185 if (
MAX(
Entry->SymbolicNameOffset +
Entry->SymbolicNameLength,
285 TmpBuffer, EndSize, &EndEntriesOffset,
NULL);
310 TmpBuffer, EndSize, &EndEntriesOffset,
NULL);
430 *UniqueId = IntUniqueId;
506 (
PVOID)((
ULONG_PTR)DatabaseEntry + DatabaseEntry->SymbolicNameOffset),
507 DatabaseEntry->SymbolicNameLength);
515 (
PVOID)((
ULONG_PTR)DatabaseEntry + DatabaseEntry->UniqueIdOffset),
516 DatabaseEntry->UniqueIdLength);
520 SymbolicString.
Length = DatabaseEntry->SymbolicNameLength;
521 SymbolicString.
MaximumLength = DatabaseEntry->SymbolicNameLength;
525 for (NextEntry = DeviceExtension->DeviceListHead.
Flink;
526 NextEntry != &(DeviceExtension->DeviceListHead);
527 NextEntry = NextEntry->
Flink)
540 DatabaseEntry->UniqueIdLength) == DatabaseEntry->UniqueIdLength)
547 if (NextEntry != &(DeviceExtension->DeviceListHead))
601 for (
Entry = DeviceExtension->DeviceListHead.Flink;
602 Entry != &DeviceExtension->DeviceListHead;
606 if (ListDeviceInfo == DeviceInformation)
613 if (
Entry == &DeviceExtension->DeviceListHead || DeviceInformation->
Removable)
638 FailedFinding =
FALSE;
641 for (
Entry = DeviceExtension->DeviceListHead.Flink;
642 Entry != &DeviceExtension->DeviceListHead;
651 NextEntry = EntryInfo->
Flink;
660 EntryInfo = NextEntry;
675 if (DatabaseHandle != 0)
707 if (DatabaseHandle != 0)
729 &ReparsePointInformation,
738 if (DatabaseHandle != 0)
750 if (DatabaseHandle == 0)
753 if (DatabaseHandle == 0)
767 if (DatabaseEntry ==
NULL)
799 &ReparsePointInformation,
814 ReparsePointInformation.
Tag == SavedReparsePointInformation.
Tag)
840 if (DatabaseEntry ==
NULL)
859 if (DatabaseEntry !=
NULL)
884 goto ReleaseDeviceLock;
892 goto ReleaseDeviceLock;
953 if (DatabaseEntry ==
NULL)
995 if (DatabaseEntry !=
NULL)
1029 FailedFinding =
TRUE;
1064 for (
Entry = DeviceExtension->DeviceListHead.Flink;
1065 Entry != &DeviceExtension->DeviceListHead;
1069 if (ListDeviceInfo == DeviceInformation)
1075 if (
Entry == &DeviceExtension->DeviceListHead)
1077 ListDeviceInfo =
NULL;
1086 if (DatabaseEntry ==
NULL)
1105 if (ListDeviceInfo !=
NULL)
1117 if (ListDeviceInfo !=
NULL && !FailedFinding)
1225 while (!
IsListEmpty(&(DeviceExtension->WorkerQueueListHead)))
1231 WorkerQueueListEntry);
1280 &(
WorkItem->WorkerQueueListEntry));
1340 if (!ReparseDataBuffer)
1474 if (DeviceInformation->Removable)
1481 ReparseFile.
MaximumLength = DeviceInformation->DeviceName.Length
1510 DeviceInformation->NoDatabase =
FALSE;
1527 &ReparsePointInformation,
1554 &ReparsePointInformation,
1563 ReparsePointInformation.
Tag == SavedReparsePointInformation.
Tag)
1580 &ReparsePointInformation,
1592 FALSE, &VolumeDeviceInformation);
1595 DeviceInformation->NoDatabase =
TRUE;
1600 if (!DeviceInformation->SkipNotifications)
1619 if (DeviceInformation->Removable)
1640 WorkItem->DeviceExtension = DeviceExtension;
1641 WorkItem->DeviceInformation = DeviceInformation;
1647 if (DeviceExtension->WorkerThreadStatus == 0 &&
1648 DeviceExtension->AutomaticDriveLetter == 1 &&
1649 DeviceExtension->NoAutoMount ==
FALSE)
1665 for (NextEntry = DeviceExtension->DeviceListHead.
Flink;
1666 NextEntry != &(DeviceExtension->DeviceListHead);
1667 NextEntry = NextEntry->
Flink)
1700 DeviceInformation =
WorkItem->DeviceInformation;
1755 DPRINT1(
"Attempt to exploit CVE-2015-1769. See CORE-10216\n");
1809 WorkItem->DeviceInformation = DeviceInformation;
1850 DeviceRemoteDatabase.
Length = 0;
1851 DeviceRemoteDatabase.
MaximumLength = DeviceInformation->DeviceName.Length
1855 if (!DeviceRemoteDatabase.
Buffer)
1866 &DeviceRemoteDatabase,
1892 DPRINT1(
"Attempt to exploit CVE-2015-1769. See CORE-10216\n");
1937 if (
Entry->UniqueIdLength != OldUniqueId->UniqueIdLength)
1947 Entry->UniqueIdLength) !=
Entry->UniqueIdLength)
1955 NewEntry =
AllocatePool(
Entry->EntrySize + NewUniqueId->UniqueIdLength - OldUniqueId->UniqueIdLength);
1964 NewEntry->
EntrySize =
Entry->EntrySize + NewUniqueId->UniqueIdLength - OldUniqueId->UniqueIdLength;
#define FILE_GENERIC_READ
VOID OnlineMountedVolumes(IN PDEVICE_EXTENSION DeviceExtension, IN PDEVICE_INFORMATION DeviceInformation)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
_In_ PCWSTR _Inout_ _At_ QueryTable _Pre_unknown_ PRTL_QUERY_REGISTRY_TABLE QueryTable
NTSTATUS NTAPI QueryUniqueIdQueryRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ PFILE_OBJECT _In_ ULONG _In_ BOOLEAN _In_ ULONG _In_opt_ PULONG _In_ BOOLEAN RestartScan
_In_ PFCB _In_ LONGLONG StartingOffset
NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID)
#define OBJ_CASE_INSENSITIVE
VOID DeleteFromLocalDatabase(IN PUNICODE_STRING SymbolicLink, IN PMOUNTDEV_UNIQUE_ID UniqueId)
VOID ReleaseRemoteDatabaseSemaphore(IN PDEVICE_EXTENSION DeviceExtension)
#define UNREFERENCED_PARAMETER(P)
#define STATUS_INVALID_PARAMETER
#define FILE_ATTRIBUTE_SYSTEM
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
_In_ PNDIS_STRING _In_ PNDIS_STRING SymbolicName
BOOLEAN IsUniqueIdPresent(IN PDEVICE_EXTENSION DeviceExtension, IN PDATABASE_ENTRY DatabaseEntry)
HANDLE OpenRemoteDatabase(IN PDEVICE_INFORMATION DeviceInformation, IN BOOLEAN MigrateDatabase)
BOOLEAN IsDriveLetter(PUNICODE_STRING SymbolicName)
VOID NTAPI KeAcquireSpinLock(PKSPIN_LOCK SpinLock, PKIRQL OldIrql)
IN PVOID IN PVOID IN USHORT IN USHORT Size
#define DO_UNLOAD_PENDING
NTSTATUS QueryUniqueIdFromMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName, OUT PMOUNTDEV_UNIQUE_ID *UniqueId)
NTSYSCALLAPI NTSTATUS NTAPI ZwOpenEvent(_Out_ PHANDLE EventHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSTATUS NTAPI IoGetDeviceObjectPointer(IN PUNICODE_STRING ObjectName, IN ACCESS_MASK DesiredAccess, OUT PFILE_OBJECT *FileObject, OUT PDEVICE_OBJECT *DeviceObject)
UNICODE_STRING SafeVolumes
VOID DeleteRegistryDriveLetter(IN PMOUNTDEV_UNIQUE_ID UniqueId)
#define FSCTL_GET_REPARSE_POINT
#define InsertTailList(ListHead, Entry)
USHORT SymbolicNameLength
NTSTATUS MountMgrCreatePointWorker(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicLinkName, IN PUNICODE_STRING DeviceName)
PIO_WORKITEM NTAPI IoAllocateWorkItem(IN PDEVICE_OBJECT DeviceObject)
LONG NTAPI KeSetEvent(IN PKEVENT Event, IN KPRIORITY Increment, IN BOOLEAN Wait)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG _Out_opt_ PULONG _Out_opt_ PULONG ValueType
NTSTATUS NTAPI KeWaitForSingleObject(IN PVOID Object, IN KWAIT_REASON WaitReason, IN KPROCESSOR_MODE WaitMode, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL)
#define OBJ_KERNEL_HANDLE
VOID NTAPI IoFreeWorkItem(IN PIO_WORKITEM IoWorkItem)
_Must_inspect_result_ FORCEINLINE BOOLEAN IsListEmpty(_In_ const LIST_ENTRY *ListHead)
#define FILE_WRITE_ATTRIBUTES
#define STATUS_STOPPED_ON_SYMLINK
#define FILE_OPEN_BY_FILE_ID
#define STATUS_BUFFER_TOO_SMALL
#define IO_STOP_ON_SYMLINK
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
#define IO_REPARSE_TAG_MOUNT_POINT
UNICODE_STRING RemoteDatabase
_In_ PDEVICE_OBJECT DeviceObject
#define FILE_SYNCHRONOUS_IO_ALERT
PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
VOID DeleteNoDriveLetterEntry(IN PMOUNTDEV_UNIQUE_ID UniqueId)
NTSYSAPI NTSTATUS WINAPI RtlWriteRegistryValue(ULONG, PCWSTR, PCWSTR, ULONG, PVOID, ULONG)
#define IO_NO_PARAMETER_CHECKING
#define MOUNTMGR_IS_VOLUME_NAME(s)
_In_ PVOID _In_ ULONG Event
NTSYSAPI NTSTATUS NTAPI ZwFsControlFile(IN HANDLE DeviceHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer, IN ULONG InputBufferSize, OUT PVOID OutputBuffer, IN ULONG OutputBufferSize)
_In_ PCWSTR _Inout_ _At_ QueryTable EntryContext
VOID ChangeRemoteDatabaseUniqueId(IN PDEVICE_INFORMATION DeviceInformation, IN PMOUNTDEV_UNIQUE_ID OldUniqueId, IN PMOUNTDEV_UNIQUE_ID NewUniqueId)
VOID NTAPI WorkerThread(IN PDEVICE_OBJECT DeviceObject, IN PVOID Context)
FORCEINLINE PLIST_ENTRY RemoveHeadList(_Inout_ PLIST_ENTRY ListHead)
NTSTATUS FindDeviceInfo(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName, IN BOOLEAN DeviceNameGiven, OUT PDEVICE_INFORMATION *DeviceInformation)
UNICODE_STRING ReparseIndex
#define InterlockedExchangeAdd
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
struct _DATABASE_ENTRY DATABASE_ENTRY
struct _LIST_ENTRY * Flink
_In_ KPROCESSOR_MODE PreviousMode
NTSTATUS CreateRemoteDatabase(IN PDEVICE_INFORMATION DeviceInformation, IN OUT PHANDLE Database)
LONG GetRemoteDatabaseSize(IN HANDLE Database)
NTSTATUS WaitForRemoteDatabaseSemaphore(IN PDEVICE_EXTENSION DeviceExtension)
NTSTATUS NTAPI RtlCreateSystemVolumeInformationFolder(IN PUNICODE_STRING VolumeRootPath)
#define NT_SUCCESS(StatCode)
struct _RECONCILE_WORK_ITEM_CONTEXT * PRECONCILE_WORK_ITEM_CONTEXT
#define ObDereferenceObject
NTSTATUS WriteUniqueIdToMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PDATABASE_ENTRY DatabaseEntry)
_In_ GUID _In_ PVOID ValueData
USHORT SymbolicNameOffset
#define FILE_READ_ATTRIBUTES
NTSTATUS NTAPI DeleteNoDriveLetterEntryRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
NTSTATUS AddRemoteDatabaseEntry(IN HANDLE Database, IN PDATABASE_ENTRY Entry)
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
VOID NTAPI CreateRemoteDatabaseWorker(IN PDEVICE_OBJECT DeviceObject, IN PVOID Context)
_In_ WDFDEVICE AssociatedDevice
#define FILE_ATTRIBUTE_NORMAL
#define FILE_SHARE_DELETE
#define InterlockedDecrement
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
NTSYSAPI NTSTATUS WINAPI RtlDeleteRegistryValue(ULONG, PCWSTR, PCWSTR)
NTSTATUS TruncateRemoteDatabase(IN HANDLE Database, IN LONG NewSize)
BOOLEAN NTAPI IoSetThreadHardErrorMode(IN BOOLEAN HardErrorEnabled)
#define FILE_NON_DIRECTORY_FILE
_Must_inspect_result_ _In_ USHORT NewSize
static const WCHAR Cleanup[]
#define RTL_REGISTRY_ABSOLUTE
#define AllocatePool(Size)
#define InterlockedExchange
VOID ReconcileThisDatabaseWithMaster(IN PDEVICE_EXTENSION DeviceExtension, IN PDEVICE_INFORMATION DeviceInformation)
NTSTATUS DeleteRemoteDatabaseEntry(IN HANDLE Database, IN LONG StartingOffset)
VOID PostOnlineNotification(IN PDEVICE_EXTENSION DeviceExtension, IN PUNICODE_STRING SymbolicName)
_In_ ULONG _In_ ULONG Offset
VOID NTAPI IoQueueWorkItem(IN PIO_WORKITEM IoWorkItem, IN PIO_WORKITEM_ROUTINE WorkerRoutine, IN WORK_QUEUE_TYPE QueueType, IN PVOID Context)
NTSTATUS CloseRemoteDatabase(IN HANDLE Database)
struct _FileName FileName
NTSTATUS QueueWorkItem(IN PDEVICE_EXTENSION DeviceExtension, IN PRECONCILE_WORK_ITEM WorkItem, IN PVOID Context)
#define KeInitializeEvent(pEvt, foo, foo2)
#define InterlockedIncrement
#define STATUS_BUFFER_OVERFLOW
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS QueryVolumeName(IN HANDLE RootDirectory, IN PFILE_REPARSE_POINT_INFORMATION ReparsePointInformation, IN PUNICODE_STRING FileName OPTIONAL, OUT PUNICODE_STRING SymbolicName, OUT PUNICODE_STRING VolumeName)
LONG NTAPI KeReleaseSemaphore(IN PKSEMAPHORE Semaphore, IN KPRIORITY Increment, IN LONG Adjustment, IN BOOLEAN Wait)
PDATABASE_ENTRY GetRemoteDatabaseEntry(IN HANDLE Database, IN LONG StartingOffset)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
static OUT PIO_STATUS_BLOCK IoStatusBlock
struct _REPARSE_DATA_BUFFER::@304::@307 MountPointReparseBuffer
VOID ReconcileAllDatabasesWithMaster(IN PDEVICE_EXTENSION DeviceExtension)
#define FILE_ATTRIBUTE_HIDDEN
VOID UpdateReplicatedUniqueIds(IN PDEVICE_INFORMATION DeviceInformation, IN PDATABASE_ENTRY DatabaseEntry)
#define KeReleaseSpinLock(sl, irql)
#define STATUS_IO_TIMEOUT
#define FileStandardInformation
NTSTATUS NTAPI IoCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options)
VOID NTAPI ReconcileThisDatabaseWithMasterWorker(IN PVOID Parameter)
#define FILE_SYNCHRONOUS_IO_NONALERT
_Must_inspect_result_ _Inout_opt_ PUNICODE_STRING VolumeName
WCHAR FileNameBuffer[_MAX_PATH]
struct tagContext Context
NTSTATUS NTAPI DeleteDriveLetterRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
#define InitializeObjectAttributes(p, n, a, r, s)
#define RtlCopyMemory(Destination, Source, Length)
_Must_inspect_result_ _In_ PWDF_WORKITEM_CONFIG _In_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFWORKITEM * WorkItem
#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE
NTSTATUS WriteRemoteDatabaseEntry(IN HANDLE Database, IN LONG Offset, IN PDATABASE_ENTRY Entry)
#define FILE_OPEN_REPARSE_POINT
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
NTSTATUS NTAPI DeleteFromLocalDatabaseRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
base of all file and directory entries
static const WCHAR SymbolicLink[]
#define RtlCompareMemory(s1, s2, l)
IN PDCB IN PCCB IN VBO IN OUT PULONG OUT PDIRENT OUT PBCB OUT PVBO ByteOffset
#define RTL_CONSTANT_STRING(s)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
PULONG MinorVersion OPTIONAL