[NTOS:MM] Fix MiLocateKernelSections() and MmMakeKernelResourceSectionWritable().

- MiLocateKernelSections(): Fix the calculation of MiKernelResourceEndPte,
  MmPoolCodeEnd and MmPteCodeEnd.

- MmMakeKernelResourceSectionWritable(): Fix PTE looping upper limit;
  use MI_MAKE_HARDWARE_PTE_KERNEL to build the updated read-write PTE.
This commit is contained in:
Hermès Bélusca-Maïto 2019-06-26 00:46:52 +02:00
parent 12542f271d
commit 05616105a5
No known key found for this signature in database
GPG key ID: 3B2539C65E7B93D0

View file

@ -320,8 +320,9 @@ MmCallDllInitialize(IN PLDR_DATA_TABLE_ENTRY LdrEntry,
"DllInitialize"); "DllInitialize");
if (!DllInit) return STATUS_SUCCESS; if (!DllInit) return STATUS_SUCCESS;
/* Do a temporary copy of BaseDllName called ImportName /*
* because we'll alter the length of the string * Do a temporary copy of BaseDllName called ImportName
* because we'll alter the length of the string.
*/ */
ImportName.Length = LdrEntry->BaseDllName.Length; ImportName.Length = LdrEntry->BaseDllName.Length;
ImportName.MaximumLength = LdrEntry->BaseDllName.MaximumLength; ImportName.MaximumLength = LdrEntry->BaseDllName.MaximumLength;
@ -1077,7 +1078,7 @@ MiResolveImageReferences(IN PVOID ImageBase,
GdiLink = GdiLink | GdiLink = GdiLink |
!(_strnicmp(ImportName, "win32k", sizeof("win32k") - 1)); !(_strnicmp(ImportName, "win32k", sizeof("win32k") - 1));
/* We can also allow dxapi (for Windows compat, allow IRT and coverage )*/ /* We can also allow dxapi (for Windows compat, allow IRT and coverage) */
NormalLink = NormalLink | NormalLink = NormalLink |
((_strnicmp(ImportName, "win32k", sizeof("win32k") - 1)) && ((_strnicmp(ImportName, "win32k", sizeof("win32k") - 1)) &&
(_strnicmp(ImportName, "dxapi", sizeof("dxapi") - 1)) && (_strnicmp(ImportName, "dxapi", sizeof("dxapi") - 1)) &&
@ -2149,8 +2150,8 @@ MiLocateKernelSections(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
SectionHeader = IMAGE_FIRST_SECTION(NtHeaders); SectionHeader = IMAGE_FIRST_SECTION(NtHeaders);
/* Loop all the sections */ /* Loop all the sections */
Sections = NtHeaders->FileHeader.NumberOfSections; for (Sections = NtHeaders->FileHeader.NumberOfSections;
while (Sections) Sections > 0; --Sections, ++SectionHeader)
{ {
/* Grab the size of the section */ /* Grab the size of the section */
Size = max(SectionHeader->SizeOfRawData, SectionHeader->Misc.VirtualSize); Size = max(SectionHeader->SizeOfRawData, SectionHeader->Misc.VirtualSize);
@ -2161,8 +2162,8 @@ MiLocateKernelSections(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
/* Remember the PTEs so we can modify them later */ /* Remember the PTEs so we can modify them later */
MiKernelResourceStartPte = MiAddressToPte(DllBase + MiKernelResourceStartPte = MiAddressToPte(DllBase +
SectionHeader->VirtualAddress); SectionHeader->VirtualAddress);
MiKernelResourceEndPte = MiKernelResourceStartPte + MiKernelResourceEndPte = MiAddressToPte(ROUND_TO_PAGES(DllBase +
BYTES_TO_PAGES(SectionHeader->VirtualAddress + Size); SectionHeader->VirtualAddress + Size));
} }
else if (*(PULONG)SectionHeader->Name == 'LOOP') else if (*(PULONG)SectionHeader->Name == 'LOOP')
{ {
@ -2177,20 +2178,16 @@ MiLocateKernelSections(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
{ {
/* Found Mm* Pool code */ /* Found Mm* Pool code */
MmPoolCodeStart = DllBase + SectionHeader->VirtualAddress; MmPoolCodeStart = DllBase + SectionHeader->VirtualAddress;
MmPoolCodeEnd = ExPoolCodeStart + Size; MmPoolCodeEnd = MmPoolCodeStart + Size;
} }
} }
else if ((*(PULONG)SectionHeader->Name == 'YSIM') && else if ((*(PULONG)SectionHeader->Name == 'YSIM') &&
(*(PULONG)&SectionHeader->Name[4] == 'ETPS')) (*(PULONG)&SectionHeader->Name[4] == 'ETPS'))
{ {
/* Found MISYSPTE (Mm System PTE code)*/ /* Found MISYSPTE (Mm System PTE code) */
MmPteCodeStart = DllBase + SectionHeader->VirtualAddress; MmPteCodeStart = DllBase + SectionHeader->VirtualAddress;
MmPteCodeEnd = ExPoolCodeStart + Size; MmPteCodeEnd = MmPteCodeStart + Size;
} }
/* Keep going */
Sections--;
SectionHeader++;
} }
} }
@ -2300,16 +2297,13 @@ MmMakeKernelResourceSectionWritable(VOID)
return; return;
/* Loop the PTEs */ /* Loop the PTEs */
for (PointerPte = MiKernelResourceStartPte; PointerPte <= MiKernelResourceEndPte; PointerPte++) for (PointerPte = MiKernelResourceStartPte; PointerPte < MiKernelResourceEndPte; ++PointerPte)
{ {
/* Read the PTE */ /* Read the PTE */
TempPte = *PointerPte; TempPte = *PointerPte;
/* Make sure it's valid */
ASSERT(TempPte.u.Hard.Valid == 1);
/* Update the protection */ /* Update the protection */
MI_MAKE_WRITE_PAGE(&TempPte); MI_MAKE_HARDWARE_PTE_KERNEL(&TempPte, PointerPte, MM_READWRITE, TempPte.u.Hard.PageFrameNumber);
MI_UPDATE_VALID_PTE(PointerPte, TempPte); MI_UPDATE_VALID_PTE(PointerPte, TempPte);
} }
@ -2620,8 +2614,7 @@ MiEnablePagingOfDriver(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
{ {
/* Nope, setup the first PTE address */ /* Nope, setup the first PTE address */
PointerPte = MiAddressToPte(ROUND_TO_PAGES(ImageBase + PointerPte = MiAddressToPte(ROUND_TO_PAGES(ImageBase +
Section-> Section->VirtualAddress));
VirtualAddress));
} }
/* Compute the size */ /* Compute the size */
@ -2630,9 +2623,7 @@ MiEnablePagingOfDriver(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
/* Find the last PTE that maps this section */ /* Find the last PTE that maps this section */
LastPte = MiAddressToPte(ImageBase + LastPte = MiAddressToPte(ImageBase +
Section->VirtualAddress + Section->VirtualAddress +
Alignment + Alignment + Size - PAGE_SIZE);
Size -
PAGE_SIZE);
} }
else else
{ {