1. remove obsolete buffer size checks from NtQueryInformationProcess()

2. fixed some buffer checks

svn path=/trunk/; revision=13210
This commit is contained in:
Thomas Bluemel 2005-01-22 13:34:27 +00:00
parent 1be6d7bcaa
commit d361170c2c
7 changed files with 357 additions and 290 deletions

View file

@ -151,6 +151,11 @@ NtCreateEvent(OUT PHANDLE EventHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObCreateObject(PreviousMode, Status = ObCreateObject(PreviousMode,
@ -285,6 +290,11 @@ NtPulseEvent(IN HANDLE EventHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObReferenceObjectByHandle(EventHandle, Status = ObReferenceObjectByHandle(EventHandle,
@ -421,6 +431,11 @@ NtResetEvent(IN HANDLE EventHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObReferenceObjectByHandle(EventHandle, Status = ObReferenceObjectByHandle(EventHandle,
@ -481,6 +496,11 @@ NtSetEvent(IN HANDLE EventHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObReferenceObjectByHandle(EventHandle, Status = ObReferenceObjectByHandle(EventHandle,

View file

@ -114,6 +114,11 @@ NtCreateEventPair(OUT PHANDLE EventPairHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObCreateObject(ExGetPreviousMode(), Status = ObCreateObject(ExGetPreviousMode(),
@ -183,6 +188,11 @@ NtOpenEventPair(OUT PHANDLE EventPairHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObOpenObjectByName(ObjectAttributes, Status = ObOpenObjectByName(ObjectAttributes,

View file

@ -137,6 +137,11 @@ NtCreateMutant(OUT PHANDLE MutantHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObCreateObject(PreviousMode, Status = ObCreateObject(PreviousMode,
@ -343,6 +348,11 @@ NtReleaseMutant(IN HANDLE MutantHandle,
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
} }
Status = ObReferenceObjectByHandle(MutantHandle, Status = ObReferenceObjectByHandle(MutantHandle,

View file

@ -119,10 +119,42 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
IN KPROFILE_SOURCE ProfileSource, IN KPROFILE_SOURCE ProfileSource,
IN KAFFINITY Affinity) IN KAFFINITY Affinity)
{ {
HANDLE SafeProfileHandle; HANDLE hProfile;
NTSTATUS Status;
PKPROFILE Profile; PKPROFILE Profile;
PEPROCESS pProcess; PEPROCESS pProcess;
KPROCESSOR_MODE PreviousMode;
OBJECT_ATTRIBUTES ObjectAttributes;
NTSTATUS Status = STATUS_SUCCESS;
PreviousMode = ExGetPreviousMode();
if(BufferSize == 0)
{
return STATUS_INVALID_PARAMETER_7;
}
if(PreviousMode != KernelMode)
{
_SEH_TRY
{
ProbeForWrite(ProfileHandle,
sizeof(HANDLE),
sizeof(ULONG));
ProbeForWrite(Buffer,
BufferSize,
sizeof(ULONG));
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
}
/* /*
* Reference the associated process * Reference the associated process
@ -132,7 +164,7 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
Status = ObReferenceObjectByHandle(Process, Status = ObReferenceObjectByHandle(Process,
PROCESS_QUERY_INFORMATION, PROCESS_QUERY_INFORMATION,
PsProcessType, PsProcessType,
UserMode, PreviousMode,
(PVOID*)&pProcess, (PVOID*)&pProcess,
NULL); NULL);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
@ -143,7 +175,11 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
else else
{ {
pProcess = NULL; pProcess = NULL;
/* FIXME: Check privilege. */ if(!SeSinglePrivilegeCheck(SeSystemProfilePrivilege,
PreviousMode))
{
return STATUS_PRIVILEGE_NOT_HELD;
}
} }
/* /*
@ -170,10 +206,16 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
/* /*
* Create the object * Create the object
*/ */
Status = ObCreateObject(ExGetPreviousMode(), InitializeObjectAttributes(&ObjectAttributes,
NULL,
0,
NULL,
NULL);
Status = ObCreateObject(KernelMode,
ExProfileObjectType, ExProfileObjectType,
NULL, &ObjectAttributes,
ExGetPreviousMode(), PreviousMode,
NULL, NULL,
sizeof(KPROFILE), sizeof(KPROFILE),
0, 0,
@ -193,6 +235,7 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
Profile->BufferMdl = MmCreateMdl(NULL, Buffer, BufferSize); Profile->BufferMdl = MmCreateMdl(NULL, Buffer, BufferSize);
if(Profile->BufferMdl == NULL) { if(Profile->BufferMdl == NULL) {
DPRINT("MmCreateMdl: Out of memory!"); DPRINT("MmCreateMdl: Out of memory!");
ObDereferenceObject (Profile);
return(STATUS_NO_MEMORY); return(STATUS_NO_MEMORY);
} }
MmProbeAndLockPages(Profile->BufferMdl, UserMode, IoWriteAccess); MmProbeAndLockPages(Profile->BufferMdl, UserMode, IoWriteAccess);
@ -212,7 +255,7 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
STANDARD_RIGHTS_ALL, STANDARD_RIGHTS_ALL,
0, 0,
NULL, NULL,
&SafeProfileHandle); &hProfile);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
ObDereferenceObject (Profile); ObDereferenceObject (Profile);
@ -222,39 +265,70 @@ NtCreateProfile(OUT PHANDLE ProfileHandle,
/* /*
* Copy the created handle back to the caller * Copy the created handle back to the caller
*/ */
Status = MmCopyToCaller(ProfileHandle, &SafeProfileHandle, sizeof(HANDLE)); _SEH_TRY
if (!NT_SUCCESS(Status)) {
{ *ProfileHandle = hProfile;
ObDereferenceObject(Profile); }
ZwClose(ProfileHandle); _SEH_HANDLE
return(Status); {
} Status = _SEH_GetExceptionCode();
}
_SEH_END;
ObDereferenceObject(Profile); ObDereferenceObject(Profile);
return(STATUS_SUCCESS); return Status;
} }
NTSTATUS STDCALL NTSTATUS STDCALL
NtQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource, NtQueryIntervalProfile(IN KPROFILE_SOURCE ProfileSource,
OUT PULONG Interval) OUT PULONG Interval)
{ {
NTSTATUS Status; KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
{
_SEH_TRY
{
ProbeForWrite(Interval,
sizeof(ULONG),
sizeof(ULONG));
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
}
if (ProfileSource == ProfileTime) if (ProfileSource == ProfileTime)
{ {
ULONG SafeInterval; ULONG ReturnInterval;
/* FIXME: What units does this use, for now nanoseconds */ /* FIXME: What units does this use, for now nanoseconds */
SafeInterval = 100; ReturnInterval = 100;
Status = MmCopyToCaller(Interval, &SafeInterval, sizeof(ULONG));
if (!NT_SUCCESS(Status)) _SEH_TRY
{ {
return(Status); *Interval = ReturnInterval;
} }
return(STATUS_SUCCESS); _SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
return Status;
} }
return(STATUS_INVALID_PARAMETER_2); return STATUS_INVALID_PARAMETER_2;
} }
NTSTATUS STDCALL NTSTATUS STDCALL
@ -267,13 +341,16 @@ NtSetIntervalProfile(IN ULONG Interval,
NTSTATUS STDCALL NTSTATUS STDCALL
NtStartProfile(IN HANDLE ProfileHandle) NtStartProfile(IN HANDLE ProfileHandle)
{ {
NTSTATUS Status;
PKPROFILE Profile; PKPROFILE Profile;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PreviousMode = ExGetPreviousMode();
Status = ObReferenceObjectByHandle(ProfileHandle, Status = ObReferenceObjectByHandle(ProfileHandle,
STANDARD_RIGHTS_ALL, STANDARD_RIGHTS_ALL,
ExProfileObjectType, ExProfileObjectType,
UserMode, PreviousMode,
(PVOID*)&Profile, (PVOID*)&Profile,
NULL); NULL);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
@ -288,13 +365,16 @@ NtStartProfile(IN HANDLE ProfileHandle)
NTSTATUS STDCALL NTSTATUS STDCALL
NtStopProfile(IN HANDLE ProfileHandle) NtStopProfile(IN HANDLE ProfileHandle)
{ {
NTSTATUS Status;
PKPROFILE Profile; PKPROFILE Profile;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PreviousMode = ExGetPreviousMode();
Status = ObReferenceObjectByHandle(ProfileHandle, Status = ObReferenceObjectByHandle(ProfileHandle,
STANDARD_RIGHTS_ALL, STANDARD_RIGHTS_ALL,
ExProfileObjectType, ExProfileObjectType,
UserMode, PreviousMode,
(PVOID*)&Profile, (PVOID*)&Profile,
NULL); NULL);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))

View file

@ -95,7 +95,6 @@ NtQuerySystemEnvironmentValue (IN PUNICODE_STRING VariableName,
IN ULONG ValueBufferLength, IN ULONG ValueBufferLength,
IN OUT PULONG ReturnLength OPTIONAL) IN OUT PULONG ReturnLength OPTIONAL)
{ {
NTSTATUS Status;
ANSI_STRING AName; ANSI_STRING AName;
UNICODE_STRING WName; UNICODE_STRING WName;
BOOLEAN Result; BOOLEAN Result;
@ -103,8 +102,38 @@ NtQuerySystemEnvironmentValue (IN PUNICODE_STRING VariableName,
ANSI_STRING AValue; ANSI_STRING AValue;
UNICODE_STRING WValue; UNICODE_STRING WValue;
KPROCESSOR_MODE PreviousMode; KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PreviousMode = ExGetPreviousMode(); PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
{
_SEH_TRY
{
ProbeForRead(VariableName,
sizeof(UNICODE_STRING),
sizeof(ULONG));
ProbeForWrite(ValueBuffer,
ValueBufferLength,
sizeof(WCHAR));
if(ReturnLength != NULL)
{
ProbeForWrite(ReturnLength,
sizeof(ULONG),
sizeof(ULONG));
}
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
}
/* /*
* Copy the name to kernel space if necessary and convert it to ANSI. * Copy the name to kernel space if necessary and convert it to ANSI.
@ -116,19 +145,6 @@ NtQuerySystemEnvironmentValue (IN PUNICODE_STRING VariableName,
VariableName); VariableName);
if(NT_SUCCESS(Status)) if(NT_SUCCESS(Status))
{ {
if(PreviousMode != KernelMode)
{
ProbeForWrite(ValueBuffer,
ValueBufferLength,
sizeof(WCHAR));
if(ReturnLength != NULL)
{
ProbeForWrite(ReturnLength,
sizeof(ULONG),
sizeof(ULONG));
}
}
/* /*
* according to ntinternals the SeSystemEnvironmentName privilege is required! * according to ntinternals the SeSystemEnvironmentName privilege is required!
*/ */

View file

@ -65,26 +65,15 @@ IoCreateSynchronizationEvent(PUNICODE_STRING EventName,
PHANDLE EventHandle) PHANDLE EventHandle)
{ {
OBJECT_ATTRIBUTES ObjectAttributes; OBJECT_ATTRIBUTES ObjectAttributes;
UNICODE_STRING CapturedEventName;
KPROCESSOR_MODE PreviousMode; KPROCESSOR_MODE PreviousMode;
PKEVENT Event; PKEVENT Event;
HANDLE Handle; HANDLE Handle;
NTSTATUS Status; NTSTATUS Status;
PreviousMode = ExGetPreviousMode(); PreviousMode = ExGetPreviousMode();
Status = RtlCaptureUnicodeString(&CapturedEventName,
PreviousMode,
NonPagedPool,
FALSE,
EventName);
if (!NT_SUCCESS(Status))
{
return NULL;
}
InitializeObjectAttributes(&ObjectAttributes, InitializeObjectAttributes(&ObjectAttributes,
&CapturedEventName, EventName,
OBJ_OPENIF, OBJ_OPENIF,
NULL, NULL,
NULL); NULL);
@ -95,10 +84,6 @@ IoCreateSynchronizationEvent(PUNICODE_STRING EventName,
SynchronizationEvent, SynchronizationEvent,
TRUE); TRUE);
RtlRelaseCapturedUnicodeString(&CapturedEventName,
PreviousMode,
FALSE);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
return NULL; return NULL;

View file

@ -1208,39 +1208,34 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
switch (ProcessInformationClass) switch (ProcessInformationClass)
{ {
case ProcessBasicInformation: case ProcessBasicInformation:
if (ProcessInformationLength != sizeof(PROCESS_BASIC_INFORMATION)) {
{ PPROCESS_BASIC_INFORMATION ProcessBasicInformationP =
Status = STATUS_INFO_LENGTH_MISMATCH; (PPROCESS_BASIC_INFORMATION)ProcessInformation;
}
else
{
PPROCESS_BASIC_INFORMATION ProcessBasicInformationP =
(PPROCESS_BASIC_INFORMATION)ProcessInformation;
_SEH_TRY _SEH_TRY
{ {
ProcessBasicInformationP->ExitStatus = Process->ExitStatus; ProcessBasicInformationP->ExitStatus = Process->ExitStatus;
ProcessBasicInformationP->PebBaseAddress = Process->Peb; ProcessBasicInformationP->PebBaseAddress = Process->Peb;
ProcessBasicInformationP->AffinityMask = Process->Pcb.Affinity; ProcessBasicInformationP->AffinityMask = Process->Pcb.Affinity;
ProcessBasicInformationP->UniqueProcessId = ProcessBasicInformationP->UniqueProcessId =
Process->UniqueProcessId; Process->UniqueProcessId;
ProcessBasicInformationP->InheritedFromUniqueProcessId = ProcessBasicInformationP->InheritedFromUniqueProcessId =
(ULONG)Process->InheritedFromUniqueProcessId; (ULONG)Process->InheritedFromUniqueProcessId;
ProcessBasicInformationP->BasePriority = ProcessBasicInformationP->BasePriority =
Process->Pcb.BasePriority; Process->Pcb.BasePriority;
if (ReturnLength) if (ReturnLength)
{ {
*ReturnLength = sizeof(PROCESS_BASIC_INFORMATION); *ReturnLength = sizeof(PROCESS_BASIC_INFORMATION);
} }
} }
_SEH_HANDLE _SEH_HANDLE
{ {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
}
break; break;
}
case ProcessQuotaLimits: case ProcessQuotaLimits:
case ProcessIoCounters: case ProcessIoCounters:
@ -1248,56 +1243,43 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
break; break;
case ProcessTimes: case ProcessTimes:
if (ProcessInformationLength != sizeof(KERNEL_USER_TIMES)) {
{ PKERNEL_USER_TIMES ProcessTimeP = (PKERNEL_USER_TIMES)ProcessInformation;
Status = STATUS_INFO_LENGTH_MISMATCH; _SEH_TRY
} {
else ProcessTimeP->CreateTime = Process->CreateTime;
{ ProcessTimeP->UserTime.QuadPart = Process->Pcb.UserTime * 100000LL;
PKERNEL_USER_TIMES ProcessTimeP = (PKERNEL_USER_TIMES)ProcessInformation; ProcessTimeP->KernelTime.QuadPart = Process->Pcb.KernelTime * 100000LL;
_SEH_TRY ProcessTimeP->ExitTime = Process->ExitTime;
{
ProcessTimeP->CreateTime = Process->CreateTime;
ProcessTimeP->UserTime.QuadPart = Process->Pcb.UserTime * 100000LL;
ProcessTimeP->KernelTime.QuadPart = Process->Pcb.KernelTime * 100000LL;
ProcessTimeP->ExitTime = Process->ExitTime;
if (ReturnLength) if (ReturnLength)
{ {
*ReturnLength = sizeof(KERNEL_USER_TIMES); *ReturnLength = sizeof(KERNEL_USER_TIMES);
} }
} }
_SEH_HANDLE _SEH_HANDLE
{ {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
} break;
break; }
case ProcessDebugPort: case ProcessDebugPort:
{ {
if (ProcessInformationLength != sizeof(HANDLE)) _SEH_TRY
{ {
Status = STATUS_INFO_LENGTH_MISMATCH; *(PHANDLE)ProcessInformation = (Process->DebugPort != NULL ? (HANDLE)-1 : NULL);
} if (ReturnLength)
else {
{ *ReturnLength = sizeof(HANDLE);
_SEH_TRY }
{ }
_SEH_HANDLE
*(PHANDLE)ProcessInformation = (Process->DebugPort != NULL ? (HANDLE)-1 : NULL); {
if (ReturnLength) Status = _SEH_GetExceptionCode();
{ }
*ReturnLength = sizeof(HANDLE); _SEH_END;
}
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
}
break; break;
} }
@ -1308,54 +1290,42 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
break; break;
case ProcessHandleCount: case ProcessHandleCount:
if (ProcessInformationLength != sizeof(ULONG)) {
{ ULONG HandleCount = ObpGetHandleCountByHandleTable(&Process->HandleTable);
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
ULONG HandleCount = ObpGetHandleCountByHandleTable(&Process->HandleTable);
_SEH_TRY _SEH_TRY
{
*(PULONG)ProcessInformation = HandleCount;
if (ReturnLength)
{ {
*(PULONG)ProcessInformation = HandleCount; *ReturnLength = sizeof(ULONG);
if (ReturnLength)
{
*ReturnLength = sizeof(ULONG);
}
} }
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
} }
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
break; break;
}
case ProcessSessionInformation: case ProcessSessionInformation:
{ {
if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION)) PPROCESS_SESSION_INFORMATION SessionInfo = (PPROCESS_SESSION_INFORMATION)ProcessInformation;
{
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
PPROCESS_SESSION_INFORMATION SessionInfo = (PPROCESS_SESSION_INFORMATION)ProcessInformation;
_SEH_TRY _SEH_TRY
{
SessionInfo->SessionId = Process->SessionId;
if (ReturnLength)
{ {
SessionInfo->SessionId = Process->SessionId; *ReturnLength = sizeof(PROCESS_SESSION_INFORMATION);
if (ReturnLength)
{
*ReturnLength = sizeof(PROCESS_SESSION_INFORMATION);
}
} }
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
} }
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
break; break;
} }
@ -1365,148 +1335,123 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
break; break;
case ProcessVmCounters: case ProcessVmCounters:
if (ProcessInformationLength != sizeof(VM_COUNTERS)) {
{ PVM_COUNTERS pOut = (PVM_COUNTERS)ProcessInformation;
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
PVM_COUNTERS pOut = (PVM_COUNTERS)ProcessInformation;
_SEH_TRY _SEH_TRY
{ {
pOut->PeakVirtualSize = Process->PeakVirtualSize; pOut->PeakVirtualSize = Process->PeakVirtualSize;
/* /*
* Here we should probably use VirtualSize.LowPart, but due to * Here we should probably use VirtualSize.LowPart, but due to
* incompatibilities in current headers (no unnamed union), * incompatibilities in current headers (no unnamed union),
* I opted for cast. * I opted for cast.
*/ */
pOut->VirtualSize = (ULONG)Process->VirtualSize.QuadPart; pOut->VirtualSize = (ULONG)Process->VirtualSize.QuadPart;
pOut->PageFaultCount = Process->Vm.PageFaultCount; pOut->PageFaultCount = Process->Vm.PageFaultCount;
pOut->PeakWorkingSetSize = Process->Vm.PeakWorkingSetSize; pOut->PeakWorkingSetSize = Process->Vm.PeakWorkingSetSize;
pOut->WorkingSetSize = Process->Vm.WorkingSetSize; pOut->WorkingSetSize = Process->Vm.WorkingSetSize;
pOut->QuotaPeakPagedPoolUsage = Process->QuotaPeakPoolUsage[0]; // TODO: Verify! pOut->QuotaPeakPagedPoolUsage = Process->QuotaPeakPoolUsage[0]; // TODO: Verify!
pOut->QuotaPagedPoolUsage = Process->QuotaPoolUsage[0]; // TODO: Verify! pOut->QuotaPagedPoolUsage = Process->QuotaPoolUsage[0]; // TODO: Verify!
pOut->QuotaPeakNonPagedPoolUsage = Process->QuotaPeakPoolUsage[1]; // TODO: Verify! pOut->QuotaPeakNonPagedPoolUsage = Process->QuotaPeakPoolUsage[1]; // TODO: Verify!
pOut->QuotaNonPagedPoolUsage = Process->QuotaPoolUsage[1]; // TODO: Verify! pOut->QuotaNonPagedPoolUsage = Process->QuotaPoolUsage[1]; // TODO: Verify!
pOut->PagefileUsage = Process->PagefileUsage; pOut->PagefileUsage = Process->PagefileUsage;
pOut->PeakPagefileUsage = Process->PeakPagefileUsage; pOut->PeakPagefileUsage = Process->PeakPagefileUsage;
if (ReturnLength) if (ReturnLength)
{ {
*ReturnLength = sizeof(VM_COUNTERS); *ReturnLength = sizeof(VM_COUNTERS);
} }
} }
_SEH_HANDLE _SEH_HANDLE
{ {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
}
break; break;
}
case ProcessDefaultHardErrorMode: case ProcessDefaultHardErrorMode:
if (ProcessInformationLength != sizeof(ULONG)) {
PULONG HardErrMode = (PULONG)ProcessInformation;
_SEH_TRY
{ {
Status = STATUS_INFO_LENGTH_MISMATCH; *HardErrMode = Process->DefaultHardErrorProcessing;
if (ReturnLength)
{
*ReturnLength = sizeof(ULONG);
}
} }
else _SEH_HANDLE
{ {
PULONG HardErrMode = (PULONG)ProcessInformation; Status = _SEH_GetExceptionCode();
_SEH_TRY
{
*HardErrMode = Process->DefaultHardErrorProcessing;
if (ReturnLength)
{
*ReturnLength = sizeof(ULONG);
}
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
} }
_SEH_END;
break; break;
}
case ProcessPriorityBoost: case ProcessPriorityBoost:
if (ProcessInformationLength != sizeof(ULONG)) {
{ PULONG BoostEnabled = (PULONG)ProcessInformation;
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
PULONG BoostEnabled = (PULONG)ProcessInformation;
_SEH_TRY _SEH_TRY
{ {
*BoostEnabled = Process->Pcb.DisableBoost ? FALSE : TRUE; *BoostEnabled = Process->Pcb.DisableBoost ? FALSE : TRUE;
if (ReturnLength) if (ReturnLength)
{ {
*ReturnLength = sizeof(ULONG); *ReturnLength = sizeof(ULONG);
} }
} }
_SEH_HANDLE _SEH_HANDLE
{ {
Status = _SEH_GetExceptionCode(); Status = _SEH_GetExceptionCode();
} }
_SEH_END; _SEH_END;
}
break; break;
}
case ProcessDeviceMap: case ProcessDeviceMap:
if (ProcessInformationLength != sizeof(PROCESS_DEVICEMAP_INFORMATION)) {
{ PROCESS_DEVICEMAP_INFORMATION DeviceMap;
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
PROCESS_DEVICEMAP_INFORMATION DeviceMap;
ObQueryDeviceMapInformation(Process, &DeviceMap); ObQueryDeviceMapInformation(Process, &DeviceMap);
_SEH_TRY _SEH_TRY
{
*(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation = DeviceMap;
if (ReturnLength)
{ {
*(PPROCESS_DEVICEMAP_INFORMATION)ProcessInformation = DeviceMap; *ReturnLength = sizeof(PROCESS_DEVICEMAP_INFORMATION);
if (ReturnLength) }
{ }
*ReturnLength = sizeof(PROCESS_DEVICEMAP_INFORMATION); _SEH_HANDLE
} {
} Status = _SEH_GetExceptionCode();
_SEH_HANDLE }
{ _SEH_END;
Status = _SEH_GetExceptionCode();
}
_SEH_END;
}
break; break;
}
case ProcessPriorityClass: case ProcessPriorityClass:
if (ProcessInformationLength != sizeof(USHORT)) {
{ PUSHORT Priority = (PUSHORT)ProcessInformation;
Status = STATUS_INFO_LENGTH_MISMATCH;
}
else
{
PUSHORT Priority = (PUSHORT)ProcessInformation;
_SEH_TRY
{
*Priority = Process->PriorityClass;
if (ReturnLength) _SEH_TRY
{ {
*ReturnLength = sizeof(USHORT); *Priority = Process->PriorityClass;
}
} if (ReturnLength)
_SEH_HANDLE {
{ *ReturnLength = sizeof(USHORT);
Status = _SEH_GetExceptionCode(); }
} }
_SEH_END; _SEH_HANDLE
} {
Status = _SEH_GetExceptionCode();
}
_SEH_END;
break; break;
}
case ProcessImageFileName: case ProcessImageFileName:
{ {
@ -1620,6 +1565,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
} }
} }
/* don't forget to detach from the process!!! */
KeDetachProcess(); KeDetachProcess();
} }
else else