Commit graph

230 commits

Author SHA1 Message Date
George Bișoc b28530d4ac [NTOS:SE] Set up an ACL and SD for the anonymous logon 2021-03-25 02:30:46 +03:00
Jérôme Gardou b13a696513 [NTOS:KE] Explicitly cast -1 to ULONG 2021-03-24 11:13:04 +01:00
Jérôme Gardou 94d175b7f2 [NTOS] Remove a definition which is redundant with ndk 2021-03-24 11:12:12 +01:00
Jérôme Gardou 187ca32175 [NTOS:KE] Use PNT_TIB as argument in KeSetTebBase 2021-03-24 11:09:20 +01:00
Victor Perevertkin 0fed07b7e4
[NTOS:PNP] Initialize DeviceDesc and LocationInformation registry fields
for manually reported devices, as it is required by the newdev.dll
for installing drivers from INF files

CORE-17212 CORE-17398

Co-authored-by: Stanislav Motylkov <x86corez@gmail.com>
2021-03-19 07:57:41 +03:00
Victor Perevertkin 59a5dba443
[NTOS:PNP] Implement PlugPlayControlStartDevice control class
This control class is triggered when a driver is being installed for a
non-critical device. The driver info should already be in the registry
so we just need to push the device through the state graph

Meanwhile, combine the code for similar control classes into
PiControlSyncDeviceAction routine

CORE-17463 CORE-17490
2021-03-16 03:17:57 +03:00
Serge Gautherie e0400e7810 [NTOS:KE] KiIdleLoop(): Propagate DECLSPEC_NORETURN to callers 2021-03-05 00:43:15 +03:00
Serge Gautherie 5f1d79f0c5 [NTOS:KE] KiIdleLoop(): Add DECLSPEC_NORETURN, Remove FASTCALL 2021-03-05 00:43:15 +03:00
Jérôme Gardou 4e4c47cccc [NTOS:KE] Generate proper frame info for trap handler in GCC builds
CORE-8531
2021-03-02 14:37:39 +01:00
George Bișoc dd4c113594
[NTOS:SE] Do not use a global lock for tokens (#3445)
In Windows Server 2003 the lock is initialised on a per-token basis, that is, the lock resource is created in SepDuplicateToken() and SepCreateToken() functions. This ensures that the lock initialisation is done locally for the specific token thus avoiding the need of a global lock.
2021-02-05 12:10:19 +03:00
Jérôme Gardou b7eb0fddf3 Address PR review 2021-02-03 09:41:24 +01:00
Jérôme Gardou 2ba1926037 [NTOS:MM][NTOS:CC] Performance improvement again
Read files by 64kb chunks instead of page-sized chunks.
2021-02-03 09:41:23 +01:00
Jérôme Gardou 41475dfcd7 [NTOS:CC] Performance improvements
Do not ditch the pages as soon as the section are unmapped
Improve MmBalancer "algorithm" (or whatever you call that)
Various needed fixes to get this going.
2021-02-03 09:41:23 +01:00
Jérôme Gardou 3e43aa1305 [NTOS:MM] Use 64-bit integer to count references on segments 2021-02-03 09:41:23 +01:00
Jérôme Gardou 90c6a65efe [NTOS:MM] Introduce MmPurgeSegment & MmFlushSegment
Those will back CcFlushCache and CcPurgeCache.
2021-02-03 09:41:23 +01:00
Jérôme Gardou 8a8b4db447 [NTOS:MM] Make the page LRU list a real LRU list.
Also, implement flushing mapped sections to disk on shutdown.
2021-02-03 09:41:23 +01:00
Jérôme Gardou d23dbdda4c [NTOS:MM] Remove unused field 2021-02-03 09:41:23 +01:00
Jérôme Gardou 5949d5095d [NTOS:CC][NTOS:MM] Try respecting ValidDataLength 2021-02-03 09:41:23 +01:00
Jérôme Gardou 9b6240ee03 [NTOS:CC] Get rid of ROS_VACB:Valid 2021-02-03 09:41:23 +01:00
Jérôme Gardou a9193b5cc2 [NTOS:CC] Remove dead code 2021-02-03 09:41:23 +01:00
Jérôme Gardou cff3c399c6 [NTOS:MM] Fix input validation/correction in MmMapViewInSystemSpace 2021-02-03 09:41:23 +01:00
Jérôme Gardou 1505abbc09 [NTOS:CC] Do not write behind concurrently the same file 2021-02-03 09:41:23 +01:00
Jérôme Gardou 1f796267bc [NTOS:MM] Do not reference the section when mapping it.
Referencing the segment is enough.
2021-02-03 09:41:22 +01:00
Jérôme Gardou f8aa14ce4e [NTOS:CC] Acquire file for flush when flushing if necessary 2021-02-03 09:41:22 +01:00
Jérôme Gardou 36e18aab35 [NTOS:CC] Remove unused functions 2021-02-03 09:41:22 +01:00
Jérôme Gardou d8cdb89fb0 [NTOSKRNL] Overhaul Cc and Mm relationship
Previously, when creating a file section, Mm requested Cc to cache the file, then Cc would request pages from Mm, then Mm would request them back to serve its file-mapping role
Now, Mm does it all by itself. If file cahcing is requested by the FS driver, then Cc creates a file mapping and uses that to serve its purpose.

This is a rewrite of Cc
2021-02-03 09:41:22 +01:00
Jérôme Gardou e4047d1521 [NTOS/MM] Introduce MmArePagesResident and MmMakePagesResident 2021-02-03 09:41:22 +01:00
Jérôme Gardou f1631b44e1 [NTOS/MM] Introduce MmMapViewInSystemSpaceEx 2021-02-03 09:41:22 +01:00
Jérôme Gardou b7d988ae5b [NTOSKRNL] Get rid of MM_ROS_SECTION_OBJECT 2021-02-03 09:41:21 +01:00
Jérôme Gardou 8b98ff66ea [NTOSKRNL] Store File Object in the segment instead of Section object 2021-02-03 09:41:21 +01:00
Jérôme Gardou e980efebd4 [NTOSKRNL] Store the MM_IMAGE_SECTION_OBJECT pointer in SECTION::Segment 2021-02-03 09:41:21 +01:00
Jérôme Gardou c6a87f28bf [NTOSKRNL] Get rid of MEMORY_AREA::Protect
Use the VAD node instead
2021-02-03 09:41:21 +01:00
Jérôme Gardou c9f924940a [NTOSKRNL/MM] Get rid of useless members of MEMORY_AREA struct 2021-02-03 09:41:21 +01:00
Jérôme Gardou defbf63416 [NTOSKRNL] Use PSECTION struct where possible 2021-02-03 09:41:21 +01:00
Jérôme Gardou 462d9a0974 [NTOSKRNL] Unload the cargo: We only use tiny bits of "NEWCC" 2021-02-03 09:41:21 +01:00
Jérôme Gardou 25722e647e [NTOSKRNL] Embed a SECTION struct inside MM_ROS_SECTION_OBJECT 2021-02-03 09:41:21 +01:00
Jérôme Gardou 10ac04ff6e [NTOSKRNL] Get rid of ROS_SECTION_OBJECT::AllocationAttributes in favor of MM_SECTION_FLAGS 2021-02-03 09:41:21 +01:00
Jérôme Gardou 819406ac97 [NTOSKRNL] Get rid of pagefile-backed sections support in legacy Mm 2021-02-03 09:41:21 +01:00
Jérôme Gardou 7afecee5eb [NTOSKRNL] Rename MM_ROS_SECTION_OBJECT:SectionPageProtection to InitialPageProtection 2021-02-03 09:41:21 +01:00
Jérôme Gardou 54c760574b [NTOSKRNL] Rename MM_ROS_SECTION_OBJECT:MaximumSize to SizeOfSection
For consistency with the SECTION struct
2021-02-03 09:41:21 +01:00
George Bișoc 1903b568b6
[NTOS:SE] Implement SECURITY_TOKEN_PROXY_DATA, SECURITY_TOKEN_AUDIT_D… (#3432)
ProxyData and AuditData are pointers to an arbitrary data, which instead, they should point to their respective data structures. This serves as preparation for SepFreeProxyData and SepCopyProxyData functions implementations in the future (regarding the proxy data stuff specifically).

For further details:
https://www.vergiliusproject.com/kernels/x86/Windows%202003/SP2/_TOKEN
https://www.nirsoft.net/kernel_struct/vista/SECURITY_TOKEN_AUDIT_DATA.html
https://www.nirsoft.net/kernel_struct/vista/SECURITY_TOKEN_PROXY_DATA.html
https://www.nirsoft.net/kernel_struct/vista/PROXY_CLASS.html
2021-02-02 01:55:42 +03:00
Victor Perevertkin 91fceab36e
[NTOS:IO][NTOS:PNP] Add PiActionAddBootDevices device action
During the boot process, it makes possible to initalize the driver's
devices right after the driver is loaded. Moreover, this way one can be
sure that all critical devices are initialized before the
IopMarkBootPartition call (because we explicitly call the driver's
AddDevice routine now, after each driver is loaded)

CORE-7826
2021-01-27 05:15:16 +03:00
Victor Perevertkin 798fc13b48
[NTOS:PNP] Implement NT5.2-like DEVICE_NODE state management
- Use DeviceNode->State field and its values, instead of
  DeviceNode->Flags for tracking current node state
- Change DNF_* flags to the ones compatible with Windows XP+
- Simplify state changes for device nodes and encapsulate all the logic
  inside the PiDevNodeStateMachine routine. This makes the ground for
  future improvements in the device removal sequence and
  resource management
- Now values inside DeviceNode->State and ->Flags are compatible with
  the windbg !devnode macro and can be tracked using it
- BUGFIX: fixed cases where IRP_MN_START_DEVICE or
  IRP_MN_QUERY_DEVICE_RELATIONS may be sent to a device after a
  IRP_MN_REMOVE_DEVICE

CORE-7826
2021-01-27 05:15:15 +03:00
Jérôme Gardou 0919324772 [NTOS:MM] Get rid of "compatibility layer" for hyper space mappings
Let's call that a bug layer instead.
2021-01-22 09:33:06 +01:00
Victor Perevertkin c4c0585f96
[NTOS:IO][NTOS:PNP] Implement PiCallDriverAddDevice
- Move the driver's name obtaining logic into the IopGetDriverNames
  function
- Create a new PiCallDriverAddDevice instead of PipCallDriverAddDevice
  and move it to pnpmgr/devaction.c file. Move around all its internal
  helpers too
- Support a proper Windows-compatible driver loading order for a PDO
  (lower filters, main service, upper filters, etc.)
- Set a correct Problem for the DeviceNode, in case of an error during
  driver loading
- Check the Start Type for all drivers before loading
- Do not try to load drivers during the early boot stage when there is
  no disk subsystem initialized
2021-01-04 16:50:33 +03:00
Victor Perevertkin 4c95339da0
[NTOS:IO] Refactoring of the driver initialization code (2)
- Do not hold the IopDriverLoadResource while trying to reference a
  driver object (but still acquire it when we actually need to load a
  driver)
- Change IopLoadDriver and IopInitializeDriverModule to use registry
  handle instead of a service name string and/or full registry path
- Do not try to reference a driver object inside IopLoadDriver. It's
  supposed to be done before the function call
2021-01-04 16:50:33 +03:00
Victor Perevertkin a6a3aa0f0d
[NTOS:IO] Refactor IopLoadUnloadDriver
- Split IopLoadUnloadDriver into IopLoadDriver and calling DriverUnload
- Schedule the worker for (un)loading driver in a separate routine
  (IopDoLoadUnloadDriver) this allows IopLoadDriver to be called
  separately (if we are sure that we're in the system process)
2021-01-04 16:50:32 +03:00
Victor Perevertkin e18a32df3a
[NTOS:IO] Refactoring of the driver initialization code
- Remove IopCreateDriver and put its code into IoCreateDriver and
  IopInitializeDriverModule. It's hard to extract a meaningful common
  part from it
- Refactor IopInitializeDriverModule. Extend and put the DriverName
  generation logic into it. Now this function frees the ModuleObject in
  case of failure and returns STATUS_FAILED_DRIVER_ENTRY in case of
  DriverInit failure (will be used later)
2021-01-04 16:50:32 +03:00
Victor Perevertkin 6f0e37b042
[NTOS:PNP][NTOS:IO] Do not create a device object + node on every driver load
- Remove the usage of IopCreateDeviceNode and change it to
  PipAllocateDeviceNode where required
2021-01-04 16:50:32 +03:00
Jérôme Gardou bd0445dbf2 [NTOS/FSRTL] Implement FsRtlAcquireToCreateMappedSection using filter callbacks 2020-12-22 11:37:53 +01:00