Pierre Schweitzer
ef8b1a1907
[NTOSKRNL] We don't need an event if we don't issue an IRP
2019-03-29 21:47:34 +01:00
Pierre Schweitzer
28ba29e457
[NTOSKRNL] Implement support for FileFsDriverPathInformation in NtQueryVolumeInformationFile
2019-03-29 21:42:42 +01:00
Pierre Schweitzer
092c37f845
[NTOSKRNL] Do. Not. L. E. A. K.
2019-03-29 19:51:38 +01:00
Pierre Schweitzer
d75ccd01f7
[NTOSKRNL] Only allow direct device open for FileFsDeviceInformation
2019-03-28 22:39:38 +01:00
Pierre Schweitzer
ce6488df31
[NTOSKRNL] Add a quick path for FileFsDeviceInformation in NtQueryVolumeInformationFile
...
This allows querying volume information without issuing an IRP to the owner device.
The kernel is supposed to already have all the required information to return
to the caller.
Side effect: this allows querying volume information for devices not implementing
IRP_MJ_QUERY_VOLUME_INFORMATION such as null.sys
This fixes opening null device in Python.
Fix based on debugging by Maxim Smirnov in PR #1442
CORE-14551
2019-03-28 22:39:38 +01:00
Thomas Faber
8c358a4a90
[NTOS:FSTUB] Unfix format string warning until GUID definition is fixed.
2019-03-25 22:40:41 +01:00
Thomas Faber
a976ebb031
[NTOS:IO] Avoid an unnecessary stack buffer in OpenRegistryHandlesFromSymbolicLink. CORE-15882
2019-03-25 08:43:47 +01:00
Thomas Faber
b0bb3d0041
[NTOS:FSTUB] Fix a clang format string warning.
2019-03-25 08:41:55 +01:00
Thomas Faber
57225adaac
[NTOS:IO] Fix always-false condition in IoCheckEaBufferValidity.
...
Spotted by clang.
2019-03-25 08:41:51 +01:00
Thomas Faber
faaf2dc0e6
[NTOS:KDBG] Fix uninitialized variable usage.
...
Spotted by clang.
2019-03-25 08:41:44 +01:00
Thomas Faber
938f0e469d
[NTOS:IO] Enable privilege check in NtLoadDriver.
2019-03-11 08:30:14 +01:00
Timo Kreuzer
8a4c5763da
[NTOS:PS] Use NULL instead of 0 in ps/kill.c
2019-03-06 00:49:59 +01:00
Timo Kreuzer
addc01d90b
[NTOS:KE] Add function comments
2019-03-06 00:39:25 +01:00
Timo Kreuzer
42730f9373
[NTOS:EX] Fix 64 bit issues in ExfWaitForRundownProtectionReleaseCacheAware
2019-03-04 21:58:42 +01:00
Pierre Schweitzer
1114b89952
[NTOSKRNL] Fix MSVC2010 build
2019-03-02 11:10:37 +01:00
Pierre Schweitzer
c2b6c3a69f
[NTOSKRNL] Fix ClockDiff aka fix MSVC build
2019-03-02 10:45:34 +01:00
Pierre Schweitzer
eb8b481cd4
[NTOSKRNL] Rewrite/fix our UUID generation implementation
...
So that it matches Windows behavior
Also implement ExUuidCreate that will generate UUID version 1
The implementation is based on the RFC 4122
2019-03-01 08:22:48 +01:00
Pierre Schweitzer
2d9673c68f
[NTOSKRNL] Introduce the UUID_CACHED_VALUES_STRUCT structure
...
Source: https://blog.48bits.com/el-codigo-ntoskvinci/
2019-03-01 08:22:47 +01:00
Pierre Schweitzer
81c88c1029
[NTOSKRNL] UuidMutex -> ExpUuidLock
2019-03-01 08:22:47 +01:00
Mark Jansen
5c05a29d3d
[APPHELP] Implement ShimDumpCache and ShimFlushCache
...
These functions simply call into the Base* functions,
having a prototype that is compatible with rundll32
CORE-11301
2019-02-25 20:00:34 +01:00
Timo Kreuzer
81727760e4
[NTOS::Mm] Fix inverted check in MiWriteProtectSystemImage
2019-02-24 20:34:02 +01:00
Thomas Faber
cf40421041
[NTOS:PNP] Correctly respect data size in PnpRegSzToString. CORE-15766
...
Spotted by Vadim Galyant.
2019-02-20 12:23:33 +01:00
Hermès Bélusca-Maïto
83fdb9a6d9
[NTOS:CM] Set and reset the CMHIVE HiveIsLoading flag adequately. Fix an assertion in CmFlushKey() and reset the CMHIVE ViewLockOwner when releasing the view lock.
2019-02-17 01:21:35 +01:00
Pierre Schweitzer
63b13ad939
[NTOSKRNL] Simplify object type name printing
2019-02-11 09:03:58 +01:00
Pierre Schweitzer
df829f7948
[NTOSKRNL] Also display sections name
2019-02-10 11:23:57 +01:00
Pierre Schweitzer
f4320047c3
[NTOSKRNL] Fix parsing loop
2019-02-09 13:59:11 +01:00
Pierre Schweitzer
2991f6e76e
[NTOSKRNL] Add a first implementation of !handle command in KDBG
...
It allows dumping all the handles (filtered by PID/Process)
and it displays basic information about file and key handles
2019-02-09 13:46:35 +01:00
Serge Gautherie
84e76b1c4c
[NTOS:MM] ExFreePoolWithTag(): Accept tag mismatch, on release build only ( #1334 )
...
"Release" builds should not BSoD on 'Freeing pool - invalid tag specified' case,
this is compatible with Windows behaviour.
Nothing changes otherwise concerning the "Debug" builds, where pool-tag mismatch
triggers a BSoD as expected.
CORE-15446
2019-02-07 16:57:56 +01:00
Andrew Cook
d8e92b5a0a
Merge pull request #1335 from ariscop/CMP0065
...
Fixes for upstream cmake
2019-02-03 12:57:20 +01:00
Thomas Faber
066ee4db3b
[NTOS:MM] Dump pool consumers at most once per second.
...
This should avoid some log spam during kmtest:ExPools, which
intentionally depletes pool.
2019-02-03 12:54:36 +01:00
Thomas Faber
f5fc9e0cf2
[NTOS:OB] Correctly handle OBJ_PROTECT_CLOSE in ObDuplicateObject.
2019-02-02 23:02:50 +01:00
Thomas Faber
63977328b1
[NTOSKRNL] Guard against negative InformationClass enum values. CORE-15651
2019-02-02 22:50:02 +01:00
Pierre Schweitzer
a6dc1d69bc
[NTOS:MM] On big pool enumeration, return entry instead of base VA
2019-02-02 10:45:15 +01:00
Serge Gautherie
0483a5a380
[NTOS:OB] Correctly check SeSinglePrivilegeCheck() return value ( #1323 )
...
SeSinglePrivilegeCheck() returns a BOOLEAN, not a NTSTATUS.
CORE-14271
2019-01-30 00:43:13 +01:00
Hermès Bélusca-Maïto
06d4fce5ee
[NTOS:MM] Some fixes for NtCreatePagingFile().
...
- Correctly probe the FileName user pointer before capturing its contents.
- A paging file name with zero length is invalid too.
- Remember (TODO!) in the code that the lower bounds of the Safe*Size values
need to be checked too!
2019-01-28 22:22:56 +01:00
Yaroslav Kibysh
5910a443c3
[NTOS:INBV] Fix the rotation line bitmap ( #1295 )
2019-01-23 13:24:40 +01:00
Jérôme Gardou
5d6c286981
[NTOS/KE] Add diagnosis DPRINT for CORE-15642
2019-01-21 09:38:29 +01:00
Thomas Faber
21ea19c40f
[NTOS:KE] Remove unnecessary breakpoint in KiRaiseException. CORE-15640
2019-01-20 09:57:03 +01:00
Timo Kreuzer
3410b25fde
[NTOS] Turn broken assert into DPRINT
2019-01-19 13:38:24 +01:00
Timo Kreuzer
65dbfc2868
[NTOS:Mm] Rewrite MiWriteProtectSystemImage ( #749 )
...
* The previous version was overcomplicated and broken and therefore disabled.
* The new version also enforces NX protection on x64.
* Now that protecting works, also protect the boot loaded images.
2019-01-18 22:11:43 +01:00
Yaroslav Kibysh
0d86ab6a18
[NTOS:INBV] Update the boot screen's rotation bar's image ( #1256 )
...
Make it smoother than what it currently is.
2019-01-17 20:45:40 +01:00
Pierre Schweitzer
d9a3fd16d4
[NTOSKRNL] Add support for callback when enumerating large pool allocations
2019-01-15 22:07:35 +01:00
Thomas Faber
e7de564bfc
[NTOS:MM] Implement big pool table expansion. CORE-15051
2019-01-09 08:18:38 +01:00
Pierre Schweitzer
a3f8813fff
[NTOSKRNL] Add support for large allocations in !poolfind
2019-01-08 08:43:23 +01:00
Pierre Schweitzer
e1342127f0
[NTOSKRNL] In !irpfind, add info about current stack major/minor
2019-01-08 08:43:23 +01:00
Pierre Schweitzer
e6a1851684
[NTOSKRNL] Misc fixes to !irpfind
2019-01-06 23:21:20 +01:00
Pierre Schweitzer
36f90e7e46
[NTOSKRNL] Move KDBG MM functions implementation to their own file
2019-01-06 22:50:57 +01:00
Pierre Schweitzer
25e14ae2a8
[NTOSKRNL] Fix !irpfind usage message
2019-01-06 13:00:43 +01:00
Pierre Schweitzer
28193399ee
[NTOSKRNL] Properly check for address validity in !poolfind
2019-01-06 12:58:14 +01:00
Pierre Schweitzer
47b48520b5
[NTOSKRNL] Reimplement !irpfind using !poolfind helpers
...
This allows avoiding one of the previous implementation limits:
leaked IRP not queued to a thread are now totally visible since
we look directly in the memory pool.
2019-01-06 12:49:57 +01:00