Hermès Bélusca-Maïto
35f800c6e2
[NTOS] Minor formatting enhancements only + typo fixes.
2019-06-25 21:01:48 +02:00
Bișoc George
42ce8519b6
[FASTFAT][FLTMGR][NTOS] Do not explicitly call ObfDereferenceObject() ( #1636 )
...
"Most code should not directly call the platform-specific ObfDereferenceObject() function but use the ObDereferenceObject() macro instead."
CORE-16081
2019-06-22 16:20:58 +02:00
Hermès Bélusca-Maïto
4d5a2dd0f3
[NTOS:KE] Use multi-processor-aware KeGetPcr() instead of the legacy PCR.
2019-06-20 19:39:49 +02:00
Hermès Bélusca-Maïto
04906f2abb
[NTOS:KE] Fixup for the NMI task handler: handle NMI recursion. -- Code was lost in commit 2efed8ef
(r45040).
2019-06-20 19:39:44 +02:00
Hermès Bélusca-Maïto
3c8f19eb21
[NTOS:KE] Improvements for the Trap02 (NMI) and Trap08 (double-fault) exception handlers.
...
- Add FRAME_TSS FPO debug information for Trap02 and Trap08.
- Switch the active TSS in Trap08 in the very same way as is done in Trap02.
This allows to correctly debug NMI and double-fault exceptions with WinDbg,
by following the different TSS contexts, as described in:
https://blogs.msdn.microsoft.com/debuggingtoolbox/2008/02/22/special-command-analyzing-and-reconstructing-the-stack-using-the-k-command-and-its-variations/
https://blogs.msdn.microsoft.com/ntdebugging/2009/11/25/part-1-got-stack-no-we-ran-out-of-kernel-mode-stack-and-kv-wont-tell-me-why/
http://www.osronline.com/article.cfm?article=254 and http://www.osronline.com/article.cfm?article=328
2019-06-20 19:38:56 +02:00
Hermès Bélusca-Maïto
d15e36a1f1
[NTOS:KE][SDK:ASM] Code formatting/styling only.
...
- Un-hardcode the RPL_MASK value.
- s/KiUnexpectedInterrupt&Number/KiUnexpectedInterrupt&Vector/
- Use C-style comments in traphdlr.c as everywhere else in the file.
- Update the URLs for the MSDN "FPO" macro documentation.
2019-06-20 18:07:59 +02:00
Eric Kohl
6866c0aede
[NTOSKRNL][USETUP][UMPNPMGR] Pass user response data to NtPlugPlayControl(PlugPlayControlUserResponse).
...
- Windows requires 16 bytes of response data.
- Add the PLUGPLAY_CONTROL_USER_RESPONSE_DATA type.
- Usetup and Umpnpmgr must fail if NtPlugPlayControl(PlugPlayControlUserResponse) does not return STATUS_SUCCESS.
2019-06-12 13:48:27 +02:00
Hermès Bélusca-Maïto
9060b0cb7a
Fix build (forgot a comma ;)
2019-06-11 22:36:10 +02:00
Hermès Bélusca-Maïto
41e7c818d1
[NTOS] IoSetHardErrorOrVerifyDevice(): Check whether the IRP is not associated with any thread.
2019-06-11 22:29:34 +02:00
Pierre Schweitzer
f6eb13a969
[NTOSKRNL] Rework ObpDeleteSymbolicLinkName and ObpCreateSymbolicLinkName
...
So that they handle LUID mappings and process device maps.
Get rid of the ObpParseSymbolicLinkToIoDeviceObject helper and introduce a
new helper ObpProcessDosDeviceSymbolicLink that will do the same things
but also handle name creation/deletion as well as device map handling.
All this is based on previous code (hence the same comments :-)).
What's left to do now is to add support for device maps in ObpLookupObjectName
2019-06-11 21:21:52 +02:00
Pierre Schweitzer
33604e0147
[NTOSKRNL] Fix ObpLUIDDeviceMapsEnabled initialization
2019-06-10 21:17:21 +02:00
Pierre Schweitzer
651ba03c6d
[NTOSKRNL] Taggify some allocs
2019-06-10 14:54:55 +02:00
Pierre Schweitzer
a5daa8894d
[NTOSKRNL] Implement SepCleanupLUIDDeviceMapDirectory
...
This will clean up all the links (drive letters) created
by an user on session deletion once LUID device maps are
in use
2019-06-10 14:49:50 +02:00
Pierre Schweitzer
5ecc05003d
[NTOSKRNL] On session last reference removal, dereference LUID device map
2019-06-10 12:30:49 +02:00
Pierre Schweitzer
ad80715b1a
[NTOSKRNL] Implement NtSetInformationProcess:ProcessDeviceMap
2019-06-10 10:35:24 +02:00
Eric Kohl
8319c73e2e
[NTOS:IO] Implement the PlugPlayControl.PlugPlayControlEnumerateDevice request
...
Drivers for Intel Pro/1000 NICs seem to install properly.
2019-06-08 20:42:38 +02:00
Serge Gautherie
cf27695269
[NTOS:MM] PeFmtCreateSection(): Improve AMD64 image failure case
...
Addendum to 98638cc2df
.
CORE-15981
2019-06-04 18:22:19 +02:00
Pierre Schweitzer
fd4752450f
[NTOSKRNL] Add support for global DOS directory in ObpLookupEntryDirectory
...
If any exists, we'll loop over in that directory, trying to find the object
2019-06-02 21:46:35 +02:00
Pierre Schweitzer
9c3c0d123b
[NTOSKRNL] In case IopMountVolume call is a success, return its VPB
...
This fixes an extra (erroneous) reference being set on the VPB.
Based on a patch by Vadim Galyant
CORE-16080
2019-06-02 10:48:35 +02:00
Pierre Schweitzer
f8a4d31da4
[NTOSKRNL] On process primary token change, dereference device map
2019-06-02 10:00:17 +02:00
Pierre Schweitzer
de17b36037
[NTOSKRNL] Implement ObSetDirectoryDeviceMap
2019-06-01 21:22:30 +02:00
Pierre Schweitzer
7c618faa32
[NTOSKRNL] Implement SeGetLogonIdDeviceMap
2019-06-01 21:09:20 +02:00
Pierre Schweitzer
4bf7d54910
[NTOSKRNL] Implement ObpSetCurrentProcessDeviceMap
2019-06-01 18:58:36 +02:00
Pierre Schweitzer
57c6086806
[NTOSKRNL] Implement ObpReferenceDeviceMap()
2019-06-01 18:43:38 +02:00
Pierre Schweitzer
59806f7eb0
[NTOSKRNL] Stub SeGetLogonIdDeviceMap
2019-06-01 18:37:47 +02:00
Pierre Schweitzer
445e895932
[NTOSKRNL] Simplify NtQueryInformationProcess:ProcessDeviceMap implementation
2019-06-01 17:40:23 +02:00
Pierre Schweitzer
46b90ccb96
[NTOSKRNL] Add support for LUID mappings in ObQueryDeviceMapInformation
2019-06-01 17:40:18 +02:00
Pierre Schweitzer
1074a9aaff
[NTOSKRNL] Implement support for PROCESS_DEVICEMAP_INFORMATION_EX in NtQueryInformationProcess
2019-06-01 15:18:52 +02:00
Pierre Schweitzer
b16a07fa69
[NTOSKRNL] Implement ObIsLUIDDeviceMapsEnabled and call it in NtQueryInformationProcess
2019-06-01 14:56:28 +02:00
Pierre Schweitzer
7898b2eaa3
[NTOSKRNL] Disable LUID mapping until it's properly implemented
2019-06-01 14:40:54 +02:00
Pierre Schweitzer
848f7bb687
[NTOSKRNL] On device map freeing, make directory object temporary again
2019-06-01 13:59:13 +02:00
Pierre Schweitzer
221ed88141
[NTOSKRNL] De-duplicate code between Ob(f)DereferenceDeviceMap functions
2019-06-01 13:54:34 +02:00
Pierre Schweitzer
1b42731dca
[NTOSKRNL] Add a few ASSERTs to ObpGetDosDevicesProtection for DBG builds
2019-06-01 13:51:40 +02:00
Pierre Schweitzer
8f655f9466
[NTOSKRNL] Implement ObpFreeDosDevicesProtection to free DACL
2019-06-01 13:44:55 +02:00
Pierre Schweitzer
933dddeb07
[NTOSKRNL] Modify ObpCreateDeviceMap so that it can handle any process
...
It is now able to set the newly created device map to any
process and will default to current process if none is provided.
It also sets system device map if no process is specified.
It also deferences existing device map in the process if needed.
Finaly, it will make the directory object permanant.
2019-06-01 13:35:41 +02:00
Hervé Poussineau
e5bffe49da
[NTOS:KDBG] Use CONTEXT instead of KTRAP_FRAME
...
Change KdbpTrapFrameToKdbTrapFrame to prefer CONTEXT (if available) over
KTRAP_FRAME.
2019-05-23 11:04:40 +02:00
Hervé Poussineau
f7ec84eea0
[NTOS:KD] Remove some _WINDK_ usages
...
- Always include kd64.h
- Change KdpPrompt() prototype to be compatible between KDBG and _WINDK_
- Rename KdComponentTable to KdpComponentTable to prevent a conflict
- Add some functions stubs and global variables
2019-05-23 11:04:40 +02:00
Hervé Poussineau
f5e962ff2e
[NTOS:KD] Remove dead code
2019-05-23 11:04:40 +02:00
Hervé Poussineau
95d5b39b57
[NTOS:KD] Remove CTRL+C pending support left over, likely broken by 5a6adb4f13
2019-05-23 11:04:40 +02:00
Hervé Poussineau
f6cec6d5cb
[NTOS:KD] Remove /BREAK support left over, likely broken by 819a0ed90a
2019-05-23 11:04:40 +02:00
Pierre Schweitzer
fe6c7f05e2
[NTOSKRNL] Use the security descriptor for all the symlinks
2019-05-21 19:28:17 +02:00
Pierre Schweitzer
95d303bf13
[NTOSKRNL] Simplify ObpCreateGlobalDosDevicesSD by using a SD on the stack
...
Rename it to ObpGetDosDevicesProtection to reflect the two previous changes:
its purpose is to return a DACL matching protection mode
2019-05-21 19:28:16 +02:00
Pierre Schweitzer
33f524c625
[NTOSKRNL] Use relaxed ACLs in ObpCreateGlobalDosDevicesSD when protection mode is not set
2019-05-21 19:28:16 +02:00
Pierre Schweitzer
1c4e44592c
[NTOSKRNL] Save ProtectionMode value on boot
2019-05-21 19:28:16 +02:00
Pierre Schweitzer
f821e1742c
[NTOSKRNL] Implement NtQuerySystemInformation(SystemObjectSecurityMode)
2019-05-18 10:37:25 +02:00
Pierre Schweitzer
a33a69b3f4
[NTOSKRNL] Save ObjectSecurityMode value on boot
2019-05-18 10:37:24 +02:00
Mark Jansen
98638cc2df
[NTOS/MM] Recognize AMD64 image in PeFmtCreateSection failure case
2019-05-15 19:39:56 +02:00
Thomas Faber
f86360fdbc
[NTOS:CM] Do not call ZwQueryObject with a zero-size buffer. CORE-15882
...
Actually fixes ntdll_apitest:NtLoadUnloadKey.
2019-05-07 13:52:50 +02:00
Thomas Faber
d3fa3b0ca2
[NTOS:CM] Check for correct status from ZwQueryObject. CORE-15882
...
Fixes regression in ntdll_apitest:NtLoadUnloadKey from d570482bc7
.
2019-05-05 17:57:12 +02:00
Thomas Faber
5706f6e9f4
[NTOS:PNP] Reduce the size of the pool buffer in IopGetParentIdPrefix. CORE-15882
2019-05-05 10:39:29 +02:00
Thomas Faber
2f1fab41fa
[NTOS:CM] Reduce the size of some unnecessarily large stack buffers. CORE-15882
2019-05-05 10:39:26 +02:00
Thomas Faber
047a3bf79a
[NTOS:CM] Simplify CmpGetRegistryPath to avoid unnecessary stack buffers. CORE-15882
2019-05-05 10:39:22 +02:00
Thomas Faber
d570482bc7
[NTOS:CM] Avoid a fixed-length stack buffer in CmpCmdHiveOpen. CORE-15882
2019-05-05 10:39:18 +02:00
Thomas Faber
26ab9f8a03
[NTOS:CM] Avoid a fixed-length stack buffer in CmpAddToHiveFileList. CORE-15882
2019-05-05 10:39:14 +02:00
Thomas Faber
f3a280f52b
[NTOS] Use correct buffer size when calling MiResolveImageReferences. CORE-15882
2019-05-05 10:39:11 +02:00
Thomas Faber
ccb91bebbe
[NTOS:PNP] Avoid a fixed-length stack buffer in IopActionConfigureChildServices. CORE-15882
2019-05-05 10:39:07 +02:00
Thomas Faber
e1b20681f5
[NTOS:IO] Avoid a fixed-length buffer in IopGetDriverObject. CORE-15882
2019-05-05 10:39:01 +02:00
Thomas Faber
6fdff1f970
[NTOS:KDBG] Avoid use of MAX_PATH. CORE-15882
2019-05-05 10:38:10 +02:00
Mark Jansen
2450dec427
[NTOS/MM] Ensure ImageBase is not used uninitialized
2019-04-30 18:57:43 +02:00
Hermès Bélusca-Maïto
884db2ea06
[NTOS:CM] In CmpParseKey(), do not assert but instead correctly return failure if CmpHandleExitNode() doesn't return a valid node, or CmpCreateKeyControlBlock() fails.
2019-04-22 21:09:10 +02:00
Hermès Bélusca-Maïto
627b1df579
[NTOS] Fix typos.
2019-04-22 19:41:19 +02:00
Bernhard Feichtinger
f5471b7b4b
[NTOS][USERSRV] Silence noisy debug output.
2019-04-22 17:41:17 +02:00
Eric Kohl
cfe54aa4b5
[NTOSKRNL] Revert f71588ff
as it seems to break the tests
2019-04-20 23:26:57 +02:00
Pierre Schweitzer
335b906ca8
[NTOSKRNL] Drop the useless Timestamp field
2019-04-20 11:31:59 +02:00
Pierre Schweitzer
77b6899d89
[NTOSKRNL] Don't set VACB dirty on release if already dirty
...
CORE-15954
2019-04-20 11:23:35 +02:00
Pierre Schweitzer
bd75947372
[NTOSKRNL] Drop the no longer needed Dirty field
...
CORE-15954
2019-04-18 08:14:41 +02:00
Pierre Schweitzer
8b6696fcdb
[NTOSKRNL] Don't mark VACB dirty on unpin
...
This could happen if BCB was marked dirty previously.
Marking VACB dirty on unpin could lead to a double write of
the VACB, even if clean.
Indeed, now that setting BCB dirty leads to marking VACB
dirty, the VACB can be flushed in between by the lazy-writer.
The BCB state is not reset on VACB flush, contrary to the VACB state.
Thus, on unpin even if the VACB was already flushed, we were
setting back the dirty state, leading the VACB to be flushed again.
This could bring a small performance downgrade. Though it remains
limited since this is mostly used for FS metadata.
Possibly it could lead to metadata corruption, but this is likely
less possible.
CORE-15954
2019-04-17 22:35:19 +02:00
Eric Kohl
f71588ff7a
[NTOSKRNL] NtPowerInformation: Report an AC powered machine by default.
2019-04-16 20:41:21 +02:00
Eric Kohl
fb36723066
[NTOSKRNL] Initialize GUID_DEVICE_BATTERY properly
2019-04-08 21:19:57 +02:00
Hervé Poussineau
4d1a8f8f54
[NTOS:FSRTL] Use _SEH2_AbnormalTermination() instead of _abnormal_termination()
...
We're already using SEH2 macros, so also use SEH2 functions
2019-04-07 19:28:18 +02:00
Eric Kohl
626aaf227c
[NTOSKRNL] Use global power capabilities and report button presence
...
- Add and initialize a global power capabilities variable.
- Return the global power capabilities via NtPowerInformation.SystemPowerCapabilities.
- Report the presence of power button, sleep button and lid.
2019-04-07 16:42:58 +02:00
Jérôme Gardou
979972b900
[CMAKE] unset EXPORT_SYMBOL for modules and shared libraries
...
We don't use that
2019-04-06 17:43:38 +02:00
Bartosz Brachaczek
d256ff6006
[NTOSKRNL] Do not try to access OldBackTracking[-1]
...
It can be triggered by the existing "F<", "FILE.TXT" case in the tests.
CORE-15902
2019-04-01 08:28:00 +02:00
Bartosz Brachaczek
695e00fbbd
[NTOSKRNL] Unify buffer size calculation in FsRtlIs{Name,Dbcs}InExpression
...
It better captures the intent now in FsRtlIsNameInExpressionPrivate and
fixes a slight overallotion by 4 bytes in FsRtlIsDbcsInExpression.
While at it, use the ANSI_DOS_DOT macro in the Dbcs version.
CORE-15902
2019-04-01 08:27:59 +02:00
Bartosz Brachaczek
e9b438bfaa
[NTOSKRNL] Addendum to 21d2c70
: properly start DOS_START loop
...
Fixes last failing test.
CORE-15902
2019-03-31 19:35:25 +02:00
Maxim Smirnov
d29e216f99
[NTOSKRNL] In MmCreateImageSection, properly check whether cache was initialized
...
This fixes a crash that occurs if nul is typed in cmd.exe
2019-03-31 13:51:06 +02:00
Bartosz Brachaczek
8bc9935fcb
[NTOSKRNL] Properly copy backtracking buffer content on realloc
...
CORE-15902
2019-03-31 11:44:01 +02:00
Bartosz Brachaczek
21d2c70bb4
[NTOSKRNL] Properly compare position to name length in FsRtlIsNameInExpressionPrivate
...
CORE-15902
2019-03-31 11:44:00 +02:00
Bartosz Brachaczek
5d5e9c8486
[NTOSKRNL] Don't overflow backtrack stack buffer
...
CORE-15902
2019-03-31 11:44:00 +02:00
Bartosz Brachaczek
b1ae592e7f
[NTOSKRNL] Don't oversize buffer for backtracking in FsRtlIsNameInExpressionPrivate
...
CORE-15902
2019-03-31 11:44:00 +02:00
Thomas Faber
d605b5063f
[NTOS:IO] Send IRPs to the correct device in IoVolumeDeviceToDosName. CORE-15415
2019-03-30 10:13:27 +01:00
Pierre Schweitzer
3a5063948e
[MEH] Forgot that file :-(
2019-03-29 21:51:41 +01:00
Pierre Schweitzer
ef8b1a1907
[NTOSKRNL] We don't need an event if we don't issue an IRP
2019-03-29 21:47:34 +01:00
Pierre Schweitzer
28ba29e457
[NTOSKRNL] Implement support for FileFsDriverPathInformation in NtQueryVolumeInformationFile
2019-03-29 21:42:42 +01:00
Pierre Schweitzer
092c37f845
[NTOSKRNL] Do. Not. L. E. A. K.
2019-03-29 19:51:38 +01:00
Pierre Schweitzer
d75ccd01f7
[NTOSKRNL] Only allow direct device open for FileFsDeviceInformation
2019-03-28 22:39:38 +01:00
Pierre Schweitzer
ce6488df31
[NTOSKRNL] Add a quick path for FileFsDeviceInformation in NtQueryVolumeInformationFile
...
This allows querying volume information without issuing an IRP to the owner device.
The kernel is supposed to already have all the required information to return
to the caller.
Side effect: this allows querying volume information for devices not implementing
IRP_MJ_QUERY_VOLUME_INFORMATION such as null.sys
This fixes opening null device in Python.
Fix based on debugging by Maxim Smirnov in PR #1442
CORE-14551
2019-03-28 22:39:38 +01:00
Thomas Faber
8c358a4a90
[NTOS:FSTUB] Unfix format string warning until GUID definition is fixed.
2019-03-25 22:40:41 +01:00
Thomas Faber
a976ebb031
[NTOS:IO] Avoid an unnecessary stack buffer in OpenRegistryHandlesFromSymbolicLink. CORE-15882
2019-03-25 08:43:47 +01:00
Thomas Faber
b0bb3d0041
[NTOS:FSTUB] Fix a clang format string warning.
2019-03-25 08:41:55 +01:00
Thomas Faber
57225adaac
[NTOS:IO] Fix always-false condition in IoCheckEaBufferValidity.
...
Spotted by clang.
2019-03-25 08:41:51 +01:00
Thomas Faber
faaf2dc0e6
[NTOS:KDBG] Fix uninitialized variable usage.
...
Spotted by clang.
2019-03-25 08:41:44 +01:00
Thomas Faber
938f0e469d
[NTOS:IO] Enable privilege check in NtLoadDriver.
2019-03-11 08:30:14 +01:00
Timo Kreuzer
8a4c5763da
[NTOS:PS] Use NULL instead of 0 in ps/kill.c
2019-03-06 00:49:59 +01:00
Timo Kreuzer
addc01d90b
[NTOS:KE] Add function comments
2019-03-06 00:39:25 +01:00
Timo Kreuzer
42730f9373
[NTOS:EX] Fix 64 bit issues in ExfWaitForRundownProtectionReleaseCacheAware
2019-03-04 21:58:42 +01:00
Pierre Schweitzer
1114b89952
[NTOSKRNL] Fix MSVC2010 build
2019-03-02 11:10:37 +01:00
Pierre Schweitzer
c2b6c3a69f
[NTOSKRNL] Fix ClockDiff aka fix MSVC build
2019-03-02 10:45:34 +01:00
Pierre Schweitzer
eb8b481cd4
[NTOSKRNL] Rewrite/fix our UUID generation implementation
...
So that it matches Windows behavior
Also implement ExUuidCreate that will generate UUID version 1
The implementation is based on the RFC 4122
2019-03-01 08:22:48 +01:00
Pierre Schweitzer
2d9673c68f
[NTOSKRNL] Introduce the UUID_CACHED_VALUES_STRUCT structure
...
Source: https://blog.48bits.com/el-codigo-ntoskvinci/
2019-03-01 08:22:47 +01:00