From b45ffd69a7205e46bbdd5d415ac591f9446fb04f Mon Sep 17 00:00:00 2001 From: zlockard Date: Mon, 31 Jul 2023 17:28:46 -0700 Subject: Update file system filter samples to use isolated state locations --- .../MetadataManager/MetadataManagerInit.c | 124 ++++++++++++++------- 1 file changed, 83 insertions(+), 41 deletions(-) (limited to 'filesys/miniFilter/MetadataManager/MetadataManagerInit.c') diff --git a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c index 222159f7..d2824241 100644 --- a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c +++ b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c @@ -88,6 +88,7 @@ FmmInstanceTeardownComplete ( VOID FmmInitializeDebugLevel ( + _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath ); @@ -115,11 +116,11 @@ FmmInitializeDebugLevel ( // // If we need to verify that the metadata file is indeed open whenever -// a create suceeds on the volume, then we need to monitor all creates +// a create suceeds on the volume, then we need to monitor all creates // not just DASD creates. -// If that is not the case, then we are better off telling filter manager -// to show us only DASD creates. That way we can avoid the performance +// If that is not the case, then we are better off telling filter manager +// to show us only DASD creates. That way we can avoid the performance // penalty of being called for all creates when we only have use for DASD // creates. // @@ -241,7 +242,7 @@ Return Value: // // Default to NonPagedPoolNx for non paged pool allocations where supported. // - + ExInitializeDriverRuntime( DrvRtPoolNxOptIn ); @@ -253,7 +254,7 @@ Return Value: // Initialize global debug level // - FmmInitializeDebugLevel( RegistryPath ); + FmmInitializeDebugLevel( DriverObject, RegistryPath ); #else @@ -301,6 +302,7 @@ Return Value: VOID FmmInitializeDebugLevel ( + _In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath ) /*++ @@ -313,6 +315,9 @@ Routine Description: Arguments: + DriverObject - Pointer to driver object created by the system to + represent this driver. + RegistryPath - The path key passed to the driver during DriverEntry. Return Value: @@ -322,7 +327,8 @@ Return Value: --*/ { OBJECT_ATTRIBUTES attributes; - HANDLE driverRegKey; + OSVERSIONINFOW versionInfo; + HANDLE driverRegKey = NULL; NTSTATUS status; ULONG resultLength; UNICODE_STRING valueName; @@ -330,48 +336,84 @@ Return Value: Globals.DebugLevel = DEBUG_TRACE_ERROR; + RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + // - // Open the desired registry key + // Determine the OS version being run. // - InitializeObjectAttributes( &attributes, - RegistryPath, - OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, - NULL ); + versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); - status = ZwOpenKey( &driverRegKey, - KEY_READ, - &attributes ); + status = RtlGetVersion( &versionInfo ); - if (NT_SUCCESS( status )) { + if (!NT_SUCCESS( status )) { + goto cleanup; + } + + // + // Open the desired registry key + // + + if (versionInfo.dwBuildNumber >= 25900) { // - // Read the DebugFlags value from the registry. + // Open the Parameters key for the service. // - RtlInitUnicodeString( &valueName, L"DebugLevel" ); + status = IoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { - status = ZwQueryValueKey( driverRegKey, - &valueName, - KeyValuePartialInformation, - buffer, - sizeof(buffer), - &resultLength ); + goto cleanup; + } + } else { + InitializeObjectAttributes( &attributes, + RegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); - if (NT_SUCCESS( status )) { + status = ZwOpenKey( &driverRegKey, + KEY_READ, + &attributes ); - Globals.DebugLevel = *((PULONG) &(((PKEY_VALUE_PARTIAL_INFORMATION) buffer)->Data)); + if (!NT_SUCCESS( status )) { + + goto cleanup; } - - // - // Close the registry entry - // - - ZwClose( driverRegKey ); - } + // + // Read the DebugFlags value from the registry. + // + + RtlInitUnicodeString( &valueName, L"DebugLevel" ); + + status = ZwQueryValueKey( driverRegKey, + &valueName, + KeyValuePartialInformation, + buffer, + sizeof(buffer), + &resultLength ); + + if (NT_SUCCESS( status )) { + + Globals.DebugLevel = *((PULONG) &(((PKEY_VALUE_PARTIAL_INFORMATION) buffer)->Data)); + } + +cleanup: + + // + // Close the registry entry + // + + if (driverRegKey != NULL) { + ZwClose( driverRegKey ); + } } #endif @@ -678,22 +720,22 @@ FmmInstanceSetupCleanup: } // - // If this is an automatic attachment (mount, load, etc) and we are not - // attaching to this volume because we do not support attaching to this - // volume, then simply return STATUS_FLT_DO_NOT_ATTACH. If we return - // anything else fltmgr logs an event log indicating failure to attach. - // Since this failure to attach is not really an error, we do not want + // If this is an automatic attachment (mount, load, etc) and we are not + // attaching to this volume because we do not support attaching to this + // volume, then simply return STATUS_FLT_DO_NOT_ATTACH. If we return + // anything else fltmgr logs an event log indicating failure to attach. + // Since this failure to attach is not really an error, we do not want // this failure to be logged as an error in the event log. For all other // error codes besides the ones we consider "normal", if is ok for fltmgr // to actually log the failure to attach. // - // If this is a manual attach attempt that we have failed then we want to - // give the user a clear indication of why the attachment failed. Hence in + // If this is a manual attach attempt that we have failed then we want to + // give the user a clear indication of why the attachment failed. Hence in // this case, we will not override the error status with STATUS_FLT_DO_NOT_ATTACH // irrespective of the cause of the failure to attach // - if (status == STATUS_NOT_SUPPORTED && + if (status == STATUS_NOT_SUPPORTED && !FlagOn( Flags, FLTFL_INSTANCE_SETUP_MANUAL_ATTACHMENT )) { status = STATUS_FLT_DO_NOT_ATTACH; -- cgit v1.3.1 From 0ea260da2277c6c70ff5b21a095d73b76748d1d9 Mon Sep 17 00:00:00 2001 From: Zac Lockard Date: Tue, 26 Sep 2023 18:09:23 -0700 Subject: Update to correct build number --- .../miniFilter/MetadataManager/MetadataManagerInit.c | 2 +- filesys/miniFilter/MetadataManager/fmm.inf | Bin 7812 -> 7812 bytes filesys/miniFilter/NameChanger/NameChanger.inf | Bin 8938 -> 8938 bytes filesys/miniFilter/NameChanger/ncinit.c | 2 +- filesys/miniFilter/avscan/avscan.inf | Bin 9104 -> 9010 bytes filesys/miniFilter/avscan/filter/avscan.c | 2 +- filesys/miniFilter/avscan/filter/avscan.vcxproj | 5 ++++- .../miniFilter/avscan/filter/avscan.vcxproj.Filters | 16 ++++++++++++++-- filesys/miniFilter/cancelSafe/cancelSafe.inf | Bin 8548 -> 8862 bytes filesys/miniFilter/cdo/CdoInit.c | 2 +- filesys/miniFilter/cdo/cdo.inf | Bin 7790 -> 8106 bytes filesys/miniFilter/change/change.inf | Bin 7586 -> 7886 bytes filesys/miniFilter/ctx/CtxInit.c | 2 +- filesys/miniFilter/ctx/ctx.inf | Bin 7776 -> 8092 bytes filesys/miniFilter/delete/delete.inf | Bin 7760 -> 8080 bytes filesys/miniFilter/minispy/minispy.inf | Bin 9916 -> 9916 bytes filesys/miniFilter/nullFilter/nullFilter.inf | Bin 7608 -> 7924 bytes filesys/miniFilter/passThrough/passThrough.inf | Bin 7866 -> 8182 bytes filesys/miniFilter/scanner/filter/scanner.c | 2 +- filesys/miniFilter/scanner/scanner.inf | Bin 8206 -> 8206 bytes filesys/miniFilter/simrep/simrep.c | 2 +- filesys/miniFilter/simrep/simrep.inf | Bin 9052 -> 9350 bytes filesys/miniFilter/swapBuffers/swapBuffers.inf | Bin 7946 -> 8266 bytes 23 files changed, 25 insertions(+), 10 deletions(-) (limited to 'filesys/miniFilter/MetadataManager/MetadataManagerInit.c') diff --git a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c index d2824241..3b371360 100644 --- a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c +++ b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c @@ -355,7 +355,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/MetadataManager/fmm.inf b/filesys/miniFilter/MetadataManager/fmm.inf index 64d3723c..02285a21 100644 Binary files a/filesys/miniFilter/MetadataManager/fmm.inf and b/filesys/miniFilter/MetadataManager/fmm.inf differ diff --git a/filesys/miniFilter/NameChanger/NameChanger.inf b/filesys/miniFilter/NameChanger/NameChanger.inf index d8660653..1969dbd5 100644 Binary files a/filesys/miniFilter/NameChanger/NameChanger.inf and b/filesys/miniFilter/NameChanger/NameChanger.inf differ diff --git a/filesys/miniFilter/NameChanger/ncinit.c b/filesys/miniFilter/NameChanger/ncinit.c index e9b2d642..3dbc24bf 100644 --- a/filesys/miniFilter/NameChanger/ncinit.c +++ b/filesys/miniFilter/NameChanger/ncinit.c @@ -334,7 +334,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/avscan/avscan.inf b/filesys/miniFilter/avscan/avscan.inf index 12fa79c7..f74d9a60 100644 Binary files a/filesys/miniFilter/avscan/avscan.inf and b/filesys/miniFilter/avscan/avscan.inf differ diff --git a/filesys/miniFilter/avscan/filter/avscan.c b/filesys/miniFilter/avscan/filter/avscan.c index 821dd733..669bde87 100644 --- a/filesys/miniFilter/avscan/filter/avscan.c +++ b/filesys/miniFilter/avscan/filter/avscan.c @@ -3083,7 +3083,7 @@ Return Value: // NOTE: Build number should match the INF file. // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/avscan/filter/avscan.vcxproj b/filesys/miniFilter/avscan/filter/avscan.vcxproj index 2ce8ce29..fa6122b5 100644 --- a/filesys/miniFilter/avscan/filter/avscan.vcxproj +++ b/filesys/miniFilter/avscan/filter/avscan.vcxproj @@ -188,7 +188,10 @@ - + + true + Document + diff --git a/filesys/miniFilter/avscan/filter/avscan.vcxproj.Filters b/filesys/miniFilter/avscan/filter/avscan.vcxproj.Filters index f7f506ae..399cecc7 100644 --- a/filesys/miniFilter/avscan/filter/avscan.vcxproj.Filters +++ b/filesys/miniFilter/avscan/filter/avscan.vcxproj.Filters @@ -59,10 +59,22 @@ Header Files + + Header Files + + + Header Files + + + Header Files + + + Header Files + - + Driver Files - + \ No newline at end of file diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.inf b/filesys/miniFilter/cancelSafe/cancelSafe.inf index 688fb3f5..d8984905 100644 Binary files a/filesys/miniFilter/cancelSafe/cancelSafe.inf and b/filesys/miniFilter/cancelSafe/cancelSafe.inf differ diff --git a/filesys/miniFilter/cdo/CdoInit.c b/filesys/miniFilter/cdo/CdoInit.c index cef73e32..a7d04e36 100644 --- a/filesys/miniFilter/cdo/CdoInit.c +++ b/filesys/miniFilter/cdo/CdoInit.c @@ -244,7 +244,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/cdo/cdo.inf b/filesys/miniFilter/cdo/cdo.inf index 51e3f32e..0403e340 100644 Binary files a/filesys/miniFilter/cdo/cdo.inf and b/filesys/miniFilter/cdo/cdo.inf differ diff --git a/filesys/miniFilter/change/change.inf b/filesys/miniFilter/change/change.inf index 96b52bdc..a9233eed 100644 Binary files a/filesys/miniFilter/change/change.inf and b/filesys/miniFilter/change/change.inf differ diff --git a/filesys/miniFilter/ctx/CtxInit.c b/filesys/miniFilter/ctx/CtxInit.c index fbb2d99c..fb04eef1 100644 --- a/filesys/miniFilter/ctx/CtxInit.c +++ b/filesys/miniFilter/ctx/CtxInit.c @@ -330,7 +330,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/ctx/ctx.inf b/filesys/miniFilter/ctx/ctx.inf index 1f3a833e..e2e54fe7 100644 Binary files a/filesys/miniFilter/ctx/ctx.inf and b/filesys/miniFilter/ctx/ctx.inf differ diff --git a/filesys/miniFilter/delete/delete.inf b/filesys/miniFilter/delete/delete.inf index 55553269..36186d35 100644 Binary files a/filesys/miniFilter/delete/delete.inf and b/filesys/miniFilter/delete/delete.inf differ diff --git a/filesys/miniFilter/minispy/minispy.inf b/filesys/miniFilter/minispy/minispy.inf index 9ff7a024..cb6cda71 100644 Binary files a/filesys/miniFilter/minispy/minispy.inf and b/filesys/miniFilter/minispy/minispy.inf differ diff --git a/filesys/miniFilter/nullFilter/nullFilter.inf b/filesys/miniFilter/nullFilter/nullFilter.inf index 394d9d8f..e35bc06c 100644 Binary files a/filesys/miniFilter/nullFilter/nullFilter.inf and b/filesys/miniFilter/nullFilter/nullFilter.inf differ diff --git a/filesys/miniFilter/passThrough/passThrough.inf b/filesys/miniFilter/passThrough/passThrough.inf index 2ff9ffee..0bb5e5fd 100644 Binary files a/filesys/miniFilter/passThrough/passThrough.inf and b/filesys/miniFilter/passThrough/passThrough.inf differ diff --git a/filesys/miniFilter/scanner/filter/scanner.c b/filesys/miniFilter/scanner/filter/scanner.c index 7602b6a1..97cf5eb9 100644 --- a/filesys/miniFilter/scanner/filter/scanner.c +++ b/filesys/miniFilter/scanner/filter/scanner.c @@ -376,7 +376,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/scanner/scanner.inf b/filesys/miniFilter/scanner/scanner.inf index df76cf09..c872e928 100644 Binary files a/filesys/miniFilter/scanner/scanner.inf and b/filesys/miniFilter/scanner/scanner.inf differ diff --git a/filesys/miniFilter/simrep/simrep.c b/filesys/miniFilter/simrep/simrep.c index 26bd1645..278555d9 100644 --- a/filesys/miniFilter/simrep/simrep.c +++ b/filesys/miniFilter/simrep/simrep.c @@ -725,7 +725,7 @@ Return Value: // Open the desired registry key // - if (versionInfo.dwBuildNumber >= 25900) { + if (versionInfo.dwBuildNumber >= 25952) { // // Open the Parameters key for the service. // diff --git a/filesys/miniFilter/simrep/simrep.inf b/filesys/miniFilter/simrep/simrep.inf index 16d08029..104b6863 100644 Binary files a/filesys/miniFilter/simrep/simrep.inf and b/filesys/miniFilter/simrep/simrep.inf differ diff --git a/filesys/miniFilter/swapBuffers/swapBuffers.inf b/filesys/miniFilter/swapBuffers/swapBuffers.inf index 664be4f3..a64bef9d 100644 Binary files a/filesys/miniFilter/swapBuffers/swapBuffers.inf and b/filesys/miniFilter/swapBuffers/swapBuffers.inf differ -- cgit v1.3.1 From d5e0277eb9489f3115779567fee3645bc99c86b5 Mon Sep 17 00:00:00 2001 From: Zac Lockard Date: Fri, 29 Sep 2023 18:25:03 -0700 Subject: Switch to final registry key loading paradigm --- .../MetadataManager/MetadataManagerInit.c | 201 +++++++++++++++---- filesys/miniFilter/MetadataManager/fmm.inf | Bin 7812 -> 8292 bytes filesys/miniFilter/NameChanger/NameChanger.inf | Bin 8938 -> 9004 bytes filesys/miniFilter/NameChanger/ncinit.c | 206 +++++++++++++++----- filesys/miniFilter/avscan/avscan.inf | Bin 9010 -> 8968 bytes filesys/miniFilter/avscan/filter/avscan.c | 207 +++++++++++++++----- filesys/miniFilter/cancelSafe/cancelSafe.c | 5 +- filesys/miniFilter/cancelSafe/cancelSafe.inf | Bin 8698 -> 8792 bytes filesys/miniFilter/cdo/CdoInit.c | 207 ++++++++++++++++---- filesys/miniFilter/cdo/cdo.inf | Bin 8106 -> 8270 bytes filesys/miniFilter/change/change.inf | Bin 7886 -> 7816 bytes filesys/miniFilter/ctx/CtxInit.c | 199 +++++++++++++++---- filesys/miniFilter/ctx/ctx.inf | Bin 8092 -> 8252 bytes filesys/miniFilter/delete/delete.inf | Bin 8080 -> 8084 bytes filesys/miniFilter/minispy/minispy.inf | Bin 9916 -> 9920 bytes filesys/miniFilter/nullFilter/nullFilter.inf | Bin 7924 -> 7928 bytes filesys/miniFilter/passThrough/passThrough.inf | Bin 8182 -> 8116 bytes filesys/miniFilter/scanner/filter/scanner.c | 216 ++++++++++++++++----- filesys/miniFilter/scanner/scanner.inf | Bin 8206 -> 8340 bytes filesys/miniFilter/simrep/simrep.c | 212 +++++++++++++++----- filesys/miniFilter/simrep/simrep.inf | Bin 9350 -> 9280 bytes filesys/miniFilter/swapBuffers/swapBuffers.inf | Bin 8266 -> 8270 bytes 22 files changed, 1143 insertions(+), 310 deletions(-) (limited to 'filesys/miniFilter/MetadataManager/MetadataManagerInit.c') diff --git a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c index 3b371360..dbedd3a8 100644 --- a/filesys/miniFilter/MetadataManager/MetadataManagerInit.c +++ b/filesys/miniFilter/MetadataManager/MetadataManagerInit.c @@ -86,6 +86,28 @@ FmmInstanceTeardownComplete ( #if DBG +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +FmmGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +FmmOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + VOID FmmInitializeDebugLevel ( _In_ PDRIVER_OBJECT DriverObject, @@ -102,6 +124,8 @@ FmmInitializeDebugLevel ( #pragma alloc_text(INIT, DriverEntry) #if DBG +#pragma alloc_text(INIT, FmmGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, FmmOpenServiceParametersKey) #pragma alloc_text(INIT, FmmInitializeDebugLevel) #endif @@ -300,18 +324,36 @@ Return Value: #if DBG -VOID -FmmInitializeDebugLevel ( +PFN_IoOpenDriverRegistryKey +FmmGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + +NTSTATUS +FmmOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ Routine Description: - This routine tries to read the filter DebugLevel parameter from - the registry. This value will be found in the registry location - indicated by the RegistryPath passed in. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -320,66 +362,82 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: - None. + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { - OBJECT_ATTRIBUTES attributes; - OSVERSIONINFOW versionInfo; - HANDLE driverRegKey = NULL; NTSTATUS status; - ULONG resultLength; - UNICODE_STRING valueName; - UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; - - Globals.DebugLevel = DEBUG_TRACE_ERROR; - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = FmmGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API + // - goto cleanup; - } + status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( status )) { + + goto cleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &driverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); if (!NT_SUCCESS( status )) { goto cleanup; } - } else { - InitializeObjectAttributes( &attributes, - RegistryPath, + + // + // Open the parameters key relative to service key path + // + + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &driverRegKey, + status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); if (!NT_SUCCESS( status )) { @@ -387,6 +445,71 @@ Return Value: } } + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +cleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return status; + +} + +VOID +FmmInitializeDebugLevel ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Description: + + This routine tries to read the filter DebugLevel parameter from + the registry. This value will be found in the registry location + indicated by the RegistryPath passed in. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + None. + +--*/ +{ + HANDLE driverRegKey = NULL; + NTSTATUS status; + ULONG resultLength; + UNICODE_STRING valueName; + UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; + + Globals.DebugLevel = DEBUG_TRACE_ERROR; + + // + // Open service parameters key to query values from. + // + + status = FmmOpenServiceParametersKey( DriverObject, + RegistryPath, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { + + driverRegKey = NULL; + goto cleanup; + } + // // Read the DebugFlags value from the registry. // diff --git a/filesys/miniFilter/MetadataManager/fmm.inf b/filesys/miniFilter/MetadataManager/fmm.inf index 02285a21..ad231a8c 100644 Binary files a/filesys/miniFilter/MetadataManager/fmm.inf and b/filesys/miniFilter/MetadataManager/fmm.inf differ diff --git a/filesys/miniFilter/NameChanger/NameChanger.inf b/filesys/miniFilter/NameChanger/NameChanger.inf index 1969dbd5..7c0b2364 100644 Binary files a/filesys/miniFilter/NameChanger/NameChanger.inf and b/filesys/miniFilter/NameChanger/NameChanger.inf differ diff --git a/filesys/miniFilter/NameChanger/ncinit.c b/filesys/miniFilter/NameChanger/ncinit.c index 3dbc24bf..7d125498 100644 --- a/filesys/miniFilter/NameChanger/ncinit.c +++ b/filesys/miniFilter/NameChanger/ncinit.c @@ -15,7 +15,31 @@ NcIs8DOT3Compatible ( _In_opt_ PUNICODE_STRING LongName ); +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +NcGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +NcOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + #ifdef ALLOC_PRAGMA +#pragma alloc_text(INIT, NcGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, NcOpenServiceParametersKey) #pragma alloc_text(INIT, NcInitializeMapping) #pragma alloc_text(INIT, NcLoadRegistryString) #pragma alloc_text(INIT, NcIs8DOT3Compatible) @@ -278,18 +302,36 @@ NcIs8DOT3Compatible ( } +PFN_IoOpenDriverRegistryKey +NcGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + NTSTATUS -NcInitializeMapping( +NcOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ -Routine Descrition: +Routine Description: - This routine initializes the mapping structure. It will - try to populate it from the registry, and if that fails - use a default string. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -298,79 +340,155 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: - None. + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { - NTSTATUS Status; - OSVERSIONINFOW versionInfo; + NTSTATUS status; + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; OBJECT_ATTRIBUTES Attributes; - HANDLE DriverRegKey = NULL; - UNICODE_STRING TempPath = EMPTY_UNICODE_STRING; - USHORT Index; - - PAGED_CODE(); - - RtlZeroMemory( &NcGlobalData, sizeof( NcGlobalData )); - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = NcGetIoOpenDriverRegistryKey(); - Status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( Status )) { + // + // Open the parameters key using the API + // - goto NcInitializeMappingCleanup; - } + status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( status )) { + + goto cleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - Status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &DriverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); - if (!NT_SUCCESS( Status )) { + if (!NT_SUCCESS( status )) { - goto NcInitializeMappingCleanup; + goto cleanup; } - } else { + // - // Open legacy registry key. + // Open the parameters key relative to service key path // + RtlInitUnicodeString( &Subkey, L"Parameters" ); + InitializeObjectAttributes( &Attributes, - RegistryPath, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - Status = ZwOpenKey( &DriverRegKey, + status = ZwOpenKey( &ParametersKey, KEY_READ, &Attributes ); - if (!NT_SUCCESS( Status )) { + if (!NT_SUCCESS( status )) { - FLT_ASSERT( DriverRegKey == NULL ); - goto NcInitializeMappingCleanup; + goto cleanup; } } + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +cleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return status; + +} + +NTSTATUS +NcInitializeMapping( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Descrition: + + This routine initializes the mapping structure. It will + try to populate it from the registry, and if that fails + use a default string. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + None. + +--*/ +{ + NTSTATUS Status; + HANDLE DriverRegKey = NULL; + UNICODE_STRING TempPath = EMPTY_UNICODE_STRING; + USHORT Index; + + PAGED_CODE(); + + RtlZeroMemory( &NcGlobalData, sizeof( NcGlobalData )); + + // + // Open service parameters key to query values from. + // + + Status = NcOpenServiceParametersKey( DriverObject, + RegistryPath, + &DriverRegKey ); + + if (!NT_SUCCESS( Status )) { + + DriverRegKey = NULL; + goto NcInitializeMappingCleanup; + } + Status = NcLoadRegistryString( DriverRegKey, L"UserMapping", &TempPath ); diff --git a/filesys/miniFilter/avscan/avscan.inf b/filesys/miniFilter/avscan/avscan.inf index f74d9a60..27091ee3 100644 Binary files a/filesys/miniFilter/avscan/avscan.inf and b/filesys/miniFilter/avscan/avscan.inf differ diff --git a/filesys/miniFilter/avscan/filter/avscan.c b/filesys/miniFilter/avscan/filter/avscan.c index 669bde87..3c96fd08 100644 --- a/filesys/miniFilter/avscan/filter/avscan.c +++ b/filesys/miniFilter/avscan/filter/avscan.c @@ -34,6 +34,29 @@ DriverEntry ( _In_ PUNICODE_STRING RegistryPath ); +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +AvGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +AvOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + + NTSTATUS AvSetConfiguration ( _In_ PDRIVER_OBJECT DriverObject, @@ -202,6 +225,8 @@ AvSendUnloadingToUser ( #ifdef ALLOC_PRAGMA #pragma alloc_text(INIT, DriverEntry) +#pragma alloc_text(INIT, AvGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, AvOpenServiceParametersKey) #pragma alloc_text(INIT, AvSetConfiguration) #pragma alloc_text(PAGE, AvUnload) #pragma alloc_text(PAGE, AvInstanceQueryTeardown) @@ -3028,16 +3053,36 @@ Return Value: return STATUS_SUCCESS; } +PFN_IoOpenDriverRegistryKey +AvGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + NTSTATUS -AvSetConfiguration ( +AvOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ -Routine Descrition: +Routine Description: - This routine sets the filter configuration based on registry values. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -3046,80 +3091,152 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. -Return Value: + ServiceParametersKey - Returns a handle to the service parameters subkey. - Returns the status of this operation. +Return Value: + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { - NTSTATUS status; - OSVERSIONINFOW versionInfo; - OBJECT_ATTRIBUTES attributes; - HANDLE settingsKey = NULL; - UNICODE_STRING valueName; - UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)]; - PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer; - ULONG valueLength = sizeof(buffer); - ULONG resultLength; - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + NTSTATUS Status; + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = AvGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API + // - goto Cleanup; - } + Status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open corresponding registry root. - // NOTE: Build number should match the INF file. - // + if (!NT_SUCCESS( Status )) { + + goto OpenServiceParametersKeyCleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &settingsKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + Status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); - if (!NT_SUCCESS( status )) { + if (!NT_SUCCESS( Status )) { - goto Cleanup; + goto OpenServiceParametersKeyCleanup; } - } else { // - // Open the legacy settings registry key. + // Open the parameters key relative to service key path // - InitializeObjectAttributes( &attributes, - RegistryPath, + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &settingsKey, + Status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); - if (!NT_SUCCESS( status )) { + if (!NT_SUCCESS( Status )) { - goto Cleanup; + goto OpenServiceParametersKeyCleanup; } } + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +OpenServiceParametersKeyCleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return Status; + +} + +NTSTATUS +AvSetConfiguration ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Descrition: + + This routine sets the filter configuration based on registry values. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + Returns the status of this operation. + + +--*/ +{ + NTSTATUS status; + HANDLE settingsKey = NULL; + UNICODE_STRING valueName; + UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)]; + PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer; + ULONG valueLength = sizeof(buffer); + ULONG resultLength; + + // + // Open service parameters key to query values from + // + + status = AvOpenServiceParametersKey( DriverObject, + RegistryPath, + &settingsKey ); + + if (!NT_SUCCESS( status )) { + + goto Cleanup; + } + #if DBG // diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.c b/filesys/miniFilter/cancelSafe/cancelSafe.c index af0f9bef..4aeb2e26 100644 --- a/filesys/miniFilter/cancelSafe/cancelSafe.c +++ b/filesys/miniFilter/cancelSafe/cancelSafe.c @@ -665,11 +665,10 @@ Return Value: if (!NT_SUCCESS( Status )) { + DriverRegKey = NULL; goto SetConfigurationCleanup; } - CloseHandle = TRUE; - // // Query the debug level. // @@ -789,7 +788,7 @@ Return Value: SetConfigurationCleanup: - if (CloseHandle) { + if (DriverRegKey != NULL) { ZwClose( DriverRegKey ); } diff --git a/filesys/miniFilter/cancelSafe/cancelSafe.inf b/filesys/miniFilter/cancelSafe/cancelSafe.inf index aca61673..69d0ccf1 100644 Binary files a/filesys/miniFilter/cancelSafe/cancelSafe.inf and b/filesys/miniFilter/cancelSafe/cancelSafe.inf differ diff --git a/filesys/miniFilter/cdo/CdoInit.c b/filesys/miniFilter/cdo/CdoInit.c index a7d04e36..f913f6fb 100644 --- a/filesys/miniFilter/cdo/CdoInit.c +++ b/filesys/miniFilter/cdo/CdoInit.c @@ -48,6 +48,28 @@ CdoInstanceSetup ( #if DBG +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +CdoGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +CdoOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + VOID CdoInitializeDebugLevel ( _In_ PDRIVER_OBJECT DriverObject, @@ -76,6 +98,8 @@ CDO_GLOBAL_DATA Globals; #pragma alloc_text(INIT, DriverEntry) #if DBG +#pragma alloc_text(INIT, CdoGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, CdoOpenServiceParametersKey) #pragma alloc_text(INIT, CdoInitializeDebugLevel) #endif @@ -189,18 +213,36 @@ DriverEntry( #if DBG -VOID -CdoInitializeDebugLevel ( +PFN_IoOpenDriverRegistryKey +CdoGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + +NTSTATUS +CdoOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ Routine Description: - This routine tries to read the filter DebugLevel parameter from - the registry. This value will be found in the registry location - indicated by the RegistryPath passed in. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -209,73 +251,154 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: - None. + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { - OBJECT_ATTRIBUTES attributes; - OSVERSIONINFOW versionInfo; - HANDLE driverRegKey = NULL; - NTSTATUS status; - ULONG resultLength; - UNICODE_STRING valueName; - UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; - - Globals.DebugLevel = DEBUG_TRACE_ERROR; - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + NTSTATUS Status; + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible. // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = CdoGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API. + // - goto cleanup; - } + Status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( Status )) { + + goto cleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key. // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &driverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); - if (!NT_SUCCESS( status )) { + Status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); + + if (!NT_SUCCESS( Status )) { goto cleanup; } - } else { - InitializeObjectAttributes( &attributes, - RegistryPath, + + // + // Open the parameters key relative to service key path. + // + + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &driverRegKey, + Status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); - if (!NT_SUCCESS( status )) { + if (!NT_SUCCESS( Status )) { goto cleanup; } } + // + // Return value to caller. + // + + *ServiceParametersKey = ParametersKey; + +cleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return Status; + +} + +VOID +CdoInitializeDebugLevel ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Description: + + This routine tries to read the filter DebugLevel parameter from + the registry. This value will be found in the registry location + indicated by the RegistryPath passed in. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + None. + +--*/ +{ + HANDLE driverRegKey = NULL; + NTSTATUS status; + ULONG resultLength; + UNICODE_STRING valueName; + UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; + + Globals.DebugLevel = DEBUG_TRACE_ERROR; + + // + // Open service parameters key to query values from. + // + + status = CdoOpenServiceParametersKey( DriverObject, + RegistryPath, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { + + driverRegKey = NULL; + goto cleanup; + } + // // Read the DebugFlags value from the registry. // diff --git a/filesys/miniFilter/cdo/cdo.inf b/filesys/miniFilter/cdo/cdo.inf index 0403e340..cdac24d9 100644 Binary files a/filesys/miniFilter/cdo/cdo.inf and b/filesys/miniFilter/cdo/cdo.inf differ diff --git a/filesys/miniFilter/change/change.inf b/filesys/miniFilter/change/change.inf index a9233eed..e7da4250 100644 Binary files a/filesys/miniFilter/change/change.inf and b/filesys/miniFilter/change/change.inf differ diff --git a/filesys/miniFilter/ctx/CtxInit.c b/filesys/miniFilter/ctx/CtxInit.c index fb04eef1..e1e2576a 100644 --- a/filesys/miniFilter/ctx/CtxInit.c +++ b/filesys/miniFilter/ctx/CtxInit.c @@ -78,6 +78,28 @@ CtxInstanceTeardownComplete ( #if DBG +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +CtxGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +CtxOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + VOID CtxInitializeDebugLevel ( _In_ PDRIVER_OBJECT DriverObject, @@ -94,6 +116,8 @@ CtxInitializeDebugLevel ( #pragma alloc_text(INIT, DriverEntry) #if DBG +#pragma alloc_text(INIT, CtxGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, CtxOpenServiceParametersKey) #pragma alloc_text(INIT, CtxInitializeDebugLevel) #endif @@ -275,18 +299,36 @@ Return Value: #if DBG -VOID -CtxInitializeDebugLevel ( +PFN_IoOpenDriverRegistryKey +CtxGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + +NTSTATUS +CtxOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ Routine Description: - This routine tries to read the filter DebugLevel parameter from - the registry. This value will be found in the registry location - indicated by the RegistryPath passed in. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -295,70 +337,82 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: - None. + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { - OBJECT_ATTRIBUTES attributes; - OSVERSIONINFOW versionInfo; - HANDLE driverRegKey = NULL; NTSTATUS status; - ULONG resultLength; - UNICODE_STRING valueName; - UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; - - Globals.DebugLevel = DEBUG_TRACE_ERROR; - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = CtxGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API + // - goto cleanup; - } + status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( status )) { + + goto cleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &driverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); if (!NT_SUCCESS( status )) { goto cleanup; } - } else { + // - // Open legacy registry key. + // Open the parameters key relative to service key path // - InitializeObjectAttributes( &attributes, - RegistryPath, + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &driverRegKey, + status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); if (!NT_SUCCESS( status )) { @@ -366,6 +420,71 @@ Return Value: } } + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +cleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return status; + +} + +VOID +CtxInitializeDebugLevel ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Description: + + This routine tries to read the filter DebugLevel parameter from + the registry. This value will be found in the registry location + indicated by the RegistryPath passed in. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + None. + +--*/ +{ + HANDLE driverRegKey = NULL; + NTSTATUS status; + ULONG resultLength; + UNICODE_STRING valueName; + UCHAR buffer[sizeof( KEY_VALUE_PARTIAL_INFORMATION ) + sizeof( LONG )]; + + Globals.DebugLevel = DEBUG_TRACE_ERROR; + + // + // Open service parameters key to query values from. + // + + status = CtxOpenServiceParametersKey( DriverObject, + RegistryPath, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { + + driverRegKey = NULL; + goto cleanup; + } + // // Read the DebugFlags value from the registry. // diff --git a/filesys/miniFilter/ctx/ctx.inf b/filesys/miniFilter/ctx/ctx.inf index e2e54fe7..8edaf764 100644 Binary files a/filesys/miniFilter/ctx/ctx.inf and b/filesys/miniFilter/ctx/ctx.inf differ diff --git a/filesys/miniFilter/delete/delete.inf b/filesys/miniFilter/delete/delete.inf index 36186d35..da348874 100644 Binary files a/filesys/miniFilter/delete/delete.inf and b/filesys/miniFilter/delete/delete.inf differ diff --git a/filesys/miniFilter/minispy/minispy.inf b/filesys/miniFilter/minispy/minispy.inf index cb6cda71..60eb8684 100644 Binary files a/filesys/miniFilter/minispy/minispy.inf and b/filesys/miniFilter/minispy/minispy.inf differ diff --git a/filesys/miniFilter/nullFilter/nullFilter.inf b/filesys/miniFilter/nullFilter/nullFilter.inf index e35bc06c..c04e9f06 100644 Binary files a/filesys/miniFilter/nullFilter/nullFilter.inf and b/filesys/miniFilter/nullFilter/nullFilter.inf differ diff --git a/filesys/miniFilter/passThrough/passThrough.inf b/filesys/miniFilter/passThrough/passThrough.inf index 0bb5e5fd..129a2ab6 100644 Binary files a/filesys/miniFilter/passThrough/passThrough.inf and b/filesys/miniFilter/passThrough/passThrough.inf differ diff --git a/filesys/miniFilter/scanner/filter/scanner.c b/filesys/miniFilter/scanner/filter/scanner.c index 97cf5eb9..ec911f63 100644 --- a/filesys/miniFilter/scanner/filter/scanner.c +++ b/filesys/miniFilter/scanner/filter/scanner.c @@ -54,6 +54,28 @@ UNICODE_STRING ScannedExtensionDefault = RTL_CONSTANT_STRING( L"doc" ); // Function prototypes // +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +ScannerGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +ScannerOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + NTSTATUS ScannerInitializeScannedExtensions( _In_ PDRIVER_OBJECT DriverObject, @@ -106,6 +128,8 @@ ScannerpCheckExtension ( #ifdef ALLOC_PRAGMA #pragma alloc_text(INIT, DriverEntry) + #pragma alloc_text(INIT, ScannerGetIoOpenDriverRegistryKey) + #pragma alloc_text(INIT, ScannerOpenServiceParametersKey) #pragma alloc_text(INIT, ScannerInitializeScannedExtensions) #pragma alloc_text(PAGE, ScannerInstanceSetup) #pragma alloc_text(PAGE, ScannerPreCreate) @@ -313,17 +337,36 @@ Return Value: } +PFN_IoOpenDriverRegistryKey +ScannerGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + NTSTATUS -ScannerInitializeScannedExtensions( +ScannerOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ -Routine Descrition: +Routine Description: - This routine sets the the extensions for files to be scanned based - on the registry. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -332,6 +375,8 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. + ServiceParametersKey - Returns a handle to the service parameters subkey. + Return Value: STATUS_SUCCESS if the function completes successfully. Otherwise a valid @@ -340,79 +385,150 @@ Return Value: --*/ { NTSTATUS status; - OBJECT_ATTRIBUTES attributes; - OSVERSIONINFOW versionInfo; - HANDLE driverRegKey = NULL; - UNICODE_STRING valueName; - PKEY_VALUE_PARTIAL_INFORMATION valueBuffer = NULL; - ULONG valueLength = 0; - BOOLEAN closeHandle = FALSE; - PWCHAR ch; - SIZE_T length; - ULONG count; - PUNICODE_STRING ext; - - PAGED_CODE(); - - ScannedExtensions = NULL; - ScannedExtensionCount = 0; - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = ScannerGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API + // - goto ScannerInitializeScannedExtensionsCleanup; - } + status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( status )) { + + goto ScannerOpenServiceParametersKeyCleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &driverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); if (!NT_SUCCESS( status )) { - goto ScannerInitializeScannedExtensionsCleanup; + goto ScannerOpenServiceParametersKeyCleanup; } - } else { + // - // Open legacy registry key. + // Open the parameters key relative to service key path // - InitializeObjectAttributes( &attributes, - RegistryPath, + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &driverRegKey, + status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); if (!NT_SUCCESS( status )) { - goto ScannerInitializeScannedExtensionsCleanup; + goto ScannerOpenServiceParametersKeyCleanup; } } - closeHandle = TRUE; + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +ScannerOpenServiceParametersKeyCleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return status; + +} + +NTSTATUS +ScannerInitializeScannedExtensions( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Descrition: + + This routine sets the the extensions for files to be scanned based + on the registry. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. + +--*/ +{ + NTSTATUS status; + HANDLE driverRegKey = NULL; + UNICODE_STRING valueName; + PKEY_VALUE_PARTIAL_INFORMATION valueBuffer = NULL; + ULONG valueLength = 0; + PWCHAR ch; + SIZE_T length; + ULONG count; + PUNICODE_STRING ext; + + PAGED_CODE(); + + ScannedExtensions = NULL; + ScannedExtensionCount = 0; + + // + // Open service parameters key to query values from. + // + + status = ScannerOpenServiceParametersKey( DriverObject, + RegistryPath, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { + + driverRegKey = NULL; + goto ScannerInitializeScannedExtensionsCleanup; + } // // Query the length of the reg value @@ -522,7 +638,7 @@ ScannerInitializeScannedExtensionsCleanup: valueBuffer = NULL; } - if (closeHandle) { + if (driverRegKey != NULL) { ZwClose( driverRegKey ); } diff --git a/filesys/miniFilter/scanner/scanner.inf b/filesys/miniFilter/scanner/scanner.inf index c872e928..d7bf6256 100644 Binary files a/filesys/miniFilter/scanner/scanner.inf and b/filesys/miniFilter/scanner/scanner.inf differ diff --git a/filesys/miniFilter/simrep/simrep.c b/filesys/miniFilter/simrep/simrep.c index 278555d9..f23dddd6 100644 --- a/filesys/miniFilter/simrep/simrep.c +++ b/filesys/miniFilter/simrep/simrep.c @@ -243,6 +243,28 @@ DriverEntry ( _In_ PUNICODE_STRING RegistryPath ); +typedef +NTSTATUS +(*PFN_IoOpenDriverRegistryKey) ( + PDRIVER_OBJECT DriverObject, + DRIVER_REGKEY_TYPE RegKeyType, + ACCESS_MASK DesiredAccess, + ULONG Flags, + PHANDLE DriverRegKey + ); + +PFN_IoOpenDriverRegistryKey +SimRepGetIoOpenDriverRegistryKey ( + VOID + ); + +NTSTATUS +SimRepOpenServiceParametersKey ( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey + ); + NTSTATUS SimRepSetConfiguration( _In_ PDRIVER_OBJECT DriverObject, @@ -507,6 +529,8 @@ SIMREP_GLOBAL_DATA Globals; #ifdef ALLOC_PRAGMA #pragma alloc_text(INIT, DriverEntry) +#pragma alloc_text(INIT, SimRepGetIoOpenDriverRegistryKey) +#pragma alloc_text(INIT, SimRepOpenServiceParametersKey) #pragma alloc_text(INIT, SimRepSetConfiguration) #pragma alloc_text(PAGE, SimRepUnload) #pragma alloc_text(PAGE, SimRepInstanceSetup) @@ -665,16 +689,36 @@ DriverEntryCleanup: } #pragma warning(pop) +PFN_IoOpenDriverRegistryKey +SimRepGetIoOpenDriverRegistryKey ( + VOID + ) +{ + static PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey = NULL; + UNICODE_STRING FunctionName = {0}; + + if (pIoOpenDriverRegistryKey == NULL) { + + RtlInitUnicodeString(&FunctionName, L"IoOpenDriverRegistryKey"); + + pIoOpenDriverRegistryKey = (PFN_IoOpenDriverRegistryKey)MmGetSystemRoutineAddress(&FunctionName); + } + + return pIoOpenDriverRegistryKey; +} + NTSTATUS -SimRepSetConfiguration( +SimRepOpenServiceParametersKey ( _In_ PDRIVER_OBJECT DriverObject, - _In_ PUNICODE_STRING RegistryPath + _In_ PUNICODE_STRING ServiceRegistryPath, + _Out_ PHANDLE ServiceParametersKey ) /*++ -Routine Descrition: +Routine Description: - This routine sets the filter configuration based on registry values. + This routine opens the service parameters key, using the isolation-compliant + APIs when possible. Arguments: @@ -683,84 +727,158 @@ Arguments: RegistryPath - The path key passed to the driver during DriverEntry. -Return Value: + ServiceParametersKey - Returns a handle to the service parameters subkey. - Returns the status of this operation. +Return Value: + STATUS_SUCCESS if the function completes successfully. Otherwise a valid + NTSTATUS code is returned. --*/ { NTSTATUS status; - OBJECT_ATTRIBUTES attributes; - OSVERSIONINFOW versionInfo; - HANDLE driverRegKey = NULL; - UNICODE_STRING valueName; - UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)]; - PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer; - ULONG valueLength = sizeof(buffer); - ULONG resultLength; - PKEY_VALUE_PARTIAL_INFORMATION mappingValue = NULL; - ULONG mappingValueLength = 0; - WCHAR oldMappingTail; - WCHAR newMappingTail; - - PAGED_CODE(); - - RtlZeroMemory( &versionInfo, sizeof( versionInfo ) ); + PFN_IoOpenDriverRegistryKey pIoOpenDriverRegistryKey; + UNICODE_STRING Subkey; + HANDLE ParametersKey = NULL; + HANDLE ServiceRegKey = NULL; + OBJECT_ATTRIBUTES Attributes; // - // Determine the OS version being run. + // Open the parameters key to read values from the INF, using the API to + // open the key if possible // - versionInfo.dwOSVersionInfoSize = sizeof( versionInfo ); + pIoOpenDriverRegistryKey = SimRepGetIoOpenDriverRegistryKey(); - status = RtlGetVersion( &versionInfo ); + if (pIoOpenDriverRegistryKey != NULL) { - if (!NT_SUCCESS( status )) { + // + // Open the parameters key using the API + // - goto SimRepSetConfigurationCleanup; - } + status = pIoOpenDriverRegistryKey( DriverObject, + DriverRegKeyParameters, + KEY_READ, + 0, + &ParametersKey ); - // - // Open the desired registry key - // + if (!NT_SUCCESS( status )) { + + goto SimRepOpenServiceParametersKeyCleanup; + } + + } else { - if (versionInfo.dwBuildNumber >= 25952) { // - // Open the Parameters key for the service. + // Open specified service root key // - status = IoOpenDriverRegistryKey( DriverObject, - DriverRegKeyParameters, - KEY_READ, - 0, - &driverRegKey ); + InitializeObjectAttributes( &Attributes, + ServiceRegistryPath, + OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, + NULL, + NULL ); + + status = ZwOpenKey( &ServiceRegKey, + KEY_READ, + &Attributes ); if (!NT_SUCCESS( status )) { - goto SimRepSetConfigurationCleanup; + goto SimRepOpenServiceParametersKeyCleanup; } - } else { + // - // Open legacy registry key. + // Open the parameters key relative to service key path // - InitializeObjectAttributes( &attributes, - RegistryPath, + RtlInitUnicodeString( &Subkey, L"Parameters" ); + + InitializeObjectAttributes( &Attributes, + &Subkey, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, - NULL, + ServiceRegKey, NULL ); - status = ZwOpenKey( &driverRegKey, + status = ZwOpenKey( &ParametersKey, KEY_READ, - &attributes ); + &Attributes ); if (!NT_SUCCESS( status )) { - goto SimRepSetConfigurationCleanup; + goto SimRepOpenServiceParametersKeyCleanup; } } + // + // Return value to caller + // + + *ServiceParametersKey = ParametersKey; + +SimRepOpenServiceParametersKeyCleanup: + + if (ServiceRegKey != NULL) { + + ZwClose( ServiceRegKey ); + } + + return status; + +} + +NTSTATUS +SimRepSetConfiguration( + _In_ PDRIVER_OBJECT DriverObject, + _In_ PUNICODE_STRING RegistryPath + ) +/*++ + +Routine Descrition: + + This routine sets the filter configuration based on registry values. + +Arguments: + + DriverObject - Pointer to driver object created by the system to + represent this driver. + + RegistryPath - The path key passed to the driver during DriverEntry. + +Return Value: + + Returns the status of this operation. + + +--*/ +{ + NTSTATUS status; + HANDLE driverRegKey = NULL; + UNICODE_STRING valueName; + UCHAR buffer[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(ULONG)]; + PKEY_VALUE_PARTIAL_INFORMATION value = (PKEY_VALUE_PARTIAL_INFORMATION)buffer; + ULONG valueLength = sizeof(buffer); + ULONG resultLength; + PKEY_VALUE_PARTIAL_INFORMATION mappingValue = NULL; + ULONG mappingValueLength = 0; + WCHAR oldMappingTail; + WCHAR newMappingTail; + + PAGED_CODE(); + + // + // Open service parameters key to query values from + // + + status = SimRepOpenServiceParametersKey( DriverObject, + RegistryPath, + &driverRegKey ); + + if (!NT_SUCCESS( status )) { + + driverRegKey = NULL; + goto SimRepSetConfigurationCleanup; + } #if DBG diff --git a/filesys/miniFilter/simrep/simrep.inf b/filesys/miniFilter/simrep/simrep.inf index 104b6863..8eea42ce 100644 Binary files a/filesys/miniFilter/simrep/simrep.inf and b/filesys/miniFilter/simrep/simrep.inf differ diff --git a/filesys/miniFilter/swapBuffers/swapBuffers.inf b/filesys/miniFilter/swapBuffers/swapBuffers.inf index a64bef9d..0aab9452 100644 Binary files a/filesys/miniFilter/swapBuffers/swapBuffers.inf and b/filesys/miniFilter/swapBuffers/swapBuffers.inf differ -- cgit v1.3.1