[NTOSKRNL] Implement support for PROCESS_DEVICEMAP_INFORMATION_EX in NtQueryInformationProcess

This commit is contained in:
Pierre Schweitzer 2019-06-01 15:18:52 +02:00
parent b16a07fa69
commit 1074a9aaff
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
3 changed files with 51 additions and 16 deletions

View file

@ -296,7 +296,8 @@ VOID
NTAPI NTAPI
ObQueryDeviceMapInformation( ObQueryDeviceMapInformation(
IN PEPROCESS Process, IN PEPROCESS Process,
OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo OUT PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo,
IN ULONG Flags
); );
// //

View file

@ -229,7 +229,8 @@ ObInheritDeviceMap(IN PEPROCESS Parent,
VOID VOID
NTAPI NTAPI
ObQueryDeviceMapInformation(IN PEPROCESS Process, ObQueryDeviceMapInformation(IN PEPROCESS Process,
IN PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo) IN PPROCESS_DEVICEMAP_INFORMATION DeviceMapInfo,
IN ULONG Flags)
{ {
PDEVICE_MAP DeviceMap; PDEVICE_MAP DeviceMap;

View file

@ -78,7 +78,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation; PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation;
PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation; PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation;
PQUOTA_LIMITS QuotaLimits = (PQUOTA_LIMITS)ProcessInformation; PQUOTA_LIMITS QuotaLimits = (PQUOTA_LIMITS)ProcessInformation;
PROCESS_DEVICEMAP_INFORMATION DeviceMap; PROCESS_DEVICEMAP_INFORMATION_EX DeviceMap;
PUNICODE_STRING ImageName; PUNICODE_STRING ImageName;
ULONG Cookie, ExecuteOptions = 0; ULONG Cookie, ExecuteOptions = 0;
ULONG_PTR Wow64 = 0; ULONG_PTR Wow64 = 0;
@ -564,22 +564,55 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
/* DOS Device Map */ /* DOS Device Map */
case ProcessDeviceMap: case ProcessDeviceMap:
if (ProcessInformationLength != RTL_FIELD_SIZE(PROCESS_DEVICEMAP_INFORMATION, Query)) if (ProcessInformationLength < sizeof(PROCESS_DEVICEMAP_INFORMATION))
{
if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX))
{
DPRINT1("PROCESS_DEVICEMAP_INFORMATION_EX not supported!\n");
Status = STATUS_NOT_IMPLEMENTED;
}
else
{ {
Status = STATUS_INFO_LENGTH_MISMATCH; Status = STATUS_INFO_LENGTH_MISMATCH;
}
break; break;
} }
if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX))
{
/* Protect read in SEH */
_SEH2_TRY
{
PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
DeviceMap.Flags = DeviceMapEx->Flags;
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{
/* Get the exception code */
Status = _SEH2_GetExceptionCode();
}
_SEH2_END;
if (!NT_SUCCESS(Status))
{
break;
}
/* Only one flag is supported and it needs LUID mappings */
if ((DeviceMap.Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 ||
!ObIsLUIDDeviceMapsEnabled())
{
Status = STATUS_INVALID_PARAMETER;
break;
}
}
else
{
if (ProcessInformationLength != sizeof(PROCESS_DEVICEMAP_INFORMATION))
{
Status = STATUS_INFO_LENGTH_MISMATCH;
break;
}
/* No flags for standard call */
DeviceMap.Flags = 0;
}
/* Set the return length */ /* Set the return length */
Length = sizeof(PROCESS_DEVICEMAP_INFORMATION); Length = ProcessInformationLength;
/* Reference the process */ /* Reference the process */
Status = ObReferenceObjectByHandle(ProcessHandle, Status = ObReferenceObjectByHandle(ProcessHandle,
@ -591,12 +624,12 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
if (!NT_SUCCESS(Status)) break; if (!NT_SUCCESS(Status)) break;
/* Query the device map information */ /* Query the device map information */
ObQueryDeviceMapInformation(Process, &DeviceMap); ObQueryDeviceMapInformation(Process, (PPROCESS_DEVICEMAP_INFORMATION)&DeviceMap, DeviceMap.Flags);
/* Enter SEH for writing back data */ /* Enter SEH for writing back data */
_SEH2_TRY _SEH2_TRY
{ {
*(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation = DeviceMap; RtlCopyMemory(ProcessInformation, &DeviceMap, sizeof(PROCESS_DEVICEMAP_INFORMATION));
} }
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{ {