sysfunc.c File Reference

#include <advapi32.h>
#include <ntsecapi.h>
#include <ksecioctl.h>
#include <md4.h>
#include <md5.h>
#include <rc4.h>

Include dependency graph for sysfunc.c:

Go to the source code of this file.

Functions
NTSTATUS WINAPI	SystemFunction001 (const BYTE *data, const BYTE *key, LPBYTE output)
NTSTATUS WINAPI	SystemFunction002 (const BYTE *data, const BYTE *key, LPBYTE output)
NTSTATUS WINAPI	SystemFunction003 (const BYTE *key, LPBYTE output)
NTSTATUS WINAPI	SystemFunction004 (const struct ustring *in, const struct ustring *key, struct ustring *out)
NTSTATUS WINAPI	SystemFunction005 (const struct ustring *in, const struct ustring *key, struct ustring *out)
NTSTATUS WINAPI	SystemFunction007 (const UNICODE_STRING *string, LPBYTE hash)
NTSTATUS WINAPI	SystemFunction008 (const BYTE *challenge, const BYTE *hash, LPBYTE response)
NTSTATUS WINAPI	SystemFunction009 (const BYTE *challenge, const BYTE *hash, LPBYTE response)
NTSTATUS WINAPI	SystemFunction010 (LPVOID unknown, const BYTE *data, LPBYTE hash)
NTSTATUS WINAPI	SystemFunction012 (const BYTE *in, const BYTE *key, LPBYTE out)
NTSTATUS WINAPI	SystemFunction013 (const BYTE *in, const BYTE *key, LPBYTE out)
NTSTATUS WINAPI	SystemFunction024 (const BYTE *in, const BYTE *key, LPBYTE out)
NTSTATUS WINAPI	SystemFunction025 (const BYTE *in, const BYTE *key, LPBYTE out)
NTSTATUS WINAPI	SystemFunction028 (_In_ PVOID ContextHandle, _Out_ LPBYTE SessionKey)
INT WINAPI	SystemFunction029 (INT a, INT b)
BOOL WINAPI	SystemFunction030 (LPCVOID b1, LPCVOID b2)
NTSTATUS WINAPI	SystemFunction032 (struct ustring *data, const struct ustring *key)
INT WINAPI	SystemFunction033 (INT a, INT b)
INT WINAPI	SystemFunction034 (INT a, INT b)
BOOL WINAPI	SystemFunction035 (LPCSTR lpszDllFilePath)
BOOLEAN WINAPI	SystemFunction036 (PVOID pbBuffer, ULONG dwLen)
static NTSTATUS	KsecOpenDevice ()
VOID	CloseKsecDdHandle (VOID)
static NTSTATUS	KsecDeviceIoControl (ULONG IoControlCode, PVOID InputBuffer, SIZE_T InputBufferLength, PVOID OutputBuffer, SIZE_T OutputBufferLength)
NTSTATUS WINAPI	SystemFunction040 (_Inout_ PVOID Memory, _In_ ULONG MemoryLength, _In_ ULONG OptionFlags)
NTSTATUS WINAPI	SystemFunction041 (_Inout_ PVOID Memory, _In_ ULONG MemoryLength, _In_ ULONG OptionFlags)

Variables
static const unsigned char	CRYPT_LMhash_Magic [8]
static const unsigned char	DefaultSessionKey [16]
HANDLE	KsecDeviceHandle

Function Documentation

CloseKsecDdHandle()

VOID CloseKsecDdHandle

(

VOID

)

Definition at line 682 of file sysfunc.c.

{
    /* Check if we already opened a handle to ksecdd */
    if (KsecDeviceHandle != NULL)
    {
        /* Close it */
        CloseHandle(KsecDeviceHandle);
        KsecDeviceHandle = NULL;
    }
}

Referenced by DllMain().

KsecDeviceIoControl()

static NTSTATUS KsecDeviceIoControl ( ULONG  IoControlCode, PVOID  InputBuffer, SIZE_T  InputBufferLength, PVOID  OutputBuffer, SIZE_T  OutputBufferLength  )

static

Definition at line 695 of file sysfunc.c.

{
    IO_STATUS_BLOCK IoStatusBlock;
    NTSTATUS Status;
 
    /* Check if we already have a handle */
    if (KsecDeviceHandle == NULL)
    {
        /* Try to open the device */
        Status = KsecOpenDevice();
        if (!NT_SUCCESS(Status))
        {
            //ERR("Failed to open handle to KsecDd driver!\n");
            return Status;
        }
    }
 
    /* Call the driver */
    Status = NtDeviceIoControlFile(KsecDeviceHandle,
                                   NULL,
                                   NULL,
                                   NULL,
                                   &IoStatusBlock,
                                   IoControlCode,
                                   InputBuffer,
                                   InputBufferLength,
                                   OutputBuffer,
                                   OutputBufferLength);
 
    return Status;
}

Referenced by SystemFunction040(), and SystemFunction041().

KsecOpenDevice()

static NTSTATUS KsecOpenDevice ( )

static

Definition at line 649 of file sysfunc.c.

{
    UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(L"\\Device\\KsecDD");
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    HANDLE DeviceHandle;
    NTSTATUS Status;
 
    InitializeObjectAttributes(&ObjectAttributes,
                               &DeviceName,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
    Status = NtOpenFile(&DeviceHandle,
                        FILE_READ_DATA | SYNCHRONIZE,
                        &ObjectAttributes,
                        &IoStatusBlock,
                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
                        FILE_SYNCHRONOUS_IO_NONALERT);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    if (InterlockedCompareExchangePointer(&KsecDeviceHandle, DeviceHandle, NULL) != NULL)
    {
        NtClose(DeviceHandle);
    }
 
    return STATUS_SUCCESS;
}

Referenced by KsecDeviceIoControl().

SystemFunction001()

NTSTATUS WINAPI SystemFunction001	(	const BYTE *	data,
		const BYTE *	key,
		LPBYTE	output
	)

Definition at line 41 of file sysfunc.c.

{
    if (!data || !output)
        return STATUS_UNSUCCESSFUL;
    CRYPT_DEShash(output, key, data);
    return STATUS_SUCCESS;
}

SystemFunction002()

NTSTATUS WINAPI SystemFunction002	(	const BYTE *	data,
		const BYTE *	key,
		LPBYTE	output
	)

Definition at line 66 of file sysfunc.c.

{
    if (!data || !output)
        return STATUS_UNSUCCESSFUL;
    CRYPT_DESunhash(output, key, data);
    return STATUS_SUCCESS;
}

SystemFunction003()

NTSTATUS WINAPI SystemFunction003	(	const BYTE *	key,
		LPBYTE	output
	)

Definition at line 90 of file sysfunc.c.

{
    if (!output)
        return STATUS_UNSUCCESSFUL;
    CRYPT_DEShash(output, key, CRYPT_LMhash_Magic);
    return STATUS_SUCCESS;
}

SystemFunction004()

NTSTATUS WINAPI SystemFunction004	(	const struct ustring *	in,
		const struct ustring *	key,
		struct ustring *	out
	)

Definition at line 119 of file sysfunc.c.

{
    union {
        unsigned char uc[8];
          unsigned int  ui[2];
    } data;
    unsigned char deskey[7];
    unsigned int crypt_len, ofs;
 
    if (key->Length<=0)
        return STATUS_INVALID_PARAMETER_2;
 
    crypt_len = ((in->Length+7)&~7);
    if (out->MaximumLength < (crypt_len+8))
    {
        out->Length = crypt_len + 8;
        return STATUS_BUFFER_TOO_SMALL;
    }
 
    data.ui[0] = in->Length;
    data.ui[1] = 1;
 
    if (key->Length<sizeof deskey)
    {
        memset(deskey, 0, sizeof deskey);
        memcpy(deskey, key->Buffer, key->Length);
    }
    else
        memcpy(deskey, key->Buffer, sizeof deskey);
 
    CRYPT_DEShash(out->Buffer, deskey, data.uc);
 
    for(ofs=0; ofs<(crypt_len-8); ofs+=8)
        CRYPT_DEShash(out->Buffer+8+ofs, deskey, in->Buffer+ofs);
 
    memset(data.uc, 0, sizeof data.uc);
    memcpy(data.uc, in->Buffer+ofs, in->Length +8-crypt_len);
    CRYPT_DEShash(out->Buffer+8+ofs, deskey, data.uc);
 
    out->Length = crypt_len+8;
 
    return STATUS_SUCCESS;
}

SystemFunction005()

NTSTATUS WINAPI SystemFunction005	(	const struct ustring *	in,
		const struct ustring *	key,
		struct ustring *	out
	)

Definition at line 182 of file sysfunc.c.

{
    union {
        unsigned char uc[8];
        unsigned int  ui[2];
    } data;
    unsigned char deskey[7];
    unsigned int ofs, crypt_len;
 
    if (key->Length<=0)
        return STATUS_INVALID_PARAMETER_2;
 
    if (key->Length<sizeof deskey)
    {
        memset(deskey, 0, sizeof deskey);
        memcpy(deskey, key->Buffer, key->Length);
    }
    else
        memcpy(deskey, key->Buffer, sizeof deskey);
 
    CRYPT_DESunhash(data.uc, deskey, in->Buffer);
 
    if (data.ui[1] != 1)
        return STATUS_UNKNOWN_REVISION;
 
    crypt_len = data.ui[0];
    if (crypt_len > out->MaximumLength)
    {
        out->Length = crypt_len;
        return STATUS_BUFFER_TOO_SMALL;
    }
 
    for (ofs=0; (ofs+8)<crypt_len; ofs+=8)
        CRYPT_DESunhash(out->Buffer+ofs, deskey, in->Buffer+ofs+8);
 
    if (ofs<crypt_len)
    {
        CRYPT_DESunhash(data.uc, deskey, in->Buffer+ofs+8);
        memcpy(out->Buffer+ofs, data.uc, crypt_len-ofs);
    }
 
    out->Length = crypt_len;
 
    return STATUS_SUCCESS;
}

SystemFunction007()

NTSTATUS WINAPI SystemFunction007	(	const UNICODE_STRING *	string,
		LPBYTE	hash
	)

Definition at line 245 of file sysfunc.c.

{
    MD4_CTX ctx;
 
    MD4Init( &ctx );
    MD4Update( &ctx, (const BYTE *)string->Buffer, string->Length );
    MD4Final( &ctx );
    memcpy( hash, ctx.digest, 0x10 );
 
    return STATUS_SUCCESS;
}

Referenced by MsvpChangePassword(), MsvpCheckPassword(), and SampInitHashes().

SystemFunction008()

NTSTATUS WINAPI SystemFunction008	(	const BYTE *	challenge,
		const BYTE *	hash,
		LPBYTE	response
	)

Definition at line 276 of file sysfunc.c.

{
    BYTE key[7*3];
 
    if (!challenge || !response)
        return STATUS_UNSUCCESSFUL;
 
    memset(key, 0, sizeof key);
    memcpy(key, hash, 0x10);
 
    CRYPT_DEShash(response, key, challenge);
    CRYPT_DEShash(response+8, key+7, challenge);
    CRYPT_DEShash(response+16, key+14, challenge);
 
    return STATUS_SUCCESS;
}

Referenced by SystemFunction009().

SystemFunction009()

NTSTATUS WINAPI SystemFunction009	(	const BYTE *	challenge,
		const BYTE *	hash,
		LPBYTE	response
	)

Definition at line 299 of file sysfunc.c.

{
    return SystemFunction008(challenge, hash, response);
}

SystemFunction010()

NTSTATUS WINAPI SystemFunction010	(	LPVOID	unknown,
		const BYTE *	data,
		LPBYTE	hash
	)

Definition at line 321 of file sysfunc.c.

{
    MD4_CTX ctx;
 
    MD4Init( &ctx );
    MD4Update( &ctx, data, 0x10 );
    MD4Final( &ctx );
    memcpy( hash, ctx.digest, 0x10 );
 
    return STATUS_SUCCESS;
}

SystemFunction012()

NTSTATUS WINAPI SystemFunction012	(	const BYTE *	in,
		const BYTE *	key,
		LPBYTE	out
	)

Definition at line 353 of file sysfunc.c.

{
    if (!in || !out)
        return STATUS_UNSUCCESSFUL;
 
    CRYPT_DEShash(out, key, in);
    CRYPT_DEShash(out+8, key+7, in+8);
    return STATUS_SUCCESS;
}

Referenced by MsvpChangePassword().

SystemFunction013()

NTSTATUS WINAPI SystemFunction013	(	const BYTE *	in,
		const BYTE *	key,
		LPBYTE	out
	)

Definition at line 383 of file sysfunc.c.

{
    if (!in || !out)
        return STATUS_UNSUCCESSFUL;
    CRYPT_DESunhash(out, key, in);
    CRYPT_DESunhash(out+8, key+7, in+8);
    return STATUS_SUCCESS;
}

Referenced by SamrChangePasswordUser().

SystemFunction024()

NTSTATUS WINAPI SystemFunction024	(	const BYTE *	in,
		const BYTE *	key,
		LPBYTE	out
	)

Definition at line 406 of file sysfunc.c.

{
    BYTE deskey[0x10];
 
    memcpy(deskey, key, 4);
    memcpy(deskey+4, key, 4);
    memcpy(deskey+8, key, 4);
    memcpy(deskey+12, key, 4);
 
    CRYPT_DEShash(out, deskey, in);
    CRYPT_DEShash(out+8, deskey+7, in+8);
 
    return STATUS_SUCCESS;
}

SystemFunction025()

NTSTATUS WINAPI SystemFunction025	(	const BYTE *	in,
		const BYTE *	key,
		LPBYTE	out
	)

Definition at line 435 of file sysfunc.c.

{
    BYTE deskey[0x10];
 
    memcpy(deskey, key, 4);
    memcpy(deskey+4, key, 4);
    memcpy(deskey+8, key, 4);
    memcpy(deskey+12, key, 4);
 
    CRYPT_DESunhash(out, deskey, in);
    CRYPT_DESunhash(out+8, deskey+7, in+8);
 
    return STATUS_SUCCESS;
}

SystemFunction028()

NTSTATUS WINAPI SystemFunction028	(	_In_ PVOID	ContextHandle,
		_Out_ LPBYTE	SessionKey
	)

Definition at line 466 of file sysfunc.c.

{
    /* HACK: Always return the default key */
    memcpy(SessionKey, DefaultSessionKey, sizeof(DefaultSessionKey));
    return STATUS_LOCAL_USER_SESSION_KEY;
 
#if 0
    //NDRCContextBinding();
    //SystemFunction034()
    SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    return 28;
#endif
}

SystemFunction029()

INT WINAPI SystemFunction029	(	INT	a,
		INT	b
	)

Definition at line 489 of file sysfunc.c.

{
    //I_RpcBindingIsClientLocal()
    SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    return 29;
}

SystemFunction030()

BOOL WINAPI SystemFunction030	(	LPCVOID	b1,
		LPCVOID	b2
	)

Definition at line 510 of file sysfunc.c.

{
    return !memcmp(b1, b2, 0x10);
}

SystemFunction032()

NTSTATUS WINAPI SystemFunction032	(	struct ustring *	data,
		const struct ustring *	key
	)

Definition at line 533 of file sysfunc.c.

{
    RC4_CONTEXT a4i;
 
    rc4_init(&a4i, key->Buffer, key->Length);
    rc4_crypt(&a4i, data->Buffer, data->Length);
 
    return STATUS_SUCCESS;
}

Referenced by read_credential_blob(), and write_credential_blob().

SystemFunction033()

INT WINAPI SystemFunction033	(	INT	a,
		INT	b
	)

Definition at line 550 of file sysfunc.c.

{
    SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    return 33;
}

SystemFunction034()

INT WINAPI SystemFunction034	(	INT	a,
		INT	b
	)

Definition at line 562 of file sysfunc.c.

{
    //RpcBindingToStringBindingW
    //I_RpcMapWin32Status
    //RpcStringBindingParseW
    //RpcStringFreeW
    SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
    return 34;
}

SystemFunction035()

BOOL WINAPI SystemFunction035

(

LPCSTR

lpszDllFilePath

)

Definition at line 582 of file sysfunc.c.

{
    //FIXME("%s: stub\n", debugstr_a(lpszDllFilePath));
    return TRUE;
}

SystemFunction036()

BOOLEAN WINAPI SystemFunction036	(	PVOID	pbBuffer,
		ULONG	dwLen
	)

Definition at line 602 of file sysfunc.c.

{
    // This function will output numbers based on the tick count. //
    // It will NOT OUTPUT CRYPTOGRAPHIC-SAFE RANDOM NUMBERS !!!    //
 
    DWORD dwSeed;
    PBYTE pBuffer;
    ULONG uPseudoRandom;
    LARGE_INTEGER time;
    static ULONG uCounter = 17;
 
    if(!pbBuffer || !dwLen)
    {
        /* This function always returns TRUE, even if invalid parameters were passed. (verified under WinXP SP2) */
        return TRUE;
    }
 
    /* Get the first seed from the performance counter */
    QueryPerformanceCounter(&time);
    dwSeed = time.LowPart ^ time.HighPart ^ RtlUlongByteSwap(uCounter++);
 
    /* We will access the buffer bytewise */
    pBuffer = (PBYTE)pbBuffer;
 
    do
    {
        /* Use the pseudo random number generator RtlRandom, which outputs a 4-byte value and a new seed */
        uPseudoRandom = RtlRandom(&dwSeed);
 
        do
        {
            /* Get each byte from the pseudo random number and store it in the buffer */
            *pBuffer = (BYTE)(uPseudoRandom >> 8 * (dwLen % 3) & 0xFF);
            ++pBuffer;
        } while(--dwLen % 3);
    } while(dwLen);
 
    return TRUE;
}

SystemFunction040()

NTSTATUS WINAPI SystemFunction040	(	_Inout_ PVOID	Memory,
		_In_ ULONG	MemoryLength,
		_In_ ULONG	OptionFlags
	)

Definition at line 761 of file sysfunc.c.

{
    ULONG IoControlCode;
 
    if (OptionFlags == RTL_ENCRYPT_OPTION_SAME_PROCESS)
    {
        IoControlCode = IOCTL_KSEC_ENCRYPT_SAME_PROCESS;
    }
    else if (OptionFlags == RTL_ENCRYPT_OPTION_CROSS_PROCESS)
    {
        IoControlCode = IOCTL_KSEC_ENCRYPT_CROSS_PROCESS;
    }
    else if (OptionFlags == RTL_ENCRYPT_OPTION_SAME_LOGON)
    {
        IoControlCode = IOCTL_KSEC_ENCRYPT_SAME_LOGON;
    }
    else
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    return KsecDeviceIoControl(IoControlCode, Memory, MemoryLength, Memory, MemoryLength);
}

SystemFunction041()

NTSTATUS WINAPI SystemFunction041	(	_Inout_ PVOID	Memory,
		_In_ ULONG	MemoryLength,
		_In_ ULONG	OptionFlags
	)

Definition at line 812 of file sysfunc.c.

{
    ULONG IoControlCode;
 
    if (OptionFlags == RTL_ENCRYPT_OPTION_SAME_PROCESS)
    {
        IoControlCode = IOCTL_KSEC_DECRYPT_SAME_PROCESS;
    }
    else if (OptionFlags == RTL_ENCRYPT_OPTION_CROSS_PROCESS)
    {
        IoControlCode = IOCTL_KSEC_DECRYPT_CROSS_PROCESS;
    }
    else if (OptionFlags == RTL_ENCRYPT_OPTION_SAME_LOGON)
    {
        IoControlCode = IOCTL_KSEC_DECRYPT_SAME_LOGON;
    }
    else
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    return KsecDeviceIoControl(IoControlCode, Memory, MemoryLength, Memory, MemoryLength);
}

Variable Documentation

CRYPT_LMhash_Magic

const unsigned char CRYPT_LMhash_Magic[8]

static

Initial value:

=
    { 'K', 'G', 'S', '!', '@', '#', '$', '%' }

Definition at line 20 of file sysfunc.c.

Referenced by SystemFunction003().

DefaultSessionKey

const unsigned char DefaultSessionKey[16]

static

Initial value:

=
    {'D', 'e', 'f', 'S', 'e', 's', 's', 'i', 'o', 'n', 'K', 'e', 'y', '!', '@', '#'}

Definition at line 22 of file sysfunc.c.

Referenced by SystemFunction028().

KsecDeviceHandle

HANDLE KsecDeviceHandle

Definition at line 645 of file sysfunc.c.

Referenced by CloseKsecDdHandle(), KsecDeviceIoControl(), and KsecOpenDevice().