Changeset 80216 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Aug 10, 2019 2:04:07 AM (5 years ago)

Author:

vboxsync

Message:

SUPHardNt: Restore text and import sections for ntdll, kernelbase and kernel32 for the first process too to try shake nasty stuff like easyhook that modifies the initial thread context and crashes the guest when trying to execute memory we've freed up during child purification.

Location:

trunk/src/VBox/HostDrivers/Support

Files:

• SUPR3HardenedMain.cpp (modified) (1 diff)
• win/SUPHardenedVerify-win.h (modified) (1 diff)
• win/SUPHardenedVerifyProcess-win.cpp (modified) (6 diffs)
• win/SUPR3HardenedMain-win.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -2518 +2518 @@
     {
         SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
-        supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV, false /*fAvastKludge*/);
+        supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV | SUPSECMAIN_FLAGS_FIRST_PROCESS, false /*fAvastKludge*/);
         supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
         return supR3HardenedWinReSpawn(1 /*iWhich*/);

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerify-win.h

@@ -55 +55 @@
     SUPHARDNTVPKIND_CHILD_PURIFICATION,
     SUPHARDNTVPKIND_SELF_PURIFICATION,
+    SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED,
     SUPHARDNTVPKIND_32BIT_HACK = 0x7fffffff
 } SUPHARDNTVPKIND;

trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

@@ -492 +492 @@
 #ifdef IN_RING3
             if (   pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
-                || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
+                || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION
+                || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
             {
                 PVOID pvRestoreAddr = (uint8_t *)pImage->uImageBase + uRva;
@@ -532 +533 @@
         return VINF_SUCCESS;
     if (   pThis->enmKind == SUPHARDNTVPKIND_CHILD_PURIFICATION
-        || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
+        || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION
+        || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
         return VINF_SUCCESS;
 
@@ -1357 +1359 @@
             pThis->cFixes++;
             SUP_DPRINTF(("supHardNtVpScanVirtualMemory: NtUnmapViewOfSection(,%p) failed: %#x\n", pMemInfo->AllocationBase, rcNt));
+        }
+        else if (pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
+        {
+            SUP_DPRINTF(("supHardNtVpScanVirtualMemory: Ignoring unknown mem at %p LB %#zx (base %p) - '%ls'\n",
+                         pMemInfo->BaseAddress, pMemInfo->RegionSize, pMemInfo->AllocationBase, pwszFilename));
+            return VINF_OBJECT_DESTROYED;
         }
 #endif
@@ -1877 +1885 @@
                 pThis->cFixes++;
             }
-            else
+            else if (pThis->enmKind != SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
 # endif /* IN_RING3 */
                 supHardNtVpSetInfo2(pThis, VERR_SUP_VP_FOUND_EXEC_MEMORY,
@@ -2436 +2444 @@
         return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_NTDLL_MAPPING,
                                    "The process has no NTDLL.DLL.");
-    if (iKernel32 == UINT32_MAX && pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION)
+    if (iKernel32 == UINT32_MAX && (   pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION
+                                    || pThis->enmKind == SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED))
         return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_NO_KERNEL32_MAPPING,
                                    "The process has no KERNEL32.DLL.");
@@ -2492 +2501 @@
      */
     int rc = VINF_SUCCESS;
-    if (enmKind != SUPHARDNTVPKIND_CHILD_PURIFICATION)
+    if (   enmKind != SUPHARDNTVPKIND_CHILD_PURIFICATION
+        && enmKind != SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED)
        rc = supHardNtVpThread(hProcess, hThread, pErrInfo);
     if (RT_SUCCESS(rc))

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -5157 +5157 @@
          */
         supR3HardenedWinInstallHooks();
+    }
+    else if (fFlags & SUPSECMAIN_FLAGS_FIRST_PROCESS)
+    {
+        /*
+         * Try shake anyone (e.g. easyhook) patching process creation code in
+         * kernelbase, kernel32 or ntdll so they won't so easily cause the child 
+         * to crash when we respawn and purify it.
+         */
+        SUP_DPRINTF(("supR3HardenedWinInit: doing limited purification...\n"));
+        uint32_t cFixes = 0;
+        rc = supHardenedWinVerifyProcess(NtCurrentProcess(), NtCurrentThread(), SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED,
+                                         0 /*fFlags*/, &cFixes, NULL /*pErrInfo*/);
+        SUP_DPRINTF(("supR3HardenedWinInit: SUPHARDNTVPKIND_SELF_PURIFICATION_LIMITED -> %Rrc, cFixes=%d\n", rc, cFixes));
+        RT_NOREF(rc); /* ignored on purpose */
     }