanding 8.3 short names as needed.
+ *
+ * @returns true / false.
+ * @param   pUniStr1        The first path.  Must be zero terminated!
+ * @param   pUniStr2        The second path.  Must be zero terminated!
+ */
+static bool supHardNtVpArePathsEqual(PCUNICODE_STRING pUniStr1, PCUNICODE_STRING pUniStr2)
+{
+    /* Both strings must be null terminated. */
+    Assert(pUniStr1->Buffer[pUniStr1->Length / sizeof(WCHAR)] == '\0');
+    Assert(pUniStr2->Buffer[pUniStr1->Length / sizeof(WCHAR)] == '\0');
+
+    /* Simple compare first.*/
+    if (supHardNtVpAreUniStringsEqual(pUniStr1, pUniStr2))
+        return true;
+
+    /* Make long names if needed. */
+    UNICODE_STRING UniStrLong1 = { 0, 0, NULL };
+    if (RTNtPathFindPossible8dot3Name(pUniStr1->Buffer))
+    {
+        int rc = RTNtPathExpand8dot3PathA(pUniStr1, false /*fPathOnly*/, &UniStrLong1);
+        if (RT_SUCCESS(rc))
+            pUniStr1 = &UniStrLong1;
+    }
+
+    UNICODE_STRING UniStrLong2 = { 0, 0, NULL };
+    if (RTNtPathFindPossible8dot3Name(pUniStr2->Buffer))
+    {
+        int rc = RTNtPathExpand8dot3PathA(pUniStr2, false /*fPathOnly*/, &UniStrLong2);
+        if (RT_SUCCESS(rc))
+            pUniStr2 = &UniStrLong2;
+    }
+
+    /* Compare again. */
+    bool fCompare = supHardNtVpAreUniStringsEqual(pUniStr1, pUniStr2);
+
+    /* Clean up. */
+    if (UniStrLong1.Buffer)
+        RTUtf16Free(UniStrLong1.Buffer);
+    if (UniStrLong2.Buffer)
+        RTUtf16Free(UniStrLong2.Buffer);
+
+    return fCompare;
 }
 
@@ -2264 +2313 @@
     if (NT_SUCCESS(rcNt))
     {
-        if (supHardNtVpAreUniStringsEqual(pUniStr, &pImage->Name.UniStr))
+        pUniStr->Buffer[pUniStr->Length / sizeof(WCHAR)] = '\0';
+        if (supHardNtVpArePathsEqual(pUniStr, &pImage->Name.UniStr))
             rc = VINF_SUCCESS;
         else
-        {
-            pUniStr->Buffer[pUniStr->Length / sizeof(WCHAR)] = '\0';
             rc = supHardNtVpSetInfo2(pThis, VERR_SUP_VP_EXE_VS_PROC_NAME_MISMATCH,
                                      "Process image name does not match the exectuable we found: %ls vs %ls.",
                                      pUniStr->Buffer, pImage->Name.UniStr.Buffer);
-        }
     }
     else