probe.h File Reference

#include <suppress.h>

Include dependency graph for probe.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	ProbeForWriteGenericType(Ptr, Type)
#define	ProbeForWriteBoolean(Ptr)   ProbeForWriteGenericType(Ptr, BOOLEAN)
#define	ProbeForWriteUchar(Ptr)   ProbeForWriteGenericType(Ptr, UCHAR)
#define	ProbeForWriteChar(Ptr)   ProbeForWriteGenericType(Ptr, CHAR)
#define	ProbeForWriteUshort(Ptr)   ProbeForWriteGenericType(Ptr, USHORT)
#define	ProbeForWriteShort(Ptr)   ProbeForWriteGenericType(Ptr, SHORT)
#define	ProbeForWriteUlong(Ptr)   ProbeForWriteGenericType(Ptr, ULONG)
#define	ProbeForWriteLong(Ptr)   ProbeForWriteGenericType(Ptr, LONG)
#define	ProbeForWriteUint(Ptr)   ProbeForWriteGenericType(Ptr, UINT)
#define	ProbeForWriteInt(Ptr)   ProbeForWriteGenericType(Ptr, INT)
#define	ProbeForWriteUlonglong(Ptr)   ProbeForWriteGenericType(Ptr, ULONGLONG)
#define	ProbeForWriteLonglong(Ptr)   ProbeForWriteGenericType(Ptr, LONGLONG)
#define	ProbeForWritePointer(Ptr)   ProbeForWriteGenericType(Ptr, PVOID)
#define	ProbeForWriteHandle(Ptr)   ProbeForWriteGenericType(Ptr, HANDLE)
#define	ProbeForWriteLangid(Ptr)   ProbeForWriteGenericType(Ptr, LANGID)
#define	ProbeForWriteSize_t(Ptr)   ProbeForWriteGenericType(Ptr, SIZE_T)
#define	ProbeForWriteLargeInteger(Ptr)   ProbeForWriteGenericType(&((PLARGE_INTEGER)Ptr)->QuadPart, LONGLONG)
#define	ProbeForWriteUlargeInteger(Ptr)   ProbeForWriteGenericType(&((PULARGE_INTEGER)Ptr)->QuadPart, ULONGLONG)
#define	ProbeForWriteUnicodeString(Ptr)   ProbeForWriteGenericType((PUNICODE_STRING)Ptr, UNICODE_STRING)
#define	ProbeForWriteIoStatusBlock(Ptr)   ProbeForWriteGenericType((PIO_STATUS_BLOCK)Ptr, IO_STATUS_BLOCK)
#define	ProbeForReadGenericType(Ptr, Type, Default)
#define	ProbeForReadBoolean(Ptr)   ProbeForReadGenericType(Ptr, BOOLEAN, FALSE)
#define	ProbeForReadUchar(Ptr)   ProbeForReadGenericType(Ptr, UCHAR, 0)
#define	ProbeForReadChar(Ptr)   ProbeForReadGenericType(Ptr, CHAR, 0)
#define	ProbeForReadUshort(Ptr)   ProbeForReadGenericType(Ptr, USHORT, 0)
#define	ProbeForReadShort(Ptr)   ProbeForReadGenericType(Ptr, SHORT, 0)
#define	ProbeForReadUlong(Ptr)   ProbeForReadGenericType(Ptr, ULONG, 0)
#define	ProbeForReadLong(Ptr)   ProbeForReadGenericType(Ptr, LONG, 0)
#define	ProbeForReadUint(Ptr)   ProbeForReadGenericType(Ptr, UINT, 0)
#define	ProbeForReadInt(Ptr)   ProbeForReadGenericType(Ptr, INT, 0)
#define	ProbeForReadUlonglong(Ptr)   ProbeForReadGenericType(Ptr, ULONGLONG, 0)
#define	ProbeForReadLonglong(Ptr)   ProbeForReadGenericType(Ptr, LONGLONG, 0)
#define	ProbeForReadPointer(Ptr)   ProbeForReadGenericType(Ptr, PVOID, NULL)
#define	ProbeForReadHandle(Ptr)   ProbeForReadGenericType(Ptr, HANDLE, NULL)
#define	ProbeForReadLangid(Ptr)   ProbeForReadGenericType(Ptr, LANGID, 0)
#define	ProbeForReadSize_t(Ptr)   ProbeForReadGenericType(Ptr, SIZE_T, 0)
#define	ProbeForReadLargeInteger(Ptr)   ProbeForReadGenericType((const LARGE_INTEGER *)(Ptr), LARGE_INTEGER, __emptyLargeInteger)
#define	ProbeForReadUlargeInteger(Ptr)   ProbeForReadGenericType((const ULARGE_INTEGER *)(Ptr), ULARGE_INTEGER, __emptyULargeInteger)
#define	ProbeForReadUnicodeString(Ptr)   ProbeForReadGenericType((const UNICODE_STRING *)(Ptr), UNICODE_STRING, __emptyUnicodeString)
#define	ProbeForReadIoStatusBlock(Ptr)   ProbeForReadGenericType((const IO_STATUS_BLOCK *)(Ptr), IO_STATUS_BLOCK, __emptyIoStatusBlock)
#define	ProbeAndZeroHandle(Ptr)

Functions
static __inline NTSTATUS	ProbeAndCaptureUnicodeString (OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
static __inline VOID	ReleaseCapturedUnicodeString (IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)

Variables
static const UNICODE_STRING	__emptyUnicodeString = {0, 0, NULL}
static const LARGE_INTEGER	__emptyLargeInteger = {{0, 0}}
static const ULARGE_INTEGER	__emptyULargeInteger = {{0, 0}}
static const IO_STATUS_BLOCK	__emptyIoStatusBlock = {{0}, 0}

Macro Definition Documentation

ProbeAndZeroHandle

#define ProbeAndZeroHandle

(

Ptr

)

Value:

do {                                                                       \
        if ((ULONG_PTR)(Ptr) + sizeof(HANDLE) - 1 < (ULONG_PTR)(Ptr) ||        \
            (ULONG_PTR)(Ptr) + sizeof(HANDLE) - 1 >= (ULONG_PTR)MmUserProbeAddress) { \
            ExRaiseAccessViolation();                                          \
        }                                                                      \
        *(volatile HANDLE *)(Ptr) = NULL;                                      \
    } while (0)

Definition at line 83 of file probe.h.

ProbeForReadBoolean

#define ProbeForReadBoolean

(

Ptr

)

ProbeForReadGenericType(Ptr, BOOLEAN, FALSE)

Definition at line 60 of file probe.h.

ProbeForReadChar

#define ProbeForReadChar

(

Ptr

)

ProbeForReadGenericType(Ptr, CHAR, 0)

Definition at line 62 of file probe.h.

ProbeForReadGenericType

#define ProbeForReadGenericType	(		Ptr,
			Type,
			Default
	)

Value:

(((ULONG_PTR)(Ptr) + sizeof(Type) - 1 < (ULONG_PTR)(Ptr) ||                \
     (ULONG_PTR)(Ptr) + sizeof(Type) - 1 >= (ULONG_PTR)MmUserProbeAddress) ?   \
         ExRaiseAccessViolation(), Default :                     \
         *(const volatile Type *)(Ptr))

Definition at line 54 of file probe.h.

ProbeForReadHandle

#define ProbeForReadHandle

(

Ptr

)

ProbeForReadGenericType(Ptr, HANDLE, NULL)

Definition at line 72 of file probe.h.

ProbeForReadInt

#define ProbeForReadInt

(

Ptr

)

ProbeForReadGenericType(Ptr, INT, 0)

Definition at line 68 of file probe.h.

ProbeForReadIoStatusBlock

#define ProbeForReadIoStatusBlock

(

Ptr

)

ProbeForReadGenericType((const IO_STATUS_BLOCK *)(Ptr), IO_STATUS_BLOCK, __emptyIoStatusBlock)

Definition at line 81 of file probe.h.

ProbeForReadLangid

#define ProbeForReadLangid

(

Ptr

)

ProbeForReadGenericType(Ptr, LANGID, 0)

Definition at line 73 of file probe.h.

ProbeForReadLargeInteger

#define ProbeForReadLargeInteger

(

Ptr

)

ProbeForReadGenericType((const LARGE_INTEGER *)(Ptr), LARGE_INTEGER, __emptyLargeInteger)

Definition at line 75 of file probe.h.

ProbeForReadLong

#define ProbeForReadLong

(

Ptr

)

ProbeForReadGenericType(Ptr, LONG, 0)

Definition at line 66 of file probe.h.

ProbeForReadLonglong

#define ProbeForReadLonglong

(

Ptr

)

ProbeForReadGenericType(Ptr, LONGLONG, 0)

Definition at line 70 of file probe.h.

ProbeForReadPointer

#define ProbeForReadPointer

(

Ptr

)

ProbeForReadGenericType(Ptr, PVOID, NULL)

Definition at line 71 of file probe.h.

ProbeForReadShort

#define ProbeForReadShort

(

Ptr

)

ProbeForReadGenericType(Ptr, SHORT, 0)

Definition at line 64 of file probe.h.

ProbeForReadSize_t

#define ProbeForReadSize_t

(

Ptr

)

ProbeForReadGenericType(Ptr, SIZE_T, 0)

Definition at line 74 of file probe.h.

ProbeForReadUchar

#define ProbeForReadUchar

(

Ptr

)

ProbeForReadGenericType(Ptr, UCHAR, 0)

Definition at line 61 of file probe.h.

ProbeForReadUint

#define ProbeForReadUint

(

Ptr

)

ProbeForReadGenericType(Ptr, UINT, 0)

Definition at line 67 of file probe.h.

ProbeForReadUlargeInteger

#define ProbeForReadUlargeInteger

(

Ptr

)

ProbeForReadGenericType((const ULARGE_INTEGER *)(Ptr), ULARGE_INTEGER, __emptyULargeInteger)

Definition at line 76 of file probe.h.

ProbeForReadUlong

#define ProbeForReadUlong

(

Ptr

)

ProbeForReadGenericType(Ptr, ULONG, 0)

Definition at line 65 of file probe.h.

ProbeForReadUlonglong

#define ProbeForReadUlonglong

(

Ptr

)

ProbeForReadGenericType(Ptr, ULONGLONG, 0)

Definition at line 69 of file probe.h.

ProbeForReadUnicodeString

#define ProbeForReadUnicodeString

(

Ptr

)

ProbeForReadGenericType((const UNICODE_STRING *)(Ptr), UNICODE_STRING, __emptyUnicodeString)

Definition at line 77 of file probe.h.

ProbeForReadUshort

#define ProbeForReadUshort

(

Ptr

)

ProbeForReadGenericType(Ptr, USHORT, 0)

Definition at line 63 of file probe.h.

ProbeForWriteBoolean

#define ProbeForWriteBoolean

(

Ptr

)

ProbeForWriteGenericType(Ptr, BOOLEAN)

Definition at line 31 of file probe.h.

ProbeForWriteChar

#define ProbeForWriteChar

(

Ptr

)

ProbeForWriteGenericType(Ptr, CHAR)

Definition at line 33 of file probe.h.

ProbeForWriteGenericType

#define ProbeForWriteGenericType	(		Ptr,
			Type
	)

Value:

do {                                                                       \
        if ((ULONG_PTR)(Ptr) + sizeof(Type) - 1 < (ULONG_PTR)(Ptr) ||          \
            (ULONG_PTR)(Ptr) + sizeof(Type) - 1 >= (ULONG_PTR)MmUserProbeAddress) { \
            ExRaiseAccessViolation();                                          \
        }                                                                      \
        *(volatile Type *)(Ptr) = *(volatile Type *)(Ptr);                     \
    } while (0)

Definition at line 22 of file probe.h.

ProbeForWriteHandle

#define ProbeForWriteHandle

(

Ptr

)

ProbeForWriteGenericType(Ptr, HANDLE)

Definition at line 43 of file probe.h.

ProbeForWriteInt

#define ProbeForWriteInt

(

Ptr

)

ProbeForWriteGenericType(Ptr, INT)

Definition at line 39 of file probe.h.

ProbeForWriteIoStatusBlock

#define ProbeForWriteIoStatusBlock

(

Ptr

)

ProbeForWriteGenericType((PIO_STATUS_BLOCK)Ptr, IO_STATUS_BLOCK)

Definition at line 52 of file probe.h.

ProbeForWriteLangid

#define ProbeForWriteLangid

(

Ptr

)

ProbeForWriteGenericType(Ptr, LANGID)

Definition at line 44 of file probe.h.

ProbeForWriteLargeInteger

#define ProbeForWriteLargeInteger

(

Ptr

)

ProbeForWriteGenericType(&((PLARGE_INTEGER)Ptr)->QuadPart, LONGLONG)

Definition at line 46 of file probe.h.

ProbeForWriteLong

#define ProbeForWriteLong

(

Ptr

)

ProbeForWriteGenericType(Ptr, LONG)

Definition at line 37 of file probe.h.

ProbeForWriteLonglong

#define ProbeForWriteLonglong

(

Ptr

)

ProbeForWriteGenericType(Ptr, LONGLONG)

Definition at line 41 of file probe.h.

ProbeForWritePointer

#define ProbeForWritePointer

(

Ptr

)

ProbeForWriteGenericType(Ptr, PVOID)

Definition at line 42 of file probe.h.

ProbeForWriteShort

#define ProbeForWriteShort

(

Ptr

)

ProbeForWriteGenericType(Ptr, SHORT)

Definition at line 35 of file probe.h.

ProbeForWriteSize_t

#define ProbeForWriteSize_t

(

Ptr

)

ProbeForWriteGenericType(Ptr, SIZE_T)

Definition at line 45 of file probe.h.

ProbeForWriteUchar

#define ProbeForWriteUchar

(

Ptr

)

ProbeForWriteGenericType(Ptr, UCHAR)

Definition at line 32 of file probe.h.

ProbeForWriteUint

#define ProbeForWriteUint

(

Ptr

)

ProbeForWriteGenericType(Ptr, UINT)

Definition at line 38 of file probe.h.

ProbeForWriteUlargeInteger

#define ProbeForWriteUlargeInteger

(

Ptr

)

ProbeForWriteGenericType(&((PULARGE_INTEGER)Ptr)->QuadPart, ULONGLONG)

Definition at line 47 of file probe.h.

ProbeForWriteUlong

#define ProbeForWriteUlong

(

Ptr

)

ProbeForWriteGenericType(Ptr, ULONG)

Definition at line 36 of file probe.h.

ProbeForWriteUlonglong

#define ProbeForWriteUlonglong

(

Ptr

)

ProbeForWriteGenericType(Ptr, ULONGLONG)

Definition at line 40 of file probe.h.

ProbeForWriteUnicodeString

#define ProbeForWriteUnicodeString

(

Ptr

)

ProbeForWriteGenericType((PUNICODE_STRING)Ptr, UNICODE_STRING)

Definition at line 48 of file probe.h.

ProbeForWriteUshort

#define ProbeForWriteUshort

(

Ptr

)

ProbeForWriteGenericType(Ptr, USHORT)

Definition at line 34 of file probe.h.

Function Documentation

ProbeAndCaptureUnicodeString()

static __inline NTSTATUS ProbeAndCaptureUnicodeString ( OUT PUNICODE_STRING  Dest, IN KPROCESSOR_MODE  CurrentMode, IN const UNICODE_STRING *  UnsafeSrc  )

static

Definition at line 142 of file probe.h.

{
    NTSTATUS Status = STATUS_SUCCESS;
    PWCHAR Buffer = NULL;
    ASSERT(Dest != NULL);

    /* Probe the structure and buffer*/
    if(CurrentMode != KernelMode)
    {
        _SEH2_TRY
        {
#ifdef __cplusplus
            ProbeForRead(UnsafeSrc, sizeof(*UnsafeSrc), 1);
            RtlCopyMemory(Dest, UnsafeSrc, sizeof(*UnsafeSrc));
#else
            *Dest = ProbeForReadUnicodeString(UnsafeSrc);
#endif
            if(Dest->Buffer != NULL)
            {
                if (Dest->Length != 0)
                {
                    ProbeForRead(Dest->Buffer, Dest->Length, sizeof(WCHAR));

                    /* Allocate space for the buffer */
                    Buffer = (PWCHAR)ExAllocatePoolWithTag(PagedPool,
                                                   Dest->Length + sizeof(WCHAR),
                                                   'RTSU');
                    if (Buffer == NULL)
                    {
                        Status = STATUS_INSUFFICIENT_RESOURCES;
                        _SEH2_LEAVE;
                    }

                    /* Copy it */
                    RtlCopyMemory(Buffer, Dest->Buffer, Dest->Length);
                    Buffer[Dest->Length / sizeof(WCHAR)] = UNICODE_NULL;

                    /* Set it as the buffer */
                    Dest->Buffer = Buffer;
                    Dest->MaximumLength = Dest->Length + sizeof(WCHAR);
                }
                else
                {
                    /* Sanitize structure */
                    Dest->MaximumLength = 0;
                    Dest->Buffer = NULL;
                }
            }
            else
            {
                /* Sanitize structure */
                Dest->Length = 0;
                Dest->MaximumLength = 0;
            }
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Free allocated resources and zero the destination string */
            if (Buffer != NULL)
            {
                ExFreePoolWithTag(Buffer, 'RTSU');
            }
            Dest->Length = 0;
            Dest->MaximumLength = 0;
            Dest->Buffer = NULL;

            /* Return the error code */
            Status = _SEH2_GetExceptionCode();
        }
        _SEH2_END;
    }
    else
    {
        /* Just copy the UNICODE_STRING structure, don't allocate new memory!
           We trust the caller to supply valid pointers and data. */
        *Dest = *UnsafeSrc;
    }

    /* Return */
    return Status;
}

Referenced by IopUnloadDriver(), NtCloseObjectAuditAlarm(), NtDeleteValueKey(), NtDisplayString(), NtLoadDriver(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtQuerySystemEnvironmentValue(), NtQueryValueKey(), NtSetSystemEnvironmentValue(), NtSetValueKey(), NtUserFindExistingCursorIcon(), NtUserRegisterUserApiHook(), NtUserResolveDesktop(), NtUserSetCursorIconData(), NtUserThunkedMenuItemInfo(), ProbeAndCaptureObjectAttributes(), and SepAccessCheckAndAuditAlarm().

ReleaseCapturedUnicodeString()

static __inline VOID ReleaseCapturedUnicodeString ( IN PUNICODE_STRING  CapturedString, IN KPROCESSOR_MODE  CurrentMode  )

static

Definition at line 228 of file probe.h.

{
    if(CurrentMode != KernelMode && CapturedString->Buffer != NULL)
    {
        ExFreePoolWithTag(CapturedString->Buffer, 'RTSU');
    }

    CapturedString->Length = 0;
    CapturedString->MaximumLength = 0;
    CapturedString->Buffer = NULL;
}

Referenced by IopUnloadDriver(), NtCloseObjectAuditAlarm(), NtDeleteValueKey(), NtDisplayString(), NtLoadDriver(), NtOpenObjectAuditAlarm(), NtPrivilegedServiceAuditAlarm(), NtQuerySystemEnvironmentValue(), NtQueryValueKey(), NtSetSystemEnvironmentValue(), NtSetValueKey(), NtUserFindExistingCursorIcon(), NtUserRegisterUserApiHook(), NtUserResolveDesktop(), NtUserSetCursorIconData(), NtUserThunkedMenuItemInfo(), ReleaseCapturedObjectAttributes(), SepAccessCheckAndAuditAlarm(), and UserUnregisterUserApiHook().

Variable Documentation

__emptyIoStatusBlock

const IO_STATUS_BLOCK __emptyIoStatusBlock = {{0}, 0}

static

Definition at line 13 of file probe.h.

__emptyLargeInteger

const LARGE_INTEGER __emptyLargeInteger = {{0, 0}}

static

Definition at line 11 of file probe.h.

__emptyULargeInteger

const ULARGE_INTEGER __emptyULargeInteger = {{0, 0}}

static

Definition at line 12 of file probe.h.

__emptyUnicodeString

const UNICODE_STRING __emptyUnicodeString = {0, 0, NULL}

static

Definition at line 10 of file probe.h.