From ce7db36b6e032cbb5e94cdba89b50605cecbab12 Mon Sep 17 00:00:00 2001 From: "Zac Brown (ODSP SECURITY)" Date: Tue, 31 Jan 2017 11:59:20 -0800 Subject: [PATCH] More general solution for handling when property Flags are set on EVENT_PROPERTY_INFO. 1) If flags are not set, try to get the length from the property 'length' field. Otherwise, try the heuristic. 2) if we couldn't get a length, fall back to calling TDH. Signed-off-by: Zac Brown (ODSP SECURITY) --- krabs/krabs/size_provider.hpp | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/krabs/krabs/size_provider.hpp b/krabs/krabs/size_provider.hpp index 4d10724..0a6962e 100644 --- a/krabs/krabs/size_provider.hpp +++ b/krabs/krabs/size_provider.hpp @@ -69,9 +69,19 @@ namespace krabs { } ULONG propertyLength = 0; - propertyLength = get_heuristic_size(propertyStart, propertyInfo); - // didn't have a heuristic for size, ask Tdh + // If no flags are set on the property, attempt to use the length + // field. If that field is 0, try using our heuristic. + if (propertyInfo.Flags == 0) + { + if (propertyInfo.length > 0) + propertyLength = propertyInfo.length; + else + propertyLength = get_heuristic_size(propertyStart, propertyInfo); + } + + // Couldn't get the length from the 'length' field or + // the heuristic for size failed -> ask Tdh. if (propertyLength == 0) propertyLength = get_tdh_size(propertyName, record); @@ -89,10 +99,6 @@ namespace krabs { // The following _very_ common property types can be short-circuited // to prevent the expensive call. - // We don't handle array types for heuristic sizing. - if (propertyInfo.Flags & PropertyParamCount) - return propertyLength; - // Be careful! Check IN and OUT types before making an assumption. if (propertyInfo.nonStructType.OutType == TDH_OUTTYPE_STRING)