From 5a25f7aeeb2aebbcfdf3a19cb92ddd99e79e39af Mon Sep 17 00:00:00 2001 From: wj32 Date: Mon, 18 May 2009 09:11:21 +0000 Subject: [PATCH] fixed "don't allow kernel-mode to bypass protection" by allowing rule creators to bypass the rules git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1296 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- trunk/KProcessHacker/i386/kprocesshacker.sys | Bin 20480 -> 20992 bytes trunk/KProcessHacker/include/kprocesshacker.h | 6 + trunk/KProcessHacker/include/protect.h | 1 + trunk/KProcessHacker/kprocesshacker.c | 147 +++++++++++++++--- trunk/KProcessHacker/protect.c | 9 +- 5 files changed, 141 insertions(+), 22 deletions(-) diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys index 77f7e46f3b79ec82d93ba0f09e177207dea295a8..c9ca9c6c3ccaae8149269771126adfd05115178f 100644 GIT binary patch delta 6186 zcmdT|d300Nx<4nRkhWFa6JJey1;(d6uP$@;j${@OOENluNtTrKMpV3CI?BMDh=fNH&M zmy09_uQsp<_IEZ+X`MTz4iaq-4g0i#jZyu>Pk??u%N6Q- zufZnvD$>}nsIq<*7L>yZ_p~Vb|G_19f+>(AER~#rD#P@Km+vEqR@F-UTU?Z-6w3!! z;TBtswuB``xnMQZGQaX1wkUclEQOqhI>T~Eq50>q*(%c1T&^i24Vw%EA^S8<&MP4c zH!SJ{d*fCWIvbvnw;d+*YtvINkVIfVSjSTZwY{H$sRPg8rd>eVh*_}|@H9I$UR_hM z+681~{X(=lB0Fz1^j8xy1;CvXp(*t?$~AFr8C+o}Hg}0u))%2O5ji6Ye?L0=*U>?d zS)>Q$MUEryN7a#|NH5wENs}6MF0z1Jj(Q{0RGmpEQCk>Q10)(2s|lHx^=r@)Z9(ov zOteS5y#L*&`49% z5I)i%KMApM0;>Qg5-eF+P@;*qKqBbE^87Anl#mHVyt1!`uk%7G4Cy8O=$BxjbEgbA z$4F6DOw%nb?-7mVG27~#a(%5#_?^Ap2=LM8ux6aSk`1d!{=^L3Yj+Y}){q9&bd4=iMVxn#G%KOW`6)PPZ(t!r_4*dC6BCtuKllbozMh8KuL$rBl{ztEnsc$J{-xi?C{7i3?W>@&!|1lboS`*h&k;O~L3 zpK&_tKCcL^$gIRczzMt?!4DwGXVstP5X$|XvUtKbU?Bi(9(0j>RGuXSXtU2z&|H(3Q z*Kjh_&IGaB}s z5DJxQt>+@%@y=-U^>FvUX9%|bQ-+w$uWSR?vH5?)ki3aH6K3kL$BI4Pm?q~g7o?tr zNF0#?*=_!acn0Uk`r1~=k=_VAEbBdZ@-MYRq}Ch9;T#D{Bz_uPU4~chAK@W)p`nTK zLyMHvXNiHe$eg&HJd8RL(?QAKC&nu27!+0r`+MkP34D3i8y92%(ygY#Ox|^IDmlB3< znF3Q_b)gzV;$%z|qUQIvjcPb}LerJQLNlP>#+I67#gf5*x*ACkQi%qq%OcceNQuS~ z?~;vRVugb?*+3Sd{N$vuI0O9Q;Aw2B#mO~m_cn+WpyHNTO}SK~fxAo*dMG)4_P20* zV=fDzhwpdXtW|_UO3)1=p{g+&Xj_fvv9HN);2j?T(U{l7oynIjIqHP zO^sIY_%aahuP5h-MUJ3p_IJ+TV%f3FTSJr#6 z+FC2;D;K2S=H}mfVTc{-%F5P;+_pOsGZ~t_?$30+FFPN2cVuTOx;CJgoO?zXfK~9w zle2|^x~GRhQceZx$>E0SK-W^KRw~vE>R_}&fRK?Xcg4^qoUEYRt#n%gwdn2K(xC-^ z=uJThd2Gzm0mAL=nDpGdDTAMc+;bxby`Hz23I zAg%)52M}uj@KGz_#Q>NGSPZBEYzDjpI1G3n@EPDHK=lwoqyYrL41fnv57-Jg3^)Vm z0`vlgc?n`Ppb#(_;Pw(3#8Rki2J8nM1zZ9o0O2?vJa_=bX!q#V^kC=-tRRSXz-^du z0LuQa|M`WVNV5Su;ia{6ESfxKy6)18@6CCA!^}x1RwS0~8kxNhy*_4U9Rmz`g20Ce zCh=UT#O)1La9IK1`jmS};%)%0Ut2;FHvzbQ0m>_(I$qxneYnJ9Iq@Vh642kqC61#0 z_QPo;k-HUs@OLdVupVsGKjGC3l4t|KhdK)M!wzSW#8Chyeh$j>S?EH+aLeIr=msd= zP@WIf@w$t@;a8srH%$PZw;jr7@=(gy;jy2OB#AEpxI1PPNyLsK(f6vi4^e|v5!FQ= z4L$%L{SXz?&fGm7h?lI!6et?*s2_?rnF)8F8(W4Dguk{=s<>7r^X|Y;m(U@anfmS} zS#CI^z2mRwx={!-8t!OT?rw4(aLKFGfq8G?Q?OBv*_;hS%w@=-S0IN@Eez&RzW-H# z=LeR(g^WyoY61*)M>mypO_P1s+^#^?0ZhYR`;k;~1xMh+j7#;*In>77t?Fw-1~y%l zei1p?6tWP_XGcO5`q?z7zs7Px%tf%mAW;o-v&y+h#rs1RD%hc9QKO+N5Z zGb-ehvhmR!nkv9l@lMR<(}M^&MZ4grxCRF%Xej~J^Vx=R?*XM$*oi{v+MS?CSdz?l z(K~#CYD62l%%`d@yo>tyT-D!Cp=?u{>ii*emnk!v1vY-?6=h3#&1j9ukvjKKzcrUb z*kSwLdq$T1gOxe&A3~j`v<$<*93#w8UW8QOzF((pJcJU2WK~-mG6~}~_&VeYoIHgd z6NXO;I}O{N3-UJH(Z#I0`6Iq_;*|&_zXpdT2p@Ru2)aNr$@S9vvf-BNHqTvo$+W%?-% z2+uz&0L5*o)9jTLLPze~YZ+GMcRpHHmf< zzT7;2+)@>~J|PdiKf%x(U35FF?h1J0aH@h@N!3srsIAn~)brF{>L7KBx=3|V|D=AV z1{t-+5yn)b#aL*ZXmlA@7&jPC7#GkU`T=?+y@r02UQhe!ZS)bkjsAfCl>R$?omMf) zOeQmiaWKV9DO1KQU?gTc^CI&q)6D!A)5?6nTxLFJzGA+wW9~3vYz(VsN3f}E7CVxq zSe~`Ag={f9g`LKhv+LP?>|fb~>}mEq`w9Cw+s*!ymDzAEmP_VxxiK8e37nmq$dz(4 zxVc;;+=B9EBxMkcX z?pdyv-$a|ngC0IK{bY&;`8naBkYk=sYJ9 zI@7ukWZ!OWv0k)(YQ1UAv6*a>ZDqDaHm}WZ+irWs_Li;3Hp zaB3zskNRKgTPn*q-k3{U=n3?6`XPE9y@h_2u43+IY9UB=fK4W`EEmtG@e}wO{&9XQ z|1N)>4>!e`QcY&lY;eN{(-Wo`Aw|d#a)gmWfj|qqU=i%#ip9cYp;VYIxWOss3k!tB tLbdRquu@nhtW6Xi71jwGgiXQ|!d792@E73)p~}40yx)AFIlZ)*{C}z)CmjF) delta 5777 zcmdT{d3;ky%0tyJoo!_}lE6jT{@9(*v&-b4Fx1ZlR zr)Cpb(@3ri#=kVM?+7CFwGkRJhSU;-?d7{xP4)(4B}eoU!wG^KN)V=((-P6!q@`C5 z%+>>P(T`+)UP1TbuF^#i4-`(H=9>o1HVynd09;bYp&8ickG-H;4u}RYXr?BIw4vpi zoV;Ra-}AW$qNs5Gj5%{3BZ#;N7+4921dM3-F`BGH zagq6jn}M&?61!{-l);l=4%}D*4X?~&-W35=l%G7x=O7hY8<{fU0T)TkPGkcOUU7na z>)JNieW#_^6<f|)D{=1CyCkzOyMx`g>qB1q9_gSpF9ojOQ7Fy zAjSr!Og(l;OQ6`OWbz?Y7?n+$o5n^>(2zpYpL>;(rY}tdq4>28?sFlF)XumA_Q5R= zN{&g+{Q)L)YhF=fCW+wNz@?%bYHyqcD+Pa#n+`LY9y7jQCa|=)wLX1AakvM_D#kJB zR7_TGD)i4L6bgVlZP1i&)+vh&UIom!4k*YaI>jg=lP-GzcmL>w-$tj|<72^3H6r1Q zt_=VO<9Jk~8%pj&hjjVmbaYwAkY1G5yO1nLp5CdNLKB+b+tqsx5UiaUPAGz6tUw2P z7v?O)EIOrY{;0jL5=5Y*z^fR2&^NR8;Yf0JYAJlsQ;7_Hen*C*vOXE47S;55xF{U2 ztGd(hRIfKTEj`*iOiL(6E%f1l3U0XzYPhvir%dVz6fZHc*3hL2*zVmosv5h<4RarcU>KP1Z1i&*2->OJqY2}*B9$$x1qk+AiEO| z_*7!`#R-a02TSDM1o}8OF_*yg<|$JrA2M{syvn=ueLNkam%yt|z!KC~pP`SMaP7@z zcMLgo>1o_apyB#FQiq;|A)QYv3(^&TkiCvYCeTKGhD~KOSu2kWU*cBeuzIrof$$Gi zt-wN9tI{rQF8m7GKo{0!=~z$<2(0ScKRPpHuFRn*t*@b)g5grHT-hnn<6>94m6|Gr zsCVD=MMHS3gE6QBS*TdtH|45Sd9vR3#6}#D66Nc)5wDgg|D@U+qV6l%Z}5f5PbH}F z@4p$G2_9V>@HsF^+5MA0Om=tHR$U@|ku_B&!k3-VEH#(;QWawYNc~|tL{dmJEb>$^ z;G}jhxMZB-H!1!E#cwEuaEBcbG-1^`J3hI`vFg?cjslK#;8Z5iq4fk`N2a)ey2a2} z469}n!6Z}^mrt6|lW{32jlg5$diYgbf^GN){-sOve4>V)TV^ zWWVb_1M9lgpu0!evlEJ7HZsR&f<9&O6uBHV#6L(5M}Li9OIpyA{jTS6 z|8bcnP_)H;2TY+z*L=fE8{7s@sp>|^D*CRhf+`aX3E0!197tyfUV!QHO}WH?Q_K2< zVdPJ!Ey199wGX=9-}~=LrgoDYFfdLf8C1jZpNI_@tH*;)r-;z~l9L$8{yXnyMB^e!ghD01_Bpezz)0ZfV~Sv%4ZyI@?9B6w}*1 zup$q;Sw7oPR{-k6q9eFj5&*5BQd89o=`chM4NF`@zKgy{OiRZWt4|5p4D5COH+#82 zIhnU1lW72%iUiYh224o#TrO#oPWUuXaqEMz=p$1Bc??}Oahlh%QEn24$}-}IfHqo> zx^27)1(6X-=Th^c0bRkZ7|*KWX>lGB(Z;02LcGb;^snuiUl&-E1gpVw>V^o$5TH?L z$&X3N`FMkR6dF7kVo(>T!l^Eyi)GurEOuoi>U&s(P8c*LIhhnuRdO2HiC#~RFS;jy zz!-Wk24132uqAs=Bb;u{b+-GwC-WkDGIehprczqJ zVGIm{G!Q~IB&OLwc7GZ}u1CLSo6wQ8StNxD(#v{v$?OeIL@%djkb}^k^ua^A`Wot7 zK%f*1wpZ~(XsAp(yL#^n8Pqppq-LcHP07d`gn5G-D+su}_1FPi8Lu|ZK{Dxa3K;n} zKZ4tO+;X2EwQ$+$S#m35@c+Z1?OqO}GLLpo$2q7cuws|tTU^)90NT<~e{bxKVObeq zq*+;36AoVK?xOx`EZu=q0ArO8PB0LS)g8Sy?)~3Q}}O3?`PC{o?=S zh(BlN0go@TGgL=ZB^qE&SI$#BtOe`@oB>1wQN5oa zG66QUvG8f;>O6w@5^xA`70-mS`|EyJ;Jg0>z&dzBtQ(9*3>mG@jas+CJ<{u17g&4d z7h82B+CF4#HA4`~c#s^-jY%|yO5EOGP7(nCuD>u1?n3}vA6P*Wxd2=bhcYfy$Lm|6 z50`lCq>&^(1$4J@iT7A{du|Fz;Pcm z2cSHhflgBK)~%V)4N$wGJRGXyb*Jy)w;+cko(14}GL$QFP%<6g@2`0z@f84fM+_o~ zUV}(w?6RyVIO@KF%z6$os|z9* zXI7#6s^8$==?Q+f2i@lKQdYxYN1uk0wo!`zyw?-Fy93jxuR0@_oKyET@6k*+iq`Ot zX!ajR7x*;IcPCLVA(`Y*t}rMaZ`&4k8@6iu26*Dt-j0ZU@fKKJy|e*G4*3Lr7@pQ% zqK<20U)&1g%7So32!?%(xwW(ENOVv1(@5!5W^XkI^v{w}6!oV!q8OGckuU{mitrwZ`uE>vW3 zrhL4!+iR7u&45HO14!3Ls&j0+P@^Sv=<=R9G|W+-b5toP1qFG%xr|N?s_)~X6f=BmE`Uv+=Qv3C>FJAox-z-BBgb$|sBB(1kpcmT- zHZl=>dJ7zPV5Q)KchFXAVhoOGu-v)eqfO|v)uO&R|22s-AUK}9Vh^IFT)2Wxl#>7L zl0}bW^WY_!O{h_tTb+RY*AlEct|+i`R<124i8Fwo0jog3?*XZglEg5;IzSMhd5k0s zfNVf9U?$)>z-NHM>F~+{>;N1E{0$H`gCq(7uK~UWWX~iC2jFo)+!FXT0tU_^i6;P5 z1!}YfV!FhdIt9NkuV|*PVj@tqgV!8rL_;0U|Bw@+|GzjPP=sq3TINbX54eV-O|HvL z?+gtm(N3oq?Jar>ts0u%G-cQv4Z7+!q2un{rar~jBdYg9tn{H0sC253;;15OG*wQm zq6X6pZKtQuKKfbu1$qg+g5E}dM4zBPqc75z>Fe}uI+|e_JM%kc6f=pL!OUfzVQQIr zW(D(m<_+dg%zMlS%t5AwX=OfT&NAOH=b0dLnYqUN!YE7uTf&yI6WIS^{cLqLThAhP z1G|~s#lFve#GYb5W6!Z|>;<-yz0TfY!?-A}Hy6hxaLHUY=itV2^SGzETCRb6h1`C@}XS}+Sv;Xz@#us~QZY!eO(KMERij(LswhIyhmQ(Pl%5#JZXEIF11mZg?= zEx%fH)?6!N6|JMJUTc|kp7j~)OV+j453R?nr>tkKKUh1gVN$ddC-s-y(llw7G*|LT zf0RCynx(I#@1=I>x2*$azTw>EgbkWX5L$4bj#^0FphnR_dJMCa`GHAf zi`en(4E9;}W%dU)kt^cHb2GRa?q%*Wm(N@Ik^E%d&%ea4<2UowE&MmUUPuvg1yQIL zjtQMYxVf)6-@Msu5=V%m#V5t*L|I%b?iLS<-->s|7)z2R*D~BvYALtOx2&*ivwUDV zX1Qcxtd-V<)&}cl>&Mpf);K9k;-!(&MCma}mfi*3Pf9__WE*UA*&eh_vdy+t+hp4Y z+n=g!7i?+vJiEg_-u}FOjeU>(sQs+{vi(`c2055bMAH?a(?F|D7dtNL1L*SDxVT5H&sUYsaL4Y)NblD^)1y-MbLV> zkap0;bUBUaP4s&Z&L`<_Xz?noVQ9v~c$w);C9?=(_$@{Q0myO>aTB-&+`HT%?j-jm zcY(Xg_2rZJJYk$rF8sHE9(`nVwH7u`D&?eP*fIm?OnM@{ke&==o?(_STbR8}GxII8 zmfgrUu?N{!b`n?3&E`u4ukehpTlhdYD%=)KW~X_Cd8~P^d4+k0d7t@+*)5I{$BSiR zxj0>{5a)=MqEB2XE)r|R#o`iinYdD1Ev^&Si;d!@f#TcZc5$cpj<{FcF9yUT;!&|x SJT0CP*EW@Sn#fgQ1^)nmMuB_) diff --git a/trunk/KProcessHacker/include/kprocesshacker.h b/trunk/KProcessHacker/include/kprocesshacker.h index 6cb96eba0..c3ac00dc4 100644 --- a/trunk/KProcessHacker/include/kprocesshacker.h +++ b/trunk/KProcessHacker/include/kprocesshacker.h @@ -81,10 +81,16 @@ #define KPH_TIMEOUT_TO_SEC ((LONGLONG) 1 * 10 * 1000 * 1000) #define KPH_REL_TIMEOUT_IN_SEC(Time) (Time * -1 * KPH_TIMEOUT_TO_SEC) +NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath); +VOID DriverUnload(PDRIVER_OBJECT DriverObject); NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS KphDispatchRead(PDEVICE_OBJECT DeviceObject, PIRP Irp); NTSTATUS KphUnsupported(PDEVICE_OBJECT DeviceObject, PIRP Irp); +BOOLEAN AddClientEntry(HANDLE ProcessId); +BOOLEAN IsProcessClient(HANDLE ProcessId); +BOOLEAN RemoveClientEntry(HANDLE ProcessId); + #endif \ No newline at end of file diff --git a/trunk/KProcessHacker/include/protect.h b/trunk/KProcessHacker/include/protect.h index ea111d18e..e250a3004 100644 --- a/trunk/KProcessHacker/include/protect.h +++ b/trunk/KProcessHacker/include/protect.h @@ -38,6 +38,7 @@ typedef struct _KPH_PROCESS_ENTRY { LIST_ENTRY ListEntry; PEPROCESS Process; + PEPROCESS CreatorProcess; HANDLE Tag; LOGICAL AllowKernelMode; ACCESS_MASK ProcessAllowMask; diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c index 654daf83e..38c28ec5d 100644 --- a/trunk/KProcessHacker/kprocesshacker.c +++ b/trunk/KProcessHacker/kprocesshacker.c @@ -28,6 +28,17 @@ #include "include/ps.h" #include "include/version.h" +typedef struct _KPH_CLIENT_ENTRY +{ + LIST_ENTRY ListEntry; + HANDLE ProcessId; +} KPH_CLIENT_ENTRY, *PKPH_CLIENT_ENTRY; + +LIST_ENTRY ClientListHead; +KSPIN_LOCK ClientListLock; +NPAGED_LOOKASIDE_LIST ClientLookasideList; +static BOOLEAN ProtectionInitialized = FALSE; + #pragma alloc_text(PAGE, KphDispatchCreate) #pragma alloc_text(PAGE, KphDispatchClose) #pragma alloc_text(PAGE, KphDispatchDeviceControl) @@ -35,25 +46,6 @@ #pragma alloc_text(PAGE, KphUnsupported) #pragma pack(1) -static BOOLEAN ProtectionInitialized = FALSE; - -VOID DriverUnload(PDRIVER_OBJECT DriverObject) -{ - UNICODE_STRING dosDeviceName; - - RtlInitUnicodeString(&dosDeviceName, KPH_DEVICE_DOS_NAME); - IoDeleteSymbolicLink(&dosDeviceName); - IoDeleteDevice(DriverObject->DeviceObject); - - if (ProtectionInitialized) - { - KphProtectDeinit(); - ProtectionInitialized = FALSE; - } - - dprintf("Driver unloaded\n"); -} - NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { NTSTATUS status = STATUS_SUCCESS; @@ -78,6 +70,19 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) if (!NT_SUCCESS(status)) return status; + /* Initialize client list structures */ + InitializeListHead(&ClientListHead); + KeInitializeSpinLock(&ClientListLock); + ExInitializeNPagedLookasideList( + &ClientLookasideList, + NULL, + NULL, + 0, + sizeof(KPH_CLIENT_ENTRY), + KPH_TAG, + 0 + ); + RtlInitUnicodeString(&deviceName, KPH_DEVICE_NAME); RtlInitUnicodeString(&dosDeviceName, KPH_DEVICE_DOS_NAME); @@ -105,6 +110,26 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) return STATUS_SUCCESS; } +VOID DriverUnload(PDRIVER_OBJECT DriverObject) +{ + UNICODE_STRING dosDeviceName; + + RtlInitUnicodeString(&dosDeviceName, KPH_DEVICE_DOS_NAME); + IoDeleteSymbolicLink(&dosDeviceName); + IoDeleteDevice(DriverObject->DeviceObject); + + /* Destroy client list structures */ + ExDeleteNPagedLookasideList(&ClientLookasideList); + + if (ProtectionInitialized) + { + KphProtectDeinit(); + ProtectionInitialized = FALSE; + } + + dprintf("Driver unloaded\n"); +} + NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) { NTSTATUS status = STATUS_SUCCESS; @@ -119,6 +144,13 @@ NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) } #endif + /* Add a client entry. */ + if (!AddClientEntry(PsGetCurrentProcessId())) + { + Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES; + return STATUS_INSUFFICIENT_RESOURCES; + } + dprintf("Client (PID %d) connected\n", PsGetCurrentProcessId()); dprintf("Base IOCTL is 0x%08x\n", KPH_CTL_CODE(0)); @@ -135,6 +167,9 @@ NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp) dprintf("Removed %d protection entries\n", count); } + /* Remove the client entry. */ + RemoveClientEntry(PsGetCurrentProcessId()); + dprintf("Client (PID %d) disconnected\n", PsGetCurrentProcessId()); return status; @@ -149,6 +184,80 @@ VOID InitProtection() } } +BOOLEAN AddClientEntry(HANDLE ProcessId) +{ + KIRQL oldIrql; + PKPH_CLIENT_ENTRY entry = ExAllocateFromNPagedLookasideList(&ClientLookasideList); + + if (!entry) + return FALSE; + + KeAcquireSpinLock(&ClientListLock, &oldIrql); + InsertHeadList(&ClientListHead, &entry->ListEntry); + KeReleaseSpinLock(&ClientListLock, oldIrql); + + return TRUE; +} + +BOOLEAN IsProcessClient(HANDLE ProcessId) +{ + KIRQL oldIrql; + PLIST_ENTRY entry = ClientListHead.Flink; + + KeAcquireSpinLock(&ClientListLock, &oldIrql); + + while (entry != &ClientListHead) + { + PKPH_CLIENT_ENTRY clientEntry = + CONTAINING_RECORD(entry, KPH_CLIENT_ENTRY, ListEntry); + + if (clientEntry->ProcessId == ProcessId) + { + KeReleaseSpinLock(&ClientListLock, oldIrql); + + return TRUE; + } + + entry = entry->Flink; + } + + KeReleaseSpinLock(&ClientListLock, oldIrql); + + return FALSE; +} + +BOOLEAN RemoveClientEntry(HANDLE ProcessId) +{ + KIRQL oldIrql; + PLIST_ENTRY entry = ClientListHead.Flink; + + KeAcquireSpinLock(&ClientListLock, &oldIrql); + + while (entry != &ClientListHead) + { + PKPH_CLIENT_ENTRY clientEntry = + CONTAINING_RECORD(entry, KPH_CLIENT_ENTRY, ListEntry); + + if (clientEntry->ProcessId == ProcessId) + { + RemoveEntryList(&clientEntry->ListEntry); + ExFreeToNPagedLookasideList( + &ClientLookasideList, + clientEntry + ); + KeReleaseSpinLock(&ClientListLock, oldIrql); + + return TRUE; + } + + entry = entry->Flink; + } + + KeReleaseSpinLock(&ClientListLock, oldIrql); + + return FALSE; +} + /* from YAPM */ NTSTATUS GetObjectName(PFILE_OBJECT FileObject, PVOID Buffer, ULONG BufferLength, PULONG ReturnLength) { diff --git a/trunk/KProcessHacker/protect.c b/trunk/KProcessHacker/protect.c index b6e5b7007..a9d5a394e 100644 --- a/trunk/KProcessHacker/protect.c +++ b/trunk/KProcessHacker/protect.c @@ -161,7 +161,7 @@ NTSTATUS NTAPI KphNewObOpenObjectByPointer( access = DesiredAccess; /* If we have an access state, get the desired access from it. */ - if (PassedAccessState != NULL) + if (PassedAccessState) access = PassedAccessState->OriginalDesiredAccess; /* Search for and copy the corresponding process protection entry. */ @@ -174,6 +174,8 @@ NTSTATUS NTAPI KphNewObOpenObjectByPointer( if ( /* check if kernel-mode is exempt from protection */ !(processEntry.AllowKernelMode && AccessMode == KernelMode) && + /* allow the creator of the rule to bypass protection */ + processEntry.CreatorProcess != PsGetCurrentProcess() && (access & mask) != access ) { @@ -228,10 +230,11 @@ PKPH_PROCESS_ENTRY KphProtectAddEntry( /* Lookaside list no longer needed. */ ExReleaseRundownProtection(&ProtectedProcessRundownProtect); - if (entry == NULL) + if (!entry) return NULL; entry->Process = Process; + entry->CreatorProcess = PsGetCurrentProcess(); entry->Tag = Tag; entry->AllowKernelMode = AllowKernelMode; entry->ProcessAllowMask = ProcessAllowMask; @@ -326,7 +329,7 @@ BOOLEAN KphProtectRemoveByProcess( { PKPH_PROCESS_ENTRY entry = KphProtectFindEntry(Process, NULL); - if (entry == NULL) + if (!entry) return FALSE; KphpProtectRemoveEntry(entry);