Commit graph

1045 commits

Author SHA1 Message Date
Jérôme Gardou
0d3825862f [NTOS:KE] Rewrite KiSystemCallTrampoline in assembly
Instead of making assumptions about what the compiler does with forced-inline functions
2021-04-06 17:57:18 +02:00
Eric Kohl
d8c38c4b4c [NTOS:PNP] PiSetDevNodeText: Do not overwrite existing DeviceDesc values
CORE-17513
2021-04-05 14:33:48 +02:00
Mark Jansen
5e928e5c92
[NTOS:MM] Stubplement cookie generation for drivers 2021-04-03 18:08:53 +02:00
Eric Kohl
c449929fef [NTOS:EX] Use RtlCutoverTimeToSystemTime to determine the current time zone id
CORE-14658
2021-04-03 09:38:07 +02:00
Jérôme Gardou
998870c5ea [NTOS:MM] Properly fail for invalid sizes of data section mappings 2021-03-30 22:20:15 +02:00
Jérôme Gardou
4c731adc04 [NTOS:MM] Fix compilation when PFN tracing is enabled 2021-03-30 17:22:09 +02:00
Jérôme Gardou
80f8beeeee [NTOS/MM] Remove an outdated check 2021-03-30 17:13:19 +02:00
Jérôme Gardou
0187c1e113 [NTOS:MM] Fix PFN tracing 2021-03-30 16:26:43 +02:00
George Bișoc
eba68ffb9c [NTOS:SE] Specify the code section of SepCreateSystemProcessToken as INIT
This function is used during the Security kernel module phase initialisation to set up the system process token which the phase initialisation procedure in itself is stored in the INIT section. With that being said, do the same for SepCreateSystemProcessToken too and add a header documentation as an addition.
2021-03-25 02:30:46 +03:00
George Bișoc
5b5b814af8 [NTOS:SE] Create the anonymous logon tokens on Security initialisation phase 2021-03-25 02:30:46 +03:00
George Bișoc
fe0f9d8646 [NTOS:SE] Implement SepCreateSystemAnonymousLogonToken and SepCreateSystemAnonymousLogonTokenNoEveryone functions
These private functions are needed to set up two different kinds of system's anonymous logon tokens: one that includes everyone in the group and the other that doesn't. These functions are needed as next step closer to the
implementation of NtImpersonateAnonymousToken system call.
2021-03-25 02:30:46 +03:00
George Bișoc
b28530d4ac [NTOS:SE] Set up an ACL and SD for the anonymous logon 2021-03-25 02:30:46 +03:00
Jérôme Gardou
6e4f83da70 [NTOS:CC] Wake up lazy scan after inserting elements in the list. 2021-03-24 15:28:04 +01:00
Jérôme Gardou
edd4a985d9 [NTOS:CC] Be verbose about why we defer writes 2021-03-24 15:27:36 +01:00
Jérôme Gardou
5c54fb9179 [NTOS:CC] Rewrite CcPostDeferredWrites
This allows to post small writes if there are any, and avoid holding the list lock for a long time.
2021-03-24 11:22:28 +01:00
Jérôme Gardou
b13a696513 [NTOS:KE] Explicitly cast -1 to ULONG 2021-03-24 11:13:04 +01:00
Jérôme Gardou
94d175b7f2 [NTOS] Remove a definition which is redundant with ndk 2021-03-24 11:12:12 +01:00
Jérôme Gardou
187ca32175 [NTOS:KE] Use PNT_TIB as argument in KeSetTebBase 2021-03-24 11:09:20 +01:00
Jérôme Gardou
173cdcae8f [CMAKE] Use the "kernel" module type for ntoskrnl and ntkrnlmp 2021-03-23 11:18:43 +01:00
Jérôme Gardou
d1d1260f5f [NTOS:MM] Fix integer arithmetics 2021-03-22 10:02:12 +01:00
Victor Perevertkin
0fed07b7e4
[NTOS:PNP] Initialize DeviceDesc and LocationInformation registry fields
for manually reported devices, as it is required by the newdev.dll
for installing drivers from INF files

CORE-17212 CORE-17398

Co-authored-by: Stanislav Motylkov <x86corez@gmail.com>
2021-03-19 07:57:41 +03:00
Victor Perevertkin
aec3d9cc8f
[NTOS:IO][NTOS:PNP] Fix incorrect usage of IopGetRegistryValue
KEY_VALUE_FULL_INFORMATION was not always freed properly
2021-03-19 01:07:22 +03:00
Jérôme Gardou
42094071ee [NTOS:MM] Silence noisy DPRINTs 2021-03-18 12:24:21 +01:00
Jérôme Gardou
4ff5d39edb [NTOS:MM] Use a define for the big pool table occupation rate 2021-03-18 12:24:21 +01:00
Jérôme Gardou
8494688eeb [NTOS:MM] Do not use atomic operations to set a bit while holding a lock.
Saving your fingers from typing it doesn't make it better code.
2021-03-18 12:24:21 +01:00
Jérôme Gardou
f06b58925d [NTOS:MM] Implement shrinking big pool allocation table
Shrink when using 1/8 of its allocated capacity (thus use 25% of it at the end of the process)
Expand when using 3/4 of its allocated capacity (thus use ~40% of it at the end of the process)
2021-03-18 12:24:21 +01:00
Jérôme Gardou
54354712e2 [NTOS:MM] Fail allocating non-paged pool when running out of available pages 2021-03-18 12:24:21 +01:00
Jérôme Gardou
34630a06ca [NTOS:MM] Do not bugcheck when we are freeing a big allocation for which we didn't manage to insert the tag 2021-03-18 12:24:21 +01:00
Jérôme Gardou
d5fa0788d8 [NTOS:MM] Silence a DPRINT which became noisy 2021-03-16 13:23:21 +01:00
Victor Perevertkin
59a5dba443
[NTOS:PNP] Implement PlugPlayControlStartDevice control class
This control class is triggered when a driver is being installed for a
non-critical device. The driver info should already be in the registry
so we just need to push the device through the state graph

Meanwhile, combine the code for similar control classes into
PiControlSyncDeviceAction routine

CORE-17463 CORE-17490
2021-03-16 03:17:57 +03:00
Victor Perevertkin
029accdcf7
[NDK] Change the data structure for PlugPlayControlResetDevice control class
PlugPlayControlResetDevice shares the input structure with several other
control classes.
Source: ProcessHacker sources e9c8121f41/ntpnpapi.h
2021-03-16 03:17:42 +03:00
Serge Gautherie
e0400e7810 [NTOS:KE] KiIdleLoop(): Propagate DECLSPEC_NORETURN to callers 2021-03-05 00:43:15 +03:00
Serge Gautherie
5f1d79f0c5 [NTOS:KE] KiIdleLoop(): Add DECLSPEC_NORETURN, Remove FASTCALL 2021-03-05 00:43:15 +03:00
George Bișoc
44b8e5caac [NTOS:SE] Complete the SepCompareTokens implementation
* Implement SepCompareSidAndAttributesFromTokens and SepComparePrivilegeAndAttributesFromTokens functions for array elements comparison
* Implement the token comparison code in SepCompareTokens function
* Add a missing PAGED_CODE() in SepCompareTokens as most of the token comparison code is paged
* Use SAL annotations for SepCompareTokens and NtCompareTokens
2021-03-04 16:22:56 +03:00
George Bișoc
a340ec1767
[NTOS:PS] Guard the quota in a spin lock (#3419)
Prior to acquiring a quota from the process and do whatever it's needed to do (charge it or return it back), we must guard ourselves with a spinlock so that we may not get into potential race conditions. In Windows Server 2003, PspGivebackQuota and PspExpandQuota do the same thing and they're the equivalent to PspReturnProcessQuotaSpecifiedPool and PspChargeProcessQuotaSpecifiedPool in our codebase.
2021-03-04 04:43:30 +03:00
Serge Gautherie
7851ad8635 [NTOS:KD] KdpDebugLogInit(): Close the thread handle
Addendum to 07dc415 (r43331).
2021-03-03 09:01:37 +01:00
Serge Gautherie
802ad6d3ee [NTOS:KD] KdpLoggerThread(): Assert being in kernel mode
to be explicit that using Nt*() is safe.

Follow-up to 9537653.
2021-03-03 09:01:37 +01:00
George Bișoc
6170b574f0
[NTOS:PS] Implement PS_QUOTA_TYPE and let the quota code use it (#3389)
This will replace the PoolIndex variable and as such we'll only be using the PS_QUOTA_TYPE enumeration, as Windows does. Both QuotaEntry, QuotaUsage and QuotaPeak depend explicitly or implicitly on this enumeration. Further details about this enum can be found in the following articles.
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ps/psquota/type.htm?tx=68,143
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ps/psquota/block.htm?tx=68,142,143
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ps/eprocess/index.htm (see QuotaPeak and QuotaUsage)
2021-03-02 20:09:58 +01:00
Jérôme Gardou
4e4c47cccc [NTOS:KE] Generate proper frame info for trap handler in GCC builds
CORE-8531
2021-03-02 14:37:39 +01:00
Jérôme Gardou
7caf9e9d48 [NTOS:KD] Use Zw* syscall variants
The log file can be (re-)initialized when previous mode is User-Mode,
thus the calls fail on probing input parameters
2021-02-26 08:46:53 +01:00
Jérôme Gardou
a93e065ebc [NTOS:MM] Do not chunk-read file when we are the modified-page-writer thread 2021-02-26 08:46:53 +01:00
Jérôme Gardou
35c091adaf [NTOS:MM] Do not chunk-read files marked with FO_RANDOM_ACCESS 2021-02-26 08:46:53 +01:00
Eric Kohl
9ff015f770 [NTOS:CM] Report key creation to the notify code 2021-02-21 15:49:06 +01:00
Jérôme Gardou
2a962eaf8c [NTOS:CC] Keep a reference on the shared cache map of the file when we are in lazy write
This should fix "Leaking VACB" debug prints
2021-02-19 15:48:31 +01:00
Jérôme Gardou
d18634c026 [NTOS:WMI] Be consistent about potential NULL pointer use 2021-02-18 10:24:53 +01:00
Serge Gautherie
17a9041da1 [NTOS:WMI] IoWMIWriteEvent(): Add WNODE_FLAG_TRACED_GUID case
Addendum to d5f8964 (r23040).
CORE-17384
2021-02-17 18:59:09 +01:00
Serge Gautherie
495e22e0d5 [NTOS:WMI] IoWMIWriteEvent(): Fix annotation, Extend DPRINT1()
CORE-17384
2021-02-17 18:59:09 +01:00
Timo Kreuzer
4b4bff0642 [NTOS:MM] Handle demand zero PTEs with MM_EXECUTE_READWRITE and MM_READWRITE 2021-02-16 18:02:57 +01:00
Hervé Poussineau
58332b076c [NTOS:KD] Merge initialization phases 1 and 2, and fix log file debugging
Phase 2 and 3 were not done anymore since 777a2d94da.

Fix that, by merging phases 1 and 2, and by calling phase 3 later
for log file debugging, when ExpInitializationPhase = 3

CORE-17470
2021-02-16 00:12:25 +01:00
Jérôme Gardou
0573de22a0 [NTOS:MM] Do not assert on a case we actually support 2021-02-10 17:48:30 +01:00