mirrors/fort
1
0
Fork 0
mirror of https://github.com/tnodir/fort synced 2024-11-15 01:55:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Driver: fortps: Prepare fort_pstree_get_svchost_name()

Browse Source
This commit is contained in:
Nodir Temirkhodjaev 2024-10-23 11:40:08 +05:00
parent 80c345f71d
commit ed416b2588
4 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/driver/fortcout.c
View File

@ -402,9 +402,12 @@ inline static BOOL fort_callout_ale_fill_path_sid(PCFORT_CALLOUT_ARG ca, PFORT_C
continue; // not "NT Authority"
// Get Service Name by SID
// TODO
cx->path.buffer = cx->svchost_name;
return FALSE;
if (fort_pstree_get_svchost_name(&fort_device()->ps_tree, &subAuth[1], &cx->path))
return TRUE;
break;
}
return FALSE;

1
src/driver/fortcoutarg.h
View File

@ -60,6 +60,7 @@ typedef struct fort_callout_ale_extra
FORT_APP_PATH path;
FORT_APP_PATH real_path;
WCHAR svchost_name[80];
PIRP irp;
ULONG_PTR info;

20
src/driver/fortps.c
View File

@ -826,6 +826,26 @@ FORT_API BOOL fort_pstree_get_proc_name(PFORT_PSTREE ps_tree, DWORD processId, P
return res;
}
static BOOL fort_pstree_get_svchost_name_locked(
PFORT_PSTREE ps_tree, const DWORD *sidBytes, PFORT_APP_PATH path)
{
return FALSE;
}
BOOL fort_pstree_get_svchost_name(PFORT_PSTREE ps_tree, const DWORD *sidBytes, PFORT_APP_PATH path)
{
BOOL res;
KLOCK_QUEUE_HANDLE lock_queue;
KeAcquireInStackQueuedSpinLock(&ps_tree->lock, &lock_queue);
{
res = fort_pstree_get_svchost_name_locked(ps_tree, sidBytes, path);
}
KeReleaseInStackQueuedSpinLock(&lock_queue);
return res;
}
inline static void fort_pstree_update_service_proc(
PFORT_PSTREE ps_tree, PCUNICODE_STRING serviceName, DWORD processId)
{

3
src/driver/fortps.h
View File

@ -37,6 +37,9 @@ FORT_API void fort_pstree_enum_processes(PFORT_PSTREE ps_tree);
FORT_API BOOL fort_pstree_get_proc_name(PFORT_PSTREE ps_tree, DWORD processId, PFORT_APP_PATH path,
BOOL *isSvcHost, BOOL *inherited);
FORT_API BOOL fort_pstree_get_svchost_name(
PFORT_PSTREE ps_tree, const DWORD *sidBytes, PFORT_APP_PATH path);
FORT_API void fort_pstree_update_services(
PFORT_PSTREE ps_tree, const PFORT_SERVICE_INFO_LIST services, ULONG data_len);