ksedb.c File Reference

#include <ntoskrnl.h>
#include <appcompat/sdbtypes.h>
#include <appcompat/sdbtagid.h>
#include <debug.h>

Include dependency graph for ksedb.c:

Go to the source code of this file.

Macros
#define	WINAPI   NTAPI
#define	NDEBUG
#define	SDB_HEADER_SIZE   12
#define	SDB_HEADER_MAGIC   'fbds'

Typedefs
typedef int	BOOL

Functions
TAG WINAPI	SdbGetTagFromTagID (PDB pdb, TAGID tagid)
TAGID WINAPI	SdbGetFirstChild (PDB pdb, TAGID parent)
TAGID WINAPI	SdbGetNextChild (PDB pdb, TAGID parent, TAGID prev_child)
TAGID WINAPI	SdbFindFirstTag (PDB pdb, TAGID parent, TAG tag)
TAGID WINAPI	SdbFindNextTag (PDB pdb, TAGID parent, TAGID prev_child)
DWORD WINAPI	SdbReadDWORDTag (PDB pdb, TAGID tagid, DWORD ret)
LPWSTR WINAPI	SdbGetStringTagPtr (PDB pdb, TAGID tagid)
BOOL __cdecl	ShimDbgPrint (_In_ ULONG Level, _In_ PCSTR FunctionName, _In_z_ _Printf_format_string_ PCSTR Format,...)
BOOL WINAPI	SdbpCheckTagIDType (_In_ PDB pdb, _In_ TAGID tagid, _In_ WORD type)
BOOL WINAPI	SdbIsNullGUID (_In_ CONST GUID *Guid)
NTSTATUS NTAPI	KseDbInitialize (_In_ PVOID DatabaseImage, _In_ ULONG DatabaseSize)
static BOOLEAN	KsepDbStringEquals (_In_ TAGID Parent, _In_ TAG Tag, _In_ PCUNICODE_STRING String)
static BOOLEAN	KsepDbMatchingFileMatches (_In_ TAGID MatchingFile, _In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI	KseDbGetShimsForDriver (_In_ PLDR_DATA_TABLE_ENTRY LdrEntry, _Inout_ PKSE_SHIM *Shims, _Inout_ PULONG NumberOfShims)

Variables
static DB	KseDriverDatabase
static TAGID	KseDatabaseRoot
ULONG	g_ShimDebugLevel = 1

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 22 of file ksedb.c.

SDB_HEADER_MAGIC

#define SDB_HEADER_MAGIC   'fbds'

Definition at line 37 of file ksedb.c.

SDB_HEADER_SIZE

#define SDB_HEADER_SIZE   12

Definition at line 36 of file ksedb.c.

WINAPI

#define WINAPI   NTAPI

Definition at line 13 of file ksedb.c.

Typedef Documentation

BOOL

typedef int BOOL

Definition at line 11 of file ksedb.c.

Function Documentation

KseDbGetShimsForDriver()

VOID NTAPI KseDbGetShimsForDriver	(	_In_ PLDR_DATA_TABLE_ENTRY	LdrEntry,
		_Inout_ PKSE_SHIM *	Shims,
		_Inout_ PULONG	NumberOfShims
	)

Definition at line 199 of file ksedb.c.

{
    TAGID Driver, MatchingFile, ShimRef;
    UNICODE_STRING ShimName;
    PWSTR Name;
    BOOLEAN Match;
 
    if (KseDatabaseRoot == TAGID_NULL)
        return;
 
    for (Driver = SdbFindFirstTag(&KseDriverDatabase, KseDatabaseRoot, TAG_KDRIVER);
         Driver != TAGID_NULL;
         Driver = SdbFindNextTag(&KseDriverDatabase, KseDatabaseRoot, Driver))
    {
        if (!KsepDbStringEquals(Driver, TAG_NAME, &LdrEntry->BaseDllName))
            continue;
 
        Match = TRUE;
        for (MatchingFile = SdbFindFirstTag(&KseDriverDatabase, Driver, TAG_MATCHING_FILE);
             MatchingFile != TAGID_NULL && Match;
             MatchingFile = SdbFindNextTag(&KseDriverDatabase, Driver, MatchingFile))
        {
            Match = KsepDbMatchingFileMatches(MatchingFile, LdrEntry);
        }
 
        if (!Match)
        {
            DPRINT1("KSE: %wZ is in the driver database, but does not match\n", &LdrEntry->BaseDllName);
            continue;
        }
 
        for (ShimRef = SdbFindFirstTag(&KseDriverDatabase, Driver, TAG_KSHIM_REF);
             ShimRef != TAGID_NULL;
             ShimRef = SdbFindNextTag(&KseDriverDatabase, Driver, ShimRef))
        {
            Name = SdbGetStringTagPtr(&KseDriverDatabase, SdbFindFirstTag(&KseDriverDatabase, ShimRef, TAG_NAME));
            if (!Name)
                continue;
 
            RtlInitUnicodeString(&ShimName, Name);
            KsepAddShimByName(&ShimName, Shims, NumberOfShims);
        }
    }
}

Referenced by KsepGetShimsForDriver().

KseDbInitialize()

NTSTATUS NTAPI KseDbInitialize	(	_In_ PVOID	DatabaseImage,
		_In_ ULONG	DatabaseSize
	)

Definition at line 92 of file ksedb.c.

{
    PULONG Header = DatabaseImage;
    PUCHAR Data;
 
    if (!DatabaseImage || DatabaseSize <= SDB_HEADER_SIZE || Header[2] != SDB_HEADER_MAGIC)
        return STATUS_INVALID_IMAGE_FORMAT;
 
    /* The loader block is freed after boot, so keep a copy */
    Data = ExAllocatePoolWithTag(PagedPool, DatabaseSize, TAG_KSE_DATABASE);
    if (!Data)
        return STATUS_INSUFFICIENT_RESOURCES;
    RtlCopyMemory(Data, DatabaseImage, DatabaseSize);
 
    RtlZeroMemory(&KseDriverDatabase, sizeof(KseDriverDatabase));
    KseDriverDatabase.data = Data;
    KseDriverDatabase.size = DatabaseSize;
    KseDriverDatabase.major = Header[0];
    KseDriverDatabase.minor = Header[1];
    KseDriverDatabase.stringtable = SdbFindFirstTag(&KseDriverDatabase, TAGID_ROOT, TAG_STRINGTABLE);
 
    KseDatabaseRoot = SdbFindFirstTag(&KseDriverDatabase, TAGID_ROOT, TAG_DATABASE);
    if (KseDatabaseRoot == TAGID_NULL)
    {
        ExFreePoolWithTag(Data, TAG_KSE_DATABASE);
        RtlZeroMemory(&KseDriverDatabase, sizeof(KseDriverDatabase));
        return STATUS_INVALID_IMAGE_FORMAT;
    }
 
    DPRINT1("KSE: Loaded driver database version %lu.%lu (%lu bytes)\n",
            KseDriverDatabase.major, KseDriverDatabase.minor, DatabaseSize);
    return STATUS_SUCCESS;
}

Referenced by CODE_SEG().

KsepDbMatchingFileMatches()

static BOOLEAN KsepDbMatchingFileMatches ( _In_ TAGID  MatchingFile, _In_ PLDR_DATA_TABLE_ENTRY  LdrEntry  )

static

Definition at line 147 of file ksedb.c.

{
    static const UNICODE_STRING Self = RTL_CONSTANT_STRING(L"*");
    PIMAGE_NT_HEADERS NtHeaders;
    TAGID Attribute;
    TAG Tag;
 
    /* Only the driver itself can be checked here */
    if (!KsepDbStringEquals(MatchingFile, TAG_NAME, &Self) &&
        !KsepDbStringEquals(MatchingFile, TAG_NAME, &LdrEntry->BaseDllName))
    {
        return FALSE;
    }
 
    NtHeaders = RtlImageNtHeader(LdrEntry->DllBase);
    if (!NtHeaders)
        return FALSE;
 
    for (Attribute = SdbGetFirstChild(&KseDriverDatabase, MatchingFile);
         Attribute != TAGID_NULL;
         Attribute = SdbGetNextChild(&KseDriverDatabase, MatchingFile, Attribute))
    {
        Tag = SdbGetTagFromTagID(&KseDriverDatabase, Attribute);
        switch (Tag)
        {
            case TAG_NAME:
                break;
 
            case TAG_LINK_DATE:
                if (SdbReadDWORDTag(&KseDriverDatabase, Attribute, 0) != NtHeaders->FileHeader.TimeDateStamp)
                    return FALSE;
                break;
 
            case TAG_CHECKSUM:
                if (SdbReadDWORDTag(&KseDriverDatabase, Attribute, 0) != NtHeaders->OptionalHeader.CheckSum)
                    return FALSE;
                break;
 
            default:
                /* Do not shim a driver based on attributes that were not checked */
                DPRINT1("KSE: Unsupported matching attribute 0x%x for %wZ\n", Tag, &LdrEntry->BaseDllName);
                return FALSE;
        }
    }
 
    return TRUE;
}

Referenced by KseDbGetShimsForDriver().

KsepDbStringEquals()

static BOOLEAN KsepDbStringEquals ( _In_ TAGID  Parent, _In_ TAG  Tag, _In_ PCUNICODE_STRING  String  )

static

Definition at line 129 of file ksedb.c.

{
    UNICODE_STRING Value;
    PWSTR Ptr;
 
    Ptr = SdbGetStringTagPtr(&KseDriverDatabase, SdbFindFirstTag(&KseDriverDatabase, Parent, Tag));
    if (!Ptr)
        return FALSE;
 
    RtlInitUnicodeString(&Value, Ptr);
    return RtlEqualUnicodeString(&Value, String, TRUE);
}

Referenced by KseDbGetShimsForDriver(), and KsepDbMatchingFileMatches().

SdbFindFirstTag()

TAGID WINAPI SdbFindFirstTag	(	PDB	pdb,
		TAGID	parent,
		TAG	tag
	)

Searches shim database for a tag within specified domain.

Parameters

[in]	pdb	Handle to the shim database.
[in]	parent	TAGID of parent.
[in]	tag	TAG to be located.

Returns

Success: TAGID of first matching tag, Failure: TAGID_NULL.

Definition at line 208 of file sdbread.c.

{
    TAGID iter;
 
    iter = SdbGetFirstChild(pdb, parent);
    while (iter != TAGID_NULL)
    {
        if (SdbGetTagFromTagID(pdb, iter) == tag)
            return iter;
        iter = SdbGetNextChild(pdb, parent, iter);
    }
    return TAGID_NULL;
}

Referenced by KseDbGetShimsForDriver(), KseDbInitialize(), KsepDbStringEquals(), and SdbGetDatabaseID().

SdbFindNextTag()

TAGID WINAPI SdbFindNextTag	(	PDB	pdb,
		TAGID	parent,
		TAGID	prev_child
	)

Searches shim database for a next tag which matches prev_child within parent's domain.

Parameters

[in]	pdb	Handle to the shim database.
[in]	parent	TAGID of parent.
[in]	prev_child	TAGID of previous match.

Returns

Success: TAGID of next match, Failure: TAGID_NULL.

Definition at line 231 of file sdbread.c.

{
    TAG tag;
    TAGID iter;
 
    tag = SdbGetTagFromTagID(pdb, prev_child);
    iter = SdbGetNextChild(pdb, parent, prev_child);
 
    while (iter != TAGID_NULL)
    {
        if (SdbGetTagFromTagID(pdb, iter) == tag)
            return iter;
        iter = SdbGetNextChild(pdb, parent, iter);
    }
    return TAGID_NULL;
}

Referenced by KseDbGetShimsForDriver().

SdbGetFirstChild()

TAGID WINAPI SdbGetFirstChild	(	PDB	pdb,
		TAGID	parent
	)

Searches shim database for a child of specified parent tag.

Parameters

[in]	pdb	Handle to the shim database.
[in]	parent	TAGID of parent.

Returns

Success: TAGID of child tag, Failure: TAGID_NULL.

Definition at line 142 of file sdbread.c.

{
    /* if we are at beginning of database */
    if (parent == TAGID_ROOT)
    {
        /* header only database: no tags */
        if (pdb->size <= _TAGID_ROOT)
            return TAGID_NULL;
        /* return *real* root tagid */
        else return _TAGID_ROOT;
    }
 
    /* only list tag can have children */
    if ((SdbGetTagFromTagID(pdb, parent) & TAG_TYPE_MASK) != TAG_TYPE_LIST)
        return TAGID_NULL;
 
    /* first child is sizeof(TAG) + sizeof(DWORD) bytes after beginning of list */
    return parent + sizeof(TAG) + sizeof(DWORD);
}

Referenced by KsepDbMatchingFileMatches(), and SdbFindFirstTag().

SdbGetNextChild()

TAGID WINAPI SdbGetNextChild	(	PDB	pdb,
		TAGID	parent,
		TAGID	prev_child
	)

Searches shim database for next child of specified parent tag.

Parameters

[in]	pdb	Handle to the shim database.
[in]	parent	TAGID of parent.
[in]	prev_child	TAGID of previous child.

Returns

Success: TAGID of next child tag, Failure: TAGID_NULL.

Definition at line 171 of file sdbread.c.

{
    TAGID next_child;
    DWORD prev_child_size, parent_size;
 
    prev_child_size = SdbpGetTagSize(pdb, prev_child);
    if (prev_child_size == 0)
        return TAGID_NULL;
 
    /* Bound check */
    next_child = prev_child + prev_child_size;
    if (next_child >= pdb->size)
        return TAGID_NULL;
 
    if (parent == TAGID_ROOT)
        return next_child;
 
    parent_size = SdbpGetTagSize(pdb, parent);
    if (parent_size == 0)
        return TAGID_NULL;
 
    /* Specified parent has no more children */
    if (next_child >= parent + parent_size)
        return TAGID_NULL;
 
    return next_child;
}

Referenced by KsepDbMatchingFileMatches(), SdbFindFirstTag(), and SdbFindNextTag().

SdbGetStringTagPtr()

LPWSTR WINAPI SdbGetStringTagPtr	(	PDB	pdb,
		TAGID	tagid
	)

Searches shim database for string associated with specified tagid.

Parameters

[in]	pdb	Handle to the shim database.
[in]	tagid	TAGID of string or stringref associated with the string.

Returns

the LPWSTR associated with specified tagid, or NULL on failure.

Definition at line 375 of file sdbread.c.

{
    return SdbpGetString(pdb, tagid, NULL);
}

Referenced by KseDbGetShimsForDriver(), and KsepDbStringEquals().

SdbGetTagFromTagID()

TAG WINAPI SdbGetTagFromTagID	(	PDB	pdb,
		TAGID	tagid
	)

Searches shim database for the tag associated with specified tagid.

Parameters

[in]	pdb	Handle to the shim database.
[in]	tagid	The TAGID of the tag.

Returns

Success: The tag associated with specified tagid, Failure: TAG_NULL.

Definition at line 93 of file sdbread.c.

{
    TAG data;
    if (!SdbpReadData(pdb, &data, tagid, sizeof(data)))
        return TAG_NULL;
    return data;
}

Referenced by KsepDbMatchingFileMatches(), SdbFindFirstTag(), SdbFindNextTag(), SdbGetFirstChild(), SdbGetTagDataSize(), SdbpCheckTagIDType(), SdbpGetString(), and SdbpGetTagSize().

SdbIsNullGUID()

BOOL WINAPI SdbIsNullGUID

(

_In_ CONST GUID *

Guid

)

Definition at line 81 of file ksedb.c.

{
    static const GUID NullGuid = { 0 };
    return IsEqualGUID(Guid, &NullGuid);
}

SdbpCheckTagIDType()

BOOL WINAPI SdbpCheckTagIDType	(	_In_ PDB	pdb,
		_In_ TAGID	tagid,
		_In_ WORD	type
	)

Definition at line 68 of file ksedb.c.

{
    TAG tag = SdbGetTagFromTagID(pdb, tagid);
    if (tag == TAG_NULL)
        return FALSE;
    return (tag & TAG_TYPE_MASK) == type;
}

SdbReadDWORDTag()

DWORD WINAPI SdbReadDWORDTag	(	PDB	pdb,
		TAGID	tagid,
		DWORD	ret
	)

Reads DWORD value at specified tagid.

Parameters

[in]	pdb	Handle to the shim database.
[in]	tagid	TAGID of DWORD value.
[in]	ret	Default return value in case function fails.

Returns

Success: DWORD value at specified tagid, otherwise ret.

Definition at line 305 of file sdbread.c.

{
    if (SdbpCheckTagIDType(pdb, tagid, TAG_TYPE_DWORD))
        SdbpReadData(pdb, &ret, tagid + 2, sizeof(DWORD));
    return ret;
}

Referenced by KsepDbMatchingFileMatches().

ShimDbgPrint()

BOOL __cdecl ShimDbgPrint	(	_In_ ULONG	Level,
		_In_ PCSTR	FunctionName,
		_In_z_ _Printf_format_string_ PCSTR	Format,
			...
	)

Definition at line 49 of file ksedb.c.

{
    va_list ap;
 
    UNREFERENCED_PARAMETER(Level);
 
    DbgPrint("KSE: [%s] ", FunctionName);
    va_start(ap, Format);
    vDbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, Format, ap);
    va_end(ap);
    return TRUE;
}

Variable Documentation

g_ShimDebugLevel

ULONG g_ShimDebugLevel = 1

Definition at line 45 of file ksedb.c.

KseDatabaseRoot

TAGID KseDatabaseRoot

static

Definition at line 40 of file ksedb.c.

Referenced by KseDbGetShimsForDriver(), and KseDbInitialize().

KseDriverDatabase

DB KseDriverDatabase

static

Definition at line 39 of file ksedb.c.

Referenced by KseDbGetShimsForDriver(), KseDbInitialize(), KsepDbMatchingFileMatches(), and KsepDbStringEquals().