diff options
| author | Zac Lockard <[email protected]> | 2023-09-28 15:31:56 -0700 |
|---|---|---|
| committer | Zac Lockard <[email protected]> | 2023-09-28 15:31:56 -0700 |
| commit | c3e1a7f2d210cbac6c51a8f6915f73defac4df71 (patch) | |
| tree | 42765665a64422908d4c738e36244830dcd6d3ca | |
| parent | f6b43cc8dc357af15c57d4ae055e8e4750472b4b (diff) | |
Clean up paradigm
| -rw-r--r-- | filesys/miniFilter/cancelSafe/cancelSafe.c | 201 | ||||
| -rw-r--r-- | filesys/miniFilter/cancelSafe/cancelSafe.inf | bin | 9046 -> 8698 bytes |
2 files changed, 138 insertions, 63 deletions
diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.c b/filesys/miniFilter/cancelSafe/cancelSafe.c index 522ce7b8..af0f9bef 100644 --- a/filesys/miniFilter/cancelSafe/cancelSafe.c +++ b/filesys/miniFilter/cancelSafe/cancelSafe.c @@ -56,7 +56,6 @@ Environment: #define CSQ_KEY_NAME_DELAY L"OperatingDelay" #define CSQ_KEY_NAME_PATH L"OperatingPath" #define CSQ_KEY_NAME_DEBUG_LEVEL L"DebugLevel" -#define CSQ_KEY_NAME_USE_PARAMETERS L"UseParameters" #define CSQ_MAX_PATH_LENGTH 256 @@ -186,6 +185,28 @@ InstanceTeardownComplete ( _In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags ); +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +GetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +OpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + NTSTATUS SetConfiguration ( _In_ PDRIVER_OBJECT DriverObject, @@ -271,6 +292,8 @@ PreReadEmptyQueueAndComplete( #ifdef ALLOC_PRAGMA #pragma alloc_text(INIT, DriverEntry) +#pragma alloc_text(INIT, GetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, OpenServiceParametersKey) #pragma alloc_text(INIT, SetConfiguration) #pragma alloc_text(PAGE, Unload) #pragma alloc_text(PAGE, FreeGlobals) @@ -458,16 +481,6 @@ DriverEntryCleanup: return Status; } -typedef -NTSTATUS -(*PFN_IoOpenDriverRegistryKey)( - PDRIVER_OBJECT DriverObject, - DRIVER_REGKEY_TYPE RegKeyType, - ACCESS_MASK DesiredAccess, - ULONG Flags, - PHANDLE DriverRegKey - ); - PFN_IoOpenDriverRegistryKey GetIoOpenDriverRegistryKey ( VOID @@ -477,7 +490,9 @@ GetIoOpenDriverRegistryKey ( UNICODE_STRING FunctionName = {0}; if (pIoOpenDriverRegistryKey == NULL) { + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); } @@ -485,16 +500,17 @@ GetIoOpenDriverRegistryKey ( } NTSTATUS -SetConfiguration ( +OpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ Routine Description: - This routine tries to configure the debuglevel, mapping path and - queue delay based on values in the registry. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -503,6 +519,8 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: STATUS_SUCCESS if the function completes successfully. Otherwise a valid @@ -512,87 +530,145 @@ Return Value: { NTSTATUS Status; PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; OBJECT_ATTRIBUTES Attributes; - HANDLE DriverRegKey = NULL; - UNICODE_STRING ValueName; - BOOLEAN CloseHandle = FALSE; - UCHAR Buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + CSQ_MAX_PATH_LENGTH * sizeof(WCHAR)]; - PKEY_VALUE_PARTIAL_INFORMATION Value = (PKEY_VALUE_PARTIAL_INFORMATION)Buffer; - ULONG ValueLength = sizeof(Buffer); - ULONG ResultLength; - ULONG Length; // - // Determine if parameters key should be used. Downlevel OS versions may not - // have IoOpenDriverRegistryKey present, so this must by dynamically loaded - // to determine the correct behavior. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible. // + pIoOpenDriverRegistryKey = GetIoOpenDriverRegistryKey(); if (pIoOpenDriverRegistryKey != NULL) { + // - // Open the parameters key. + // Open the parameters key using the API. // + Status = pIoOpenDriverRegistryKey( DriverObject, DriverRegKeyParameters, KEY_READ, 0, - &DriverRegKey ); - - if (NT_SUCCESS( Status )) { - // - // Query value to determine that parameters subkey should be used. - // - RtlInitUnicodeString( &ValueName, CSQ_KEY_NAME_USE_PARAMETERS ); - - Status = ZwQueryValueKey( DriverRegKey, - &ValueName, - KeyValuePartialInformation, - Value, - ValueLength, - &ResultLength ); + &ParametersKey ); - // - // If the UseParameters value cannot be found or is not set correctly, - // close the parameters key and read values from the legacy locations. - // - if ((!NT_SUCCESS( Status )) || (*(PULONG)(Value->Data) != 1)) { - ZwClose( DriverRegKey ); - DriverRegKey = NULL; + if (!NT_SUCCESS( Status )) { - } else { - CloseHandle = TRUE; - } + goto OpenServiceParametersKeyCleanup; } - } - // - // Open legacy registry root if the modern one was not opened earlier. - // + } else { - if (DriverRegKey == NULL) { // - // Open the legacy driver registry key. + // Open specified service root key. // InitializeObjectAttributes( &Attributes, - RegistryPath, + ServiceRegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL ); - Status = ZwOpenKey( &DriverRegKey, + Status = ZwOpenKey( &ServiceRegKey, KEY_READ, &Attributes ); if (!NT_SUCCESS( Status )) { - goto SetConfigurationCleanup; + goto OpenServiceParametersKeyCleanup; } - CloseHandle = TRUE; + // + // Open the parameters key relative to service key path. + // + + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + ServiceRegKey, + NULL ); + + Status = ZwOpenKey( &ParametersKey, + KEY_READ, + &Attributes ); + + if (!NT_SUCCESS( Status )) { + + goto OpenServiceParametersKeyCleanup; + } + } + + // + // Return value to caller. + // + + *ServiceParametersKey = ParametersKey; + +OpenServiceParametersKeyCleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return Status; + +} + +NTSTATUS +SetConfiguration ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Description: + + This routine tries to configure the debuglevel, mapping path and + queue delay based on values in the registry. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. + +--*/ +{ + NTSTATUS Status; + HANDLE DriverRegKey = NULL; + UNICODE_STRING ValueName; + BOOLEAN CloseHandle = FALSE; + UCHAR Buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + CSQ_MAX_PATH_LENGTH * sizeof(WCHAR)]; + PKEY_VALUE_PARTIAL_INFORMATION Value = (PKEY_VALUE_PARTIAL_INFORMATION)Buffer; + ULONG ValueLength = sizeof(Buffer); + ULONG ResultLength; + ULONG Length; + + // + // Open service parameters key to query values from. + // + + Status = OpenServiceParametersKey( DriverObject, + RegistryPath, + &DriverRegKey ); + + if (!NT_SUCCESS( Status )) { + + goto SetConfigurationCleanup; } + CloseHandle = TRUE; // // Query the debug level. @@ -612,7 +688,6 @@ Return Value: Globals.DebugLevel = *(PULONG)(Value->Data); } - // // Query the queue time delay. // @@ -639,7 +714,7 @@ Return Value: } // - // Query the mapping path. + // Query the mapping path. // RtlInitUnicodeString( &ValueName, CSQ_KEY_NAME_PATH ); diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.inf b/filesys/miniFilter/cancelSafe/cancelSafe.inf Binary files differindex bea97d70..aca61673 100644 --- a/filesys/miniFilter/cancelSafe/cancelSafe.inf +++ b/filesys/miniFilter/cancelSafe/cancelSafe.inf |
