summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZac Lockard <[email protected]>2023-09-28 15:31:56 -0700
committerZac Lockard <[email protected]>2023-09-28 15:31:56 -0700
commitc3e1a7f2d210cbac6c51a8f6915f73defac4df71 (patch)
tree42765665a64422908d4c738e36244830dcd6d3ca
parentf6b43cc8dc357af15c57d4ae055e8e4750472b4b (diff)
Clean up paradigm
-rw-r--r--filesys/miniFilter/cancelSafe/cancelSafe.c201
-rw-r--r--filesys/miniFilter/cancelSafe/cancelSafe.infbin9046 -> 8698 bytes
2 files changed, 138 insertions, 63 deletions
diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.c b/filesys/miniFilter/cancelSafe/cancelSafe.c
index 522ce7b8..af0f9bef 100644
--- a/filesys/miniFilter/cancelSafe/cancelSafe.c
+++ b/filesys/miniFilter/cancelSafe/cancelSafe.c
@@ -56,7 +56,6 @@ Environment:
#define CSQ_KEY_NAME_DELAY L"OperatingDelay"
#define CSQ_KEY_NAME_PATH L"OperatingPath"
#define CSQ_KEY_NAME_DEBUG_LEVEL L"DebugLevel"
-#define CSQ_KEY_NAME_USE_PARAMETERS L"UseParameters"
#define CSQ_MAX_PATH_LENGTH 256
@@ -186,6 +185,28 @@ InstanceTeardownComplete (
_In_ FLT_INSTANCE_TEARDOWN_FLAGS Flags
);
+typedef
+NTSTATUS
+(*PFN_IoOpenDriverRegistryKey) (
+ PDRIVER_OBJECT DriverObject,
+ DRIVER_REGKEY_TYPE RegKeyType,
+ ACCESS_MASK DesiredAccess,
+ ULONG Flags,
+ PHANDLE DriverRegKey
+ );
+
+PFN_IoOpenDriverRegistryKey
+GetIoOpenDriverRegistryKey (
+ VOID
+ );
+
+NTSTATUS
+OpenServiceParametersKey (
+ _In_ PDRIVER_OBJECT DriverObject,
+ _In_ PUNICODE_STRING ServiceRegistryPath,
+ _Out_ PHANDLE ServiceParametersKey
+ );
+
NTSTATUS
SetConfiguration (
_In_ PDRIVER_OBJECT DriverObject,
@@ -271,6 +292,8 @@ PreReadEmptyQueueAndComplete(
#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT, DriverEntry)
+#pragma alloc_text(INIT, GetIoOpenDriverRegistryKey)
+#pragma alloc_text(INIT, OpenServiceParametersKey)
#pragma alloc_text(INIT, SetConfiguration)
#pragma alloc_text(PAGE, Unload)
#pragma alloc_text(PAGE, FreeGlobals)
@@ -458,16 +481,6 @@ DriverEntryCleanup:
return Status;
}
-typedef
-NTSTATUS
-(*PFN_IoOpenDriverRegistryKey)(
- PDRIVER_OBJECT DriverObject,
- DRIVER_REGKEY_TYPE RegKeyType,
- ACCESS_MASK DesiredAccess,
- ULONG Flags,
- PHANDLE DriverRegKey
- );
-
PFN_IoOpenDriverRegistryKey
GetIoOpenDriverRegistryKey (
VOID
@@ -477,7 +490,9 @@ GetIoOpenDriverRegistryKey (
UNICODE_STRING FunctionName = {0};
if (pIoOpenDriverRegistryKey == NULL) {
+
RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey");
+
pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName);
}
@@ -485,16 +500,17 @@ GetIoOpenDriverRegistryKey (
}
NTSTATUS
-SetConfiguration (
+OpenServiceParametersKey (
_In_ PDRIVER_OBJECT DriverObject,
- _In_ PUNICODE_STRING RegistryPath
+ _In_ PUNICODE_STRING ServiceRegistryPath,
+ _Out_ PHANDLE ServiceParametersKey
)
/*++
Routine Description:
- This routine tries to configure the debuglevel, mapping path and
- queue delay based on values in the registry.
+ This routine opens the service parameters key, using the isolation-compliant
+ APIs when possible.
Arguments:
@@ -503,6 +519,8 @@ Arguments:
RegistryPath - The path key passed to the driver during DriverEntry.
+ ServiceParametersKey - Returns a handle to the service parameters subkey.
+
Return Value:
STATUS_SUCCESS if the function completes successfully. Otherwise a valid
@@ -512,87 +530,145 @@ Return Value:
{
NTSTATUS Status;
PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey;
+ UNICODE_STRING Subkey;
+ HANDLE ParametersKey = NULL;
+ HANDLE ServiceRegKey = NULL;
OBJECT_ATTRIBUTES Attributes;
- HANDLE DriverRegKey = NULL;
- UNICODE_STRING ValueName;
- BOOLEAN CloseHandle = FALSE;
- UCHAR Buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + CSQ_MAX_PATH_LENGTH * sizeof(WCHAR)];
- PKEY_VALUE_PARTIAL_INFORMATION Value = (PKEY_VALUE_PARTIAL_INFORMATION)Buffer;
- ULONG ValueLength = sizeof(Buffer);
- ULONG ResultLength;
- ULONG Length;
//
- // Determine if parameters key should be used. Downlevel OS versions may not
- // have IoOpenDriverRegistryKey present, so this must by dynamically loaded
- // to determine the correct behavior.
+ // Open the parameters key to read values from the INF, using the API to
+ // open the key if possible.
//
+
pIoOpenDriverRegistryKey = GetIoOpenDriverRegistryKey();
if (pIoOpenDriverRegistryKey != NULL) {
+
//
- // Open the parameters key.
+ // Open the parameters key using the API.
//
+
Status = pIoOpenDriverRegistryKey( DriverObject,
DriverRegKeyParameters,
KEY_READ,
0,
- &DriverRegKey );
-
- if (NT_SUCCESS( Status )) {
- //
- // Query value to determine that parameters subkey should be used.
- //
- RtlInitUnicodeString( &ValueName, CSQ_KEY_NAME_USE_PARAMETERS );
-
- Status = ZwQueryValueKey( DriverRegKey,
- &ValueName,
- KeyValuePartialInformation,
- Value,
- ValueLength,
- &ResultLength );
+ &ParametersKey );
- //
- // If the UseParameters value cannot be found or is not set correctly,
- // close the parameters key and read values from the legacy locations.
- //
- if ((!NT_SUCCESS( Status )) || (*(PULONG)(Value->Data) != 1)) {
- ZwClose( DriverRegKey );
- DriverRegKey = NULL;
+ if (!NT_SUCCESS( Status )) {
- } else {
- CloseHandle = TRUE;
- }
+ goto OpenServiceParametersKeyCleanup;
}
- }
- //
- // Open legacy registry root if the modern one was not opened earlier.
- //
+ } else {
- if (DriverRegKey == NULL) {
//
- // Open the legacy driver registry key.
+ // Open specified service root key.
//
InitializeObjectAttributes( &Attributes,
- RegistryPath,
+ ServiceRegistryPath,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL );
- Status = ZwOpenKey( &DriverRegKey,
+ Status = ZwOpenKey( &ServiceRegKey,
KEY_READ,
&Attributes );
if (!NT_SUCCESS( Status )) {
- goto SetConfigurationCleanup;
+ goto OpenServiceParametersKeyCleanup;
}
- CloseHandle = TRUE;
+ //
+ // Open the parameters key relative to service key path.
+ //
+
+ RtlInitUnicodeString( &Subkey, L"Parameters" );
+
+ InitializeObjectAttributes( &Attributes,
+ &Subkey,
+ OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
+ ServiceRegKey,
+ NULL );
+
+ Status = ZwOpenKey( &ParametersKey,
+ KEY_READ,
+ &Attributes );
+
+ if (!NT_SUCCESS( Status )) {
+
+ goto OpenServiceParametersKeyCleanup;
+ }
+ }
+
+ //
+ // Return value to caller.
+ //
+
+ *ServiceParametersKey = ParametersKey;
+
+OpenServiceParametersKeyCleanup:
+
+ if (ServiceRegKey != NULL) {
+
+ ZwClose( ServiceRegKey );
+ }
+
+ return Status;
+
+}
+
+NTSTATUS
+SetConfiguration (
+ _In_ PDRIVER_OBJECT DriverObject,
+ _In_ PUNICODE_STRING RegistryPath
+ )
+/*++
+
+Routine Description:
+
+ This routine tries to configure the debuglevel, mapping path and
+ queue delay based on values in the registry.
+
+Arguments:
+
+ DriverObject - Pointer to driver object created by the system to
+ represent this driver.
+
+ RegistryPath - The path key passed to the driver during DriverEntry.
+
+Return Value:
+
+ STATUS_SUCCESS if the function completes successfully. Otherwise a valid
+ NTSTATUS code is returned.
+
+--*/
+{
+ NTSTATUS Status;
+ HANDLE DriverRegKey = NULL;
+ UNICODE_STRING ValueName;
+ BOOLEAN CloseHandle = FALSE;
+ UCHAR Buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + CSQ_MAX_PATH_LENGTH * sizeof(WCHAR)];
+ PKEY_VALUE_PARTIAL_INFORMATION Value = (PKEY_VALUE_PARTIAL_INFORMATION)Buffer;
+ ULONG ValueLength = sizeof(Buffer);
+ ULONG ResultLength;
+ ULONG Length;
+
+ //
+ // Open service parameters key to query values from.
+ //
+
+ Status = OpenServiceParametersKey( DriverObject,
+ RegistryPath,
+ &DriverRegKey );
+
+ if (!NT_SUCCESS( Status )) {
+
+ goto SetConfigurationCleanup;
}
+ CloseHandle = TRUE;
//
// Query the debug level.
@@ -612,7 +688,6 @@ Return Value:
Globals.DebugLevel = *(PULONG)(Value->Data);
}
-
//
// Query the queue time delay.
//
@@ -639,7 +714,7 @@ Return Value:
}
//
- // Query the mapping path.
+ // Query the mapping path.
//
RtlInitUnicodeString( &ValueName, CSQ_KEY_NAME_PATH );
diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.inf b/filesys/miniFilter/cancelSafe/cancelSafe.inf
index bea97d70..aca61673 100644
--- a/filesys/miniFilter/cancelSafe/cancelSafe.inf
+++ b/filesys/miniFilter/cancelSafe/cancelSafe.inf
Binary files differ