/// <summary>
/// Starts filtering process and thread access rights.
/// </summary>
NTSTATUS HsRegisterProtector()
{
NTSTATUS status;
OB_CALLBACK_REGISTRATION callbackRegistration;
OB_OPERATION_REGISTRATION operationRegistration[2];
operationRegistration[0].ObjectType = PsProcessType;
operationRegistration[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
operationRegistration[0].PreOperation = HspObPreCallback;
operationRegistration[0].PostOperation = NULL;
operationRegistration[1].ObjectType = PsThreadType;
operationRegistration[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
operationRegistration[1].PreOperation = HspObPreCallback;
operationRegistration[1].PostOperation = NULL;
callbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
callbackRegistration.RegistrationContext = NULL;
callbackRegistration.OperationRegistrationCount = ARRAYSIZE(operationRegistration);
callbackRegistration.OperationRegistration = operationRegistration;
RtlInitUnicodeString(&callbackRegistration.Altitude, L"40100.7");
FltInitializePushLock(&ObCallbackInstance.ProtectedProcessLock);
RtlInitializeGenericTableAvl(
&ObCallbackInstance.ProtectedProcesses,
HspCompareProtectedProcess,
HsAvlAllocate,
HsAvlFree,
NULL);
status = ObRegisterCallbacks(&callbackRegistration, &ObCallbackInstance.RegistrationHandle);
if (!NT_SUCCESS(status))
FltDeletePushLock(&ObCallbackInstance.ProtectedProcessLock);
return status;
}
CAVL() :
CBinTreeWalker(
(const AVL_NODE<TYPE>**)reinterpret_cast<AVL_NODE<TYPE>**>(&m_avl.BalancedRoot.RightChild),
offsetof(RTL_BALANCED_LINKS, Parent),
offsetof(RTL_BALANCED_LINKS, LeftChild),
offsetof(RTL_BALANCED_LINKS, RightChild)
)
{
RtlInitializeGenericTableAvl(&m_avl, CompareRoutine, AllocationRoutine, FreeRoutine, NULL);
}
PAGEABLE
NTSTATUS
MESSAGETABLE_Create(
_Out_ PHMESSAGETABLE phMessageTable
)
{
NTSTATUS eStatus = STATUS_UNSUCCESSFUL;
PMESSAGE_TABLE ptMessageTable = NULL;
ASSERT(PASSIVE_LEVEL == KeGetCurrentIrql());
if (NULL == phMessageTable)
{
eStatus = STATUS_INVALID_PARAMETER;
goto lblCleanup;
}
ptMessageTable = ExAllocatePoolWithTag(NonPagedPool,
sizeof(*ptMessageTable),
MESSAGE_TABLE_POOL_TAG);
if (NULL == ptMessageTable)
{
eStatus = STATUS_INSUFFICIENT_RESOURCES;
goto lblCleanup;
}
RtlSecureZeroMemory(ptMessageTable, sizeof(*ptMessageTable));
RtlInitializeGenericTableAvl(&(ptMessageTable->tTable),
&messagetable_CompareRoutine,
&messagetable_AllocateRoutine,
&messagetable_FreeRoutine,
NULL);
ptMessageTable->bTableInitialized = TRUE;
eStatus = ExInitializeResourceLite(&(ptMessageTable->tLock));
if (!NT_SUCCESS(eStatus))
{
goto lblCleanup;
}
ptMessageTable->bLockInitialized = TRUE;
// Transfer ownership:
*phMessageTable = (HMESSAGETABLE)ptMessageTable;
ptMessageTable = NULL;
eStatus = STATUS_SUCCESS;
lblCleanup:
#pragma warning(suppress: 4133) // warning C4133: 'function': incompatible types - from 'PMESSAGE_TABLE' to 'HMESSAGETABLE'
CLOSE(ptMessageTable, MESSAGETABLE_Destroy);
return eStatus;
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
{
NTSTATUS status = STATUS_SUCCESS;
PDEVICE_OBJECT deviceObject = NULL;
UNICODE_STRING deviceName;
UNICODE_STRING deviceLink;
UNREFERENCED_PARAMETER( RegistryPath );
// Get OS Dependant offsets
status = BBInitDynamicData( &dynData );
if (!NT_SUCCESS( status ))
{
DPRINT( "BlackBone: %s: Unsupported OS version. Aborting\n", __FUNCTION__ );
return status;
}
// Initialize some loader structures
status = BBInitLdrData( (PKLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection );
if (!NT_SUCCESS( status ))
return status;
//
// Globals init
//
InitializeListHead( &g_PhysProcesses );
RtlInitializeGenericTableAvl( &g_ProcessPageTables, &AvlCompare, &AvlAllocate, &AvlFree, NULL );
KeInitializeGuardedMutex( &g_globalLock );
// Setup process termination notifier
status = PsSetCreateProcessNotifyRoutine( BBProcessNotify, FALSE );
if (!NT_SUCCESS( status ))
{
DPRINT( "BlackBone: %s: Failed to setup notify routine with staus 0x%X\n", __FUNCTION__, status );
return status;
}
RtlUnicodeStringInit( &deviceName, DEVICE_NAME );
status = IoCreateDevice( DriverObject, 0, &deviceName, FILE_DEVICE_BLACKBONE, 0, FALSE, &deviceObject );
if (!NT_SUCCESS( status ))
{
DPRINT( "BlackBone: %s: IoCreateDevice failed with status 0x%X\n", __FUNCTION__, status );
return status;
}
DriverObject->MajorFunction[IRP_MJ_CREATE] =
DriverObject->MajorFunction[IRP_MJ_CLOSE] =
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = BBDispatch;
DriverObject->DriverUnload = BBUnload;
RtlUnicodeStringInit( &deviceLink, DOS_DEVICE_NAME );
status = IoCreateSymbolicLink( &deviceLink, &deviceName );
if (!NT_SUCCESS( status ))
{
DPRINT( "BlackBone: %s: IoCreateSymbolicLink failed with status 0x%X\n", __FUNCTION__, status );
IoDeleteDevice (deviceObject);
}
return status;
}
