#include <ntimage.h>

Include dependency graph for aux_klib.h:

This graph shows which files directly or indirectly include this file:

Classes
struct	_AUX_MODULE_BASIC_INFO

struct	_AUX_MODULE_EXTENDED_INFO

struct	_KBUGCHECK_DATA

Macros
#define	AUX_KLIB_MODULE_PATH_LEN 0x100

Typedefs
typedef struct _AUX_MODULE_BASIC_INFO	AUX_MODULE_BASIC_INFO

typedef struct _AUX_MODULE_BASIC_INFO *	PAUX_MODULE_BASIC_INFO

typedef struct _AUX_MODULE_EXTENDED_INFO	AUX_MODULE_EXTENDED_INFO

typedef struct _AUX_MODULE_EXTENDED_INFO *	PAUX_MODULE_EXTENDED_INFO

typedef struct _KBUGCHECK_DATA	KBUGCHECK_DATA

typedef struct _KBUGCHECK_DATA *	PKBUGCHECK_DATA

Functions
NTSTATUS NTAPI	AuxKlibInitialize (VOID)

	_IRQL_requires_max_ (PASSIVE_LEVEL) NTSTATUS NTAPI AuxKlibQueryModuleInformation(_Inout_ PULONG InformationLength
	Queries information details about a security descriptor.

NTSTATUS	AuxKlibGetBugCheckData (_Inout_ PKBUGCHECK_DATA BugCheckData)

PIMAGE_EXPORT_DIRECTORY	AuxKlibGetImageExportDirectory (_In_ PVOID ImageBase)

	_Out_writes_bytes_to_opt_ (BufferLength, *ReturnLength) PVOID FirmwareTableBuffer

Variables
_In_ ULONG	SizePerModule

_In_ ULONG _Out_writes_bytes_opt_ InformationLength PAUX_MODULE_EXTENDED_INFO	ModuleInfo

_In_ ULONG	BufferLength

_In_ ULONG _Out_opt_ PULONG	ReturnLength

_In_ ULONG	FirmwareTableID

Macro Definition Documentation

◆ AUX_KLIB_MODULE_PATH_LEN

#define AUX_KLIB_MODULE_PATH_LEN 0x100

Definition at line 31 of file aux_klib.h.

Typedef Documentation

◆ AUX_MODULE_BASIC_INFO

typedef struct _AUX_MODULE_BASIC_INFO AUX_MODULE_BASIC_INFO

◆ AUX_MODULE_EXTENDED_INFO

typedef struct _AUX_MODULE_EXTENDED_INFO AUX_MODULE_EXTENDED_INFO

◆ KBUGCHECK_DATA

typedef struct _KBUGCHECK_DATA KBUGCHECK_DATA

◆ PAUX_MODULE_BASIC_INFO

typedef struct _AUX_MODULE_BASIC_INFO * PAUX_MODULE_BASIC_INFO

◆ PAUX_MODULE_EXTENDED_INFO

typedef struct _AUX_MODULE_EXTENDED_INFO * PAUX_MODULE_EXTENDED_INFO

◆ PKBUGCHECK_DATA

typedef struct _KBUGCHECK_DATA * PKBUGCHECK_DATA

Function Documentation

◆ _IRQL_requires_max_()

_IRQL_requires_max_ ( PASSIVE_LEVEL )

Queries information details about a security descriptor.

Computes the quota size of a security descriptor.

Assigns a security descriptor for a new object.

An extended function that assigns a security descriptor for a new object.

Frees a security descriptor.

An extended function that sets new information data to a security descriptor.

Modifies some information data about a security descriptor.

Parameters

[in]	SecurityInformation	Security information details to be queried from a security descriptor.
[out]	SecurityDescriptor	The returned security descriptor with security information data.
[in,out]	Length	The returned length of a security descriptor.
[in,out]	ObjectsSecurityDescriptor	The returned object security descriptor.

Returns: Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns: See SeSetSecurityDescriptorInfoEx.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	AutoInheritFlags	Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns: Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.

Parameters

[in] SecurityDescriptor A security descriptor to be freed from memory.

Returns: Returns STATUS_SUCCESS.

Parameters

[in]	_ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	_ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	ObjectType	The type of the new object.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	AutoInheritFlags	Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns: Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.

Parameters

[in]	ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns: See SeAssignSecurityEx.

Parameters

[in]	SecurityDescriptor	A security descriptor.
[out]	QuotaInfoSize	The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.

Returns: Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.

Definition at line 923 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;
 
    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
 
        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);
 
        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;
 
        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);
 
            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;
 
            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }
 
    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }
 
    return Status;
}

◆ _Out_writes_bytes_to_opt_()

_Out_writes_bytes_to_opt_	(	BufferLength	,
		*	ReturnLength
	)

◆ AuxKlibGetBugCheckData()

NTSTATUS AuxKlibGetBugCheckData ( _Inout_ PKBUGCHECK_DATA BugCheckData )

Definition at line 178 of file aux_klib.c.

{
    if (BugCheckData->BugCheckDataSize != sizeof(*BugCheckData))
    {
        return STATUS_INFO_LENGTH_MISMATCH;
    }
 
    BugCheckData->BugCheckCode = KiBugCheckData[0];
    BugCheckData->Parameter1 = KiBugCheckData[1];
    BugCheckData->Parameter2 = KiBugCheckData[2];
    BugCheckData->Parameter3 = KiBugCheckData[3];
    BugCheckData->Parameter4 = KiBugCheckData[4];
 
    return STATUS_SUCCESS;
}

Referenced by FxpBugCheckCallbackFilter().

◆ AuxKlibGetImageExportDirectory()

PIMAGE_EXPORT_DIRECTORY AuxKlibGetImageExportDirectory ( _In_ PVOID ImageBase )

Definition at line 196 of file aux_klib.c.

{
    ULONG size;
    return RtlImageDirectoryEntryToData(ImageBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size);
}

◆ AuxKlibInitialize()

NTSTATUS NTAPI AuxKlibInitialize ( VOID )

Definition at line 26 of file aux_klib.c.

{
    RTL_OSVERSIONINFOW osVersion;
    UNICODE_STRING strRtlQueryModuleInformation = RTL_CONSTANT_STRING(L"RtlQueryModuleInformation");
 
    PAGED_CODE();
 
    if (!gKlibInitialized)
    {
        RtlGetVersion(&osVersion);
        if (osVersion.dwMajorVersion >= 5)
        {
            pfnRtlQueryModuleInformation = MmGetSystemRoutineAddress(&strRtlQueryModuleInformation);
            InterlockedExchange(&gKlibInitialized, 1);
        }
        else
        {
            return STATUS_NOT_SUPPORTED;
        }
    }
 
    return STATUS_SUCCESS;
}