/*
@implemented
*/
NTSTATUS
NTAPI
KsAddItemToObjectBag(
IN KSOBJECT_BAG ObjectBag,
IN PVOID Item,
IN PFNKSFREE Free OPTIONAL)
{
PKSIOBJECT_BAG Bag;
PKSIOBJECT_BAG_ENTRY BagEntry;
DPRINT("KsAddItemToObjectBag\n");
/* get real object bag */
Bag = (PKSIOBJECT_BAG)ObjectBag;
/* acquire bag mutex */
KeWaitForSingleObject(Bag->BagMutex, Executive, KernelMode, FALSE, NULL);
/* is the item already present in this object bag */
BagEntry = KspFindObjectBagItem(&Bag->ObjectList, Item);
if (BagEntry)
{
/* is is, update reference count */
InterlockedIncrement((PLONG)&BagEntry->References);
/* release mutex */
KeReleaseMutex(Bag->BagMutex, FALSE);
/* return result */
return STATUS_SUCCESS;
}
/* item is new, allocate entry */
BagEntry = AllocateItem(NonPagedPool, sizeof(KSIOBJECT_BAG_ENTRY));
if (!BagEntry)
{
/* no memory */
KeReleaseMutex(Bag->BagMutex, FALSE);
/* return result */
return STATUS_INSUFFICIENT_RESOURCES;
}
/* initialize bag entry */
BagEntry->References = 1;
BagEntry->Item = Item;
if (Free)
BagEntry->Free = Free;
else
BagEntry->Free = ExFreePool;
/* insert item */
InsertTailList(&Bag->ObjectList, &BagEntry->Entry);
/* release mutex */
KeReleaseMutex(Bag->BagMutex, FALSE);
/* done */
return STATUS_SUCCESS;
}
/*
@implemented
*/
KSDDKAPI
NTSTATUS
NTAPI
KsCopyObjectBagItems(
IN KSOBJECT_BAG ObjectBagDestination,
IN KSOBJECT_BAG ObjectBagSource)
{
PKSIOBJECT_BAG ObjectBagDest, ObjectBagSrc;
PLIST_ENTRY Entry;
PKSIOBJECT_BAG_ENTRY BagEntry;
NTSTATUS Status = STATUS_SUCCESS;
/* get object bag src */
ObjectBagSrc = (PKSIOBJECT_BAG)ObjectBagSource;
/* get object bag dst */
ObjectBagDest = (PKSIOBJECT_BAG)ObjectBagDestination;
/* acquire source mutex */
KeWaitForSingleObject(ObjectBagSrc->BagMutex, Executive, KernelMode, FALSE, NULL);
if (ObjectBagSrc->BagMutex != ObjectBagDest->BagMutex)
{
/* acquire destination mutex */
KeWaitForSingleObject(ObjectBagDest->BagMutex, Executive, KernelMode, FALSE, NULL);
}
/* point to first item */
Entry = ObjectBagSrc->ObjectList.Flink;
/* first scan the list if the item is already inserted */
while(Entry != &ObjectBagSrc->ObjectList)
{
/* get bag entry */
BagEntry = (PKSIOBJECT_BAG_ENTRY)CONTAINING_RECORD(Entry, KSIOBJECT_BAG_ENTRY, Entry);
/* add the item */
Status = KsAddItemToObjectBag(ObjectBagDestination, BagEntry->Item, BagEntry->Free);
/* check for success */
if (!NT_SUCCESS(Status))
break;
/* move to next entry */
Entry = Entry->Flink;
}
if (ObjectBagSrc->BagMutex != ObjectBagDest->BagMutex)
{
/* release destination mutex */
KeReleaseMutex(ObjectBagDest->BagMutex, FALSE);
}
/* release source mutex */
KeReleaseMutex(ObjectBagSrc->BagMutex, FALSE);
return Status;
}
NTSTATUS
YtDisableOnPartition(
PDEVICE_OBJECT DeviceObject,
LONG PartitionIndex
)
{
PDEVICE_EXTENSION deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;
if(!deviceExtension->IsProtected)
{
DebugPrint(("YtEnableOnPartition: device %p is not protected.\n", DeviceObject));
return STATUS_DEVICE_NOT_READY;
}
if(PartitionIndex < 0 || PartitionIndex >= (LONG) deviceExtension->DriveLayout->PartitionCount)
{
DebugPrint(("YtDisableOnPartition: illegal partition index %d for device %p.\n", PartitionIndex, DeviceObject));
return STATUS_DEVICE_NOT_READY;
}
KeWaitForSingleObject(
&deviceExtension->PartStatus[PartitionIndex].Mutex,
Executive,
KernelMode,
FALSE,
NULL
);
if(!deviceExtension->PartStatus[PartitionIndex].IsProtected)
{
DebugPrint(("YtEnableOnPartition: protection on partition %d of device %p already disabled.\n",
deviceExtension->DriveLayout->PartitionEntry[PartitionIndex].PartitionNumber, DeviceObject));
KeReleaseMutex(&deviceExtension->PartStatus[PartitionIndex].Mutex, 0);
return STATUS_SUCCESS;
}
free_rb_tree(deviceExtension->PartStatus[PartitionIndex].Tree.root);
deviceExtension->PartStatus[PartitionIndex].Tree.root = NULL;
deviceExtension->PartStatus[PartitionIndex].IsProtected = FALSE;
YtUninitContext(DeviceObject, PartitionIndex);
DebugPrint(("YtEnableOnPartition: protection on partition %d of device %p disabled successfully.\n",
deviceExtension->DriveLayout->PartitionEntry[PartitionIndex].PartitionNumber, DeviceObject));
KeReleaseMutex(&deviceExtension->PartStatus[PartitionIndex].Mutex, 0);
return STATUS_SUCCESS;
}
//--------------------------------------------------------------------------------------
void DbgOpenLogFile(void)
{
OBJECT_ATTRIBUTES ObjAttr;
IO_STATUS_BLOCK StatusBlock;
UNICODE_STRING usFileName;
RtlInitUnicodeString(&usFileName, DBG_LOGFILE_NAME);
InitializeObjectAttributes(&ObjAttr, &usFileName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE , NULL, NULL);
KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);
NTSTATUS status = ZwCreateFile(
&hDbgLogFile,
FILE_ALL_ACCESS | SYNCHRONIZE,
&ObjAttr,
&StatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OVERWRITE_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0
);
if (!NT_SUCCESS(status))
{
DbgMsg(__FILE__, __LINE__, "ZwCreateFile() fails; status: 0x%.8x\n", status);
}
KeReleaseMutex(&DbgMutex, FALSE);
}
//--------------------------------------------------------------------------------------
void DbgOpenPipe(void)
{
OBJECT_ATTRIBUTES ObjAttr;
IO_STATUS_BLOCK IoStatusBlock;
UNICODE_STRING usPipeName;
RtlInitUnicodeString(&usPipeName, L"\\Device\\NamedPipe\\" DBG_PIPE_NAME);
InitializeObjectAttributes(&ObjAttr, &usPipeName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);
// open data pipe by name
NTSTATUS status = ZwCreateFile(
&hDbgPipe,
FILE_WRITE_DATA | SYNCHRONIZE,
&ObjAttr,
&IoStatusBlock,
0,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0
);
if (!NT_SUCCESS(status))
{
DbgMsg(__FILE__, __LINE__, "ZwCreateFile() fails; status: 0x%.8x\n", status);
}
KeReleaseMutex(&DbgMutex, FALSE);
}
void dc_update_volume(dev_hook *hook)
{
void *p_buff = NULL;
u64 old_sz = hook->dsk_size;
wait_object_infinity(&hook->busy_lock);
if (IS_STORAGE_ON_END(hook->flags) != 0)
{
if ( (p_buff = mm_alloc(hook->head_len, 0)) == NULL ) {
goto exit;
}
if (NT_SUCCESS(io_device_rw(hook->hook_dev, p_buff, hook->head_len, 0, 1)) == FALSE) {
goto exit;
}
}
if (io_hook_ioctl(hook, IOCTL_VOLUME_UPDATE_PROPERTIES, NULL, 0, NULL, 0) != ST_OK) {
goto exit;
}
if ( (dc_fill_disk_info(hook) != ST_OK) || (hook->dsk_size == old_sz) ) {
goto exit;
} else {
hook->use_size += hook->dsk_size - old_sz;
}
if (p_buff != NULL) {
hook->stor_off = hook->dsk_size - hook->head_len;
io_device_rw(hook->hook_dev, p_buff, hook->head_len, 0, 0);
}
exit:
if (p_buff != NULL) mm_free(p_buff);
KeReleaseMutex(&hook->busy_lock, FALSE);
}
/*
kd> kb
ChildEBP RetAddr Args to Child
f8afdaa8 805c62ae f8afdcf0 00000000 f8afdb44 DrvHide!LoadImageNotify+0x10
f8afdac8 805a4159 f8afdcf0 00000000 f8afdb44 nt!PsCallImageNotifyRoutines+0x36
f8afdc6c 80576483 f8afdcf0 00000000 00000000 nt!MmLoadSystemImage+0x9e5
f8afdd4c 8057688f 80000378 00000001 00000000 nt!IopLoadDriver+0x371
f8afdd74 80534c02 80000378 00000000 823c63c8 nt!IopLoadUnloadDriver+0x45
f8afddac 805c6160 b286ecf4 00000000 00000000 nt!ExpWorkerThread+0x100
f8afdddc 80541dd2 80534b02 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
*/
VOID LoadImageNotify(
PUNICODE_STRING FullImageName,
HANDLE ProcessId, // where image is mapped
PIMAGE_INFO ImageInfo)
{
KeWaitForMutexObject(&m_GlobalMutex, Executive, KernelMode, FALSE, NULL);
// check for kernel driver
if (ProcessId == 0 && ImageInfo->SystemModeImage && !m_bFreeAreaFound &&
IsKnownDriver(FullImageName))
{
PVOID TargetImageBase = ImageInfo->ImageBase;
ULONG TargetImageSize = ImageInfo->ImageSize;
DbgMsg(
__FILE__, __LINE__, "%d '%wZ' is at "IFMT", size: %d\n",
PsGetCurrentProcessId(), FullImageName, TargetImageBase, TargetImageSize
);
// check for free area at the image discardable sections
if (m_bFreeAreaFound = CheckForFreeArea(TargetImageBase, &m_FreeAreaRVA, &m_FreeAreaLength))
{
m_FreeAreaVA = RVATOVA(TargetImageBase, m_FreeAreaRVA);
DbgMsg(__FILE__, __LINE__, "Free area found!\n");
// hook image entry point
HookImageEntry(TargetImageBase);
}
}
KeReleaseMutex(&m_GlobalMutex, FALSE);
}
void
PGPdiskMutex::Leave(PGPBoolean wait)
{
pgpAssertAddrValid(mMutexPointer, KMUTEX);
KeReleaseMutex(mMutexPointer, wait);
}
int dc_format_done(wchar_t *dev_name)
{
dev_hook *hook = NULL;
int resl;
DbgMsg("dc_format_done\n");
do
{
if ( (hook = dc_find_hook(dev_name)) == NULL ) {
resl = ST_NF_DEVICE; break;
}
wait_object_infinity(&hook->busy_lock);
if ( !(hook->flags & F_FORMATTING) ) {
resl = ST_ERROR; break;
}
/* set hook fields */
hook->tmp_size = 0;
hook->flags &= ~F_FORMATTING;
/* free resources */
dc_wipe_free(&hook->wp_ctx);
mm_free(hook->tmp_buff);
mm_free(hook->tmp_key);
resl = ST_OK;
} while (0);
if (hook != NULL) {
KeReleaseMutex(&hook->busy_lock, FALSE);
dc_deref_hook(hook);
}
return resl;
}
BOOLEAN
KMutexRelease(KMUTEX * mutex)
{
if (!KeReleaseMutex(mutex, FALSE))
return TRUE;
return FALSE;
}
/*
* DriverUnload
*
* Purpose:
*
* Driver unload procedure.
*
*/
VOID DriverUnload(
_In_ struct _DRIVER_OBJECT *DriverObject
)
{
PAGED_CODE();
UNICODE_STRING SymLink;
#ifdef _DEBUGMSG
DbgPrint("[TSMI] Unload, DrvObj = %p\n", DriverObject);
#endif
if (g_NotifySet) {
PsRemoveLoadImageNotifyRoutine(TsmiPsImageHandler);
}
KeWaitForSingleObject(&g_VBoxDD.Lock, Executive, KernelMode, FALSE, NULL);
if (g_VBoxDD.Chains) {
ExFreePoolWithTag(g_VBoxDD.Chains, TSUGUMI_TAG);
g_VBoxDD.Chains = NULL;
g_VBoxDD.ChainsLength = 0;
}
KeReleaseMutex(&g_VBoxDD.Lock, FALSE);
RtlInitUnicodeString(&SymLink, TSUGUMI_SYM_LINK);
IoDeleteSymbolicLink(&SymLink);
IoDeleteDevice(DriverObject->DeviceObject);
}
/*
* TsmiCopyPatchChainsData
*
* Purpose:
*
* Copy/Refresh patch chains data to global variable.
*
*/
VOID TsmiCopyPatchChainsData(
_In_ VBOX_PATCH *Src,
_In_ VBOX_PATCH *Dst
)
{
PAGED_CODE();
if ((Src == NULL) || (Dst == NULL))
return;
if ((Src->Chains == NULL) || (Src->ChainsLength == 0))
return;
KeWaitForSingleObject(&Dst->Lock, Executive, KernelMode, FALSE, NULL);
if (Dst->Chains != NULL) {
ExFreePoolWithTag(Dst->Chains, TSUGUMI_TAG);
Dst->Chains = NULL;
Dst->ChainsLength = 0;
}
Dst->Chains = Src->Chains;
Dst->ChainsLength = Src->ChainsLength;
KeReleaseMutex(&Dst->Lock, FALSE);
}
BOOL
ShareLockKImp::Unlock() {
switch(m_LockType) {
case LockTypeMutex:
return KeReleaseMutex(&m_LockObject.m_Mutex.m_Mutex,
FALSE);
break;
case LockTypeEvent:
return KeSetEvent(&m_LockObject.m_Event.m_Event,
IO_NO_INCREMENT,
FALSE);
break;
case LockTypeSemaphore:
return KeReleaseSemaphore(&m_LockObject.m_Semaphore.m_Semaphore,
IO_NO_INCREMENT,
1,
FALSE);
break;
case LockTypeSpinlock:
break;
case LockTypeNamedSpinlock: {
if (m_LockObject.m_NamedSpinlock.m_lpHeader) {
InterlockedCompareExchange(&m_LockObject.m_NamedSpinlock.m_lpHeader->m_LockProcId,
0,
(LONG)PsGetCurrentProcessId());
return STATUS_SUCCESS;
}
}
break;
default:
break;
}
return FALSE;
}
NTSTATUS ScanCache_Unlock ()
{
ASSERT (g_data.bInitialized) ;
ASSERT (ScanCache_IsLocked()) ;
KeReleaseMutex (&g_data.mutex, FALSE) ;
return STATUS_SUCCESS ;
}
NTSTATUS
NTAPI
IKsDevice_fnReleaseDevice(
IN IKsDevice * iface)
{
PKSIDEVICE_HEADER This = (PKSIDEVICE_HEADER)CONTAINING_RECORD(iface, KSIDEVICE_HEADER, BasicHeader.OuterUnknown);
return KeReleaseMutex(&This->DeviceMutex, FALSE);
}
VOID DrvFilter_UnlockMutex ()
{
// verify that this module is initialized
ASSERT (g_data.bInitialized) ;
ASSERT (DrvFilter_IsLocked()) ;
KeReleaseMutex (&g_data.mutex, FALSE) ;
}
VOID UnlockLcxlMutexRead(PMultiReadMutex pMutex)//解锁读互斥
{
ExAcquireFastMutex(&pMutex->kReadMutex);
pMutex->iReadCount--;
if (pMutex->iReadCount == 0) {
KeReleaseMutex(&pMutex->kRWMutex, FALSE);
}
ExReleaseFastMutex(&pMutex->kReadMutex);
}
/**
* effects: install Vis on the fly.
*/
NTSTATUS NTAPI HvmSwallowBluepill()
{//SAME
CCHAR cProcessorNumber;
NTSTATUS Status, CallbackStatus;
Print(("HelloWorld:HvmSwallowBluepill(): Going to subvert %d processor%s\n",
KeNumberProcessors, KeNumberProcessors == 1 ? "" : "s"));
KeWaitForSingleObject (&g_HvmMutex, Executive, KernelMode, FALSE, NULL);
for (cProcessorNumber = 0; cProcessorNumber < KeNumberProcessors; cProcessorNumber++)
{
Print(("HelloWorld:HvmSwallowBluepill():Installing HelloWorld VT Root Manager on processor #%d\n", cProcessorNumber));
Status = CmDeliverToProcessor(cProcessorNumber, CmSubvert, NULL, &CallbackStatus);
if (!NT_SUCCESS (Status)) {
Print(("HelloWorld:HvmSwallowBluepill(): CmDeliverToProcessor() failed with status 0x%08hX\n", Status));
KeReleaseMutex (&g_HvmMutex, FALSE);
HvmSpitOutBluepill ();
return Status;
}
if (!NT_SUCCESS (CallbackStatus)) {
Print(("HelloWorld:HvmSwallowBluepill(): HvmSubvertCpu() failed with status 0x%08hX\n", CallbackStatus));
KeReleaseMutex (&g_HvmMutex, FALSE);
HvmSpitOutBluepill ();
return CallbackStatus;
}
}
KeReleaseMutex (&g_HvmMutex, FALSE);
if (KeNumberProcessors != g_uSubvertedCPUs) {
HvmSpitOutBluepill ();
return STATUS_UNSUCCESSFUL;
}
return STATUS_SUCCESS;
}
int down_read_trylock( struct rw_semaphore *sem)
{
NTSTATUS nts = KeWaitForMutexObject( ( KMUTEX *)sem->mutex, Executive, KernelMode, FALSE, 0);
if ( nts == STATUS_SUCCESS)
{
sem->reader_count++;
KeReleaseMutex( ( KMUTEX *)sem->mutex, FALSE);
}
return nts != STATUS_SUCCESS;
}
int dc_backup_header(wchar_t *dev_name, dc_pass *password, void *out)
{
dc_header *header = NULL;
xts_key *hdr_key = NULL;
dev_hook *hook = NULL;
int resl;
s8 salt[PKCS5_SALT_SIZE];
do
{
if ( (hook = dc_find_hook(dev_name)) == NULL ) {
resl = ST_NF_DEVICE; break;
}
wait_object_infinity(&hook->busy_lock);
if (hook->flags & (F_SYNC | F_UNSUPRT | F_DISABLE | F_CDROM)) {
resl = ST_ERROR; break;
}
if ( (hdr_key = mm_alloc(sizeof(xts_key), MEM_SECURE)) == NULL ) {
resl = ST_NOMEM; break;
}
/* get device params */
if (hook->dsk_size == 0) {
if ( (resl = dc_fill_disk_info(hook)) != ST_OK ) break;
}
if ( (resl = io_read_header(hook, &header, NULL, password)) != ST_OK ) {
break;
}
/* generate new salt */
cp_rand_bytes(header->salt, PKCS5_SALT_SIZE);
/* save original salt */
memcpy(salt, header->salt, PKCS5_SALT_SIZE);
/* init new header key */
cp_set_header_key(hdr_key, header->salt, header->alg_1, password);
/* encrypt header with new key */
xts_encrypt(pv(header), pv(header), sizeof(dc_header), 0, hdr_key);
/* restore original salt */
memcpy(header->salt, salt, PKCS5_SALT_SIZE);
/* copy header to output */
memcpy(out, header, sizeof(dc_header));
resl = ST_OK;
} while (0);
if (hook != NULL) {
KeReleaseMutex(&hook->busy_lock, FALSE);
dc_deref_hook(hook);
}
/* prevent leaks */
burn(salt, sizeof(salt));
/* free memory */
if (header != NULL) mm_free(header);
if (hdr_key != NULL) mm_free(hdr_key);
return resl;
}
//--------------------------------------------------------------------------------------
void DbgClosePipe(void)
{
KeWaitForMutexObject(&DbgMutex, Executive, KernelMode, FALSE, NULL);
if (hDbgPipe)
{
ZwClose(hDbgPipe);
hDbgPipe = NULL;
}
KeReleaseMutex(&DbgMutex, FALSE);
}
NTSTATUS WatchObjs_Unlock ()
{
// TRACE ;
// verify that this module is initialized
ASSERT (g_data.bInitialized) ;
ASSERT (_WatchObjs_IsLocked()) ;
KeReleaseMutex (&g_data.mutex, FALSE) ;
return STATUS_SUCCESS ;
}
static
NTSTATUS dc_process_power_irp(dev_hook *hook, PIRP irp)
{
NTSTATUS status;
PIO_STACK_LOCATION irp_sp;
int no_pass = 0;
irp_sp = IoGetCurrentIrpStackLocation(irp);
if ( (irp_sp->MinorFunction == IRP_MN_SET_POWER) &&
(irp_sp->Parameters.Power.Type == SystemPowerState) )
{
wait_object_infinity(&hook->busy_lock);
if (irp_sp->Parameters.Power.State.SystemState == PowerSystemHibernate)
{
/* prevent device encryption to sync device and memory state */
hook->flags |= F_PREVENT_ENC;
dc_send_sync_packet(hook->dev_name, S_OP_SYNC, 0);
}
if (irp_sp->Parameters.Power.State.SystemState == PowerSystemWorking) {
/* allow encryption requests */
hook->flags &= ~F_PREVENT_ENC;
}
KeReleaseMutex(&hook->busy_lock, FALSE);
}
if ( (irp_sp->MinorFunction == IRP_MN_QUERY_POWER) &&
(irp_sp->Parameters.Power.Type == SystemPowerState) &&
(irp_sp->Parameters.Power.State.SystemState == PowerSystemHibernate) )
{
if ( (dc_is_vista_or_later == 0) && (dump_is_pverent_hibernate() != 0) ) {
PoStartNextPowerIrp(irp);
status = dc_complete_irp(irp, STATUS_UNSUCCESSFUL, 0);
no_pass = 1;
}
}
if (no_pass == 0) {
PoStartNextPowerIrp(irp);
IoSkipCurrentIrpStackLocation(irp);
status = PoCallDriver(hook->orig_dev, irp);
}
IoReleaseRemoveLock(&hook->remv_lock, irp);
return status;
}
/*
* This helper runs a program from the driver service.
* Connection is estabilished with named pipe.
*/
void run_process(DWORD i, WCHAR *pwcProg)
{
DbgPrint("Runing %ls...\r\n", pwcProg);
while (!NT_SUCCESS(KeWaitForMutexObject(&mutex, Executive,
KernelMode, FALSE, NULL)));
LARGE_INTEGER delay = RtlConvertUlongToLargeInteger(300000l);
NTSTATUS status;
HANDLE pipe;
OBJECT_ATTRIBUTES fattrs;
UNICODE_STRING pipe_name;
IO_STATUS_BLOCK io_stat_block;
RtlInitUnicodeString(&pipe_name, L"\\??\\pipe\\drvtest");
InitializeObjectAttributes(&fattrs, &pipe_name,
OBJ_CASE_INSENSITIVE | 0x0200/*OBJ_KERNEL_HANDLE*/,
0, NULL);
status = ZwCreateFile(&pipe, FILE_WRITE_DATA | FILE_READ_DATA | SYNCHRONIZE,
&fattrs, &io_stat_block, NULL, 0,
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN,
FILE_NON_DIRECTORY_FILE, NULL, 0);
if (!NT_SUCCESS(status))
DbgPrint("Alert! 0x%0.8x, 0x%0.8x\r\n", status, io_stat_block.Status);
example_ioctl_data out_data = { code: MCODE_SPAWN };
wcscpy(out_data.rprog, pwcProg);
status = ZwWriteFile(pipe, NULL, NULL, NULL, &io_stat_block, &out_data,
sizeof(out_data), NULL, NULL);
if (!NT_SUCCESS(status))
DbgPrint("Alert! 0x%0.8x\r\n", status);
DWORD pid;
do {
status = ZwReadFile(pipe, NULL, NULL, NULL, &io_stat_block, &pid,
sizeof(DWORD), NULL, NULL);
if (!NT_SUCCESS(status))
KeDelayExecutionThread(KernelMode, FALSE, &delay);
} while(STATUS_PENDING == status);
if (!NT_SUCCESS(status))
DbgPrint("Alert! 0x%0.8x\r\n", status);
DbgPrint("PID: %d\r\n", pid);
g_proc_table[i].sl_pid = pid;
ZwClose(pipe);
KeReleaseMutex(&mutex, FALSE);
return;
/* return proc_infn.dwProcessId; */
}
int dc_change_pass(wchar_t *dev_name, dc_pass *old_pass, dc_pass *new_pass)
{
dc_header *header = NULL;
dev_hook *hook = NULL;
int wp_init = 0;
int resl;
wipe_ctx wipe;
do
{
if ( (hook = dc_find_hook(dev_name)) == NULL ) {
resl = ST_NF_DEVICE; break;
}
wait_object_infinity(&hook->busy_lock);
if ( !(hook->flags & F_ENABLED) ) {
resl = ST_NO_MOUNT; break;
}
if (hook->flags & (F_SYNC | F_FORMATTING | F_CDROM)) {
resl = ST_ERROR; break;
}
/* read old volume header */
if ( (resl = io_read_header(hook, &header, NULL, old_pass)) != ST_OK ) {
break;
}
/* init data wipe */
if ( (resl = dc_wipe_init(
&wipe, hook, hook->head_len, WP_GUTMANN, hook->crypt.cipher_id)) == ST_OK )
{
wp_init = 1;
} else break;
/* wipe volume header */
dc_wipe_process(&wipe, 0, hook->head_len);
/* write new volume header */
resl = io_write_header(hook, header, NULL, new_pass);
} while (0);
if (wp_init != 0) {
dc_wipe_free(&wipe);
}
if (hook != NULL) {
KeReleaseMutex(&hook->busy_lock, FALSE);
dc_deref_hook(hook);
}
if (header != NULL) mm_free(header);
return resl;
}
NTSTATUS ScanCache_Uninit ()
{
TRACE ;
ASSERT (g_data.bInitialized) ;
ScanCache_Lock () ;
KeSetEvent (&g_data.event, 0, FALSE) ;
FREE (g_data.pEntries) ;
g_data.bInitialized = FALSE ;
KeReleaseMutex (&g_data.mutex, FALSE) ;
return STATUS_SUCCESS ;
}
int dc_restore_header(wchar_t *dev_name, dc_pass *password, void *in)
{
dc_header *header = NULL;
xts_key *hdr_key = NULL;
dev_hook *hook = NULL;
int resl;
do
{
if ( (hook = dc_find_hook(dev_name)) == NULL ) {
resl = ST_NF_DEVICE; break;
}
wait_object_infinity(&hook->busy_lock);
if (hook->flags & (F_ENABLED | F_CDROM)) {
resl = ST_ERROR; break;
}
/* get device params */
if (hook->dsk_size == 0) {
if ( (resl = dc_fill_disk_info(hook)) != ST_OK ) break;
}
if ( (header = mm_alloc(sizeof(dc_header), MEM_SECURE)) == NULL ) {
resl = ST_NOMEM; break;
}
/* copy header from input */
memcpy(header, in, sizeof(dc_header));
if ( (hdr_key = mm_alloc(sizeof(xts_key), MEM_SECURE)) == NULL ) {
resl = ST_NOMEM; break;
}
/* decrypt header */
if (cp_decrypt_header(hdr_key, header, password) == 0) {
resl = ST_PASS_ERR; break;
}
/* write new volume header */
resl = io_write_header(hook, header, NULL, password);
} while (0);
if (hook != NULL) {
KeReleaseMutex(&hook->busy_lock, FALSE);
dc_deref_hook(hook);
}
if (hdr_key != NULL) mm_free(hdr_key);
if (header != NULL) mm_free(header);
return resl;
}
/*
@implemented
*/
KSDDKAPI
VOID
NTAPI
KsFreeObjectBag(
IN KSOBJECT_BAG ObjectBag)
{
PLIST_ENTRY Entry;
PKSIOBJECT_BAG Bag;
PKSIOBJECT_BAG_ENTRY BagEntry;
ULONG TotalRefs;
/* get real object bag */
Bag = (PKSIOBJECT_BAG)ObjectBag;
/* acquire bag mutex */
KeWaitForSingleObject(Bag->BagMutex, Executive, KernelMode, FALSE, NULL);
while(!IsListEmpty(&Bag->ObjectList))
{
/* get an bag entry */
Entry = RemoveHeadList(&Bag->ObjectList);
/* access bag entry item */
BagEntry = (PKSIOBJECT_BAG_ENTRY)CONTAINING_RECORD(Entry, KSIOBJECT_BAG, Entry);
/* check if the item is present in some other bag */
TotalRefs = KspGetObjectItemReferenceCount((PKSIDEVICE_HEADER)Bag->DeviceHeader, &BagEntry->Item);
if (TotalRefs == 0)
{
/* item is ready to be freed */
BagEntry->Free(BagEntry->Item);
}
/* free bag entry item */
FreeItem(BagEntry);
}
/* remove bag entry from device object list */
RemoveEntryList(&Bag->Entry);
/* release bag mutex */
KeReleaseMutex(Bag->BagMutex, FALSE);
/* now free object bag */
FreeItem(Bag);
}
//=============================================================================
STDMETHODIMP_(NTSTATUS) CMiniportWaveCyclicStream::SetFormat(
IN PKSDATAFORMAT Format
)
/*++
Routine Description:
The SetFormat function changes the format associated with a stream.
Callers of SetFormat should run at IRQL PASSIVE_LEVEL
Arguments:
Format - Pointer to a KSDATAFORMAT structure which indicates the new format
of the stream.
Return Value:
NT status code.
--*/
{
PAGED_CODE();
ASSERT(Format);
DPF_ENTER(("[CMiniportWaveCyclicStream::SetFormat]"));
NTSTATUS ntStatus = STATUS_INVALID_DEVICE_REQUEST;
PWAVEFORMATEX pWfx;
if (m_ksState != KSSTATE_RUN) {
// MSVAD does not validate the format.
pWfx = GetWaveFormatEx(Format);
if (pWfx) {
ntStatus = KeWaitForSingleObject(&m_pMiniport->m_SampleRateSync, Executive, KernelMode, FALSE, NULL);
if (STATUS_SUCCESS == ntStatus) {
m_usBlockAlign = pWfx->nBlockAlign;
m_fFormat16Bit = (pWfx->wBitsPerSample == 16);
m_pMiniport->m_SamplingFrequency = pWfx->nSamplesPerSec;
m_ulDmaMovementRate = pWfx->nAvgBytesPerSec;
DPF(D_TERSE, ("New Format - SpS: %d - BpS: %d - aBypS: %d - C: %d", pWfx->nSamplesPerSec, pWfx->wBitsPerSample, pWfx->nAvgBytesPerSec, pWfx->nChannels));
}
KeReleaseMutex(&m_pMiniport->m_SampleRateSync, FALSE);
}
}
return ntStatus;
} // SetFormat
NTSTATUS STDCALL my_ioctl(PDEVICE_OBJECT deviceObject, PIRP Irp) {
NTSTATUS status = STATUS_SUCCESS;
BOOLEAN mutexHeld = FALSE;
DbgPrint("my_ioctl called\n");
DbgPrint("Attached device: 0x%08X\n", deviceObject->AttachedDevice);
device_context_t* context = (device_context_t*) deviceObject->DeviceExtension;
status = KeWaitForMutexObject(&(context->mutex), Executive, KernelMode, FALSE, NULL);
if(status != STATUS_SUCCESS) {
DbgPrint("Mutex problem\n");
goto cleanup;
}
mutexHeld = TRUE;
PIO_STACK_LOCATION pIoStackIrp = IoGetCurrentIrpStackLocation(Irp);
if(!pIoStackIrp) {
DbgPrint("No I/O stack location\n");
status = STATUS_UNSUCCESSFUL;
goto cleanup;
}
DbgPrint("IOCTL = 0x%08X\n", pIoStackIrp->Parameters.DeviceIoControl.IoControlCode);
switch (pIoStackIrp->Parameters.DeviceIoControl.IoControlCode) {
case MY_IOCTL_PUSH:
status = my_ioctl_push(context, Irp);
break;
case MY_IOCTL_POP:
status = my_ioctl_pop(context, Irp);
break;
default:
status = STATUS_NOT_SUPPORTED;
break;
}
cleanup:
if (mutexHeld) {
KeReleaseMutex(&(context->mutex), FALSE);
}
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return status;
}
