Commit graph

502 commits

Author SHA1 Message Date
Joachim Henze 1a9f0bc429 [0.4.12][NTOSKRNL] Restore section layout to fix BSOD regression CORE-14683
This fixes high chance for BSOD 0x50 PAGE_FAULT_IN_NONPAGED_AREA
when booting after DVDwriteNow has been installed.

Many thanks to the fixes author Thomas Faber.

We believe this was a regression of SVN r55835
6ebf8c2537

The fix has not been applied to master yet.
2019-07-06 12:38:43 +02:00
Joachim Henze 78b5bc9de7 [0.4.12][NTOS:PNP] Workaround a BSOD with HDAUDIO during boot PR#1560 CORE-15874
Thanks to Thomas Faber, author of the patch.
I depend on external testers here for confirmation of effectiveness.

We think the problem was unhidden by 0.4.12-dev-757-g
789cfd3ddc
and surrounding works.

When traversing the device tree, keep a reference to the current device.
Devices can be deleted during the traversal, so in order to keep
the tree walk intact without use-after-free situations,
this just keeps the PDO around until we no longer need the device node.

It could be argued that this is a hack, however implementing it the "correct way"
(I haven't actually researched how Windows does this) is unlikely to be possible
with our current PNP manager -- so this should keep us going for a while.
2019-06-13 01:25:28 +02:00
Joachim Henze b053803df1 [0.4.12] Revert "[NTOSKRNL] Properly align VACB writes"
to avoid CORE-15384 "ros corrupts FAT16 partition"

This reverts commit 0.4.11-dev-210-g
2a80ae2bb6
Like we did in 0.4.11rls.

I would happily switch over to a proper working fix from master later.
I would also do that if it appeared only after this interim solution got committed.

(cherry picked from commit 78cd6265d9)
2019-04-10 22:23:06 +02:00
Hervé Poussineau 4d1a8f8f54 [NTOS:FSRTL] Use _SEH2_AbnormalTermination() instead of _abnormal_termination()
We're already using SEH2 macros, so also use SEH2 functions
2019-04-07 19:28:18 +02:00
Eric Kohl 626aaf227c [NTOSKRNL] Use global power capabilities and report button presence
- Add and initialize a global power capabilities variable.
- Return the global power capabilities via NtPowerInformation.SystemPowerCapabilities.
- Report the presence of power button, sleep button and lid.
2019-04-07 16:42:58 +02:00
Jérôme Gardou 979972b900 [CMAKE] unset EXPORT_SYMBOL for modules and shared libraries
We don't use that
2019-04-06 17:43:38 +02:00
Bartosz Brachaczek d256ff6006
[NTOSKRNL] Do not try to access OldBackTracking[-1]
It can be triggered by the existing "F<", "FILE.TXT" case in the tests.

CORE-15902
2019-04-01 08:28:00 +02:00
Bartosz Brachaczek 695e00fbbd
[NTOSKRNL] Unify buffer size calculation in FsRtlIs{Name,Dbcs}InExpression
It better captures the intent now in FsRtlIsNameInExpressionPrivate and
fixes a slight overallotion by 4 bytes in FsRtlIsDbcsInExpression.

While at it, use the ANSI_DOS_DOT macro in the Dbcs version.

CORE-15902
2019-04-01 08:27:59 +02:00
Bartosz Brachaczek e9b438bfaa
[NTOSKRNL] Addendum to 21d2c70: properly start DOS_START loop
Fixes last failing test.

CORE-15902
2019-03-31 19:35:25 +02:00
Maxim Smirnov d29e216f99 [NTOSKRNL] In MmCreateImageSection, properly check whether cache was initialized
This fixes a crash that occurs if nul is typed in cmd.exe
2019-03-31 13:51:06 +02:00
Bartosz Brachaczek 8bc9935fcb
[NTOSKRNL] Properly copy backtracking buffer content on realloc
CORE-15902
2019-03-31 11:44:01 +02:00
Bartosz Brachaczek 21d2c70bb4
[NTOSKRNL] Properly compare position to name length in FsRtlIsNameInExpressionPrivate
CORE-15902
2019-03-31 11:44:00 +02:00
Bartosz Brachaczek 5d5e9c8486
[NTOSKRNL] Don't overflow backtrack stack buffer
CORE-15902
2019-03-31 11:44:00 +02:00
Bartosz Brachaczek b1ae592e7f
[NTOSKRNL] Don't oversize buffer for backtracking in FsRtlIsNameInExpressionPrivate
CORE-15902
2019-03-31 11:44:00 +02:00
Thomas Faber d605b5063f
[NTOS:IO] Send IRPs to the correct device in IoVolumeDeviceToDosName. CORE-15415 2019-03-30 10:13:27 +01:00
Pierre Schweitzer 3a5063948e
[MEH] Forgot that file :-( 2019-03-29 21:51:41 +01:00
Pierre Schweitzer ef8b1a1907
[NTOSKRNL] We don't need an event if we don't issue an IRP 2019-03-29 21:47:34 +01:00
Pierre Schweitzer 28ba29e457
[NTOSKRNL] Implement support for FileFsDriverPathInformation in NtQueryVolumeInformationFile 2019-03-29 21:42:42 +01:00
Pierre Schweitzer 092c37f845
[NTOSKRNL] Do. Not. L. E. A. K. 2019-03-29 19:51:38 +01:00
Pierre Schweitzer d75ccd01f7
[NTOSKRNL] Only allow direct device open for FileFsDeviceInformation 2019-03-28 22:39:38 +01:00
Pierre Schweitzer ce6488df31
[NTOSKRNL] Add a quick path for FileFsDeviceInformation in NtQueryVolumeInformationFile
This allows querying volume information without issuing an IRP to the owner device.
The kernel is supposed to already have all the required information to return
to the caller.

Side effect: this allows querying volume information for devices not implementing
IRP_MJ_QUERY_VOLUME_INFORMATION such as null.sys
This fixes opening null device in Python.

Fix based on debugging by Maxim Smirnov in PR #1442

CORE-14551
2019-03-28 22:39:38 +01:00
Thomas Faber 8c358a4a90
[NTOS:FSTUB] Unfix format string warning until GUID definition is fixed. 2019-03-25 22:40:41 +01:00
Thomas Faber a976ebb031
[NTOS:IO] Avoid an unnecessary stack buffer in OpenRegistryHandlesFromSymbolicLink. CORE-15882 2019-03-25 08:43:47 +01:00
Thomas Faber b0bb3d0041
[NTOS:FSTUB] Fix a clang format string warning. 2019-03-25 08:41:55 +01:00
Thomas Faber 57225adaac
[NTOS:IO] Fix always-false condition in IoCheckEaBufferValidity.
Spotted by clang.
2019-03-25 08:41:51 +01:00
Thomas Faber faaf2dc0e6
[NTOS:KDBG] Fix uninitialized variable usage.
Spotted by clang.
2019-03-25 08:41:44 +01:00
Thomas Faber 938f0e469d
[NTOS:IO] Enable privilege check in NtLoadDriver. 2019-03-11 08:30:14 +01:00
Timo Kreuzer 8a4c5763da [NTOS:PS] Use NULL instead of 0 in ps/kill.c 2019-03-06 00:49:59 +01:00
Timo Kreuzer addc01d90b [NTOS:KE] Add function comments 2019-03-06 00:39:25 +01:00
Timo Kreuzer 42730f9373 [NTOS:EX] Fix 64 bit issues in ExfWaitForRundownProtectionReleaseCacheAware 2019-03-04 21:58:42 +01:00
Pierre Schweitzer 1114b89952
[NTOSKRNL] Fix MSVC2010 build 2019-03-02 11:10:37 +01:00
Pierre Schweitzer c2b6c3a69f
[NTOSKRNL] Fix ClockDiff aka fix MSVC build 2019-03-02 10:45:34 +01:00
Pierre Schweitzer eb8b481cd4
[NTOSKRNL] Rewrite/fix our UUID generation implementation
So that it matches Windows behavior
Also implement ExUuidCreate that will generate UUID version 1

The implementation is based on the RFC 4122
2019-03-01 08:22:48 +01:00
Pierre Schweitzer 2d9673c68f
[NTOSKRNL] Introduce the UUID_CACHED_VALUES_STRUCT structure
Source: https://blog.48bits.com/el-codigo-ntoskvinci/
2019-03-01 08:22:47 +01:00
Pierre Schweitzer 81c88c1029
[NTOSKRNL] UuidMutex -> ExpUuidLock 2019-03-01 08:22:47 +01:00
Mark Jansen 5c05a29d3d
[APPHELP] Implement ShimDumpCache and ShimFlushCache
These functions simply call into the Base* functions,
having a prototype that is compatible with rundll32
CORE-11301
2019-02-25 20:00:34 +01:00
Timo Kreuzer 81727760e4 [NTOS::Mm] Fix inverted check in MiWriteProtectSystemImage 2019-02-24 20:34:02 +01:00
Thomas Faber cf40421041
[NTOS:PNP] Correctly respect data size in PnpRegSzToString. CORE-15766
Spotted by Vadim Galyant.
2019-02-20 12:23:33 +01:00
Hermès Bélusca-Maïto 83fdb9a6d9
[NTOS:CM] Set and reset the CMHIVE HiveIsLoading flag adequately. Fix an assertion in CmFlushKey() and reset the CMHIVE ViewLockOwner when releasing the view lock. 2019-02-17 01:21:35 +01:00
Pierre Schweitzer 63b13ad939
[NTOSKRNL] Simplify object type name printing 2019-02-11 09:03:58 +01:00
Pierre Schweitzer df829f7948
[NTOSKRNL] Also display sections name 2019-02-10 11:23:57 +01:00
Pierre Schweitzer f4320047c3
[NTOSKRNL] Fix parsing loop 2019-02-09 13:59:11 +01:00
Pierre Schweitzer 2991f6e76e
[NTOSKRNL] Add a first implementation of !handle command in KDBG
It allows dumping all the handles (filtered by PID/Process)
and it displays basic information about file and key handles
2019-02-09 13:46:35 +01:00
Serge Gautherie 84e76b1c4c [NTOS:MM] ExFreePoolWithTag(): Accept tag mismatch, on release build only (#1334)
"Release" builds should not BSoD on 'Freeing pool - invalid tag specified' case,
this is compatible with Windows behaviour.
Nothing changes otherwise concerning the "Debug" builds, where pool-tag mismatch
triggers a BSoD as expected.

CORE-15446
2019-02-07 16:57:56 +01:00
Andrew Cook d8e92b5a0a Merge pull request #1335 from ariscop/CMP0065
Fixes for upstream cmake
2019-02-03 12:57:20 +01:00
Thomas Faber 066ee4db3b
[NTOS:MM] Dump pool consumers at most once per second.
This should avoid some log spam during kmtest:ExPools, which
intentionally depletes pool.
2019-02-03 12:54:36 +01:00
Thomas Faber f5fc9e0cf2
[NTOS:OB] Correctly handle OBJ_PROTECT_CLOSE in ObDuplicateObject. 2019-02-02 23:02:50 +01:00
Thomas Faber 63977328b1
[NTOSKRNL] Guard against negative InformationClass enum values. CORE-15651 2019-02-02 22:50:02 +01:00
Pierre Schweitzer a6dc1d69bc
[NTOS:MM] On big pool enumeration, return entry instead of base VA 2019-02-02 10:45:15 +01:00
Serge Gautherie 0483a5a380 [NTOS:OB] Correctly check SeSinglePrivilegeCheck() return value (#1323)
SeSinglePrivilegeCheck() returns a BOOLEAN, not a NTSTATUS.
CORE-14271
2019-01-30 00:43:13 +01:00