mirrors/fort
1
0
Fork 0
mirror of https://github.com/tnodir/fort synced 2024-11-15 08:35:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Driver: Don't expand kernel stack for workers

Browse Source
This commit is contained in:
Nodir Temirkhodjaev 2023-04-15 18:58:30 +03:00
parent a2c5eb33c6
commit 153e41563b
8 changed files with 11 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
src/driver/evt/FORTEVT_MSG00001.bin
View File

Binary file not shown.

11
src/driver/evt/fortevt.h
View File

@ -39,7 +39,6 @@
#define FACILITY_DRIVER 0x4 #define FACILITY_DRIVER 0x4
#define FACILITY_SHAPER 0x5 #define FACILITY_SHAPER 0x5
#define FACILITY_PROCESS_TREE 0x6 #define FACILITY_PROCESS_TREE 0x6
#define FACILITY_WORKER 0x7
// //
@ -173,14 +172,4 @@
// //
#define FORT_PSTREE_ENUM_PROCESSES_ERROR ((NTSTATUS)0xC0060002L) #define FORT_PSTREE_ENUM_PROCESSES_ERROR ((NTSTATUS)0xC0060002L)
/* Worker */
//
// MessageId: FORT_WORKER_CALLBACK_ERROR
//
// MessageText:
//
// Worker: Callback Error.
//
#define FORT_WORKER_CALLBACK_ERROR ((NTSTATUS)0xC0070001L)
#endif // FORTEVT_H #endif // FORTEVT_H

7
src/driver/evt/fortevt.mc
View File

@ -21,7 +21,6 @@ FacilityNames = (
Driver = 4:FACILITY_DRIVER Driver = 4:FACILITY_DRIVER
Shaper = 5:FACILITY_SHAPER Shaper = 5:FACILITY_SHAPER
ProcessTree = 6:FACILITY_PROCESS_TREE ProcessTree = 6:FACILITY_PROCESS_TREE
Worker = 7:FACILITY_WORKER
) )
@ -101,10 +100,4 @@ Language=English
Enum Processes Error. Enum Processes Error.
. .
;/* Worker */
MessageId=1 Facility=Worker Severity=Error SymbolicName=FORT_WORKER_CALLBACK_ERROR
Language=English
Worker: Callback Error.
.
;#endif // FORTEVT_H ;#endif // FORTEVT_H

10
src/driver/fortdev.c
View File

@ -21,10 +21,8 @@ FORT_API void fort_device_set(PFORT_DEVICE device)
g_device = device; g_device = device;
} }
static void NTAPI fort_worker_reauth(PVOID worker) static void NTAPI fort_worker_reauth(void)
{ {
UNUSED(worker);
const FORT_CONF_FLAGS conf_flags = fort_device()->conf.conf_flags; const FORT_CONF_FLAGS conf_flags = fort_device()->conf.conf_flags;
NTSTATUS status; NTSTATUS status;
@ -215,7 +213,7 @@ static NTSTATUS fort_device_control_app(const PFORT_APP_ENTRY app_entry, ULONG l
fort_conf_ref_put(&fort_device()->conf, conf_ref); fort_conf_ref_put(&fort_device()->conf, conf_ref);
if (NT_SUCCESS(status)) { if (NT_SUCCESS(status)) {
fort_worker_reauth(NULL); fort_worker_reauth();
} }
return status; return status;
@ -235,7 +233,7 @@ static NTSTATUS fort_device_control_setzones(const PFORT_CONF_ZONES zones, ULONG
} else { } else {
fort_conf_zones_set(&fort_device()->conf, conf_zones); fort_conf_zones_set(&fort_device()->conf, conf_zones);
fort_worker_reauth(NULL); fort_worker_reauth();
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }
@ -249,7 +247,7 @@ static NTSTATUS fort_device_control_setzoneflag(const PFORT_CONF_ZONE_FLAG zone_
if (len == sizeof(FORT_CONF_ZONE_FLAG)) { if (len == sizeof(FORT_CONF_ZONE_FLAG)) {
fort_conf_zone_flag_set(&fort_device()->conf, zone_flag); fort_conf_zone_flag_set(&fort_device()->conf, zone_flag);
fort_worker_reauth(NULL); fort_worker_reauth();
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }

4
src/driver/fortps.c
View File

@ -825,10 +825,8 @@ static void fort_pstree_enum_processes_loop(
} }
} }
FORT_API void NTAPI fort_pstree_enum_processes(PVOID worker) FORT_API void NTAPI fort_pstree_enum_processes(void)
{ {
UNUSED(worker);
NTSTATUS status; NTSTATUS status;
ULONG bufferSize; ULONG bufferSize;

2
src/driver/fortps.h
View File

@ -36,7 +36,7 @@ FORT_API void fort_pstree_open(PFORT_PSTREE ps_tree);
FORT_API void fort_pstree_close(PFORT_PSTREE ps_tree); FORT_API void fort_pstree_close(PFORT_PSTREE ps_tree);
FORT_API void NTAPI fort_pstree_enum_processes(PVOID worker); FORT_API void NTAPI fort_pstree_enum_processes(void);
FORT_API BOOL fort_pstree_get_proc_name( FORT_API BOOL fort_pstree_get_proc_name(
PFORT_PSTREE ps_tree, DWORD processId, PUNICODE_STRING path, BOOL *inherited); PFORT_PSTREE ps_tree, DWORD processId, PUNICODE_STRING path, BOOL *inherited);

21
src/driver/fortwrk.c
View File

@ -11,20 +11,10 @@ static void fort_worker_callback_run(
PFORT_WORKER worker, enum FORT_WORKER_TYPE worker_type, UCHAR id_bits) PFORT_WORKER worker, enum FORT_WORKER_TYPE worker_type, UCHAR id_bits)
{ {
if ((id_bits & (1 << worker_type)) != 0) { if ((id_bits & (1 << worker_type)) != 0) {
worker->funcs[worker_type](worker); worker->funcs[worker_type]();
} }
} }
static void NTAPI fort_worker_callback_expand(PVOID context)
{
PFORT_WORKER worker = (PFORT_WORKER) context;
const UCHAR id_bits = InterlockedAnd8(&worker->id_bits, 0);
fort_worker_callback_run(worker, FORT_WORKER_REAUTH, id_bits);
fort_worker_callback_run(worker, FORT_WORKER_PSTREE, id_bits);
}
static void NTAPI fort_worker_callback(PDEVICE_OBJECT device, PVOID context) static void NTAPI fort_worker_callback(PDEVICE_OBJECT device, PVOID context)
{ {
UNUSED(device); UNUSED(device);
@ -33,13 +23,10 @@ static void NTAPI fort_worker_callback(PDEVICE_OBJECT device, PVOID context)
InterlockedDecrement16(&worker->queue_size); InterlockedDecrement16(&worker->queue_size);
const NTSTATUS status = const UCHAR id_bits = InterlockedAnd8(&worker->id_bits, 0);
KeExpandKernelStackAndCallout(&fort_worker_callback_expand, worker, KERNEL_STACK_SIZE);
if (!NT_SUCCESS(status)) { fort_worker_callback_run(worker, FORT_WORKER_REAUTH, id_bits);
LOG("Worker Callback: Error: %x\n", status); fort_worker_callback_run(worker, FORT_WORKER_PSTREE, id_bits);
TRACE(FORT_WORKER_CALLBACK_ERROR, status, 0, 0);
}
} }
static void fort_worker_wait(PFORT_WORKER worker) static void fort_worker_wait(PFORT_WORKER worker)

2
src/driver/fortwrk.h
View File

@ -9,7 +9,7 @@ enum FORT_WORKER_TYPE {
FORT_WORKER_FUNC_COUNT, FORT_WORKER_FUNC_COUNT,
}; };
typedef void(NTAPI *FORT_WORKER_FUNC)(PVOID worker); typedef void(NTAPI *FORT_WORKER_FUNC)(void);
typedef struct fort_worker typedef struct fort_worker
{ {