From 3b09a59ddd64d38eedbda77c5e652d7c51072bb6 Mon Sep 17 00:00:00 2001 From: BrentHoltsclaw Date: Wed, 26 Sep 2018 10:36:53 -0700 Subject: [PATCH] WIN10 driver update --- drivers/win7/chipsec_hlpr.inf | 86 +++++++++++++ drivers/win7/chipsec_hlpr.vcxproj | 207 ++++++++++++++++++++++++++++++ drivers/win7/driver.c | 43 ++++--- drivers/win7/i386/cpu.asm | 2 +- drivers/win7/include/cpu.h | 4 +- drivers/win7/win10_readme | 35 +++++ 6 files changed, 355 insertions(+), 22 deletions(-) create mode 100644 drivers/win7/chipsec_hlpr.inf create mode 100644 drivers/win7/chipsec_hlpr.vcxproj create mode 100644 drivers/win7/win10_readme diff --git a/drivers/win7/chipsec_hlpr.inf b/drivers/win7/chipsec_hlpr.inf new file mode 100644 index 00000000..83b354b0 --- /dev/null +++ b/drivers/win7/chipsec_hlpr.inf @@ -0,0 +1,86 @@ +; +; chipsec_hlpr.inf +; + +[Version] +Signature="$WINDOWS NT$" +Class=Sample ; TODO: edit Class +ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid +Provider=%ManufacturerName% +CatalogFile=chipsec_hlpr.cat +DriverVer= ; TODO: set DriverVer in stampinf property pages + +[DestinationDirs] +DefaultDestDir = 12 +chipsec_hlpr_Device_CoInstaller_CopyFiles = 11 + +; ================= Class section ===================== + +[ClassInstall32] +Addreg=SampleClassReg + +[SampleClassReg] +HKR,,,0,%ClassName% +HKR,,Icon,,-5 + +[SourceDisksNames] +1 = %DiskName%,,,"" + +[SourceDisksFiles] +chipsec_hlpr.sys = 1,, +WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames + +;***************************************** +; Install Section +;***************************************** + +[Manufacturer] +%ManufacturerName%=Standard,NT$ARCH$ + +[Standard.NT$ARCH$] +%chipsec_hlpr.DeviceDesc%=chipsec_hlpr_Device, Root\chipsec_hlpr ; TODO: edit hw-id + +[chipsec_hlpr_Device.NT] +CopyFiles=Drivers_Dir + +[Drivers_Dir] +chipsec_hlpr.sys + +;-------------- Service installation +[chipsec_hlpr_Device.NT.Services] +AddService = chipsec_hlpr,%SPSVCINST_ASSOCSERVICE%, chipsec_hlpr_Service_Inst + +; -------------- chipsec_hlpr driver install sections +[chipsec_hlpr_Service_Inst] +DisplayName = %chipsec_hlpr.SVCDESC% +ServiceType = 1 ; SERVICE_KERNEL_DRIVER +StartType = 3 ; SERVICE_DEMAND_START +ErrorControl = 1 ; SERVICE_ERROR_NORMAL +ServiceBinary = %12%\chipsec_hlpr.sys + +; +;--- chipsec_hlpr_Device Coinstaller installation ------ +; + +[chipsec_hlpr_Device.NT.CoInstallers] +AddReg=chipsec_hlpr_Device_CoInstaller_AddReg +CopyFiles=chipsec_hlpr_Device_CoInstaller_CopyFiles + +[chipsec_hlpr_Device_CoInstaller_AddReg] +HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller" + +[chipsec_hlpr_Device_CoInstaller_CopyFiles] +WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll + +[chipsec_hlpr_Device.NT.Wdf] +KmdfService = chipsec_hlpr, chipsec_hlpr_wdfsect +[chipsec_hlpr_wdfsect] +KmdfLibraryVersion = $KMDFVERSION$ + +[Strings] +SPSVCINST_ASSOCSERVICE= 0x00000002 +ManufacturerName="" ;TODO: Replace with your manufacturer name +ClassName="Samples" ; TODO: edit ClassName +DiskName = "chipsec_hlpr Installation Disk" +chipsec_hlpr.DeviceDesc = "chipsec_hlpr Device" +chipsec_hlpr.SVCDESC = "chipsec_hlpr Service" diff --git a/drivers/win7/chipsec_hlpr.vcxproj b/drivers/win7/chipsec_hlpr.vcxproj new file mode 100644 index 00000000..48af1d20 --- /dev/null +++ b/drivers/win7/chipsec_hlpr.vcxproj @@ -0,0 +1,207 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM + + + Release + ARM + + + Debug + ARM64 + + + Release + ARM64 + + + + {FDC9216F-B321-4B46-9E3B-D9DF02D78C28} + {1bc93793-694f-48fe-9372-81e2b05556fd} + v4.5 + 12.0 + Debug + Win32 + chipsec_hlpr + + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + + + + + + + + + DbgengKernelDebugger + $(ProjectDir)\include\;$(IncludePath) + $(LibraryPath) + + + DbgengKernelDebugger + $(ProjectDir)\include\;$(IncludePath) + $(LibraryPath) + + + DbgengKernelDebugger + $(ProjectDir)\include\;$(IncludePath) + $(DDK_LIB_PATH) + + + DbgengKernelDebugger + $(ProjectDir)\include\;$(IncludePath) + $(DDK_LIB_PATH) + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + $(DDK_LIB_PATH)wdmsec.lib;%(AdditionalDependencies) + + + false + + + mkdir ..\..\chipsec\helper\win\win7_$(DDKPlatform) +copy $(DbgengLocalCommand) ..\..\chipsec\helper\win\win7_$(DDKPlatform) + + + + + $(SDK_INC_PATH) + + + false + + + $(DDK_LIB_PATH)wdmsec.lib;%(AdditionalDependencies) + + + mkdir ..\..\chipsec\helper\win\win7_$(DDKPlatform) +copy $(DbgengLocalCommand) ..\..\chipsec\helper\win\win7_$(DDKPlatform) + + + + + + + + + + + + + + + + + + + false + true + false + true + + + true + true + + + + + + \ No newline at end of file diff --git a/drivers/win7/driver.c b/drivers/win7/driver.c index b7f52e88..435c2be3 100644 --- a/drivers/win7/driver.c +++ b/drivers/win7/driver.c @@ -147,7 +147,9 @@ DriverEntry( PDEVICE_OBJECT DeviceObject = NULL; NTSTATUS Status = STATUS_SUCCESS; UNICODE_STRING DeviceName; - UNICODE_STRING DosDeviceName; + UNICODE_STRING DosDeviceName; + + UNREFERENCED_PARAMETER(RegistryPath); // // Initialize a unicode string for the drivers object name. @@ -291,7 +293,7 @@ NTSTATUS _read_phys_mem( PHYSICAL_ADDRESS pa, unsigned int len, void * pData ) DbgPrint( "[chipsec] ERROR: no space for mapping\n" ); return STATUS_UNSUCCESSFUL; } - DbgPrint( "[chipsec] reading %d bytes from physical address 0x%08x_%08x (virtual = %#010x)", len, pa.HighPart, pa.LowPart, (unsigned int)va ); + DbgPrint( "[chipsec] reading %d bytes from physical address 0x%08x_%08x (virtual = %#010x)", len, pa.HighPart, pa.LowPart, (UINTN)va ); RtlCopyMemory( pData, va, len ); MmUnmapIoSpace( va, len ); return STATUS_SUCCESS; @@ -305,7 +307,7 @@ NTSTATUS _write_phys_mem( PHYSICAL_ADDRESS pa, unsigned int len, void * pData ) DbgPrint( "[chipsec] ERROR: no space for mapping\n" ); return STATUS_UNSUCCESSFUL; } - DbgPrint( "[chipsec] writing %d bytes to physical address 0x%08x_%08x (virtual = %#010x)", len, pa.HighPart, pa.LowPart, (unsigned int)va ); + DbgPrint( "[chipsec] writing %d bytes to physical address 0x%08x_%08x (virtual = %#010x)", len, pa.HighPart, pa.LowPart, (UINTN)va ); RtlCopyMemory( va, pData, len ); MmUnmapIoSpace( va, len ); return STATUS_SUCCESS; @@ -327,7 +329,7 @@ DriverDeviceControl( unsigned int new_cpu_thread_id = 0; ULONG _num_active_cpus = 0; KAFFINITY _kaffinity = 0; - UINT32 core_id = 0; + //UINT32 core_id = 0; // // Get the current IRP stack location of this request @@ -412,7 +414,7 @@ DriverDeviceControl( case IOCTL_READ_PHYSMEM: { UINT32 len = 0; - PVOID virt_addr; + //PVOID virt_addr; PHYSICAL_ADDRESS phys_addr = { 0x0, 0x0 }; DbgPrint( "[chipsec] > IOCTL_READ_PHYSMEM\n" ); @@ -461,7 +463,7 @@ DriverDeviceControl( case IOCTL_WRITE_PHYSMEM: { UINT32 len = 0; - PVOID virt_addr = 0; + //PVOID virt_addr = 0; PHYSICAL_ADDRESS phys_addr = { 0x0, 0x0 }; DbgPrint( "[chipsec] > IOCTL_WRITE_PHYSMEM\n" ); @@ -480,7 +482,8 @@ DriverDeviceControl( phys_addr.HighPart = ((UINT32*)pInBuf)[0]; phys_addr.LowPart = ((UINT32*)pInBuf)[1]; len = ((UINT32*)pInBuf)[2]; - ((UINT32*)pInBuf) += 3; + //((UINT32*)pInBuf) += 3; + *pInBuf = *pInBuf + (3 * sizeof(UINT32*)); if( IrpSp->Parameters.DeviceIoControl.InputBufferLength < len + 3*sizeof(UINT32) ) { @@ -552,20 +555,20 @@ DriverDeviceControl( case IOCTL_FREE_PHYSMEM: { - UINT64 va = 0x0; + UINTN va = 0x0; pInBuf = Irp->AssociatedIrp.SystemBuffer; pOutBuf = Irp->AssociatedIrp.SystemBuffer; DbgPrint( "[chipsec] > IOCTL_FREE_PHYSMEM\n" ); if( !Irp->AssociatedIrp.SystemBuffer || - IrpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof(UINT64)) + IrpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof(UINTN)) { DbgPrint( "[chipsec] ERROR: STATUS_INVALID_PARAMETER\n" ); Status = STATUS_INVALID_PARAMETER; break; } - RtlCopyBytes( &va, (BYTE*)Irp->AssociatedIrp.SystemBuffer, sizeof(UINT64) ); + RtlCopyBytes( &va, (BYTE*)Irp->AssociatedIrp.SystemBuffer, sizeof(UINTN) ); DbgPrint( "[chipsec][IOCTL_FREE_PHYSMEM] Virtual address of the memory being freed: 0x%I64X\n", va ); MmFreeContiguousMemory( (PVOID)va ); @@ -577,7 +580,7 @@ DriverDeviceControl( case IOCTL_GET_PHYSADDR: { - UINT64 va = 0x0; + UINTN va = 0x0; PHYSICAL_ADDRESS pa = { 0x0, 0x0 }; pInBuf = Irp->AssociatedIrp.SystemBuffer; @@ -585,26 +588,26 @@ DriverDeviceControl( DbgPrint( "[chipsec] > IOCTL_GET_PHYSADDR\n" ); if( !Irp->AssociatedIrp.SystemBuffer || - IrpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof(UINT64)) + IrpSp->Parameters.DeviceIoControl.InputBufferLength != sizeof(UINTN)) { DbgPrint( "[chipsec] ERROR: STATUS_INVALID_PARAMETER\n" ); Status = STATUS_INVALID_PARAMETER; break; } - if( IrpSp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(UINT64)) + if( IrpSp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(UINTN)) { DbgPrint( "[chipsec] ERROR: STATUS_BUFFER_TOO_SMALL\n" ); Status = STATUS_BUFFER_TOO_SMALL; break; } - RtlCopyBytes( &va, (BYTE*)Irp->AssociatedIrp.SystemBuffer, sizeof(UINT64) ); + RtlCopyBytes( &va, (BYTE*)Irp->AssociatedIrp.SystemBuffer, sizeof(UINTN) ); pa = MmGetPhysicalAddress( (PVOID)va ); DbgPrint( "[chipsec][IOCTL_GET_PHYSADDR] Traslated virtual address 0x%I64X to physical: 0x%I64X\n", va, pa.QuadPart, pa.LowPart); - RtlCopyBytes( Irp->AssociatedIrp.SystemBuffer, (void*)&pa, sizeof(UINT64) ); - IrpSp->Parameters.Read.Length = sizeof(UINT64); + RtlCopyBytes( Irp->AssociatedIrp.SystemBuffer, (void*)&pa, sizeof(UINTN) ); + IrpSp->Parameters.Read.Length = sizeof(UINTN); dwBytesWritten = IrpSp->Parameters.Read.Length; Status = STATUS_SUCCESS; break; @@ -992,9 +995,9 @@ DriverDeviceControl( } case IOCTL_CPUID: { - DWORD CPUInfo[4] = {-1}; - DWORD gprs[2] = {0}; - DWORD _rax = 0, _rcx = 0; + int CPUInfo[4] = {-1}; + int gprs[2] = {0}; + int _rax = 0, _rcx = 0; //CPU_REG_TYPE gprs[6]; //CPU_REG_TYPE _rax = 0, _rbx = 0, _rcx = 0, _rdx = 0, _rsi = 0, _rdi = 0; @@ -1198,7 +1201,7 @@ DriverDeviceControl( __try { - result = hypercall(regs[0], regs[1], regs[2], regs[3], regs[4], regs[5], regs[6], regs[7], regs[8], regs[9], regs[10], &hypercall_page); + result = hypercall(regs[0], regs[1], regs[2], regs[3], regs[4], regs[5], regs[6], regs[7], regs[8], regs[9], regs[10], (void*)&hypercall_page); } __except( EXCEPTION_EXECUTE_HANDLER ) { diff --git a/drivers/win7/i386/cpu.asm b/drivers/win7/i386/cpu.asm index cccb6f01..cdf82ad9 100644 --- a/drivers/win7/i386/cpu.asm +++ b/drivers/win7/i386/cpu.asm @@ -483,7 +483,7 @@ cPublicProc _hypercall, 12 pop esi pop ebx stdRET _hypercall -stdENDP _hypercall ENDP +stdENDP _hypercall ;------------------------------------------------------------------------------ ; UINT64 hypercall_page ( ) diff --git a/drivers/win7/include/cpu.h b/drivers/win7/include/cpu.h index bd0c3535..df887558 100644 --- a/drivers/win7/include/cpu.h +++ b/drivers/win7/include/cpu.h @@ -35,8 +35,10 @@ chipsec@intel.com #if defined(_M_AMD64) typedef UINT64 CPU_REG_TYPE; +typedef UINT64 UINTN; #elif defined(_M_IX86) -typedef UINT32 CPU_REG_TYPE; +typedef unsigned long CPU_REG_TYPE; +typedef UINT32 UINTN; #else #error "Architecture not supported" #endif diff --git a/drivers/win7/win10_readme b/drivers/win7/win10_readme new file mode 100644 index 00000000..596002d7 --- /dev/null +++ b/drivers/win7/win10_readme @@ -0,0 +1,35 @@ +!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +!! WARNING +!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +!! +!! Chipsec should only be run on test systems! It should not be installed/deployed on end-user systems! +!! +!! There are multiple reasons for that: +!! +!! 1. Chipsec kernel drivers provide raw access to HW resources to user-mode applications +!! (like access to physical memory). This would allow malware to compromise the OS kernel. +!! +!! 2. The driver is distributed as a source code. In order to load it on OS which requires signed drivers +!! (e.g. x64 Microsoft Windows 7 and higher), you'll need to enable TestSigning mode and self-sign the +!! driver binary. Enabling TestSigning (or equivalent) mode also turns off important protection of OS kernel. +!! +!! 3. Due to the nature of access to HW resources, if any chipsec module issues incorrect access +!! to these HW resources, OS can crash/hang. +!! +!! If, for any reason, you want to production sign chipsec driver and deploy chipsec on end-user systems, +!! DON'T! +!! +!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + + +1. Build CHIPSEC kernel driver +---------------------------------------------------- + +- Install Visual Studio 2017 and WDK for Windows 10 + You can find instructions to install Visual Studio and WDK from https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk +- Open the Visual Studio project file (drivers/win7/chipsec_hlpr.vcxproj) +- Select the Build TYPE (DEBUG or RELEASE) and ARCHITECTURE for the driver (x64 or x86) +- Select Build->Build Solution from the menu +- Enable loading of test-signed kernel mode drivers (see chipsec-manual.pdf for details) + +