Commit graph

418 commits

Author SHA1 Message Date
Hermès Bélusca-Maïto b2bad34b9b
[NTOS] Addendum to 03873aee: check that the computed size of the OEM-converted string is less than MAXUSHORT. 2018-12-21 00:34:56 +01:00
Pierre Schweitzer daf9743c7b
[NTOSKRNL] Check that caller has the priviliege to unload a driver
Also, probe the service name when unloading a driver if called from
user-mode. This will avoid that userland applications can trigger an
invalid read in the kernel (and thus, a BSOD).

CORE-15468
2018-12-20 08:50:51 +01:00
Hermès Bélusca-Maïto bc5acd8102
[NTOS] Minor formatting + don't hardcode sizeof(UCHAR) value. 2018-12-20 03:47:46 +01:00
Hermès Bélusca-Maïto f4597b5540
[NTOS] Addendum to d8cb37bf: return the correct Status from NtAllocateUuids(). 2018-12-20 03:47:45 +01:00
Hermès Bélusca-Maïto 03873aeef3
[NTOS] Fixes for NtDisplayString().
- Require the user to have TCB privilege for using this function.
- Probe and capture the user-provided string (and avoid usermode-triggered BSODS ;-)
- Allocate the OEM-converted string in *NonPagedPool* because we are
  going to transmit the buffer to BOOTVID.
2018-12-20 03:47:36 +01:00
Pierre Schweitzer 4f8b041bf0
[NTOSKRNL] Drop the ViewLock mutex in favour of the master spin lock
This will allow Cc calls during DPC, which is required by MS FastFAT

CORE-11819
2018-12-19 22:51:45 +01:00
Eric Kohl b67dbdbea5 [NTOSKRNL] Fix indentation. No code changes. 2018-12-19 19:18:21 +01:00
Eric Kohl 7e56b21ad6 [NTOSKRNL] Fix indentation. No code changes. 2018-12-19 19:18:20 +01:00
Pierre Schweitzer 549793b8a4
[NTOSKRNL] Fix copy/pasta ;-) 2018-12-19 08:15:11 +01:00
Pierre Schweitzer d8cb37bf15
[NTOSKRNL] Probe parameters in NtAllocateUuids() if called from user-mode
This will avoid that userland applications can trigger an invalid write in
the kernel (and thus, a BSOD).

CORE-15462
2018-12-19 08:09:04 +01:00
Pierre Schweitzer 6ca1c55c6e
[NTOSKRNL] Only allow SYSTEM to call NtSetUuidSeed()
Also, validate input buffer before attempting any operation on it.
This will avoid userland applications to be able to trigger an invalid
read in the kernel (and thus a BSOD).

Regarding access restriction, see:
https://stackoverflow.com/questions/1254244/need-access-to-ntsetuuidseed-from-a-non-localsystem-process

CORE-15460
2018-12-18 23:12:41 +01:00
Eric Kohl 167bffd80f [NTOSKRNL] Add and call the CmpSaveBootControlSet() stub. 2018-12-16 12:49:59 +01:00
Eric Kohl e8d16d0a7d [NTOSKRNL] Fix indentation. No code changes. 2018-12-16 10:30:23 +01:00
Andrew Boyarshin 3ba51dc218 [NTOS:MM] Fix typo in MiCheckForUserStackOverflow 2018-12-12 12:57:08 +01:00
Eric Kohl 12fdc129cf [NTOSKRNL] IopGetDeviceProperty: Send an IRP_MN_QUERY_CAPABILITIES request to the device in order to query the power capabilities. 2018-12-10 00:37:04 +01:00
Pierre Schweitzer 962b2fd66a
[NTOSKRNL] Implement SystemDpcBehaviourInformation query 2018-12-09 20:54:40 +01:00
Pierre Schweitzer 13d9d3ebbf
[NTOSKRNL] Also account PRCBs for Io operations counters 2018-12-09 19:30:07 +01:00
Pierre Schweitzer e632375851
[NTOSKRNL] For SystemPerformanceInformation, return some info extracted from PRCB
This notably includes the amount of context switchs and system calls.
2018-12-09 18:56:50 +01:00
Pierre Schweitzer 4d974e56ee
[NTOSKRNL] Return the amount of hits in system lookaside lists in ExQueryPoolUsage() 2018-12-09 18:25:11 +01:00
Timo Kreuzer 431643b9b3 [NTOS:LPC] Add a number of DPRINTs on failure 2018-12-09 03:16:19 +01:00
Pierre Schweitzer 182cc5c5ab
[NTOSKRNL] Don't dereference VACB when allocating its memory area fails
This avoids performing a double-free (even though that's hidden by the
fact we use lookaside allocations for VACB), and it avoids freeing
a memory address at an uninitialized address.
We don't care about references here, the VACB was just allocated, never
linked and we're its only user.

CORE-15413
2018-12-08 19:56:03 +01:00
Pierre Schweitzer 67e7399164
[NTOSKRNL] Use proper enum type for IopCreateSecurityDescriptorPerType() 2018-12-04 19:20:47 +01:00
Pierre Schweitzer 73e7a5d474
[NTOSKRNL] Use the appropriated security descriptor when creating a device
CORE-9176
2018-12-04 19:13:57 +01:00
Pierre Schweitzer 36c38c45ee
[NTOSKRNL] Implement IopCreateDefaultDeviceSecurityDescriptor() and IopCreateSecurityDescriptorPerType()
CORE-9176
2018-12-04 19:13:57 +01:00
Andrew Boyarshin 198601a101 [NTOS:IO] Tiny improvement to debug message
Add quotes around string, since it is often empty, thus confusing in log.
2018-11-25 11:31:12 +01:00
Bernhard Feichtinger 8a0495063b [NTOS:MM] Handle unimplemeted case for MiCheckForUserStackOverflow 2018-11-25 11:29:18 +01:00
Hermès Bélusca-Maïto f87d9caf77 [NTOS:IO] Finally remove the dreadful IopParseDevice() hack! \o/ 2018-11-25 09:00:40 +01:00
Pierre Schweitzer 4f1e9252f1
[NTOSKRNL] ExfReleaseRundownProtectionCacheAware*() functions don't return anything 2018-11-17 17:36:18 +01:00
Pierre Schweitzer 7ed17cd714
[NTOSKRNL] Implement ExfReInitializeRundownProtectionCacheAware()
We're done with cache-aware rundown protections!
2018-11-17 16:44:37 +01:00
Pierre Schweitzer 05cca64448
[NTOSKRNL] Implement ExfRundownCompletedCacheAware() 2018-11-17 16:44:37 +01:00
Pierre Schweitzer fed61c6305
[NTOSKRNL] Replace ExGetRunRefForCurrentProcessor() by a more generic function 2018-11-17 16:44:36 +01:00
Pierre Schweitzer 7e849470af
[NTOSKRNL] Implement ExfWaitForRundownProtectionReleaseCacheAware() 2018-11-17 16:44:36 +01:00
Pierre Schweitzer acdf74aa3b
[NTOSKRNL] Properly align runrefs on SMP in ExInitializeRundownProtectionCacheAware() 2018-11-17 16:44:36 +01:00
Pierre Schweitzer c5db202bdc
[NTOSKRNL] Properly align allocation on SMP in ExAllocateCacheAwareRundownProtection() 2018-11-17 16:44:36 +01:00
Pierre Schweitzer 36fadc2dca
[NTOSKRNL] Implement ExfAcquireRundownProtectionCacheAwareEx(), ExfReleaseRundownProtectionCacheAwareEx() 2018-11-17 16:44:35 +01:00
Pierre Schweitzer afb2214154
[NTOSKRNL] Simplify implementation of ExfAcquireRundownProtectionCacheAware(), ExfReleaseRundownProtectionCacheAware() 2018-11-17 16:44:35 +01:00
Pierre Schweitzer 010b9b5469
[NTOSKRNL] Implement ExGetRunRefForCurrentProcessor() to get runref for a proc 2018-11-17 16:44:35 +01:00
Pierre Schweitzer 7e36e76d5d
[NTOSKRNL] Implement ExfAcquireRundownProtectionCacheAware(), ExfReleaseRundownProtectionCacheAware() 2018-11-17 16:44:35 +01:00
Pierre Schweitzer 47d309b262
[NTOSKRNL] Implement ExSizeOfRundownProtectionCacheAware() 2018-11-17 16:44:35 +01:00
Pierre Schweitzer ce94d37dbe
[NTOSKRNL] Implement ExInitializeRundownProtectionCacheAware() 2018-11-17 16:44:35 +01:00
Pierre Schweitzer bc77f83888
[NTOSKRNL] Implement ExAllocateCacheAwareRundownProtection() and ExFreeCacheAwareRundownProtection() 2018-11-17 16:44:34 +01:00
Pierre Schweitzer a0c33934fc
[NTOSKRNL] Properly check for negative values in IoCheckEaBufferValidity()
CID 1441355, 1441382
2018-11-16 22:07:08 +01:00
Pierre Schweitzer 95bc44e214
[NTOSKRNL] Don't leak DACL
Spotted by Thomas :-)
2018-11-11 23:21:36 +01:00
Hermès Bélusca-Maïto cbaa8e7dfb
[NTOS:IO] RAW-FS: Few improvements.
- Simplify the volume-deletion code in RawCheckForDismount().

- Fixes the OpenCount check in RawClose(): the VCB mutex must be
  released when the volume has not been dismounted, either because
  OpenCount != 0 or because RawCheckForDismount() returned FALSE.

- Explicitly use VCB_STATE_LOCKED instead of hardcoding its value.

- In IRP_MN_VERIFY_VOLUME handling, lock the volume before playing
  with it, and again let the volume be dismounted only if OpenCount == 0
  (and the IoDeleteDevice() call is done by RawCheckForDismount()).
2018-11-11 21:56:18 +01:00
Hermès Bélusca-Maïto a5ead049d9
[NTOS:IO] RAW-FS: Minor code formatting only. 2018-11-11 21:56:17 +01:00
Pierre Schweitzer 6747dacf10
[NTOSKRNL] Create a security descriptor for the \security directory object 2018-11-10 23:25:10 +01:00
Pierre Schweitzer 102ba75f15
[NTOSKRNL] Return security descriptor size when querying object basic info 2018-11-10 10:54:10 +01:00
Pierre Schweitzer 1fb32afefa
[NTOSKRNL] Return quota information when querying object basic info 2018-11-10 10:54:06 +01:00
Jérôme Gardou df25e4e791 [NTOS/MM] Properly handle page faults in regions marked with
PAGE_NOACCESS or PAGE_GUARD

ROSTESTS-110
2018-11-03 12:50:16 +01:00
Jérôme Gardou 47ac7a2b28 [NTOS/MM] Move up MmAlterViewAttributes for later use in MmNotPresentFaultSectionView
No code change
2018-11-03 12:50:16 +01:00