SUPR3HardenedMainImports-win.cpp@ 69498

Last change on this file since 69498 was 69498, checked in by vboxsync, 7 years ago
backed out r118835 as it incorrectly updated the 'This file is based on' file headers.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 37.2 KB

Line
1	/* $Id: SUPR3HardenedMainImports-win.cpp 69498 2017-10-28 15:07:25Z vboxsync $ */
2	/** @file
3	* VirtualBox Support Library - Hardened Main, Windows Import Trickery.
4	*/
5
6	/*
7	* Copyright (C) 2006-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/nt/nt-and-windows.h>
32
33	#include <VBox/sup.h>
34	#include <VBox/err.h>
35	#include <iprt/ctype.h>
36	#include <iprt/string.h>
37	#include <iprt/initterm.h>
38	#include <iprt/param.h>
39
40	#include "SUPLibInternal.h"
41	#include "SUPHardenedVerify-win.h"
42
43
44	/*********************************************************************************************************************************
45	* Defined Constants And Macros *
46	*********************************************************************************************************************************/
47	#define SUPHARNT_COMMENT(a_Blah) /* nothing */
48
49	#define VBOX_HARDENED_STUB_WITHOUT_IMPORTS
50	#ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
51	# define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
52	do { \
53	if (a_fReportErrors) supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__); \
54	else { static const char s_szWhere[] = a_szWhere; (char )(uintptr_t)(a_id) += 1; __debugbreak(); } \
55	} while (0)
56	#else
57	# define SUPHNTIMP_ERROR(a_fReportErrors, a_id, a_szWhere, a_enmOp, a_rc, ...) \
58	supR3HardenedFatalMsg(a_szWhere, a_enmOp, a_rc, __VA_ARGS__)
59
60	#endif
61
62
63	/*********************************************************************************************************************************
64	* Defined Constants And Macros *
65	*********************************************************************************************************************************/
66	/**
67	* Import function entry.
68	*/
69	typedef struct SUPHNTIMPFUNC
70	{
71	/** The name of the function we're importing. */
72	const char *pszName;
73	/** Where to store the function address (think __imp_ApiName). */
74	PFNRT *ppfnImport;
75	/** Pointer to an early dummy function for imports that aren't available
76	* during early process initialization. */
77	PFNRT pfnEarlyDummy;
78	/** Indicates whether this is an optional import and failure to locate it
79	* should set it to NULL instead of freaking out. */
80	bool fOptional;
81	} SUPHNTIMPFUNC;
82	/** Pointer to an import table entry. */
83	typedef SUPHNTIMPFUNC const *PCSUPHNTIMPFUNC;
84
85	/**
86	* Information for constructing a direct system call.
87	*/
88	typedef struct SUPHNTIMPSYSCALL
89	{
90	/** Where to store the system call number.
91	* NULL if this import doesn't stupport direct system call. */
92	uint32_t *puApiNo;
93	/** Assembly system call routine, type 1. */
94	PFNRT pfnType1;
95	/** Assembly system call routine, type 2. */
96	PFNRT pfnType2;
97	#ifdef RT_ARCH_X86
98	/** The parameter size in bytes for a standard call. */
99	uint32_t cbParams;
100	#endif
101	} SUPHNTIMPSYSCALL;
102	/** Pointer to a system call entry. */
103	typedef SUPHNTIMPSYSCALL const *PCSUPHNTIMPSYSCALL;
104
105	/**
106	* Import DLL.
107	*
108	* This contains both static (like name & imports) and runtime information (like
109	* load and export table locations).
110	*/
111	typedef struct SUPHNTIMPDLL
112	{
113	/** @name Static data.
114	* @{ */
115	const wchar_t *pwszName;
116	const char *pszName;
117	size_t cImports;
118	PCSUPHNTIMPFUNC paImports;
119	/** Array running parallel to paImports if present. */
120	PCSUPHNTIMPSYSCALL paSyscalls;
121	/** @} */
122
123
124	/** The image base. */
125	uint8_t const *pbImageBase;
126	/** The NT headers. */
127	PIMAGE_NT_HEADERS pNtHdrs;
128	/** The NT header offset/RVA. */
129	uint32_t offNtHdrs;
130	/** The end of the section headers. */
131	uint32_t offEndSectHdrs;
132	/** The end of the image. */
133	uint32_t cbImage;
134	/** Offset of the export directory. */
135	uint32_t offExportDir;
136	/** Size of the export directory. */
137	uint32_t cbExportDir;
138
139	/** Exported functions and data by ordinal (RVAs). */
140	uint32_t const *paoffExports;
141	/** The number of exports. */
142	uint32_t cExports;
143	/** The number of exported names. */
144	uint32_t cNamedExports;
145	/** Pointer to the array of exported names (RVAs to strings). */
146	uint32_t const *paoffNamedExports;
147	/** Array parallel to paoffNamedExports with the corresponding ordinals
148	* (indexes into paoffExports). */
149	uint16_t const *pau16NameOrdinals;
150
151	/** Number of patched export table entries. */
152	uint32_t cPatchedExports;
153
154	} SUPHNTIMPDLL;
155	/** Pointer to an import DLL entry. */
156	typedef SUPHNTIMPDLL *PSUPHNTIMPDLL;
157
158
159
160	/*
161	* Declare assembly symbols.
162	*/
163	#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
164	extern PFNRT RT_CONCAT(g_pfn, a_Name);
165	#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86)
166	#define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
167	SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
168	extern uint32_t RT_CONCAT(g_uApiNo, a_Name); \
169	extern FNRT RT_CONCAT(a_Name, _SyscallType1); \
170	extern FNRT RT_CONCAT(a_Name, _SyscallType2);
171	#define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
172	extern PFNRT RT_CONCAT(g_pfn, a_Name); \
173	extern FNRT RT_CONCAT(a_Name, _Early);
174	#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
175
176	RT_C_DECLS_BEGIN
177	#include "import-template-ntdll.h"
178	#include "import-template-kernel32.h"
179	RT_C_DECLS_END
180
181	/*
182	* Import functions.
183	*/
184	#undef SUPHARNT_IMPORT_SYSCALL
185	#undef SUPHARNT_IMPORT_STDCALL_EARLY
186	#undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
187	#undef SUPHARNT_IMPORT_STDCALL
188	#undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
189	#define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
190	{ #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
191	#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
192	{ #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, false },
193	#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) \
194	{ #a_Name, &RT_CONCAT(g_pfn, a_Name), NULL, true },
195	#define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
196	{ #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), false },
197	#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) \
198	{ #a_Name, &RT_CONCAT(g_pfn, a_Name), RT_CONCAT(a_Name,_Early), true },
199	static const SUPHNTIMPFUNC g_aSupNtImpNtDllFunctions[] =
200	{
201	#include "import-template-ntdll.h"
202	};
203
204	static const SUPHNTIMPFUNC g_aSupNtImpKernel32Functions[] =
205	{
206	#include "import-template-kernel32.h"
207	};
208
209
210
211	/*
212	* Syscalls in ntdll.
213	*/
214	#undef SUPHARNT_IMPORT_SYSCALL
215	#undef SUPHARNT_IMPORT_STDCALL_EARLY
216	#undef SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL
217	#undef SUPHARNT_IMPORT_STDCALL
218	#undef SUPHARNT_IMPORT_STDCALL_OPTIONAL
219	#ifdef RT_ARCH_AMD64
220	# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
221	{ NULL, NULL },
222	# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
223	{ &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name, _SyscallType1), &RT_CONCAT(a_Name, _SyscallType2) },
224	#elif defined(RT_ARCH_X86)
225	# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
226	{ NULL, NULL, NULL, 0 },
227	# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
228	{ &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name,_SyscallType1), &RT_CONCAT(a_Name, _SyscallType2), a_cbParamsX86 },
229	#endif
230	#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
231	#define SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
232	#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86) SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
233	static const SUPHNTIMPSYSCALL g_aSupNtImpNtDllSyscalls[] =
234	{
235	#include "import-template-ntdll.h"
236	};
237
238
239	/**
240	* All the DLLs we import from.
241	* @remarks Code ASSUMES that ntdll is the first entry.
242	*/
243	static SUPHNTIMPDLL g_aSupNtImpDlls[] =
244	{
245	{ L"ntdll.dll", "ntdll.dll", RT_ELEMENTS(g_aSupNtImpNtDllFunctions), g_aSupNtImpNtDllFunctions, g_aSupNtImpNtDllSyscalls },
246	{ L"kernelbase.dll", "kernelbase.dll", 0 /* optional module, forwarders only */, NULL, NULL },
247	{ L"kernel32.dll", "kernel32.dll", RT_ELEMENTS(g_aSupNtImpKernel32Functions), g_aSupNtImpKernel32Functions, NULL },
248	};
249
250
251	static void supR3HardenedFindOrLoadModule(PSUPHNTIMPDLL pDll)
252	{
253	#ifdef VBOX_HARDENED_STUB_WITHOUT_IMPORTS
254	uint32_t const cbName = (uint32_t)RTUtf16Len(pDll->pwszName) * sizeof(WCHAR);
255	PPEB_LDR_DATA pLdrData = NtCurrentPeb()->Ldr;
256	LIST_ENTRY *pList = &pLdrData->InMemoryOrderModuleList;
257	LIST_ENTRY *pListEntry = pList->Flink;
258	uint32_t cLoops = 0;
259	while (pListEntry != pList && cLoops < 1024)
260	{
261	PLDR_DATA_TABLE_ENTRY pLdrEntry = RT_FROM_MEMBER(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
262
263	if ( pLdrEntry->FullDllName.Length > cbName + sizeof(WCHAR)
264	&& ( pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '\\'
265	\|\| pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR) - 1] == '/')
266	&& RTUtf16ICmpAscii(&pLdrEntry->FullDllName.Buffer[(pLdrEntry->FullDllName.Length - cbName) / sizeof(WCHAR)],
267	pDll->pszName) == 0)
268	{
269	pDll->pbImageBase = (uint8_t *)pLdrEntry->DllBase;
270	return;
271	}
272
273	pListEntry = pListEntry->Flink;
274	cLoops++;
275	}
276
277	if (!pDll->cImports)
278	pDll->pbImageBase = NULL; /* optional */
279	else
280	SUPHNTIMP_ERROR(false, 1, "supR3HardenedFindOrLoadModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
281	"Failed to locate %ls", pDll->pwszName);
282	#else
283	HMODULE hmod = GetModuleHandleW(pDll->pwszName);
284	if (RT_UNLIKELY(!hmod && pDll->cImports))
285	SUPHNTIMP_ERROR(true, 1, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
286	"Failed to locate %ls", pDll->pwszName);
287	pDll->pbImageBase = (uint8_t *)hmod;
288	#endif
289	}
290
291
292	static void supR3HardenedParseModule(PSUPHNTIMPDLL pDll)
293	{
294	/*
295	* Locate the PE header, do some basic validations.
296	*/
297	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pDll->pbImageBase;
298	uint32_t offNtHdrs = 0;
299	PIMAGE_NT_HEADERS pNtHdrs;
300	if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
301	{
302	offNtHdrs = pMzHdr->e_lfanew;
303	if (offNtHdrs > _2K)
304	SUPHNTIMP_ERROR(false, 2, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
305	"%ls: e_lfanew=%#x, expected a lower value", pDll->pwszName, offNtHdrs);
306	}
307	pDll->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pDll->pbImageBase[offNtHdrs];
308
309	if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
310	SUPHNTIMP_ERROR(false, 3, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
311	"%ls: Invalid PE signature: %#x", pDll->pwszName, pNtHdrs->Signature);
312	if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
313	SUPHNTIMP_ERROR(false, 4, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
314	"%ls: Unexpected optional header size: %#x", pDll->pwszName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
315	if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
316	SUPHNTIMP_ERROR(false, 5, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
317	"%ls: Unexpected optional header magic: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.Magic);
318	if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
319	SUPHNTIMP_ERROR(false, 6, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
320	"%ls: Unexpected number of RVA and sizes: %#x", pDll->pwszName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
321
322	pDll->offNtHdrs = offNtHdrs;
323	pDll->offEndSectHdrs = offNtHdrs
324	+ sizeof(*pNtHdrs)
325	+ pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
326	pDll->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
327
328	/*
329	* Find the export directory.
330	*/
331	IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
332	if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
333	\|\| ExpDir.VirtualAddress < pDll->offEndSectHdrs
334	\|\| ExpDir.VirtualAddress >= pNtHdrs->OptionalHeader.SizeOfImage
335	\|\| ExpDir.VirtualAddress + ExpDir.Size > pNtHdrs->OptionalHeader.SizeOfImage)
336	SUPHNTIMP_ERROR(false, 7, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
337	"%ls: Missing or invalid export directory: %#lx LB %#x", pDll->pwszName, ExpDir.VirtualAddress, ExpDir.Size);
338	pDll->offExportDir = ExpDir.VirtualAddress;
339	pDll->cbExportDir = ExpDir.Size;
340
341	IMAGE_EXPORT_DIRECTORY const pExpDir = (IMAGE_EXPORT_DIRECTORY const )&pDll->pbImageBase[ExpDir.VirtualAddress];
342
343	if ( pExpDir->NumberOfFunctions >= _1M
344	\|\| pExpDir->NumberOfFunctions < 1
345	\|\| pExpDir->NumberOfNames >= _1M
346	\|\| pExpDir->NumberOfNames < 1)
347	SUPHNTIMP_ERROR(false, 8, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
348	"%ls: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
349	pDll->pwszName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
350	pDll->cNamedExports = pExpDir->NumberOfNames;
351	pDll->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
352
353	if ( pExpDir->AddressOfFunctions < pDll->offEndSectHdrs
354	\|\| pExpDir->AddressOfFunctions >= pNtHdrs->OptionalHeader.SizeOfImage
355	\|\| pExpDir->AddressOfFunctions + pDll->cExports * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
356	SUPHNTIMP_ERROR(false, 9, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
357	"%ls: Bad AddressOfFunctions: %#x\n", pDll->pwszName, pExpDir->AddressOfFunctions);
358	pDll->paoffExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfFunctions];
359
360	if ( pExpDir->AddressOfNames < pDll->offEndSectHdrs
361	\|\| pExpDir->AddressOfNames >= pNtHdrs->OptionalHeader.SizeOfImage
362	\|\| pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
363	SUPHNTIMP_ERROR(false, 10, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
364	"%ls: Bad AddressOfNames: %#x\n", pDll->pwszName, pExpDir->AddressOfNames);
365	pDll->paoffNamedExports = (uint32_t const *)&pDll->pbImageBase[pExpDir->AddressOfNames];
366
367	if ( pExpDir->AddressOfNameOrdinals < pDll->offEndSectHdrs
368	\|\| pExpDir->AddressOfNameOrdinals >= pNtHdrs->OptionalHeader.SizeOfImage
369	\|\| pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pNtHdrs->OptionalHeader.SizeOfImage)
370	SUPHNTIMP_ERROR(false, 11, "supR3HardenedParseModule", kSupInitOp_Misc, VERR_INVALID_EXE_SIGNATURE,
371	"%ls: Bad AddressOfNameOrdinals: %#x\n", pDll->pwszName, pExpDir->AddressOfNameOrdinals);
372	pDll->pau16NameOrdinals = (uint16_t const *)&pDll->pbImageBase[pExpDir->AddressOfNameOrdinals];
373	}
374
375
376	static const char *supR3HardenedResolveImport(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, bool fReportErrors)
377	{
378	/*
379	* Binary search.
380	*/
381	uint32_t iStart = 0;
382	uint32_t iEnd = pDll->cNamedExports;
383	while (iStart < iEnd)
384	{
385	uint32_t iCur = iStart + (iEnd - iStart) / 2;
386	uint32_t offExpName = pDll->paoffNamedExports[iCur];
387	if (RT_UNLIKELY(offExpName < pDll->offEndSectHdrs \|\| offExpName >= pDll->cbImage))
388	SUPHNTIMP_ERROR(fReportErrors, 12, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
389	"%ls: Bad export name entry: %#x (iCur=%#x)", pDll->pwszName, offExpName, iCur);
390
391	const char pszExpName = (const char )&pDll->pbImageBase[offExpName];
392	int iDiff = strcmp(pszExpName, pImport->pszName);
393	if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
394	iEnd = iCur;
395	else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
396	iStart = iCur + 1;
397	else /* pszExpName == pszSymbol */
398	{
399	uint16_t iExpOrdinal = pDll->pau16NameOrdinals[iCur];
400	if (iExpOrdinal < pDll->cExports)
401	{
402	uint32_t offExport = pDll->paoffExports[iExpOrdinal];
403
404	/* detect export table patching. */
405	if (offExport >= pDll->cbImage)
406	pDll->cPatchedExports++;
407
408	if (offExport - pDll->offExportDir >= pDll->cbExportDir)
409	{
410	*pImport->ppfnImport = (PFNRT)&pDll->pbImageBase[offExport];
411	return NULL;
412	}
413
414	/* Forwarder. */
415	return (const char *)&pDll->pbImageBase[offExport];
416	}
417	SUPHNTIMP_ERROR(fReportErrors, 14, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_BAD_EXE_FORMAT,
418	"%ls: Name ordinal for '%s' is out of bounds: %#x (max %#x)",
419	pDll->pwszName, iExpOrdinal, pDll->cExports);
420	return NULL;
421	}
422	}
423
424	if (!pImport->fOptional)
425	SUPHNTIMP_ERROR(fReportErrors, 15, "supR3HardenedResolveImport", kSupInitOp_Misc, VERR_SYMBOL_NOT_FOUND,
426	"%ls: Failed to resolve '%s'.", pDll->pwszName, pImport->pszName);
427	*pImport->ppfnImport = NULL;
428	return NULL;
429	}
430
431
432	static void supR3HardenedDirectSyscall(PSUPHNTIMPDLL pDll, PCSUPHNTIMPFUNC pImport, PCSUPHNTIMPSYSCALL pSyscall,
433	PSUPHNTLDRCACHEENTRY pLdrEntry, uint8_t *pbBits, bool fReportErrors)
434	{
435	/*
436	* Skip non-syscall entries.
437	*/
438	if (!pSyscall->puApiNo)
439	return;
440
441	/*
442	* Locate the virgin bits.
443	*/
444	RTLDRADDR uValue;
445	int rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)pDll->pbImageBase, UINT32_MAX, pImport->pszName, &uValue);
446	if (RT_FAILURE(rc))
447	{
448	SUPHNTIMP_ERROR(fReportErrors, 16, "supR3HardenedDirectSyscall", kSupInitOp_Misc, rc,
449	"%s: RTLdrGetSymbolEx failed on %s: %Rrc", pDll->pszName, pImport->pszName, rc);
450	return;
451	}
452	uintptr_t offSymbol = (uintptr_t)uValue - (uintptr_t)pDll->pbImageBase;
453	uint8_t const *pbFunction = &pbBits[offSymbol];
454
455	/*
456	* Parse the code and extract the API call number.
457	*/
458	#ifdef RT_ARCH_AMD64
459	/* Pattern #1: XP64/W2K3-64 thru Windows 10 build 10240.
460	0:000> u ntdll!NtCreateSection
461	ntdll!NtCreateSection:
462	00000000`779f1750 4c8bd1 mov r10,rcx
463	00000000`779f1753 b847000000 mov eax,47h
464	00000000`779f1758 0f05 syscall
465	00000000`779f175a c3 ret
466	00000000`779f175b 0f1f440000 nop dword ptr [rax+rax]
467
468	Pattern #2: Windows 10 build 10525+.
469	0:000> u ntdll_7ffc26300000!NtCreateSection
470	ntdll_7ffc26300000!ZwCreateSection:
471	00007ffc`263943e0 4c8bd1 mov r10,rcx
472	00007ffc`263943e3 b84a000000 mov eax,4Ah
473	00007ffc`263943e8 f604250803fe7f01 test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
474	00007ffc`263943f0 7503 jne ntdll_7ffc26300000!ZwCreateSection+0x15 (00007ffc`263943f5)
475	00007ffc`263943f2 0f05 syscall
476	00007ffc`263943f4 c3 ret
477	00007ffc`263943f5 cd2e int 2Eh
478	00007ffc`263943f7 c3 ret
479	*/
480	if ( pbFunction[ 0] == 0x4c /* mov r10, rcx */
481	&& pbFunction[ 1] == 0x8b
482	&& pbFunction[ 2] == 0xd1
483	&& pbFunction[ 3] == 0xb8 /* mov eax, 0000yyzzh */
484	//&& pbFunction[ 4] == 0xZZ
485	//&& pbFunction[ 5] == 0xYY
486	&& pbFunction[ 6] == 0x00
487	&& pbFunction[ 7] == 0x00)
488	{
489	if ( pbFunction[ 8] == 0x0f /* syscall */
490	&& pbFunction[ 9] == 0x05
491	&& pbFunction[10] == 0xc3 /* ret */ )
492	{
493	*pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
494	*pImport->ppfnImport = pSyscall->pfnType1;
495	return;
496	}
497	if ( pbFunction[ 8] == 0xf6 /* test byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1 */
498	&& pbFunction[ 9] == 0x04
499	&& pbFunction[10] == 0x25
500	&& pbFunction[11] == 0x08
501	&& pbFunction[12] == 0x03
502	&& pbFunction[13] == 0xfe
503	&& pbFunction[14] == 0x7f
504	&& pbFunction[15] == 0x01
505	&& pbFunction[16] == 0x75 /* jnz +3 */
506	&& pbFunction[17] == 0x03
507	&& pbFunction[18] == 0x0f /* syscall*/
508	&& pbFunction[19] == 0x05
509	&& pbFunction[20] == 0xc3 /* ret */
510	&& pbFunction[21] == 0xcd /* int 2eh */
511	&& pbFunction[22] == 0x2e
512	&& pbFunction[23] == 0xc3 /* ret */ )
513	{
514	*pSyscall->puApiNo = RT_MAKE_U16(pbFunction[4], pbFunction[5]);
515	*pImport->ppfnImport = pSyscall->pfnType2;
516	return;
517	}
518	}
519	#else
520	/* Pattern #1: XP thru Windows 7
521	kd> u ntdll!NtCreateSection
522	ntdll!NtCreateSection:
523	7c90d160 b832000000 mov eax,32h
524	7c90d165 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
525	7c90d16a ff12 call dword ptr [edx]
526	7c90d16c c21c00 ret 1Ch
527	7c90d16f 90 nop
528	The variable bit is the value loaded into eax: XP=32h, W2K3=34h, Vista=4bh, W7=54h
529
530	Pattern #2: Windows 8.1
531	0:000:x86> u ntdll_6a0f0000!NtCreateSection
532	ntdll_6a0f0000!NtCreateSection:
533	6a15eabc b854010000 mov eax,154h
534	6a15eac1 e803000000 call ntdll_6a0f0000!NtCreateSection+0xd (6a15eac9)
535	6a15eac6 c21c00 ret 1Ch
536	6a15eac9 8bd4 mov edx,esp
537	6a15eacb 0f34 sysenter
538	6a15eacd c3 ret
539	The variable bit is the value loaded into eax: W81=154h
540	Note! One nice thing here is that we can share code pattern #1. */
541
542	if ( pbFunction[ 0] == 0xb8 /* mov eax, 0000yyzzh*/
543	//&& pbFunction[ 1] <= 0xZZ
544	//&& pbFunction[ 2] <= 0xYY
545	&& pbFunction[ 3] == 0x00
546	&& pbFunction[ 4] == 0x00)
547	{
548	*pSyscall->puApiNo = RT_MAKE_U16(pbFunction[1], pbFunction[2]);
549	if ( pbFunction[5] == 0xba /* mov edx, offset SharedUserData!SystemCallStub */
550	&& pbFunction[ 6] == 0x00
551	&& pbFunction[ 7] == 0x03
552	&& pbFunction[ 8] == 0xfe
553	&& pbFunction[ 9] == 0x7f
554	&& pbFunction[10] == 0xff /* call [edx] */
555	&& pbFunction[11] == 0x12
556	&& ( ( pbFunction[12] == 0xc2 /* ret 1ch */
557	&& pbFunction[13] == pSyscall->cbParams
558	&& pbFunction[14] == 0x00)
559	\|\| ( pbFunction[12] == 0xc3 /* ret */
560	&& pSyscall->cbParams == 0)
561	)
562	)
563	{
564	*pImport->ppfnImport = pSyscall->pfnType1;
565	return;
566	}
567
568	if ( pbFunction[ 5] == 0xe8 /* call [$+3] */
569	&& RT_ABS((int32_t )&pbFunction[6]) < 0x10
570	&& ( ( pbFunction[10] == 0xc2 /* ret 1ch */
571	&& pbFunction[11] == pSyscall->cbParams
572	&& pbFunction[12] == 0x00)
573	\|\| ( pbFunction[10] == 0xc3 /* ret */
574	&& pSyscall->cbParams == 0)
575	)
576	)
577	{
578	*pImport->ppfnImport = pSyscall->pfnType2;
579	return;
580	}
581	}
582	#endif
583
584	/*
585	* Failed to parse it.
586	*/
587	volatile uint8_t abCopy[16];
588	memcpy((void *)&abCopy[0], pbFunction, sizeof(abCopy));
589	SUPHNTIMP_ERROR(fReportErrors, 17, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
590	"%ls: failed to parse syscall: '%s': %.16Rhxs",
591	pDll->pwszName, pImport->pszName, &abCopy[0]);
592	}
593
594
595	/**
596	* Check out system calls and do the directly instead of via NtDll.
597	*
598	* We need to have access to the on disk NTDLL.DLL file as we do not trust the
599	* stuff we find in memory. Too early to verify signatures though.
600	*
601	* @param fReportErrors Whether we've got the machinery for reporting
602	* errors going already.
603	* @param pErrInfo Buffer for gathering additional error info. This
604	* is mainly to avoid consuming lots of stacks with
605	* RTERRINFOSTATIC structures.
606	*/
607	DECLHIDDEN(void) supR3HardenedWinInitSyscalls(bool fReportErrors, PRTERRINFO pErrInfo)
608	{
609	for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
610	if (g_aSupNtImpDlls[iDll].paSyscalls)
611	{
612	PSUPHNTLDRCACHEENTRY pLdrEntry;
613	int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, pErrInfo);
614	if (RT_SUCCESS(rc))
615	{
616	uint8_t *pbBits;
617	rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
618	NULL, NULL, pErrInfo);
619	if (RT_SUCCESS(rc))
620	{
621	for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
622	supR3HardenedDirectSyscall(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
623	&g_aSupNtImpDlls[iDll].paSyscalls[i], pLdrEntry, pbBits, fReportErrors);
624	}
625	else
626	SUPHNTIMP_ERROR(fReportErrors, 20, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
627	"%ls: supHardNtLdrCacheEntryGetBits failed: %Rrc %s",
628	g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
629	}
630	else
631	SUPHNTIMP_ERROR(fReportErrors, 21, "supR3HardenedWinInitImports", kSupInitOp_Misc, rc,
632	"%ls: supHardNtLdrCacheOpen failed: %Rrc %s",
633	g_aSupNtImpDlls[iDll].pwszName, rc, pErrInfo ? pErrInfo->pszMsg : "");
634	}
635	}
636
637
638	/**
639	* Resolves a few NtDll functions we need before child purification is executed.
640	*
641	* We must not permanently modify any global data here.
642	*
643	* @param uNtDllAddr The address of the NTDLL.
644	* @param ppfnNtWaitForSingleObject Where to store the NtWaitForSingleObject
645	* address.
646	* @param ppfnNtSetEvent Where to store the NtSetEvent address.
647	*/
648	DECLHIDDEN(void) supR3HardenedWinGetVeryEarlyImports(uintptr_t uNtDllAddr,
649	PFNNTWAITFORSINGLEOBJECT *ppfnNtWaitForSingleObject,
650	PFNNTSETEVENT *ppfnNtSetEvent)
651	{
652	/*
653	* NTDLL is the first entry in the list. Save it and do the parsing.
654	*/
655	SUPHNTIMPDLL SavedDllEntry = g_aSupNtImpDlls[0];
656
657	g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
658	supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
659
660	/*
661	* Create a temporary import table for the requested APIs and resolve them.
662	*/
663	SUPHNTIMPFUNC aImports[] =
664	{
665	{ "NtWaitForSingleObject", (PFNRT *)ppfnNtWaitForSingleObject, NULL, false },
666	{ "NtSetEvent", (PFNRT *)ppfnNtSetEvent, NULL, false },
667	};
668
669	for (uint32_t i = 0; i < RT_ELEMENTS(aImports); i++)
670	{
671	const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &aImports[i], false);
672	if (pszForwarder)
673	SUPHNTIMP_ERROR(false, 31, "supR3HardenedWinGetVeryEarlyImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
674	"ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
675	}
676
677	/*
678	* Restore the NtDll entry.
679	*/
680	g_aSupNtImpDlls[0] = SavedDllEntry;
681	}
682
683
684	/**
685	* Resolves NtDll functions we can trust calling before process init.
686	*
687	* @param uNtDllAddr The address of the NTDLL.
688	*/
689	DECLHIDDEN(void) supR3HardenedWinInitImportsEarly(uintptr_t uNtDllAddr)
690	{
691	/*
692	* NTDLL is the first entry in the list.
693	*/
694	g_aSupNtImpDlls[0].pbImageBase = (uint8_t const *)uNtDllAddr;
695	supR3HardenedParseModule(&g_aSupNtImpDlls[0]);
696	for (uint32_t i = 0; i < g_aSupNtImpDlls[0].cImports; i++)
697	if (!g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy)
698	{
699	const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &g_aSupNtImpDlls[0].paImports[i], false);
700	if (pszForwarder)
701	SUPHNTIMP_ERROR(false, 32, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
702	"ntdll: Failed to resolve forwarder '%s'.", pszForwarder);
703	}
704	else
705	*g_aSupNtImpDlls[0].paImports[i].ppfnImport = g_aSupNtImpDlls[0].paImports[i].pfnEarlyDummy;
706
707	/*
708	* Point the other imports at the early init stubs.
709	*/
710	for (uint32_t iDll = 1; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
711	for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
712	if (!g_aSupNtImpDlls[iDll].paImports[i].fOptional)
713	*g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = g_aSupNtImpDlls[iDll].paImports[i].pfnEarlyDummy;
714	else
715	*g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = NULL;
716	}
717
718
719	/**
720	* Resolves imported functions, esp. system calls from NTDLL.
721	*
722	* This crap is necessary because there are sandboxing products out there that
723	* will mess with system calls we make, just like any other wannabe userland
724	* rootkit. Kudos to microsoft for not providing a generic system call hook API
725	* in the kernel mode, which I guess is what forcing these kind of products to
726	* do ugly userland hacks that doesn't really hold water.
727	*/
728	DECLHIDDEN(void) supR3HardenedWinInitImports(void)
729	{
730	RTERRINFOSTATIC ErrInfo;
731
732	/*
733	* Find the DLLs we will be needing first (forwarders).
734	*/
735	for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
736	{
737	supR3HardenedFindOrLoadModule(&g_aSupNtImpDlls[iDll]);
738	if (g_aSupNtImpDlls[iDll].pbImageBase)
739	supR3HardenedParseModule(&g_aSupNtImpDlls[iDll]);
740	}
741
742	/*
743	* Resolve the functions.
744	*/
745	for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
746	for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
747	{
748	const char *pszForwarder = supR3HardenedResolveImport(&g_aSupNtImpDlls[iDll], &g_aSupNtImpDlls[iDll].paImports[i],
749	false);
750	if (pszForwarder)
751	{
752	const char *pszDot = strchr(pszForwarder, '.');
753	size_t cchDllName = pszDot - pszForwarder;
754	SUPHNTIMPFUNC Tmp = g_aSupNtImpDlls[iDll].paImports[i];
755	Tmp.pszName = pszDot + 1;
756	if (cchDllName == sizeof("ntdll") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("ntdll")) == 0)
757	supR3HardenedResolveImport(&g_aSupNtImpDlls[0], &Tmp, false);
758	else if (cchDllName == sizeof("kernelbase") - 1 && RTStrNICmp(pszForwarder, RT_STR_TUPLE("kernelbase")) == 0)
759	supR3HardenedResolveImport(&g_aSupNtImpDlls[1], &Tmp, false);
760	else
761	SUPHNTIMP_ERROR(false, 18, "supR3HardenedWinInitImports", kSupInitOp_Misc, VERR_MODULE_NOT_FOUND,
762	"%ls: Failed to resolve forwarder '%s'.", g_aSupNtImpDlls[iDll].pwszName, pszForwarder);
763	}
764	}
765
766	/*
767	* Do system calls directly.
768	*/
769	supR3HardenedWinInitSyscalls(false, RTErrInfoInitStatic(&ErrInfo));
770
771	/*
772	* Use the on disk image to avoid export table patching. Currently
773	* ignoring errors here as can live normally without this step.
774	*/
775	for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
776	if (g_aSupNtImpDlls[iDll].cPatchedExports > 0)
777	{
778	PSUPHNTLDRCACHEENTRY pLdrEntry;
779	int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
780	if (RT_SUCCESS(rc))
781	{
782	uint8_t *pbBits;
783	rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
784	RTErrInfoInitStatic(&ErrInfo));
785	if (RT_SUCCESS(rc))
786	for (uint32_t i = 0; i < g_aSupNtImpDlls[iDll].cImports; i++)
787	{
788	RTLDRADDR uValue;
789	rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
790	UINT32_MAX, g_aSupNtImpDlls[iDll].paImports[i].pszName, &uValue);
791	if (RT_SUCCESS(rc))
792	*g_aSupNtImpDlls[iDll].paImports[i].ppfnImport = (PFNRT)(uintptr_t)uValue;
793	}
794	}
795	}
796
797
798	#if 0 /* Win7/32 ntdll!LdrpDebugFlags. */
799	(uint8_t )&g_aSupNtImpDlls[0].pbImageBase[0xdd770] = 0x3;
800	#endif
801	}
802
803
804	/**
805	* Gets the address of a procedure in a DLL, ignoring our own syscall
806	* implementations.
807	*
808	* Currently restricted to NTDLL and KERNEL32
809	*
810	* @returns The procedure address.
811	* @param pszDll The DLL name.
812	* @param pszProcedure The procedure name.
813	*/
814	DECLHIDDEN(PFNRT) supR3HardenedWinGetRealDllSymbol(const char pszDll, const char pszProcedure)
815	{
816	RTERRINFOSTATIC ErrInfo;
817
818	/*
819	* Look the DLL up in the import DLL table.
820	*/
821	for (uint32_t iDll = 0; iDll < RT_ELEMENTS(g_aSupNtImpDlls); iDll++)
822	if (RTStrICmp(g_aSupNtImpDlls[iDll].pszName, pszDll) == 0)
823	{
824
825	PSUPHNTLDRCACHEENTRY pLdrEntry;
826	int rc = supHardNtLdrCacheOpen(g_aSupNtImpDlls[iDll].pszName, &pLdrEntry, RTErrInfoInitStatic(&ErrInfo));
827	if (RT_SUCCESS(rc))
828	{
829	uint8_t *pbBits;
830	rc = supHardNtLdrCacheEntryGetBits(pLdrEntry, &pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase, NULL, NULL,
831	RTErrInfoInitStatic(&ErrInfo));
832	if (RT_SUCCESS(rc))
833	{
834	RTLDRADDR uValue;
835	rc = RTLdrGetSymbolEx(pLdrEntry->hLdrMod, pbBits, (uintptr_t)g_aSupNtImpDlls[iDll].pbImageBase,
836	UINT32_MAX, pszProcedure, &uValue);
837	if (RT_SUCCESS(rc))
838	return (PFNRT)(uintptr_t)uValue;
839	SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: Error getting %s in %s -> %Rrc\n", pszProcedure, pszDll, rc));
840	}
841	else
842	SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheEntryAllocBits failed on %s: %Rrc %s\n",
843	pszDll, rc, ErrInfo.Core.pszMsg));
844	}
845	else
846	SUP_DPRINTF(("supR3HardenedWinGetRealDllSymbol: supHardNtLdrCacheOpen failed on %s: %Rrc %s\n",
847	pszDll, rc, ErrInfo.Core.pszMsg));
848
849	/* Complications, just call GetProcAddress. */
850	if (g_enmSupR3HardenedMainState >= SUPR3HARDENEDMAINSTATE_WIN_IMPORTS_RESOLVED)
851	return (PFNRT)GetProcAddress(GetModuleHandleW(g_aSupNtImpDlls[iDll].pwszName), pszProcedure);
852	return NULL;
853	}
854
855	supR3HardenedFatal("supR3HardenedWinGetRealDllSymbol: Unknown DLL %s (proc: %s)\n", pszDll, pszProcedure);
856	/* not reached */
857	}
858

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainImports-win.cpp@ 69498

Download in other formats: