Blindwrite 7's ezplay.sys has sections which are consecutive in memory but not page aligned. Thus changing the protection to PROT_READWRITE one section at a time has the effect that old_prot for all sections but the first is set to PROT_READWRITE (actually, PROT_WRITECOPY), causing us to restore the wrong protection and the driver to crash in its entry point.
To fix this, protect and unprotect one page at a time while processing it, i.e. essentially revert 6c0a8c359. To avoid reintroducing bug 28254, protect two pages at a time instead of just one.
Signed-off-by: Zebediah Figura z.figura12@gmail.com --- dlls/ntoskrnl.exe/ntoskrnl.c | 39 ++++++++++-------------------------- 1 file changed, 11 insertions(+), 28 deletions(-)
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c index 398f1dacfd..6ee08f7202 100644 --- a/dlls/ntoskrnl.exe/ntoskrnl.c +++ b/dlls/ntoskrnl.exe/ntoskrnl.c @@ -3327,16 +3327,13 @@ static inline void *get_rva( HMODULE module, DWORD va ) return (void *)((char *)module + va); }
-/* Copied from ntdll with checks for page alignment and characteristics removed */ -static NTSTATUS perform_relocations( void *module, SIZE_T len ) +static NTSTATUS perform_relocations( void *module, SIZE_T len, ULONG page_size ) { IMAGE_NT_HEADERS *nt; char *base; IMAGE_BASE_RELOCATION *rel, *end; const IMAGE_DATA_DIRECTORY *relocs; - const IMAGE_SECTION_HEADER *sec; INT_PTR delta; - ULONG protect_old[96], i;
nt = RtlImageNtHeader( module ); base = (char *)nt->OptionalHeader.ImageBase; @@ -3355,19 +3352,6 @@ static NTSTATUS perform_relocations( void *module, SIZE_T len ) if (!relocs->Size) return STATUS_SUCCESS; if (!relocs->VirtualAddress) return STATUS_CONFLICTING_ADDRESSES;
- if (nt->FileHeader.NumberOfSections > ARRAY_SIZE( protect_old )) - return STATUS_INVALID_IMAGE_FORMAT; - - sec = (const IMAGE_SECTION_HEADER *)((const char *)&nt->OptionalHeader + - nt->FileHeader.SizeOfOptionalHeader); - for (i = 0; i < nt->FileHeader.NumberOfSections; i++) - { - void *addr = get_rva( module, sec[i].VirtualAddress ); - SIZE_T size = sec[i].SizeOfRawData; - NtProtectVirtualMemory( NtCurrentProcess(), &addr, - &size, PAGE_READWRITE, &protect_old[i] ); - } - TRACE( "relocating from %p-%p to %p-%p\n", base, base + len, module, (char *)module + len );
@@ -3377,25 +3361,24 @@ static NTSTATUS perform_relocations( void *module, SIZE_T len )
while (rel < end - 1 && rel->SizeOfBlock) { + void *page = get_rva( module, rel->VirtualAddress ); + DWORD old_prot; + if (rel->VirtualAddress >= len) { WARN( "invalid address %p in relocation %p\n", get_rva( module, rel->VirtualAddress ), rel ); return STATUS_ACCESS_VIOLATION; } - rel = LdrProcessRelocationBlock( get_rva( module, rel->VirtualAddress ), - (rel->SizeOfBlock - sizeof(*rel)) / sizeof(USHORT), + + /* Relocation entries may hang over the end of the page, so we need to + * protect two pages. */ + VirtualProtect( page, page_size * 2, PAGE_READWRITE, &old_prot ); + rel = LdrProcessRelocationBlock( page, (rel->SizeOfBlock - sizeof(*rel)) / sizeof(USHORT), (USHORT *)(rel + 1), delta ); + VirtualProtect( page, page_size * 2, old_prot, &old_prot ); if (!rel) return STATUS_INVALID_IMAGE_FORMAT; }
- for (i = 0; i < nt->FileHeader.NumberOfSections; i++) - { - void *addr = get_rva( module, sec[i].VirtualAddress ); - SIZE_T size = sec[i].SizeOfRawData; - NtProtectVirtualMemory( NtCurrentProcess(), &addr, - &size, protect_old[i], &protect_old[i] ); - } - return STATUS_SUCCESS; }
@@ -3424,7 +3407,7 @@ static HMODULE load_driver_module( const WCHAR *name ) if (nt->OptionalHeader.SectionAlignment < info.PageSize || !(nt->FileHeader.Characteristics & IMAGE_FILE_DLL)) { - status = perform_relocations(module, nt->OptionalHeader.SizeOfImage); + status = perform_relocations( module, nt->OptionalHeader.SizeOfImage, info.PageSize ); if (status != STATUS_SUCCESS) goto error;
Needed by Blindwrite 7's kernel driver.
Signed-off-by: Zebediah Figura z.figura12@gmail.com --- dlls/ntdll/ntdll.spec | 1 + dlls/ntoskrnl.exe/ntoskrnl.exe.spec | 1 + include/ddk/wdm.h | 5 +++++ 3 files changed, 7 insertions(+)
diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec index 0be6ec6bfc..baa3dcef1f 100644 --- a/dlls/ntdll/ntdll.spec +++ b/dlls/ntdll/ntdll.spec @@ -526,6 +526,7 @@ @ stdcall RtlCopyLuid(ptr ptr) @ stdcall RtlCopyLuidAndAttributesArray(long ptr ptr) @ stdcall -arch=x86_64 RtlCopyMemory(ptr ptr long) +@ stdcall -arch=x86_64 RtlCopyMemoryNonTemporal(ptr ptr long) RtlCopyMemory # @ stub RtlCopyMemoryStreamTo # @ stub RtlCopyOutOfProcessMemoryStreamTo # @ stub RtlCopyRangeList diff --git a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec index 7e52751608..14d95a47f8 100644 --- a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec +++ b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec @@ -1002,6 +1002,7 @@ @ stdcall RtlCopyLuid(ptr ptr) @ stdcall RtlCopyLuidAndAttributesArray(long ptr ptr) @ stdcall -arch=x86_64 RtlCopyMemory(ptr ptr long) +@ stdcall -arch=x86_64 RtlCopyMemoryNonTemporal(ptr ptr long) RtlCopyMemory @ stub RtlCopyRangeList @ stdcall RtlCopySid(long ptr ptr) @ stdcall RtlCopyString(ptr ptr) diff --git a/include/ddk/wdm.h b/include/ddk/wdm.h index b180d11556..60396779fc 100644 --- a/include/ddk/wdm.h +++ b/include/ddk/wdm.h @@ -1696,6 +1696,11 @@ HANDLE WINAPI PsGetProcessInheritedFromUniqueProcessId(PEPROCESS); BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*); NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
+#ifdef __x86_64__ +void WINAPI RtlCopyMemoryNonTemporal(void*,const void*,SIZE_T); +#else +#define RtlCopyMemoryNonTemporal RtlCopyMemory +#endif BOOLEAN WINAPI RtlIsNtDdiVersionAvailable(ULONG);
NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
Hi,
While running your changed tests, I think I found new failures. Being a bot and all I'm not very good at pattern recognition, so I might be wrong, but could you please double-check?
Full results can be found at: https://testbot.winehq.org/JobDetails.pl?Key=71051
Your paranoid android.
=== debiant (build log) ===
error: patch failed: dlls/ntoskrnl.exe/ntoskrnl.exe.spec:1002 Task: Patch failed to apply
=== debiant (build log) ===
error: patch failed: dlls/ntoskrnl.exe/ntoskrnl.exe.spec:1002 Task: Patch failed to apply
-
Marvin -
Zebediah Figura