Commit graph

233 commits

Author SHA1 Message Date
Jérôme Gardou
0187c1e113 [NTOS:MM] Fix PFN tracing 2021-03-30 16:26:43 +02:00
George Bișoc
5b5b814af8 [NTOS:SE] Create the anonymous logon tokens on Security initialisation phase 2021-03-25 02:30:46 +03:00
George Bișoc
fe0f9d8646 [NTOS:SE] Implement SepCreateSystemAnonymousLogonToken and SepCreateSystemAnonymousLogonTokenNoEveryone functions
These private functions are needed to set up two different kinds of system's anonymous logon tokens: one that includes everyone in the group and the other that doesn't. These functions are needed as next step closer to the
implementation of NtImpersonateAnonymousToken system call.
2021-03-25 02:30:46 +03:00
George Bișoc
b28530d4ac [NTOS:SE] Set up an ACL and SD for the anonymous logon 2021-03-25 02:30:46 +03:00
Jérôme Gardou
b13a696513 [NTOS:KE] Explicitly cast -1 to ULONG 2021-03-24 11:13:04 +01:00
Jérôme Gardou
94d175b7f2 [NTOS] Remove a definition which is redundant with ndk 2021-03-24 11:12:12 +01:00
Jérôme Gardou
187ca32175 [NTOS:KE] Use PNT_TIB as argument in KeSetTebBase 2021-03-24 11:09:20 +01:00
Victor Perevertkin
0fed07b7e4
[NTOS:PNP] Initialize DeviceDesc and LocationInformation registry fields
for manually reported devices, as it is required by the newdev.dll
for installing drivers from INF files

CORE-17212 CORE-17398

Co-authored-by: Stanislav Motylkov <x86corez@gmail.com>
2021-03-19 07:57:41 +03:00
Victor Perevertkin
59a5dba443
[NTOS:PNP] Implement PlugPlayControlStartDevice control class
This control class is triggered when a driver is being installed for a
non-critical device. The driver info should already be in the registry
so we just need to push the device through the state graph

Meanwhile, combine the code for similar control classes into
PiControlSyncDeviceAction routine

CORE-17463 CORE-17490
2021-03-16 03:17:57 +03:00
Serge Gautherie
e0400e7810 [NTOS:KE] KiIdleLoop(): Propagate DECLSPEC_NORETURN to callers 2021-03-05 00:43:15 +03:00
Serge Gautherie
5f1d79f0c5 [NTOS:KE] KiIdleLoop(): Add DECLSPEC_NORETURN, Remove FASTCALL 2021-03-05 00:43:15 +03:00
Jérôme Gardou
4e4c47cccc [NTOS:KE] Generate proper frame info for trap handler in GCC builds
CORE-8531
2021-03-02 14:37:39 +01:00
George Bișoc
dd4c113594
[NTOS:SE] Do not use a global lock for tokens (#3445)
In Windows Server 2003 the lock is initialised on a per-token basis, that is, the lock resource is created in SepDuplicateToken() and SepCreateToken() functions. This ensures that the lock initialisation is done locally for the specific token thus avoiding the need of a global lock.
2021-02-05 12:10:19 +03:00
Jérôme Gardou
b7eb0fddf3 Address PR review 2021-02-03 09:41:24 +01:00
Jérôme Gardou
2ba1926037 [NTOS:MM][NTOS:CC] Performance improvement again
Read files by 64kb chunks instead of page-sized chunks.
2021-02-03 09:41:23 +01:00
Jérôme Gardou
41475dfcd7 [NTOS:CC] Performance improvements
Do not ditch the pages as soon as the section are unmapped
Improve MmBalancer "algorithm" (or whatever you call that)
Various needed fixes to get this going.
2021-02-03 09:41:23 +01:00
Jérôme Gardou
3e43aa1305 [NTOS:MM] Use 64-bit integer to count references on segments 2021-02-03 09:41:23 +01:00
Jérôme Gardou
90c6a65efe [NTOS:MM] Introduce MmPurgeSegment & MmFlushSegment
Those will back CcFlushCache and CcPurgeCache.
2021-02-03 09:41:23 +01:00
Jérôme Gardou
8a8b4db447 [NTOS:MM] Make the page LRU list a real LRU list.
Also, implement flushing mapped sections to disk on shutdown.
2021-02-03 09:41:23 +01:00
Jérôme Gardou
d23dbdda4c [NTOS:MM] Remove unused field 2021-02-03 09:41:23 +01:00
Jérôme Gardou
5949d5095d [NTOS:CC][NTOS:MM] Try respecting ValidDataLength 2021-02-03 09:41:23 +01:00
Jérôme Gardou
9b6240ee03 [NTOS:CC] Get rid of ROS_VACB:Valid 2021-02-03 09:41:23 +01:00
Jérôme Gardou
a9193b5cc2 [NTOS:CC] Remove dead code 2021-02-03 09:41:23 +01:00
Jérôme Gardou
cff3c399c6 [NTOS:MM] Fix input validation/correction in MmMapViewInSystemSpace 2021-02-03 09:41:23 +01:00
Jérôme Gardou
1505abbc09 [NTOS:CC] Do not write behind concurrently the same file 2021-02-03 09:41:23 +01:00
Jérôme Gardou
1f796267bc [NTOS:MM] Do not reference the section when mapping it.
Referencing the segment is enough.
2021-02-03 09:41:22 +01:00
Jérôme Gardou
f8aa14ce4e [NTOS:CC] Acquire file for flush when flushing if necessary 2021-02-03 09:41:22 +01:00
Jérôme Gardou
36e18aab35 [NTOS:CC] Remove unused functions 2021-02-03 09:41:22 +01:00
Jérôme Gardou
d8cdb89fb0 [NTOSKRNL] Overhaul Cc and Mm relationship
Previously, when creating a file section, Mm requested Cc to cache the file, then Cc would request pages from Mm, then Mm would request them back to serve its file-mapping role
Now, Mm does it all by itself. If file cahcing is requested by the FS driver, then Cc creates a file mapping and uses that to serve its purpose.

This is a rewrite of Cc
2021-02-03 09:41:22 +01:00
Jérôme Gardou
e4047d1521 [NTOS/MM] Introduce MmArePagesResident and MmMakePagesResident 2021-02-03 09:41:22 +01:00
Jérôme Gardou
f1631b44e1 [NTOS/MM] Introduce MmMapViewInSystemSpaceEx 2021-02-03 09:41:22 +01:00
Jérôme Gardou
b7d988ae5b [NTOSKRNL] Get rid of MM_ROS_SECTION_OBJECT 2021-02-03 09:41:21 +01:00
Jérôme Gardou
8b98ff66ea [NTOSKRNL] Store File Object in the segment instead of Section object 2021-02-03 09:41:21 +01:00
Jérôme Gardou
e980efebd4 [NTOSKRNL] Store the MM_IMAGE_SECTION_OBJECT pointer in SECTION::Segment 2021-02-03 09:41:21 +01:00
Jérôme Gardou
c6a87f28bf [NTOSKRNL] Get rid of MEMORY_AREA::Protect
Use the VAD node instead
2021-02-03 09:41:21 +01:00
Jérôme Gardou
c9f924940a [NTOSKRNL/MM] Get rid of useless members of MEMORY_AREA struct 2021-02-03 09:41:21 +01:00
Jérôme Gardou
defbf63416 [NTOSKRNL] Use PSECTION struct where possible 2021-02-03 09:41:21 +01:00
Jérôme Gardou
462d9a0974 [NTOSKRNL] Unload the cargo: We only use tiny bits of "NEWCC" 2021-02-03 09:41:21 +01:00
Jérôme Gardou
25722e647e [NTOSKRNL] Embed a SECTION struct inside MM_ROS_SECTION_OBJECT 2021-02-03 09:41:21 +01:00
Jérôme Gardou
10ac04ff6e [NTOSKRNL] Get rid of ROS_SECTION_OBJECT::AllocationAttributes in favor of MM_SECTION_FLAGS 2021-02-03 09:41:21 +01:00
Jérôme Gardou
819406ac97 [NTOSKRNL] Get rid of pagefile-backed sections support in legacy Mm 2021-02-03 09:41:21 +01:00
Jérôme Gardou
7afecee5eb [NTOSKRNL] Rename MM_ROS_SECTION_OBJECT:SectionPageProtection to InitialPageProtection 2021-02-03 09:41:21 +01:00
Jérôme Gardou
54c760574b [NTOSKRNL] Rename MM_ROS_SECTION_OBJECT:MaximumSize to SizeOfSection
For consistency with the SECTION struct
2021-02-03 09:41:21 +01:00
George Bișoc
1903b568b6
[NTOS:SE] Implement SECURITY_TOKEN_PROXY_DATA, SECURITY_TOKEN_AUDIT_D… (#3432)
ProxyData and AuditData are pointers to an arbitrary data, which instead, they should point to their respective data structures. This serves as preparation for SepFreeProxyData and SepCopyProxyData functions implementations in the future (regarding the proxy data stuff specifically).

For further details:
https://www.vergiliusproject.com/kernels/x86/Windows%202003/SP2/_TOKEN
https://www.nirsoft.net/kernel_struct/vista/SECURITY_TOKEN_AUDIT_DATA.html
https://www.nirsoft.net/kernel_struct/vista/SECURITY_TOKEN_PROXY_DATA.html
https://www.nirsoft.net/kernel_struct/vista/PROXY_CLASS.html
2021-02-02 01:55:42 +03:00
Victor Perevertkin
91fceab36e
[NTOS:IO][NTOS:PNP] Add PiActionAddBootDevices device action
During the boot process, it makes possible to initalize the driver's
devices right after the driver is loaded. Moreover, this way one can be
sure that all critical devices are initialized before the
IopMarkBootPartition call (because we explicitly call the driver's
AddDevice routine now, after each driver is loaded)

CORE-7826
2021-01-27 05:15:16 +03:00
Victor Perevertkin
798fc13b48
[NTOS:PNP] Implement NT5.2-like DEVICE_NODE state management
- Use DeviceNode->State field and its values, instead of
  DeviceNode->Flags for tracking current node state
- Change DNF_* flags to the ones compatible with Windows XP+
- Simplify state changes for device nodes and encapsulate all the logic
  inside the PiDevNodeStateMachine routine. This makes the ground for
  future improvements in the device removal sequence and
  resource management
- Now values inside DeviceNode->State and ->Flags are compatible with
  the windbg !devnode macro and can be tracked using it
- BUGFIX: fixed cases where IRP_MN_START_DEVICE or
  IRP_MN_QUERY_DEVICE_RELATIONS may be sent to a device after a
  IRP_MN_REMOVE_DEVICE

CORE-7826
2021-01-27 05:15:15 +03:00
Jérôme Gardou
0919324772 [NTOS:MM] Get rid of "compatibility layer" for hyper space mappings
Let's call that a bug layer instead.
2021-01-22 09:33:06 +01:00
Victor Perevertkin
c4c0585f96
[NTOS:IO][NTOS:PNP] Implement PiCallDriverAddDevice
- Move the driver's name obtaining logic into the IopGetDriverNames
  function
- Create a new PiCallDriverAddDevice instead of PipCallDriverAddDevice
  and move it to pnpmgr/devaction.c file. Move around all its internal
  helpers too
- Support a proper Windows-compatible driver loading order for a PDO
  (lower filters, main service, upper filters, etc.)
- Set a correct Problem for the DeviceNode, in case of an error during
  driver loading
- Check the Start Type for all drivers before loading
- Do not try to load drivers during the early boot stage when there is
  no disk subsystem initialized
2021-01-04 16:50:33 +03:00
Victor Perevertkin
4c95339da0
[NTOS:IO] Refactoring of the driver initialization code (2)
- Do not hold the IopDriverLoadResource while trying to reference a
  driver object (but still acquire it when we actually need to load a
  driver)
- Change IopLoadDriver and IopInitializeDriverModule to use registry
  handle instead of a service name string and/or full registry path
- Do not try to reference a driver object inside IopLoadDriver. It's
  supposed to be done before the function call
2021-01-04 16:50:33 +03:00
Victor Perevertkin
a6a3aa0f0d
[NTOS:IO] Refactor IopLoadUnloadDriver
- Split IopLoadUnloadDriver into IopLoadDriver and calling DriverUnload
- Schedule the worker for (un)loading driver in a separate routine
  (IopDoLoadUnloadDriver) this allows IopLoadDriver to be called
  separately (if we are sure that we're in the system process)
2021-01-04 16:50:32 +03:00