185 if (
MAX(
Entry->SymbolicNameOffset +
Entry->SymbolicNameLength,
285 TmpBuffer, EndSize, &EndEntriesOffset,
NULL);
310 TmpBuffer, EndSize, &EndEntriesOffset,
NULL);
430 *UniqueId = IntUniqueId;
506 (
PVOID)((
ULONG_PTR)DatabaseEntry + DatabaseEntry->SymbolicNameOffset),
507 DatabaseEntry->SymbolicNameLength);
515 (
PVOID)((
ULONG_PTR)DatabaseEntry + DatabaseEntry->UniqueIdOffset),
516 DatabaseEntry->UniqueIdLength);
520 SymbolicString.
Length = DatabaseEntry->SymbolicNameLength;
521 SymbolicString.
MaximumLength = DatabaseEntry->SymbolicNameLength;
525 for (NextEntry = DeviceExtension->DeviceListHead.
Flink;
526 NextEntry != &(DeviceExtension->DeviceListHead);
527 NextEntry = NextEntry->
Flink)
540 DatabaseEntry->UniqueIdLength) == DatabaseEntry->UniqueIdLength)
547 if (NextEntry != &(DeviceExtension->DeviceListHead))
601 for (
Entry = DeviceExtension->DeviceListHead.Flink;
602 Entry != &DeviceExtension->DeviceListHead;
606 if (ListDeviceInfo == DeviceInformation)
613 if (
Entry == &DeviceExtension->DeviceListHead || DeviceInformation->
Removable)
638 FailedFinding =
FALSE;
641 for (
Entry = DeviceExtension->DeviceListHead.Flink;
642 Entry != &DeviceExtension->DeviceListHead;
651 NextEntry = EntryInfo->
Flink;
660 EntryInfo = NextEntry;
675 if (DatabaseHandle != 0)
707 if (DatabaseHandle != 0)
729 &ReparsePointInformation,
738 if (DatabaseHandle != 0)
750 if (DatabaseHandle == 0)
753 if (DatabaseHandle == 0)
767 if (DatabaseEntry ==
NULL)
799 &ReparsePointInformation,
814 ReparsePointInformation.
Tag == SavedReparsePointInformation.
Tag)
840 if (DatabaseEntry ==
NULL)
859 if (DatabaseEntry !=
NULL)
884 goto ReleaseDeviceLock;
892 goto ReleaseDeviceLock;
953 if (DatabaseEntry ==
NULL)
995 if (DatabaseEntry !=
NULL)
1029 FailedFinding =
TRUE;
1064 for (
Entry = DeviceExtension->DeviceListHead.Flink;
1065 Entry != &DeviceExtension->DeviceListHead;
1069 if (ListDeviceInfo == DeviceInformation)
1075 if (
Entry == &DeviceExtension->DeviceListHead)
1077 ListDeviceInfo =
NULL;
1086 if (DatabaseEntry ==
NULL)
1105 if (ListDeviceInfo !=
NULL)
1117 if (ListDeviceInfo !=
NULL && !FailedFinding)
1170 Timeout.QuadPart = -10000000LL;
1225 while (!
IsListEmpty(&(DeviceExtension->WorkerQueueListHead)))
1231 WorkerQueueListEntry);
1280 &(
WorkItem->WorkerQueueListEntry));
1340 if (!ReparseDataBuffer)
1474 if (DeviceInformation->Removable)
1481 ReparseFile.
MaximumLength = DeviceInformation->DeviceName.Length
1510 DeviceInformation->NoDatabase =
FALSE;
1527 &ReparsePointInformation,
1554 &ReparsePointInformation,
1563 ReparsePointInformation.
Tag == SavedReparsePointInformation.
Tag)
1580 &ReparsePointInformation,
1592 FALSE, &VolumeDeviceInformation);
1595 DeviceInformation->NoDatabase =
TRUE;
1600 if (!DeviceInformation->SkipNotifications)
1619 if (DeviceInformation->Removable)
1640 WorkItem->DeviceExtension = DeviceExtension;
1641 WorkItem->DeviceInformation = DeviceInformation;
1647 if (DeviceExtension->WorkerThreadStatus == 0 &&
1648 DeviceExtension->AutomaticDriveLetter &&
1649 DeviceExtension->NoAutoMount)
1665 for (NextEntry = DeviceExtension->DeviceListHead.
Flink;
1666 NextEntry != &(DeviceExtension->DeviceListHead);
1667 NextEntry = NextEntry->
Flink)
1700 DeviceInformation =
WorkItem->DeviceInformation;
1755 DPRINT1(
"Attempt to exploit CVE-2015-1769. See CORE-10216\n");
1809 WorkItem->DeviceInformation = DeviceInformation;
1850 DeviceRemoteDatabase.
Length = 0;
1851 DeviceRemoteDatabase.
MaximumLength = DeviceInformation->DeviceName.Length
1855 if (!DeviceRemoteDatabase.
Buffer)
1866 &DeviceRemoteDatabase,
1892 DPRINT1(
"Attempt to exploit CVE-2015-1769. See CORE-10216\n");
1937 if (
Entry->UniqueIdLength != OldUniqueId->UniqueIdLength)
1947 Entry->UniqueIdLength) !=
Entry->UniqueIdLength)
1955 NewEntry =
AllocatePool(
Entry->EntrySize + NewUniqueId->UniqueIdLength - OldUniqueId->UniqueIdLength);
1964 NewEntry->
EntrySize =
Entry->EntrySize + NewUniqueId->UniqueIdLength - OldUniqueId->UniqueIdLength;
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
#define InterlockedIncrement
#define InterlockedExchange
#define InterlockedDecrement
#define FILE_NON_DIRECTORY_FILE
WCHAR FileNameBuffer[MAX_PATH]
_In_ PFCB _In_ LONGLONG StartingOffset
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
#define FILE_ATTRIBUTE_NORMAL
static const WCHAR SymbolicLink[]
static const WCHAR Cleanup[]
NTSTATUS CloseRemoteDatabase(IN HANDLE Database)
VOID OnlineMountedVolumes(IN PDEVICE_EXTENSION DeviceExtension, IN PDEVICE_INFORMATION DeviceInformation)
NTSTATUS QueryUniqueIdFromMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName, OUT PMOUNTDEV_UNIQUE_ID *UniqueId)
NTSTATUS NTAPI DeleteFromLocalDatabaseRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
NTSTATUS DeleteRemoteDatabaseEntry(IN HANDLE Database, IN LONG StartingOffset)
NTSTATUS TruncateRemoteDatabase(IN HANDLE Database, IN LONG NewSize)
NTSTATUS WaitForRemoteDatabaseSemaphore(IN PDEVICE_EXTENSION DeviceExtension)
VOID ReconcileThisDatabaseWithMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PDEVICE_INFORMATION DeviceInformation)
VOID DeleteRegistryDriveLetter(IN PMOUNTDEV_UNIQUE_ID UniqueId)
VOID NTAPI WorkerThread(IN PDEVICE_OBJECT DeviceObject, IN PVOID Context)
VOID NTAPI ReconcileThisDatabaseWithMasterWorker(IN PVOID Parameter)
NTSTATUS CreateRemoteDatabase(IN PDEVICE_INFORMATION DeviceInformation, IN OUT PHANDLE Database)
VOID DeleteNoDriveLetterEntry(IN PMOUNTDEV_UNIQUE_ID UniqueId)
VOID ReleaseRemoteDatabaseSemaphore(IN PDEVICE_EXTENSION DeviceExtension)
NTSTATUS AddRemoteDatabaseEntry(IN HANDLE Database, IN PDATABASE_ENTRY Entry)
NTSTATUS WriteUniqueIdToMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PDATABASE_ENTRY DatabaseEntry)
VOID NTAPI CreateRemoteDatabaseWorker(IN PDEVICE_OBJECT DeviceObject, IN PVOID Context)
NTSTATUS WriteRemoteDatabaseEntry(IN HANDLE Database, IN LONG Offset, IN PDATABASE_ENTRY Entry)
VOID ReconcileAllDatabasesWithMaster(IN PDEVICE_EXTENSION DeviceExtension)
HANDLE OpenRemoteDatabase(IN PDEVICE_INFORMATION DeviceInformation, IN BOOLEAN MigrateDatabase)
LONG GetRemoteDatabaseSize(IN HANDLE Database)
PDATABASE_ENTRY GetRemoteDatabaseEntry(IN HANDLE Database, IN LONG StartingOffset)
NTSTATUS NTAPI DeleteDriveLetterRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
VOID ChangeRemoteDatabaseUniqueId(IN PDEVICE_INFORMATION DeviceInformation, IN PMOUNTDEV_UNIQUE_ID OldUniqueId, IN PMOUNTDEV_UNIQUE_ID NewUniqueId)
VOID DeleteFromLocalDatabase(IN PUNICODE_STRING SymbolicLink, IN PMOUNTDEV_UNIQUE_ID UniqueId)
NTSTATUS NTAPI DeleteNoDriveLetterEntryRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
NTSTATUS QueueWorkItem(IN PDEVICE_EXTENSION DeviceExtension, IN PRECONCILE_WORK_ITEM WorkItem, IN PVOID Context)
NTSTATUS NTAPI QueryUniqueIdQueryRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
UNICODE_STRING RemoteDatabase
NTSTATUS QueryVolumeName(IN HANDLE RootDirectory, IN PFILE_REPARSE_POINT_INFORMATION ReparsePointInformation, IN PUNICODE_STRING FileName OPTIONAL, OUT PUNICODE_STRING SymbolicName, OUT PUNICODE_STRING VolumeName)
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define IsListEmpty(ListHead)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define RtlCompareMemory(s1, s2, l)
#define KeInitializeEvent(pEvt, foo, foo2)
#define KeReleaseSpinLock(sl, irql)
#define KeSetEvent(pEvt, foo, foo2)
#define KeAcquireSpinLock(sl, irql)
#define DO_UNLOAD_PENDING
#define RemoveHeadList(ListHead)
IN PDCB IN PCCB IN VBO IN OUT PULONG OUT PDIRENT OUT PBCB OUT PVBO ByteOffset
struct _FileName FileName
_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING VolumeName
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG _In_ BOOLEAN RestartScan
_Must_inspect_result_ _In_ USHORT NewSize
#define FILE_OPEN_BY_FILE_ID
@ FileEndOfFileInformation
@ FileReparsePointInformation
@ FileAllocationInformation
#define FILE_OPEN_REPARSE_POINT
#define FILE_SYNCHRONOUS_IO_NONALERT
#define FILE_SYNCHRONOUS_IO_ALERT
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
_In_ GUID _In_ PVOID ValueData
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
NTSYSAPI NTSTATUS WINAPI RtlDeleteRegistryValue(ULONG, PCWSTR, PCWSTR)
NTSYSAPI NTSTATUS WINAPI RtlWriteRegistryValue(ULONG, PCWSTR, PCWSTR, ULONG, PVOID, ULONG)
NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID)
#define InterlockedExchangeAdd
VOID NTAPI IoQueueWorkItem(IN PIO_WORKITEM IoWorkItem, IN PIO_WORKITEM_ROUTINE WorkerRoutine, IN WORK_QUEUE_TYPE QueueType, IN PVOID Context)
VOID NTAPI IoFreeWorkItem(IN PIO_WORKITEM IoWorkItem)
PIO_WORKITEM NTAPI IoAllocateWorkItem(IN PDEVICE_OBJECT DeviceObject)
struct _RECONCILE_WORK_ITEM_CONTEXT * PRECONCILE_WORK_ITEM_CONTEXT
UNICODE_STRING SafeVolumes
UNICODE_STRING ReparseIndex
struct _DATABASE_ENTRY DATABASE_ENTRY
NTSTATUS FindDeviceInfo(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName, IN BOOLEAN DeviceNameGiven, OUT PDEVICE_INFORMATION *DeviceInformation)
NTSTATUS MountMgrCreatePointWorker(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicLinkName, IN PUNICODE_STRING DeviceName)
VOID PostOnlineNotification(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName)
BOOLEAN IsDriveLetter(PUNICODE_STRING SymbolicName)
VOID UpdateReplicatedUniqueIds(IN PDEVICE_INFORMATION DeviceInformation, IN PDATABASE_ENTRY DatabaseEntry)
BOOLEAN IsUniqueIdPresent(IN PDEVICE_EXTENSION DeviceExtension, IN PDATABASE_ENTRY DatabaseEntry)
#define AllocatePool(Size)
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
#define MOUNTMGR_IS_VOLUME_NAME(s)
_In_ PNDIS_STRING _In_ PNDIS_STRING SymbolicName
NTSYSCALLAPI NTSTATUS NTAPI ZwOpenEvent(_Out_ PHANDLE EventHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
_In_ PCWSTR _Inout_ _At_ QueryTable EntryContext
_In_ PCWSTR _Inout_ _At_ QueryTable _Pre_unknown_ PRTL_QUERY_REGISTRY_TABLE QueryTable
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define FILE_READ_ATTRIBUTES
#define FILE_ATTRIBUTE_HIDDEN
#define FILE_ATTRIBUTE_SYSTEM
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define RTL_REGISTRY_ABSOLUTE
#define FILE_SHARE_DELETE
#define FILE_WRITE_ATTRIBUTES
#define FILE_GENERIC_READ
#define UNREFERENCED_PARAMETER(P)
_In_ ULONG _In_ ULONG Offset
NTSYSAPI NTSTATUS NTAPI ZwFsControlFile(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferSize, OUT PVOID OutputBuffer, IN ULONG OutputBufferSize)
NTSTATUS NTAPI IoGetDeviceObjectPointer(IN PUNICODE_STRING ObjectName, IN ACCESS_MASK DesiredAccess, OUT PFILE_OBJECT *FileObject, OUT PDEVICE_OBJECT *DeviceObject)
BOOLEAN NTAPI IoSetThreadHardErrorMode(IN BOOLEAN HardErrorEnabled)
NTSTATUS NTAPI IoCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options)
#define STATUS_STOPPED_ON_SYMLINK
#define FSCTL_GET_REPARSE_POINT
LONG NTAPI KeReleaseSemaphore(IN PKSEMAPHORE Semaphore, IN KPRIORITY Increment, IN LONG Adjustment, IN BOOLEAN Wait)
#define FileStandardInformation
#define STATUS_BUFFER_TOO_SMALL
#define STATUS_BUFFER_OVERFLOW
PULONG MinorVersion OPTIONAL
base of all file and directory entries
USHORT SymbolicNameLength
USHORT SymbolicNameOffset
struct _LIST_ENTRY * Flink
struct _REPARSE_DATA_BUFFER::@314::@317 MountPointReparseBuffer
PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine
NTSTATUS NTAPI RtlCreateSystemVolumeInformationFolder(IN PUNICODE_STRING VolumeRootPath)
#define RTL_CONSTANT_STRING(s)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_INVALID_PARAMETER
#define STATUS_IO_TIMEOUT
#define STATUS_INSUFFICIENT_RESOURCES
_In_ PDEVICE_OBJECT DeviceObject
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_In_ WDFDEVICE AssociatedDevice
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG _Out_opt_ PULONG _Out_opt_ PULONG ValueType
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
_Must_inspect_result_ _In_ PWDF_WORKITEM_CONFIG _In_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFWORKITEM * WorkItem
#define IO_NO_PARAMETER_CHECKING
#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE
#define IO_STOP_ON_SYMLINK
#define IO_REPARSE_TAG_MOUNT_POINT
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
#define ObDereferenceObject
_Inout_opt_ PVOID Parameter