Skip to content

Fix wrong sizeof call in driver #370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Fix wrong sizeof call in driver #370

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
00c4304
Fix wrong sizeof target (pointer instead of structure)
mathieuwolf Sep 29, 2024
815c6aa
Merge pull request #1 from Cynet-Security/fix_wrong_sizeof
jacka-cynet Sep 29, 2024
b397a07
done
jacka-cynet Oct 9, 2024
765ff2d
Revert "done"
jacka-cynet Oct 9, 2024
679e4d2
fix
jacka-cynet Oct 9, 2024
46ffe09
Merge pull request #3 from Cynet-Security/AllocationNxFix
jacka-cynet Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 27 additions & 8 deletions sys/windivert.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,16 @@
* Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/

#include <ntdef.h>

// Required for a single driver binary to support multiple Windows versions using the POOL_NX_OPTIN opt-in mechanism.
// (See: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/single-binary-opt-in-pool-nx-optin)
#define POOL_NX_OPTIN 1

// Required for deprecation of ExAllocatePool
// (See: https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/updating-deprecated-exallocatepool-calls)
#define POOL_ZERO_DOWN_LEVEL_SUPPORT

#include <ntifs.h>
#include <ntddk.h>
#include <fwpsk.h>
Expand Down Expand Up @@ -305,7 +315,6 @@ static NDIS_HANDLE nb_pool_handle = NULL;
static HANDLE engine_handle = NULL;
static LONG priority_counter = 0;
static LONGLONG counts_per_ms = 0;
static POOL_TYPE non_paged_pool = NonPagedPool;
static MM_PAGE_PRIORITY no_write_flag = 0;
static MM_PAGE_PRIORITY no_exec_flag = 0;
static LONG64 num_opens = 0;
Expand Down Expand Up @@ -933,12 +942,20 @@ static const struct layer_s windivert_layer_flow_established_ipv6 =
*/
static PVOID windivert_malloc(SIZE_T size, BOOL paged)
{
POOL_TYPE pool = (paged? PagedPool: non_paged_pool);
PVOID retval = NULL;
POOL_TYPE pool = (paged ? PagedPool : NonPagedPool);
if (size == 0)
{
return NULL;
}
return ExAllocatePoolWithTag(pool, size, WINDIVERT_TAG);

#if (NTDDI_VERSION >= NTDDI_WIN10_VB)
retval = ExAllocatePool2(pool, size, WINDIVERT_TAG);
#else
retval = ExAllocatePoolZero(pool, size, WINDIVERT_TAG);
#endif

return retval;
}
static VOID windivert_free(PVOID ptr)
{
Expand Down Expand Up @@ -967,6 +984,10 @@ extern NTSTATUS DriverEntry(IN PDRIVER_OBJECT driver_obj,
RTL_OSVERSIONINFOW version;
LARGE_INTEGER freq;
NTSTATUS status;

// Must be called before any memory allocation occurs
ExInitializeDriverRuntime(DrvRtPoolNxOptIn);

DECLARE_CONST_UNICODE_STRING(device_name,
L"\\Device\\" WINDIVERT_DEVICE_NAME);
DECLARE_CONST_UNICODE_STRING(dos_device_name,
Expand All @@ -981,14 +1002,13 @@ extern NTSTATUS DriverEntry(IN PDRIVER_OBJECT driver_obj,
if (version.dwMajorVersion > 6 ||
(version.dwMajorVersion == 6 && version.dwMinorVersion >= 2))
{
non_paged_pool = (POOL_TYPE)512; // NonPagedPoolNx (documented)
no_exec_flag = (MM_PAGE_PRIORITY)0x40000000;
// MdlMappingNoExecute
no_write_flag = (MM_PAGE_PRIORITY)0x80000000;
// MdlMappingNoWrite
}
}

// Initialize timer info.
KeQueryPerformanceCounter(&freq);
counts_per_ms = freq.QuadPart / 1000;
Expand Down Expand Up @@ -2741,7 +2761,7 @@ static NTSTATUS windivert_write(context_t context, WDFREQUEST request,
packet->object = NULL;
network_data =
(PWINDIVERT_DATA_NETWORK)WINDIVERT_LAYER_DATA_PTR(packet);
RtlCopyMemory(network_data, &addr[i].Network, sizeof(network_data));
RtlCopyMemory(network_data, &addr[i].Network, sizeof(WINDIVERT_DATA_NETWORK));
data_copy = WINDIVERT_PACKET_DATA_PTR(WINDIVERT_DATA_NETWORK, packet);
RtlCopyMemory(data_copy, data, packet_len);
switch (version)
Expand Down Expand Up @@ -6481,5 +6501,4 @@ static void windivert_log_event(PEPROCESS process, PDRIVER_OBJECT driver,
RtlCopyMemory(str, pid_str, pid_size);

IoWriteErrorLogEntry(packet);
}

}