ufrisk/MemProcFS
1
0
Fork 0
mirror of https://github.com/ufrisk/MemProcFS.git synced 2026-10-12 02:23:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 5.18.7

Browse Source
This commit is contained in:
Ulf Frisk
2026-09-05 11:25:53 +02:00
parent 62bd11407b
commit a9ab0d5034
51 changed files with 688 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files
m_vmemd/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 6
#define VERSION_BUILD 245
#define VERSION_REVISION 7
#define VERSION_BUILD 246
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Plugin vmemd"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
memprocfs/Makefile
+2 -2
View File
@@ -13,8 +13,8 @@ ifeq ($(shell basename $(CC)),gcc)
#CFLAGS += -g -O0 -Wextra
endif
LDFLAGS += -Wl,-rpath,'$$ORIGIN' -ldl -L. -l:vmm.so -Wl,-z,noexecstack `pkg-config fuse --libs`
DEPS = vfs.h
OBJ = oscompatibility.o charutil.o vfslist.o memprocfs_fuse.o ob/ob_cachemap.o ob/ob_core.o ob/ob_map.o ob/ob_set.o
DEPS = vfs.h vmmloader.h
OBJ = oscompatibility.o charutil.o vfslist.o vmmloader.o memprocfs_fuse.o ob/ob_cachemap.o ob/ob_core.o ob/ob_map.o ob/ob_set.o
%.o: %.c $(DEPS)
$(CC) -c -o $@ $< $(CFLAGS)
memprocfs/Makefile.macos
+2 -2
View File
@@ -15,8 +15,8 @@ LDFLAGS += -L/usr/local/lib -lfuse -pthread
LDFLAGS += -Wl,-rpath,@loader_path
LDFLAGS += -mmacosx-version-min=11.0
DEPS = vfslist.h
OBJ = oscompatibility.o charutil.o vfslist.o memprocfs_fuse.o ob/ob_cachemap.o ob/ob_core.o ob/ob_map.o ob/ob_set.o
DEPS = vfslist.h vmmloader.h
OBJ = oscompatibility.o charutil.o vfslist.o vmmloader.o memprocfs_fuse.o ob/ob_cachemap.o ob/ob_core.o ob/ob_map.o ob/ob_set.o
# ARCH SPECIFIC FLAGS:
CFLAGS_X86_64 = $(CFLAGS) -arch x86_64
memprocfs/charutil.c
+1 -1
View File
@@ -1330,7 +1330,7 @@ LPCSTR CharUtil_SplitLast(_In_ LPCSTR usz, _In_ CHAR ch, _Out_writes_(cbu1) LPST
/*
* Split a string into a list of strings at the delimiter characters.
* The function allocates neccessary memory for the result array and its values.
* The function allocates necessary memory for the result array and its values.
* CALLER LocalFree: *ppuszArray
* -- usz = utf-8/ascii string to split.
* -- chDelimiter = character to split at.
memprocfs/memprocfs.vcxproj
+2
View File
@@ -324,6 +324,7 @@
<ClCompile Include="ob\ob_set.c" />
<ClCompile Include="oscompatibility.c" />
<ClCompile Include="vfslist.c" />
<ClCompile Include="vmmloader.c" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\includes\dokan.h" />
@@ -336,6 +337,7 @@
<ClInclude Include="oscompatibility.h" />
<ClInclude Include="version.h" />
<ClInclude Include="vfslist.h" />
<ClInclude Include="vmmloader.h" />
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="MemProcFS.rc" />
memprocfs/memprocfs.vcxproj.filters
+6
View File
@@ -51,6 +51,9 @@
<ClCompile Include="oscompatibility.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="vmmloader.c">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="version.h">
@@ -83,6 +86,9 @@
<ClInclude Include="vfslist.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="vmmloader.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="MemProcFS.rc">
memprocfs/memprocfs_dokan.c
+41 -3
View File
@@ -11,6 +11,7 @@
#include <vmmdll.h>
#include "charutil.h"
#include "vfslist.h"
#include "vmmloader.h"
#include "version.h"
#pragma warning( push )
#pragma warning( disable : 4005 )
@@ -31,6 +32,7 @@ PVMMVFS_CONFIG ctxVfs;
VMM_HANDLE g_hVMM;
CHAR g_VfsMountPoint = 'M';
BOOL g_IsLinux = FALSE;
@@ -270,6 +272,9 @@ VOID VfsDokan_InitializeAndMount_DisplayInfo(LPWSTR wszMountPoint)
ULONG64 qwVersionVmmMajor = 0, qwVersionVmmMinor = 0, qwVersionVmmRevision = 0;
ULONG64 qwVersionWinMajor = 0, qwVersionWinMinor = 0, qwVersionWinBuild = 0;
ULONG64 qwUniqueSystemId = 0, iMemoryModel;
DWORD cbRead = 0;
CHAR szLinuxBanner[96] = { 0 }, szTag[32] = { 0 };
LPSTR szLinuxRelease = NULL;
LPSTR uszLicensedTo = NULL;
BOOL fGPL;
// get vmm.dll versions
@@ -282,6 +287,11 @@ VOID VfsDokan_InitializeAndMount_DisplayInfo(LPWSTR wszMountPoint)
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_VERSION_MINOR, &qwVersionWinMinor);
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_VERSION_BUILD, &qwVersionWinBuild);
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_SYSTEM_UNIQUE_ID, &qwUniqueSystemId);
if(g_IsLinux) {
VMMDLL_VfsReadU(g_hVMM, "\\sys\\unique-tag.txt", (PBYTE)szTag, sizeof(szTag) - 1, &cbRead, 0);
} else {
snprintf(szTag, sizeof(szTag), "%i_%x", (DWORD)qwVersionWinBuild, (DWORD)qwUniqueSystemId);
}
uszLicensedTo = VMMDLL_LicensedTo();
if(!uszLicensedTo) {
printf("[CRITICAL] A valid license could not be found. Terminating.\n");
@@ -297,13 +307,20 @@ VOID VfsDokan_InitializeAndMount_DisplayInfo(LPWSTR wszMountPoint)
printf("\n"MEMPROCFS_SPLASH \
" - Version: %i.%i.%i (%s)\n" \
" - Mount Point: %S \n" \
" - Tag: %i_%x \n",
" - Tag: %s \n",
uszLicensedTo,
(DWORD)qwVersionVmmMajor, (DWORD)qwVersionVmmMinor, (DWORD)qwVersionVmmRevision, VER_OSARCH,
wszMountPoint, (DWORD)qwVersionWinBuild, (DWORD)qwUniqueSystemId);
wszMountPoint, szTag);
if(qwVersionWinMajor && (iMemoryModel < (sizeof(VMMDLL_MEMORYMODEL_TOSTRING) / sizeof(LPSTR)))) {
printf(" - Operating System: Windows %i.%i.%i (%s)\n",
(DWORD)qwVersionWinMajor, (DWORD)qwVersionWinMinor, (DWORD)qwVersionWinBuild, VMMDLL_MEMORYMODEL_TOSTRING[iMemoryModel]);
} else if(g_IsLinux) {
VMMDLL_VfsReadU(g_hVMM, "\\sys\\version.txt", (PBYTE)szLinuxBanner, sizeof(szLinuxBanner) - 1, &cbRead, 0);
if(!strncmp(szLinuxBanner, "Linux version ", 14)) {
szLinuxRelease = szLinuxBanner + 14;
szLinuxRelease[strcspn(szLinuxRelease, " ")] = 0;
}
printf(" - Operating System: Linux x64 %s\n", szLinuxRelease);
} else {
printf(" - Operating System: Unknown\n");
}
@@ -436,6 +453,20 @@ CHAR GetMountPoint(_In_ DWORD argc, _In_ wchar_t* argv[], _Out_ PBOOL pfMountSpe
return chMountPoint;
}
/*
*
*/
VOID MemProcFS_SetLinuxMode(_In_ DWORD argc, _In_ wchar_t* argv[])
{
DWORD i;
for(i = 1; i < argc; i++) {
if(0 == _wcsicmp(argv[i], L"-linux")) {
g_IsLinux = TRUE;
return;
}
}
}
/*
* Call the VMMDLL_Close() function in a separate newly create thread.
* This will allow the main thread to exit even if the VMMDLL_Close()
@@ -519,10 +550,17 @@ int wmain(_In_ int argc, _In_ wchar_t* argv[])
printf("MemProcFS: Invalid argument!\n");
return 1;
}
if(!_stricmp(szArgs[i], "-linux")) {
g_IsLinux = TRUE;
}
}
if(argc > 2) {
CharUtil_UtoU("-userinteract", (DWORD)-1, NULL, 0, &szArgs[argc++], NULL, CHARUTIL_FLAG_ALLOC);
}
if(g_IsLinux && !VmmlxLoader_Initialize()) {
printf("MemProcFS: Error: Unable to load required vmmlx.dll\n");
return 1;
}
g_hVMM = VMMDLL_Initialize(argc, szArgs);
if(!g_hVMM) {
// any error message will already be shown by the InitializeReserved function.
@@ -535,7 +573,7 @@ int wmain(_In_ int argc, _In_ wchar_t* argv[])
VMMDLL_ConfigSet(g_hVMM, VMMDLL_OPT_CONFIG_STATISTICS_FUNCTIONCALL, 1);
result = VMMDLL_InitializePlugins(g_hVMM);
if(!result) {
printf("MemProcFS: Error file system plugins in vmm.dll!\n");
printf("MemProcFS: Error file system plugins in %s!\n", (g_IsLinux ? "vmmlx.dll" : "vmm.dll"));
return 1;
}
SetConsoleCtrlHandler(MemProcFsCtrlHandler, TRUE);
memprocfs/memprocfs_fuse.c
+28 -3
View File
@@ -8,6 +8,7 @@
#include <vmmdll.h>
#include "charutil.h"
#include "vfslist.h"
#include "vmmloader.h"
#include "version.h"
#define FUSE_USE_VERSION 30
#include <fuse.h>
@@ -23,6 +24,8 @@ FUSE_INFO g_FuseInfo = { 0 };
VMM_HANDLE g_hVMM = NULL;
BOOL g_IsLinux = FALSE;
//-----------------------------------------------------------------------------
// FUSE FILE SYSTEM FUNCTIONALITY BELOW:
//-----------------------------------------------------------------------------
@@ -245,6 +248,9 @@ VOID Vfs_InitializeAndMount_DisplayInfo(_In_ LPSTR uszMountPoint)
ULONG64 qwVersionVmmMajor = 0, qwVersionVmmMinor = 0, qwVersionVmmRevision = 0;
ULONG64 qwVersionWinMajor = 0, qwVersionWinMinor = 0, qwVersionWinBuild = 0;
ULONG64 qwUniqueSystemId = 0, iMemoryModel;
DWORD cbRead = 0;
CHAR szLinuxBanner[96] = { 0 }, szTag[32] = { 0 };
LPSTR szLinuxRelease = NULL;
LPSTR uszLicensedTo = NULL;
BOOL fGPL;
// get vmm.dll versions
@@ -257,6 +263,11 @@ VOID Vfs_InitializeAndMount_DisplayInfo(_In_ LPSTR uszMountPoint)
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_VERSION_MINOR, &qwVersionWinMinor);
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_VERSION_BUILD, &qwVersionWinBuild);
VMMDLL_ConfigGet(g_hVMM, VMMDLL_OPT_WIN_SYSTEM_UNIQUE_ID, &qwUniqueSystemId);
if(g_IsLinux) {
VMMDLL_VfsReadU(g_hVMM, "\\sys\\unique-tag.txt", (PBYTE)szTag, sizeof(szTag) - 1, &cbRead, 0);
} else {
snprintf(szTag, sizeof(szTag), "%i_%x", (DWORD)qwVersionWinBuild, (DWORD)qwUniqueSystemId);
}
uszLicensedTo = VMMDLL_LicensedTo();
if(!uszLicensedTo) {
printf("[CRITICAL] A valid license could not be found. Terminating.\n");
@@ -272,13 +283,20 @@ VOID Vfs_InitializeAndMount_DisplayInfo(_In_ LPSTR uszMountPoint)
printf("\n"MEMPROCFS_SPLASH \
" - Version: %i.%i.%i (%s)\n" \
" - Mount Point: %s \n" \
" - Tag: %i_%x \n",
" - Tag: %s \n",
uszLicensedTo,
(DWORD)qwVersionVmmMajor, (DWORD)qwVersionVmmMinor, (DWORD)qwVersionVmmRevision, VER_OSARCH,
uszMountPoint, (DWORD)qwVersionWinBuild, (DWORD)qwUniqueSystemId);
uszMountPoint, szTag);
if(qwVersionWinMajor && (iMemoryModel < (sizeof(VMMDLL_MEMORYMODEL_TOSTRING) / sizeof(LPSTR)))) {
printf(" - Operating System: Windows %i.%i.%i (%s)\n",
(DWORD)qwVersionWinMajor, (DWORD)qwVersionWinMinor, (DWORD)qwVersionWinBuild, VMMDLL_MEMORYMODEL_TOSTRING[iMemoryModel]);
} else if(g_IsLinux) {
VMMDLL_VfsReadU(g_hVMM, "\\sys\\version.txt", (PBYTE)szLinuxBanner, sizeof(szLinuxBanner) - 1, &cbRead, 0);
if(!strncmp(szLinuxBanner, "Linux version ", 14)) {
szLinuxRelease = szLinuxBanner + 14;
szLinuxRelease[strcspn(szLinuxRelease, " ")] = 0;
}
printf(" - Operating System: Linux x64 %s\n", szLinuxRelease);
} else {
printf(" - Operating System: Unknown\n");
}
@@ -317,11 +335,18 @@ int main(_In_ int argc, _In_ char* argv[])
}
for(i = 1; i < argc; i++) {
szArgs[i] = argv[i];
if(!_stricmp(szArgs[i], "-linux")) {
g_IsLinux = TRUE;
}
}
szArgs[0] = "-printf";
// catch CTRL+C
signal(SIGINT, signal_handler_execute);
// Initialize MemProcFS
if(g_IsLinux && !VmmlxLoader_Initialize()) {
printf("MemProcFS: Error: Unable to load required vmmlx.so\n");
return 1;
}
g_hVMM = VMMDLL_Initialize(argc, szArgs);
if(!g_hVMM) {
// any error message will already be shown by the InitializeReserved function.
@@ -333,7 +358,7 @@ int main(_In_ int argc, _In_ char* argv[])
}
VMMDLL_ConfigSet(g_hVMM, VMMDLL_OPT_CONFIG_STATISTICS_FUNCTIONCALL, 1);
if(!VMMDLL_InitializePlugins(g_hVMM)) {
printf("MemProcFS: Error file system plugins in vmm.dll!\n");
printf("MemProcFS: Error file system plugins in %s!\n", (g_IsLinux ? "vmmlx.so" : "vmm.so"));
return 1;
}
VfsList_Initialize(MemProcFS_VfsListU, 500, 128, FALSE);
memprocfs/ob/ob_cachemap.c
+4 -1
View File
@@ -142,6 +142,10 @@ BOOL _ObCacheMap_Push(_In_ POB_CACHEMAP pcm, _In_ QWORD qwKey, _In_ PVOID pvObje
}
// 3: add new object
if(!(pe = LocalAlloc(0, sizeof(OB_CACHEMAPENTRY)))) { return FALSE; }
if(!ObMap_Push(pcm->pm, qwKey, pe)) {
LocalFree(pe);
return FALSE;
}
if(pcm->fObjectsOb) { Ob_INCREF(pvObject); }
pe->pvObject = pvObject;
pe->qwContext = qwContextInitial;
@@ -153,7 +157,6 @@ BOOL _ObCacheMap_Push(_In_ POB_CACHEMAP pcm, _In_ QWORD qwKey, _In_ PVOID pvObje
} else {
pe->BLink = pe->FLink = pe;
}
ObMap_Push(pcm->pm, qwKey, pe);
pcm->AgeListHead = pe;
pcm->c++;
return TRUE;
memprocfs/ob/ob_map.c
+6 -1
View File
@@ -805,9 +805,14 @@ BOOL _ObMap_Grow(_In_ POB_MAP pm)
{
DWORD iEntry;
PDWORD pdwNewAllocHashMap;
PPOB_MAP_ENTRY ppNewAllocTable;
if(!(pdwNewAllocHashMap = LocalAlloc(LMEM_ZEROINIT, 2 * sizeof(DWORD) * pm->cHashMax * (pm->fKey ? 2 : 1)))) { return FALSE; }
if(!pm->fLargeMode) {
if(!(pm->Directory[0] = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_MAP_ENTRY) * OB_MAP_ENTRIES_TABLE))) { return FALSE; }
if(!(ppNewAllocTable = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_MAP_ENTRY) * OB_MAP_ENTRIES_TABLE))) {
LocalFree(pdwNewAllocHashMap);
return FALSE;
}
pm->Directory[0] = ppNewAllocTable;
pm->Directory[0][0] = pm->Store00;
ZeroMemory(pm->_SmallHashMap, sizeof(pm->_SmallHashMap));
pm->pHashMapKey = NULL;
memprocfs/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 6
#define VERSION_BUILD 245
#define VERSION_REVISION 7
#define VERSION_BUILD 246
#define VER_FILE_DESCRIPTION_STR "MemProcFS"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
memprocfs/vmmloader.c
+206
View File
@@ -0,0 +1,206 @@
// vmmloader.c : implementation related to transparent loading of vmm (Windows) or vmmlx (Linux) memory parsing engines.
//
// (c) Ulf Frisk, 2026
// Author: Ulf Frisk, [email protected]
//
#define VMMLOADER_NO_REMAP
#include "vmmloader.h"
#include "oscompatibility.h"
typedef VMM_HANDLE(*PFN_VMMLX_INITIALIZE)(_In_ DWORD argc, _In_ LPCSTR argv[]);
typedef VOID(*PFN_VMMLX_CLOSEALL)();
typedef VOID(*PFN_VMMLX_MEMFREE)(_Frees_ptr_opt_ PVOID pvMem);
typedef BOOL(*PFN_VMMLX_CONFIGGET)(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _Out_ PULONG64 pqwValue);
typedef BOOL(*PFN_VMMLX_CONFIGSET)(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _In_ ULONG64 qwValue);
typedef BOOL(*PFN_VMMLX_INITIALIZEPLUGINS)(_In_ VMM_HANDLE hVMM);
typedef BOOL(*PFN_VMMLX_VFSLISTU)(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszPath, _Inout_ PVMMDLL_VFS_FILELIST2 pFileList);
typedef NTSTATUS(*PFN_VMMLX_VFSREADU)(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
typedef NTSTATUS(*PFN_VMMLX_VFSWRITEU)(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
typedef NTSTATUS(*PFN_VMMLX_VFSREADW)(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
typedef NTSTATUS(*PFN_VMMLX_VFSWRITEW)(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
typedef LPSTR(*PFN_VMMLX_LICENSEDTO)();
typedef struct tdVMMLX_LOADER_CONTEXT {
HMODULE hModule;
PFN_VMMLX_INITIALIZE pfnInitialize;
PFN_VMMLX_CLOSEALL pfnCloseAll;
PFN_VMMLX_MEMFREE pfnMemFree;
PFN_VMMLX_CONFIGGET pfnConfigGet;
PFN_VMMLX_CONFIGSET pfnConfigSet;
PFN_VMMLX_INITIALIZEPLUGINS pfnInitializePlugins;
PFN_VMMLX_VFSLISTU pfnVfsListU;
PFN_VMMLX_VFSREADU pfnVfsReadU;
PFN_VMMLX_VFSWRITEU pfnVfsWriteU;
PFN_VMMLX_VFSREADW pfnVfsReadW;
PFN_VMMLX_VFSWRITEW pfnVfsWriteW;
PFN_VMMLX_LICENSEDTO pfnLicensedTo;
} VMMLX_LOADER_CONTEXT;
static VMMLX_LOADER_CONTEXT g_VmmlxLoader = { 0 };
static PVOID VmmlxLoader_GetSymbol(_In_ LPCSTR szSymbol)
{
#ifdef _WIN32
return GetProcAddress(g_VmmlxLoader.hModule, szSymbol);
#else /* _WIN32 */
return dlsym(g_VmmlxLoader.hModule, szSymbol);
#endif /* _WIN32 */
}
static VOID VmmlxLoader_CloseModule()
{
if(!g_VmmlxLoader.hModule) {
return;
}
#ifdef _WIN32
FreeLibrary(g_VmmlxLoader.hModule);
#else /* _WIN32 */
dlclose(g_VmmlxLoader.hModule);
#endif /* _WIN32 */
memset(&g_VmmlxLoader, 0, sizeof(g_VmmlxLoader));
}
#ifdef _WIN32
static HMODULE VmmlxLoader_LoadLocalModule()
{
DWORD cchPath;
LPWSTR wszSlash;
WCHAR wszPath[MAX_PATH];
cchPath = GetModuleFileNameW(NULL, wszPath, _countof(wszPath));
if(!cchPath || (cchPath >= _countof(wszPath)) || !(wszSlash = wcsrchr(wszPath, L'\\'))) {
return NULL;
}
if(0 != wcscpy_s(wszSlash + 1, _countof(wszPath) - (wszSlash + 1 - wszPath), L"vmmlx.dll")) {
return NULL;
}
g_VmmlxLoader.hModule = LoadLibraryW(wszPath);
return g_VmmlxLoader.hModule;
}
#elif defined(MACOS)
static HMODULE VmmlxLoader_LoadLocalModule()
{
g_VmmlxLoader.hModule = dlopen("@executable_path/vmmlx.dylib", RTLD_NOW | RTLD_LOCAL);
return g_VmmlxLoader.hModule;
}
#else /* LINUX */
static HMODULE VmmlxLoader_LoadLocalModule()
{
LPSTR szSlash;
ssize_t cchPath;
CHAR szPath[4096];
cchPath = readlink("/proc/self/exe", szPath, sizeof(szPath) - 1);
if((cchPath <= 0) || ((SIZE_T)cchPath >= sizeof(szPath) - 1)) {
return NULL;
}
szPath[cchPath] = 0;
if(!(szSlash = strrchr(szPath, '/')) || ((SIZE_T)(szSlash + 1 - szPath) + sizeof("vmmlx.so") > sizeof(szPath))) {
return NULL;
}
strcpy(szSlash + 1, "vmmlx.so");
g_VmmlxLoader.hModule = dlopen(szPath, RTLD_NOW | RTLD_LOCAL);
return g_VmmlxLoader.hModule;
}
#endif /* _WIN32 || MACOS || LINUX */
#define VMMLOADER_RESOLVE(fn, suffix) \
do { \
LPCSTR szSymbol = "VMMLX_" suffix; \
PVOID pSymbol = VmmlxLoader_GetSymbol(szSymbol); \
if(!pSymbol || (sizeof(pSymbol) != sizeof(g_VmmlxLoader.fn))) { \
VmmlxLoader_CloseModule(); \
return FALSE; \
} \
memcpy(&g_VmmlxLoader.fn, &pSymbol, sizeof(g_VmmlxLoader.fn)); \
} while(0)
_Success_(return)
BOOL VmmlxLoader_Initialize()
{
if(g_VmmlxLoader.hModule) { return TRUE; }
if(!VmmlxLoader_LoadLocalModule()) { return FALSE; }
VMMLOADER_RESOLVE(pfnInitialize, "Initialize");
VMMLOADER_RESOLVE(pfnCloseAll, "CloseAll");
VMMLOADER_RESOLVE(pfnMemFree, "MemFree");
VMMLOADER_RESOLVE(pfnConfigGet, "ConfigGet");
VMMLOADER_RESOLVE(pfnConfigSet, "ConfigSet");
VMMLOADER_RESOLVE(pfnInitializePlugins, "InitializePlugins");
VMMLOADER_RESOLVE(pfnLicensedTo, "LicensedTo");
VMMLOADER_RESOLVE(pfnVfsListU, "VfsListU");
VMMLOADER_RESOLVE(pfnVfsReadU, "VfsReadU");
VMMLOADER_RESOLVE(pfnVfsWriteU, "VfsWriteU");
#ifdef _WIN32
VMMLOADER_RESOLVE(pfnVfsReadW, "VfsReadW");
VMMLOADER_RESOLVE(pfnVfsWriteW, "VfsWriteW");
#endif /* _WIN32 */
return TRUE;
}
VMM_HANDLE VmmlxLoader_VmmInitialize(_In_ DWORD argc, _In_ LPCSTR argv[])
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnInitialize(argc, argv) : VMMDLL_Initialize(argc, argv);
}
VOID VmmlxLoader_VmmCloseAll()
{
if(g_VmmlxLoader.hModule) {
g_VmmlxLoader.pfnCloseAll();
} else {
VMMDLL_CloseAll();
}
}
VOID VmmlxLoader_VmmMemFree(_Frees_ptr_opt_ PVOID pvMem)
{
if(g_VmmlxLoader.hModule) {
g_VmmlxLoader.pfnMemFree(pvMem);
} else {
VMMDLL_MemFree(pvMem);
}
}
BOOL VmmlxLoader_VmmConfigGet(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _Out_ PULONG64 pqwValue)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnConfigGet(hVMM, fOption, pqwValue) : VMMDLL_ConfigGet(hVMM, fOption, pqwValue);
}
BOOL VmmlxLoader_VmmConfigSet(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _In_ ULONG64 qwValue)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnConfigSet(hVMM, fOption, qwValue) : VMMDLL_ConfigSet(hVMM, fOption, qwValue);
}
BOOL VmmlxLoader_VmmInitializePlugins(_In_ VMM_HANDLE hVMM)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnInitializePlugins(hVMM) : VMMDLL_InitializePlugins(hVMM);
}
LPSTR VmmlxLoader_VmmLicensedTo()
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnLicensedTo() : VMMDLL_LicensedTo();
}
BOOL VmmlxLoader_VmmVfsListU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszPath, _Inout_ PVMMDLL_VFS_FILELIST2 pFileList)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnVfsListU(hVMM, uszPath, pFileList) : VMMDLL_VfsListU(hVMM, uszPath, pFileList);
}
NTSTATUS VmmlxLoader_VmmVfsReadU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnVfsReadU(hVMM, uszFileName, pb, cb, pcbRead, cbOffset) : VMMDLL_VfsReadU(hVMM, uszFileName, pb, cb, pcbRead, cbOffset);
}
NTSTATUS VmmlxLoader_VmmVfsWriteU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnVfsWriteU(hVMM, uszFileName, pb, cb, pcbWrite, cbOffset) : VMMDLL_VfsWriteU(hVMM, uszFileName, pb, cb, pcbWrite, cbOffset);
}
#ifdef _WIN32
NTSTATUS VmmlxLoader_VmmVfsReadW(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnVfsReadW(hVMM, wszFileName, pb, cb, pcbRead, cbOffset) : VMMDLL_VfsReadW(hVMM, wszFileName, pb, cb, pcbRead, cbOffset);
}
NTSTATUS VmmlxLoader_VmmVfsWriteW(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset)
{
return g_VmmlxLoader.hModule ? g_VmmlxLoader.pfnVfsWriteW(hVMM, wszFileName, pb, cb, pcbWrite, cbOffset) : VMMDLL_VfsWriteW(hVMM, wszFileName, pb, cb, pcbWrite, cbOffset);
}
#endif /* _WIN32 */
memprocfs/vmmloader.h
+50
View File
@@ -0,0 +1,50 @@
// vmmlx_loader.h : definitions related to transparent loading of vmm (Windows) or vmmlx (Linux) memory parsing engines.
//
// (c) Ulf Frisk, 2026
// Author: Ulf Frisk, [email protected]
//
#ifndef __VMMLOADER_H__
#define __VMMLOADER_H__
#include <vmmdll.h>
/*
* Initialize the vmm loader (required to load the linux engine, vmmlx).
*/
_Success_(return) BOOL VmmlxLoader_Initialize();
/*
* Wrapper functions around the vmm / vmmlx counterparts.
*/
VMM_HANDLE VmmlxLoader_VmmInitialize(_In_ DWORD argc, _In_ LPCSTR argv[]);
VOID VmmlxLoader_VmmCloseAll();
VOID VmmlxLoader_VmmMemFree(_Frees_ptr_opt_ PVOID pvMem);
BOOL VmmlxLoader_VmmConfigGet(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _Out_ PULONG64 pqwValue);
BOOL VmmlxLoader_VmmConfigSet(_In_ VMM_HANDLE hVMM, _In_ ULONG64 fOption, _In_ ULONG64 qwValue);
BOOL VmmlxLoader_VmmInitializePlugins(_In_ VMM_HANDLE hVMM);
BOOL VmmlxLoader_VmmVfsListU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszPath, _Inout_ PVMMDLL_VFS_FILELIST2 pFileList);
NTSTATUS VmmlxLoader_VmmVfsReadU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
NTSTATUS VmmlxLoader_VmmVfsWriteU(_In_ VMM_HANDLE hVMM, _In_ LPCSTR uszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
NTSTATUS VmmlxLoader_VmmVfsReadW(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _Out_writes_to_(cb, *pcbRead) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbRead, _In_ ULONG64 cbOffset);
NTSTATUS VmmlxLoader_VmmVfsWriteW(_In_ VMM_HANDLE hVMM, _In_ LPCWSTR wszFileName, _In_reads_(cb) PBYTE pb, _In_ DWORD cb, _Out_ PDWORD pcbWrite, _In_ ULONG64 cbOffset);
LPSTR VmmlxLoader_VmmLicensedTo();
/*
* Defines of the original VMMDLL functionality which are forwarded to the wrapper functions.
*/
#ifndef VMMLOADER_NO_REMAP
#define VMMDLL_Initialize VmmlxLoader_VmmInitialize
#define VMMDLL_CloseAll VmmlxLoader_VmmCloseAll
#define VMMDLL_MemFree VmmlxLoader_VmmMemFree
#define VMMDLL_ConfigGet VmmlxLoader_VmmConfigGet
#define VMMDLL_ConfigSet VmmlxLoader_VmmConfigSet
#define VMMDLL_InitializePlugins VmmlxLoader_VmmInitializePlugins
#define VMMDLL_VfsListU VmmlxLoader_VmmVfsListU
#define VMMDLL_VfsReadU VmmlxLoader_VmmVfsReadU
#define VMMDLL_VfsWriteU VmmlxLoader_VmmVfsWriteU
#define VMMDLL_VfsReadW VmmlxLoader_VmmVfsReadW
#define VMMDLL_VfsWriteW VmmlxLoader_VmmVfsWriteW
#define VMMDLL_LicensedTo VmmlxLoader_VmmLicensedTo
#endif /* VMMLOADER_NO_REMAP */
#endif /* __VMMLOADER_H__ */
vmm/fc.c
+4 -1
View File
@@ -1345,7 +1345,10 @@ VOID FcScanVirtmem_ScanRanges_ThreadProc(_In_ VMM_HANDLE H, _In_ PFCOB_SCAN_VIRT
PBYTE pbBuffer = NULL;
if(!(pbBuffer = LocalAlloc(LMEM_ZEROINIT, FC_SCAN_VIRTMEM_MAX_CHUNK_SIZE))) { goto fail; }
while((pe = ObMap_Pop(ctx->pmScanItems))) {
if(H->fAbort) { goto fail; }
if(H->fAbort) {
Ob_DECREF(pe);
goto fail;
}
if(pe->dwVersion == VMMDLL_FORENSIC_INGEST_VIRTMEM_VERSION) {
pe->pb = pbBuffer;
FcScanVirtmem_ScanRanges_Virtmem(H, ctx, pe);
vmm/infodb.c
+5
View File
@@ -364,6 +364,11 @@ BOOL InfoDB_YaraRulesBuiltIn(_In_ VMM_HANDLE H, _Out_ PINFODB_YARA_RULES *ppObYa
}
*ppObYaraRules = pObResult;
fail:
if(!pObResult) {
for(i = 0; i < cRules; i++) {
LocalFree(pszRules[i]);
}
}
LocalFree(pszRules);
sqlite3_finalize(hStmt);
InfoDB_SqlReserveReturn(pObCtx, hSql);
vmm/mm/mm_vad.c
+5 -4
View File
@@ -952,10 +952,11 @@ VOID MmVad_Spider_DoWork(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pSystemProcess, _I
ObContainer_SetOb(pProcess->pObPersistent->pObCMapVadPrefetch, psObAll);
// 8: shrink oversized result object (if sufficiently too large)
if(pmObVad->cMap + 0x10 < cMax) {
pmObVadTemp = pmObVad;
if(!(pmObVad = Ob_AllocEx(H, OB_TAG_MAP_VAD, 0, sizeof(VMMOB_MAP_VAD) + pmObVadTemp->cMap * sizeof(VMM_MAP_VADENTRY), MmVad_MemMapVad_CloseObCallback, NULL))) { goto fail; }
memcpy(((POB_DATA)pmObVad)->pb, ((POB_DATA)pmObVadTemp)->pb, pmObVad->ObHdr.cbData);
Ob_DECREF_NULL(&pmObVadTemp);
if((pmObVadTemp = Ob_AllocEx(H, OB_TAG_MAP_VAD, 0, sizeof(VMMOB_MAP_VAD) + pmObVad->cMap * sizeof(VMM_MAP_VADENTRY), MmVad_MemMapVad_CloseObCallback, NULL))) {
memcpy(((POB_DATA)pmObVadTemp)->pb, ((POB_DATA)pmObVad)->pb, pmObVadTemp->ObHdr.cbData);
Ob_DECREF(pmObVad);
pmObVad = pmObVadTemp;
}
}
pProcess->Map.pObVad = Ob_INCREF(pmObVad);
fail:
vmm/modules/m_evil_proc1.c
+1
View File
@@ -129,6 +129,7 @@ VOID MEvilProc1_Modules(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess)
}
Ob_DECREF(pObModuleMap);
}
Ob_DECREF(pObVadMap);
}
vmm/modules/m_evil_thread1.c
+6 -1
View File
@@ -56,7 +56,10 @@ BOOL MEvilThread1_InitContext(_In_ VMM_HANDLE H, _Inout_ PMEVIL_THREAD1_CONTEXT
}
}
if(!pObProcessSMSS) { return FALSE; }
if(!(ctx->pm = ObMap_New(H, OB_MAP_FLAGS_OBJECT_LOCALFREE))) { return FALSE; }
if(!(ctx->pm = ObMap_New(H, OB_MAP_FLAGS_OBJECT_LOCALFREE))) {
Ob_DECREF(pObProcessSMSS);
return FALSE;
}
ctx->vaLoadLibrary = SysQuery_GetProcAddress(H, pObProcessSMSS, "kernel32.dll", "LoadLibrary");
ctx->vaRtlUserThreadStart = SysQuery_GetProcAddress(H, pObProcessSMSS, "ntdll.dll", "RtlUserThreadStart");
if(VmmMap_GetModuleEntryEx(H, pObProcessSMSS, 0, "ntdll.dll", 0, &pObModuleMap, &peModule)) {
@@ -224,6 +227,7 @@ VOID MEvilThread1_LogEntry(_In_ VMM_HANDLE H, _In_ PMEVIL_THREAD1_ENTRY pe)
}
pObProcess = VmmProcessGet(H, pe->dwPID);
FcEvilAdd(H, EVIL_THREAD, pObProcess, pe->vaWin32StartAddress, "%s", usz);
Ob_DECREF(pObProcess);
}
@@ -275,6 +279,7 @@ VOID MEvilThread1_DoWork(_In_ VMM_HANDLE H, _In_ VMMDLL_MODULE_ID MID, _In_opt_
fail:
Ob_DECREF_NULL(&ctx.pm);
Ob_DECREF_NULL(&ctx.pModuleMap);
Ob_DECREF_NULL(&ctx.pVadMap);
Ob_DECREF(pObThreadMap);
Ob_DECREF(pObProcess);
}
vmm/modules/m_fc_amcache.c
+183 -169
View File
@@ -513,42 +513,43 @@ static BOOL MFcAmcache_ParseApplicationValues(_In_ VMM_HANDLE H, _In_ POB_REGIST
DWORD i, iMax;
CHAR uszProgramId[MFCAMCACHE_MAX_VALUE_UTF8];
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
if(!(pmValues = VmmWinReg_KeyValueList(H, pHive, pKey))) { return FALSE; }
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++)
{
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi));
VmmWinReg_ValueInfo(pHive, pValue, &vi);
VmmWinReg_ValueInfo(pHive, pObValue, &vi);
vi.uszName[_countof(vi.uszName) - 1] = 0;
if(!vi.uszName[0]) { continue; }
if(!vi.uszName[0]) { Ob_DECREF(pObValue); continue; }
if(CharUtil_StrEquals(vi.uszName, "ProgramId", TRUE)) {
if(MFcAmcache_ReadString(H, pHive, pValue, uszProgramId, sizeof(uszProgramId))) {
if(MFcAmcache_ReadString(H, pHive, pObValue, uszProgramId, sizeof(uszProgramId))) {
fProgramId = ObStrMap_PushPtrUU(psm, uszProgramId, &pe->uszProgramId, NULL ) || fProgramId;
}
}
else if(CharUtil_StrEquals(vi.uszName, "ProgramInstanceId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszProgramInstanceId); }
else if(CharUtil_StrEquals(vi.uszName, "Name", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszName); }
else if(CharUtil_StrEquals(vi.uszName, "Publisher", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszPublisher); }
else if(CharUtil_StrEquals(vi.uszName, "Version", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName, "RootDirPath", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszRootDirPath); }
else if(CharUtil_StrEquals(vi.uszName, "RegistryKeyPath", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszRegistryKeyPath); }
else if(CharUtil_StrEquals(vi.uszName, "UninstallString", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszUninstallString); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDate", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszInstallDate); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDateMsi", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszInstallDateMsi); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDateFromLinkFile", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszInstallDateFromLinkFile); }
else if(CharUtil_StrEquals(vi.uszName, "Source", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszSource); }
else if(CharUtil_StrEquals(vi.uszName, "Type", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszType); }
else if(CharUtil_StrEquals(vi.uszName, "PackageFullName", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszPackageFullName); }
else if(CharUtil_StrEquals(vi.uszName, "MsiProductCode", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszMsiProductCode); }
else if(CharUtil_StrEquals(vi.uszName, "MsiPackageCode", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszMsiPackageCode); }
else if(CharUtil_StrEquals(vi.uszName, "ManifestPath", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszManifestPath); }
else if(CharUtil_StrEquals(vi.uszName, "BundleManifestPath", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszBundleManifestPath); }
else if(CharUtil_StrEquals(vi.uszName, "Language", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszLanguage); }
else if(CharUtil_StrEquals(vi.uszName, "OSVersionAtInstallTime", TRUE)){ MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszOSVersionAtInstallTime); }
else if(CharUtil_StrEquals(vi.uszName, "Manufacturer", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszManufacturer); }
else if(CharUtil_StrEquals(vi.uszName, "ProgramInstanceId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszProgramInstanceId); }
else if(CharUtil_StrEquals(vi.uszName, "Name", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszName); }
else if(CharUtil_StrEquals(vi.uszName, "Publisher", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszPublisher); }
else if(CharUtil_StrEquals(vi.uszName, "Version", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName, "RootDirPath", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszRootDirPath); }
else if(CharUtil_StrEquals(vi.uszName, "RegistryKeyPath", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszRegistryKeyPath); }
else if(CharUtil_StrEquals(vi.uszName, "UninstallString", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszUninstallString); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDate", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszInstallDate); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDateMsi", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszInstallDateMsi); }
else if(CharUtil_StrEquals(vi.uszName, "InstallDateFromLinkFile", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszInstallDateFromLinkFile); }
else if(CharUtil_StrEquals(vi.uszName, "Source", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszSource); }
else if(CharUtil_StrEquals(vi.uszName, "Type", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszType); }
else if(CharUtil_StrEquals(vi.uszName, "PackageFullName", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszPackageFullName); }
else if(CharUtil_StrEquals(vi.uszName, "MsiProductCode", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszMsiProductCode); }
else if(CharUtil_StrEquals(vi.uszName, "MsiPackageCode", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszMsiPackageCode); }
else if(CharUtil_StrEquals(vi.uszName, "ManifestPath", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszManifestPath); }
else if(CharUtil_StrEquals(vi.uszName, "BundleManifestPath", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszBundleManifestPath); }
else if(CharUtil_StrEquals(vi.uszName, "Language", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszLanguage); }
else if(CharUtil_StrEquals(vi.uszName, "OSVersionAtInstallTime", TRUE)){ MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszOSVersionAtInstallTime); }
else if(CharUtil_StrEquals(vi.uszName, "Manufacturer", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszManufacturer); }
Ob_DECREF(pObValue);
}
Ob_DECREF(pmValues);
return fProgramId;
@@ -558,29 +559,29 @@ static VOID MFcAmcache_ParseApplications(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HI
{
BOOL fProgramIdValue;
DWORD i, iMax;
POB_REGISTRY_KEY pRoot = NULL;
POB_REGISTRY_KEY pKey;
POB_REGISTRY_KEY pObRoot = NULL;
POB_REGISTRY_KEY pObKey = NULL;
POB_MAP pmKeys = NULL;
PVMM_MAP_AMCACHE_APPLICATION pe = NULL;
VMM_REGISTRY_KEY_INFO ki = { 0 };
pRoot = VmmWinReg_KeyGetByPath(H, pHive, "\\ROOT\\Root\\InventoryApplication");
if(!pRoot) { goto finish; }
pObRoot = VmmWinReg_KeyGetByPath(H, pHive, "\\ROOT\\Root\\InventoryApplication");
if(!pObRoot) { goto finish; }
ctx->fInventoryApplicationFound = TRUE;
pmKeys = VmmWinReg_KeyList(H, pHive, pRoot);
pmKeys = VmmWinReg_KeyList(H, pHive, pObRoot);
if(!pmKeys) { goto finish; }
if(ObMap_Size(pmKeys) > MFCAMCACHE_MAX_APPLICATIONS) {
ctx->fApplicationsTruncated = TRUE;
}
iMax = min(ObMap_Size(pmKeys), MFCAMCACHE_MAX_APPLICATIONS);
for(i = 0; i < iMax; i++) {
pKey = ObMap_GetByIndex(pmKeys, i);
if(!pKey) { continue; }
pObKey = ObMap_GetByIndex(pmKeys, i);
if(!pObKey) { continue; }
if(!(pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_APPLICATION)))) {
ctx->fApplicationsTruncated = TRUE;
break;
}
ZeroMemory(&ki, sizeof(ki));
VmmWinReg_KeyInfo(pHive, pKey, &ki);
VmmWinReg_KeyInfo(pHive, pObKey, &ki);
ki.uszName[_countof(ki.uszName) - 1] = 0;
pe->dwIndex = ObMap_Size(ctx->pmApplications);
pe->ftKeyLastWrite = ki.ftLastWrite;
@@ -594,17 +595,19 @@ static VOID MFcAmcache_ParseApplications(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HI
if(ki.uszName[0]) {
ObStrMap_PushPtrUU(ctx->psm, ki.uszName, &pe->uszRegistrySubKey, NULL);
}
fProgramIdValue = MFcAmcache_ParseApplicationValues(H, pHive, pKey, ctx->psm, pe);
fProgramIdValue = MFcAmcache_ParseApplicationValues(H, pHive, pObKey, ctx->psm, pe);
if(!fProgramIdValue && ki.uszName[0]) {
ObStrMap_PushPtrUU(ctx->psm, ki.uszName, &pe->uszProgramId, NULL);
pe->dwFlags |= MFCAMCACHE_APP_FLAG_PROGRAMID_FROM_KEY;
}
Ob_DECREF_NULL(&pObKey);
pe = NULL;
}
finish:
LocalFree(pe);
Ob_DECREF(pObKey);
Ob_DECREF(pmKeys);
Ob_DECREF(pRoot);
Ob_DECREF(pObRoot);
}
@@ -617,49 +620,50 @@ static VOID MFcAmcache_ParseFileValues(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE
DWORD i, iMax;
QWORD qw;
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
if(!(pmValues = VmmWinReg_KeyValueList(H, pHive, pKey))) { return; }
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi));
VmmWinReg_ValueInfo(pHive, pValue, &vi);
VmmWinReg_ValueInfo(pHive, pObValue, &vi);
vi.uszName[_countof(vi.uszName) - 1] = 0;
if(!vi.uszName[0]) { continue; }
if(!vi.uszName[0]) { Ob_DECREF(pObValue); continue; }
if(CharUtil_StrEquals(vi.uszName, "Size", TRUE)) {
if(MFcAmcache_ReadQWORD(H, pHive, pValue, &qw)) {
if(MFcAmcache_ReadQWORD(H, pHive, pObValue, &qw)) {
pe->cbFile = qw;
}
} else if(CharUtil_StrEquals(vi.uszName, "Usn", TRUE)) {
if(MFcAmcache_ReadQWORD(H, pHive, pValue, &qw)) {
if(MFcAmcache_ReadQWORD(H, pHive, pObValue, &qw)) {
pe->usn = qw;
}
} else if(CharUtil_StrEquals(vi.uszName, "IsPeFile", TRUE)) {
if(MFcAmcache_ReadQWORD(H, pHive, pValue, &qw)) {
if(MFcAmcache_ReadQWORD(H, pHive, pObValue, &qw)) {
pe->fIsPeFile = qw ? TRUE : FALSE;
}
} else if(CharUtil_StrEquals(vi.uszName, "IsOsComponent", TRUE)) {
if(MFcAmcache_ReadQWORD(H, pHive, pValue, &qw)) {
if(MFcAmcache_ReadQWORD(H, pHive, pObValue, &qw)) {
pe->fIsOsComponent = qw ? TRUE : FALSE;
}
}
else if(CharUtil_StrEquals(vi.uszName, "FileId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszFileId); }
else if(CharUtil_StrEquals(vi.uszName, "ProgramId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszProgramId); }
else if(CharUtil_StrEquals(vi.uszName, "LowerCaseLongPath", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszLowerCaseLongPath); }
else if(CharUtil_StrEquals(vi.uszName, "Name", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszName); }
else if(CharUtil_StrEquals(vi.uszName, "Publisher", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszPublisher); }
else if(CharUtil_StrEquals(vi.uszName, "ProductName", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszProductName); }
else if(CharUtil_StrEquals(vi.uszName, "ProductVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "Version", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinFileVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszBinFileVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinProductVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszBinProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinaryType", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszBinaryType); }
else if(CharUtil_StrEquals(vi.uszName, "Language", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszLanguage); }
else if(CharUtil_StrEquals(vi.uszName, "LinkDate", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszLinkDate); }
else if(CharUtil_StrEquals(vi.uszName, "LongPathHash", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszLongPathHash); }
else if(CharUtil_StrEquals(vi.uszName, "Description", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszDescription); }
else if(CharUtil_StrEquals(vi.uszName, "OriginalFileName", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, psm, &pe->uszOriginalFileName); }
else if(CharUtil_StrEquals(vi.uszName, "FileId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszFileId); }
else if(CharUtil_StrEquals(vi.uszName, "ProgramId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszProgramId); }
else if(CharUtil_StrEquals(vi.uszName, "LowerCaseLongPath", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszLowerCaseLongPath); }
else if(CharUtil_StrEquals(vi.uszName, "Name", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszName); }
else if(CharUtil_StrEquals(vi.uszName, "Publisher", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszPublisher); }
else if(CharUtil_StrEquals(vi.uszName, "ProductName", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszProductName); }
else if(CharUtil_StrEquals(vi.uszName, "ProductVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "Version", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinFileVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszBinFileVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinProductVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszBinProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "BinaryType", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszBinaryType); }
else if(CharUtil_StrEquals(vi.uszName, "Language", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszLanguage); }
else if(CharUtil_StrEquals(vi.uszName, "LinkDate", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszLinkDate); }
else if(CharUtil_StrEquals(vi.uszName, "LongPathHash", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszLongPathHash); }
else if(CharUtil_StrEquals(vi.uszName, "Description", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszDescription); }
else if(CharUtil_StrEquals(vi.uszName, "OriginalFileName", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, psm, &pe->uszOriginalFileName); }
Ob_DECREF(pObValue);
}
Ob_DECREF(pmValues);
}
@@ -667,43 +671,45 @@ static VOID MFcAmcache_ParseFileValues(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE
static VOID MFcAmcache_ParseFiles(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE pHive, _Inout_ PMFCAMCACHE_INIT_CONTEXT ctx)
{
DWORD i, iMax;
POB_REGISTRY_KEY pRoot = NULL;
POB_REGISTRY_KEY pKey;
POB_REGISTRY_KEY pObRoot = NULL;
POB_REGISTRY_KEY pObKey = NULL;
POB_MAP pmKeys = NULL;
PVMM_MAP_AMCACHE_FILE pe = NULL;
VMM_REGISTRY_KEY_INFO ki = { 0 };
pRoot = VmmWinReg_KeyGetByPath(H, pHive, "\\ROOT\\Root\\InventoryApplicationFile");
if(!pRoot) { goto finish; }
pObRoot = VmmWinReg_KeyGetByPath(H, pHive, "\\ROOT\\Root\\InventoryApplicationFile");
if(!pObRoot) { goto finish; }
ctx->fInventoryApplicationFileFound = TRUE;
pmKeys = VmmWinReg_KeyList(H, pHive, pRoot);
pmKeys = VmmWinReg_KeyList(H, pHive, pObRoot);
if(!pmKeys) { goto finish; }
iMax = min(ObMap_Size(pmKeys), MFCAMCACHE_MAX_FILES);
ctx->fFilesTruncated = (iMax == MFCAMCACHE_MAX_FILES);
for(i = 0; i < iMax; i++) {
pKey = ObMap_GetByIndex(pmKeys, i);
if(!pKey) { continue; }
pObKey = ObMap_GetByIndex(pmKeys, i);
if(!pObKey) { continue; }
if(!(pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_FILE)))) {
ctx->fFilesTruncated = TRUE;
break;
}
ZeroMemory(&ki, sizeof(ki));
VmmWinReg_KeyInfo(pHive, pKey, &ki);
VmmWinReg_KeyInfo(pHive, pObKey, &ki);
ki.uszName[_countof(ki.uszName) - 1] = 0;
pe->dwIndex = ObMap_Size(ctx->pmFiles);
pe->iApplication = MFCAMCACHE_APPLICATION_NONE;
pe->ftKeyLastWrite = ki.ftLastWrite;
if(ObMap_Push(ctx->pmFiles, pe->dwIndex + 1, pe)) {
MFcAmcache_ParseFileValues(H, pHive, pKey, ctx->psm, pe);
MFcAmcache_ParseFileValues(H, pHive, pObKey, ctx->psm, pe);
ObStrMap_PushPtrUU(ctx->psm, ki.uszName, &pe->uszRegistrySubKey, NULL);
} else {
LocalFree(pe);
ctx->fFilesTruncated = TRUE;
}
Ob_DECREF_NULL(&pObKey);
pe = NULL;
}
finish:
Ob_DECREF(pObKey);
Ob_DECREF(pmKeys);
Ob_DECREF(pRoot);
Ob_DECREF(pObRoot);
}
typedef VOID(*PFN_MFCAMCACHE_LIST_ITEM)(_Inout_ PVOID pvContext, _In_ LPCSTR uszItem);
@@ -849,31 +855,33 @@ finish:
static VOID MFcAmcache_ParseRootKeyList(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE pHive, _Inout_ PMFCAMCACHE_INIT_CONTEXT ctx, _In_ LPCSTR uszPath, _In_ DWORD cMax, _Out_ PBOOL pfFound, _Out_ PBOOL pfTruncated, _In_ PFN_MFCAMCACHE_PARSE_KEY pfnParse)
{
DWORD i, iMax;
POB_REGISTRY_KEY pRoot = NULL, pKey;
POB_REGISTRY_KEY pObRoot = NULL, pObKey = NULL;
POB_MAP pmKeys = NULL;
VMM_REGISTRY_KEY_INFO ki = { 0 };
*pfFound = FALSE;
*pfTruncated = FALSE;
pRoot = VmmWinReg_KeyGetByPath(H, pHive, uszPath);
if(!pRoot) { goto finish; }
pObRoot = VmmWinReg_KeyGetByPath(H, pHive, uszPath);
if(!pObRoot) { goto finish; }
*pfFound = TRUE;
pmKeys = VmmWinReg_KeyList(H, pHive, pRoot);
pmKeys = VmmWinReg_KeyList(H, pHive, pObRoot);
if(!pmKeys) { goto finish; }
if(ObMap_Size(pmKeys) > cMax) { *pfTruncated = TRUE; }
iMax = min(ObMap_Size(pmKeys), cMax);
for(i = 0; i < iMax; i++) {
if(!(pKey = ObMap_GetByIndex(pmKeys, i))) { continue; }
if(!(pObKey = ObMap_GetByIndex(pmKeys, i))) { continue; }
ZeroMemory(&ki, sizeof(ki));
VmmWinReg_KeyInfo(pHive, pKey, &ki);
VmmWinReg_KeyInfo(pHive, pObKey, &ki);
ki.uszName[_countof(ki.uszName) - 1] = 0;
if(!pfnParse(H, pHive, pKey, &ki, ctx)) {
if(!pfnParse(H, pHive, pObKey, &ki, ctx)) {
*pfTruncated = TRUE;
break;
}
Ob_DECREF_NULL(&pObKey);
}
finish:
Ob_DECREF(pObKey);
Ob_DECREF(pmKeys);
Ob_DECREF(pRoot);
Ob_DECREF(pObRoot);
}
//------------------------------------------------------------------------------
@@ -885,7 +893,7 @@ static BOOL MFcAmcache_ParseShortcutKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIV
BOOL fAnyKnown = FALSE, fProgramId = FALSE;
CHAR uszProgramId[MFCAMCACHE_MAX_VALUE_UTF8];
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
PVMM_MAP_AMCACHE_SHORTCUT pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_SHORTCUT));
if(!pe) { return FALSE; }
@@ -896,28 +904,30 @@ static BOOL MFcAmcache_ParseShortcutKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIV
if((pmValues = VmmWinReg_KeyValueList(H, pHive, pKey))) {
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi));
VmmWinReg_ValueInfo(pHive, pValue, &vi);
VmmWinReg_ValueInfo(pHive, pObValue, &vi);
vi.uszName[_countof(vi.uszName) - 1] = 0;
if(CharUtil_StrEquals(vi.uszName, "ShortcutProgramId", TRUE)) {
if(MFcAmcache_ReadString(H, pHive, pValue, uszProgramId, sizeof(uszProgramId))) {
if(MFcAmcache_ReadString(H, pHive, pObValue, uszProgramId, sizeof(uszProgramId))) {
ObStrMap_PushPtrUU(ctx->psm, uszProgramId, &pe->uszShortcutProgramId, NULL);
fProgramId = TRUE;
}
fAnyKnown = TRUE;
} else if(CharUtil_StrEquals(vi.uszName, "ShortcutPath", TRUE)) {
MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszShortcutPath);
MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszShortcutPath);
fAnyKnown = TRUE;
} else if(CharUtil_StrEquals(vi.uszName, "ShortcutTargetPath", TRUE) || CharUtil_StrEquals(vi.uszName, "TargetPath", TRUE)) {
MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszShortcutTargetPath);
MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszShortcutTargetPath);
fAnyKnown = TRUE;
}
Ob_DECREF(pObValue);
}
/* Older modern-schema variants expose only one unnamed/unknown value. */
if(!fAnyKnown && ObMap_Size(pmValues)) {
pValue = ObMap_GetByIndex(pmValues, 0);
if(pValue) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszShortcutPath); }
pObValue = ObMap_GetByIndex(pmValues, 0);
if(pObValue) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszShortcutPath); }
Ob_DECREF(pObValue);
}
}
if(!fProgramId && pKeyInfo->uszName[0]) {
@@ -940,7 +950,7 @@ static BOOL MFcAmcache_ParseDriverBinaryKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY
QWORD qw = 0;
CHAR uszDriverId[MFCAMCACHE_MAX_VALUE_UTF8];
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
PVMM_MAP_AMCACHE_DRIVER_BINARY pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_DRIVER_BINARY));
if(!pe) { return FALSE; }
@@ -951,33 +961,34 @@ static BOOL MFcAmcache_ParseDriverBinaryKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY
if((pmValues = VmmWinReg_KeyValueList(H, pHive, pKey))) {
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi)); VmmWinReg_ValueInfo(pHive, pValue, &vi); vi.uszName[_countof(vi.uszName)-1] = 0;
if(CharUtil_StrEquals(vi.uszName, "DriverCheckSum", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->qwDriverCheckSum=qw; }
else if(CharUtil_StrEquals(vi.uszName, "DriverTimeStamp", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->qwDriverTimeStamp=qw; }
else if(CharUtil_StrEquals(vi.uszName, "ImageSize", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->cbImageSize=qw; }
else if(CharUtil_StrEquals(vi.uszName, "DriverInBox", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fDriverInBox=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverIsKernelMode", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fDriverIsKernelMode=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverSigned", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fDriverSigned=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverName", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverCompany", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverCompany); }
else if(CharUtil_StrEquals(vi.uszName, "DriverPackageStrongName", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverPackageStrongName); }
else if(CharUtil_StrEquals(vi.uszName, "Service", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszService); }
else if(CharUtil_StrEquals(vi.uszName, "Inf", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName, "Product", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszProduct); }
else if(CharUtil_StrEquals(vi.uszName, "ProductVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverVersion); }
else if(CharUtil_StrEquals(vi.uszName, "DriverLastWriteTime", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverLastWriteTime); }
else if(CharUtil_StrEquals(vi.uszName, "DriverType", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDriverType); }
else if(CharUtil_StrEquals(vi.uszName, "WdfVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszWdfVersion); }
else if(CharUtil_StrEquals(vi.uszName, "COMPID", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszCOMPID); }
else if(CharUtil_StrEquals(vi.uszName, "HWID", TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszHWID); }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi)); VmmWinReg_ValueInfo(pHive, pObValue, &vi); vi.uszName[_countof(vi.uszName)-1] = 0;
if(CharUtil_StrEquals(vi.uszName, "DriverCheckSum", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->qwDriverCheckSum=qw; }
else if(CharUtil_StrEquals(vi.uszName, "DriverTimeStamp", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->qwDriverTimeStamp=qw; }
else if(CharUtil_StrEquals(vi.uszName, "ImageSize", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->cbImageSize=qw; }
else if(CharUtil_StrEquals(vi.uszName, "DriverInBox", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fDriverInBox=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverIsKernelMode", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fDriverIsKernelMode=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverSigned", TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fDriverSigned=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName, "DriverName", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverCompany", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverCompany); }
else if(CharUtil_StrEquals(vi.uszName, "DriverPackageStrongName", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverPackageStrongName); }
else if(CharUtil_StrEquals(vi.uszName, "Service", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszService); }
else if(CharUtil_StrEquals(vi.uszName, "Inf", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName, "Product", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszProduct); }
else if(CharUtil_StrEquals(vi.uszName, "ProductVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszProductVersion); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverVersion); }
else if(CharUtil_StrEquals(vi.uszName, "DriverLastWriteTime", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverLastWriteTime); }
else if(CharUtil_StrEquals(vi.uszName, "DriverType", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDriverType); }
else if(CharUtil_StrEquals(vi.uszName, "WdfVersion", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszWdfVersion); }
else if(CharUtil_StrEquals(vi.uszName, "COMPID", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszCOMPID); }
else if(CharUtil_StrEquals(vi.uszName, "HWID", TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszHWID); }
else if(CharUtil_StrEquals(vi.uszName, "DriverId", TRUE)) {
fDriverId = MFcAmcache_ReadString(H, pHive, pValue, uszDriverId, sizeof(uszDriverId));
fDriverId = MFcAmcache_ReadString(H, pHive, pObValue, uszDriverId, sizeof(uszDriverId));
if(fDriverId) {
ObStrMap_PushPtrUU(ctx->psm, uszDriverId, &pe->uszDriverId, NULL);
}
}
Ob_DECREF(pObValue);
}
}
if(!fDriverId && pKeyInfo->uszName[0]) {
@@ -997,7 +1008,7 @@ static BOOL MFcAmcache_ParseDriverPackageKey(_In_ VMM_HANDLE H, _In_ POB_REGISTR
DWORD i, iMax;
QWORD qw = 0;
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
PVMM_MAP_AMCACHE_DRIVER_PACKAGE pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_DRIVER_PACKAGE));
if(!pe) { return FALSE; }
@@ -1007,21 +1018,22 @@ static BOOL MFcAmcache_ParseDriverPackageKey(_In_ VMM_HANDLE H, _In_ POB_REGISTR
if((pmValues = VmmWinReg_KeyValueList(H, pHive, pKey))) {
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi)); VmmWinReg_ValueInfo(pHive,pValue,&vi); vi.uszName[_countof(vi.uszName)-1]=0;
if(CharUtil_StrEquals(vi.uszName,"DriverInBox",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fDriverInBox=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"Class",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszClass); }
else if(CharUtil_StrEquals(vi.uszName,"ClassGuid",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszClassGuid); }
else if(CharUtil_StrEquals(vi.uszName,"Date",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDate); }
else if(CharUtil_StrEquals(vi.uszName,"Directory",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDirectory); }
else if(CharUtil_StrEquals(vi.uszName,"Inf",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName,"Provider",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszProvider); }
else if(CharUtil_StrEquals(vi.uszName,"Version",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName,"FlightIds",TRUE)) { MFcAmcache_ReadListString(H,pHive,pValue,ctx->psm,&pe->uszFlightIds,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"RecoveryIds",TRUE)) { MFcAmcache_ReadListString(H,pHive,pValue,ctx->psm,&pe->uszRecoveryIds,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"SubmissionId",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszSubmissionId); }
else if(CharUtil_StrEquals(vi.uszName,"HWIDs",TRUE) || CharUtil_StrEquals(vi.uszName,"Hwids",TRUE)) { MFcAmcache_ReadListString(H,pHive,pValue,ctx->psm,&pe->uszHWIDs,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"SYSFILE",TRUE)) { MFcAmcache_ReadListString(H,pHive,pValue,ctx->psm,&pe->uszSYSFILE,NULL,NULL); }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi)); VmmWinReg_ValueInfo(pHive,pObValue,&vi); vi.uszName[_countof(vi.uszName)-1]=0;
if(CharUtil_StrEquals(vi.uszName,"DriverInBox",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fDriverInBox=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"Class",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszClass); }
else if(CharUtil_StrEquals(vi.uszName,"ClassGuid",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszClassGuid); }
else if(CharUtil_StrEquals(vi.uszName,"Date",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDate); }
else if(CharUtil_StrEquals(vi.uszName,"Directory",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDirectory); }
else if(CharUtil_StrEquals(vi.uszName,"Inf",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName,"Provider",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszProvider); }
else if(CharUtil_StrEquals(vi.uszName,"Version",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszVersion); }
else if(CharUtil_StrEquals(vi.uszName,"FlightIds",TRUE)) { MFcAmcache_ReadListString(H,pHive,pObValue,ctx->psm,&pe->uszFlightIds,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"RecoveryIds",TRUE)) { MFcAmcache_ReadListString(H,pHive,pObValue,ctx->psm,&pe->uszRecoveryIds,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"SubmissionId",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszSubmissionId); }
else if(CharUtil_StrEquals(vi.uszName,"HWIDs",TRUE) || CharUtil_StrEquals(vi.uszName,"Hwids",TRUE)) { MFcAmcache_ReadListString(H,pHive,pObValue,ctx->psm,&pe->uszHWIDs,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"SYSFILE",TRUE)) { MFcAmcache_ReadListString(H,pHive,pObValue,ctx->psm,&pe->uszSYSFILE,NULL,NULL); }
Ob_DECREF(pObValue);
}
}
Ob_DECREF(pmValues);
@@ -1038,7 +1050,7 @@ static BOOL MFcAmcache_ParseDeviceContainerKey(_In_ VMM_HANDLE H, _In_ POB_REGIS
DWORD i, iMax;
QWORD qw = 0;
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
PVMM_MAP_AMCACHE_DEVICE_CONTAINER pe;
pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_DEVICE_CONTAINER));
@@ -1048,25 +1060,26 @@ static BOOL MFcAmcache_ParseDeviceContainerKey(_In_ VMM_HANDLE H, _In_ POB_REGIS
if((pmValues = VmmWinReg_KeyValueList(H,pHive,pKey))) {
iMax = min(ObMap_Size(pmValues), MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi));
VmmWinReg_ValueInfo(pHive, pValue, &vi);
VmmWinReg_ValueInfo(pHive, pObValue, &vi);
vi.uszName[_countof(vi.uszName) - 1] = 0;
if(CharUtil_StrEquals(vi.uszName,"IsActive",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fIsActive=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsConnected",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fIsConnected=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsMachineContainer",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fIsMachineContainer=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsNetworked",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fIsNetworked=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsPaired",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pValue,&qw)) pe->fIsPaired=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"Categories",TRUE)) { MFcAmcache_ReadListString(H,pHive,pValue,ctx->psm,&pe->uszCategories,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"DiscoveryMethod",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszDiscoveryMethod); }
else if(CharUtil_StrEquals(vi.uszName,"FriendlyName",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszFriendlyName); }
else if(CharUtil_StrEquals(vi.uszName,"Icon",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszIcon); }
else if(CharUtil_StrEquals(vi.uszName,"Manufacturer",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszManufacturer); }
else if(CharUtil_StrEquals(vi.uszName,"ModelId",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszModelId); }
else if(CharUtil_StrEquals(vi.uszName,"ModelName",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszModelName); }
else if(CharUtil_StrEquals(vi.uszName,"ModelNumber",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszModelNumber); }
else if(CharUtil_StrEquals(vi.uszName,"PrimaryCategory",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszPrimaryCategory); }
else if(CharUtil_StrEquals(vi.uszName,"State",TRUE)) { MFcAmcache_PushString(H,pHive,pValue,ctx->psm,&pe->uszState); }
if(CharUtil_StrEquals(vi.uszName,"IsActive",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fIsActive=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsConnected",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fIsConnected=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsMachineContainer",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fIsMachineContainer=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsNetworked",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fIsNetworked=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"IsPaired",TRUE)) { if(MFcAmcache_ReadQWORD(H,pHive,pObValue,&qw)) pe->fIsPaired=qw?TRUE:FALSE; }
else if(CharUtil_StrEquals(vi.uszName,"Categories",TRUE)) { MFcAmcache_ReadListString(H,pHive,pObValue,ctx->psm,&pe->uszCategories,NULL,NULL); }
else if(CharUtil_StrEquals(vi.uszName,"DiscoveryMethod",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszDiscoveryMethod); }
else if(CharUtil_StrEquals(vi.uszName,"FriendlyName",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszFriendlyName); }
else if(CharUtil_StrEquals(vi.uszName,"Icon",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszIcon); }
else if(CharUtil_StrEquals(vi.uszName,"Manufacturer",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszManufacturer); }
else if(CharUtil_StrEquals(vi.uszName,"ModelId",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszModelId); }
else if(CharUtil_StrEquals(vi.uszName,"ModelName",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszModelName); }
else if(CharUtil_StrEquals(vi.uszName,"ModelNumber",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszModelNumber); }
else if(CharUtil_StrEquals(vi.uszName,"PrimaryCategory",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszPrimaryCategory); }
else if(CharUtil_StrEquals(vi.uszName,"State",TRUE)) { MFcAmcache_PushString(H,pHive,pObValue,ctx->psm,&pe->uszState); }
Ob_DECREF(pObValue);
}
}
Ob_DECREF(pmValues);
@@ -1082,7 +1095,7 @@ static BOOL MFcAmcache_ParseDevicePnpKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HI
{
DWORD i, iMax;
POB_MAP pmValues = NULL;
POB_REGISTRY_VALUE pValue;
POB_REGISTRY_VALUE pObValue;
VMM_REGISTRY_VALUE_INFO vi = { 0 };
PVMM_MAP_AMCACHE_DEVICE_PNP pe;
pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMM_MAP_AMCACHE_DEVICE_PNP));
@@ -1096,34 +1109,35 @@ static BOOL MFcAmcache_ParseDevicePnpKey(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HI
if((pmValues=VmmWinReg_KeyValueList(H,pHive,pKey))) {
iMax=min(ObMap_Size(pmValues),MFCAMCACHE_MAX_VALUES_PER_RECORD);
for(i = 0; i < iMax; i++) {
if(!(pValue = ObMap_GetByIndex(pmValues, i))) { continue; }
if(!(pObValue = ObMap_GetByIndex(pmValues, i))) { continue; }
ZeroMemory(&vi, sizeof(vi));
VmmWinReg_ValueInfo(pHive, pValue, &vi);
VmmWinReg_ValueInfo(pHive, pObValue, &vi);
vi.uszName[_countof(vi.uszName) - 1] = 0;
if(CharUtil_StrEquals(vi.uszName, "BusReportedDescription", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszBusReportedDescription); }
else if(CharUtil_StrEquals(vi.uszName, "Class", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszClass); }
else if(CharUtil_StrEquals(vi.uszName, "ClassGuid", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszClassGuid); }
else if(CharUtil_StrEquals(vi.uszName, "COMPID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pValue, ctx->psm, &pe->uszCOMPID, NULL, NULL); }
else if(CharUtil_StrEquals(vi.uszName, "ContainerId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszContainerId); }
else if(CharUtil_StrEquals(vi.uszName, "Description", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDescription); }
else if(CharUtil_StrEquals(vi.uszName, "DeviceState", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDeviceState); }
else if(CharUtil_StrEquals(vi.uszName, "DriverId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDriverId); }
else if(CharUtil_StrEquals(vi.uszName, "DriverName", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDriverName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverPackageStrongName", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDriverPackageStrongName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVerDate", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDriverVerDate); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVerVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszDriverVerVersion); }
else if(CharUtil_StrEquals(vi.uszName, "Enumerator", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszEnumerator); }
else if(CharUtil_StrEquals(vi.uszName, "HWID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pValue, ctx->psm, &pe->uszHWID, NULL, NULL); }
else if(CharUtil_StrEquals(vi.uszName, "Inf", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName, "InstallState", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszInstallState); }
else if(CharUtil_StrEquals(vi.uszName, "Manufacturer", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszManufacturer); }
else if(CharUtil_StrEquals(vi.uszName, "MatchingID", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszMatchingID); }
else if(CharUtil_StrEquals(vi.uszName, "Model", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszModel); }
else if(CharUtil_StrEquals(vi.uszName, "ParentId", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszParentId); }
else if(CharUtil_StrEquals(vi.uszName, "ProblemCode", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszProblemCode); }
else if(CharUtil_StrEquals(vi.uszName, "Provider", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszProvider); }
else if(CharUtil_StrEquals(vi.uszName, "Service", TRUE)) { MFcAmcache_PushString(H, pHive, pValue, ctx->psm, &pe->uszService); }
else if(CharUtil_StrEquals(vi.uszName, "STACKID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pValue, ctx->psm, &pe->uszSTACKID, NULL, NULL); }
if(CharUtil_StrEquals(vi.uszName, "BusReportedDescription", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszBusReportedDescription); }
else if(CharUtil_StrEquals(vi.uszName, "Class", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszClass); }
else if(CharUtil_StrEquals(vi.uszName, "ClassGuid", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszClassGuid); }
else if(CharUtil_StrEquals(vi.uszName, "COMPID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pObValue, ctx->psm, &pe->uszCOMPID, NULL, NULL); }
else if(CharUtil_StrEquals(vi.uszName, "ContainerId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszContainerId); }
else if(CharUtil_StrEquals(vi.uszName, "Description", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDescription); }
else if(CharUtil_StrEquals(vi.uszName, "DeviceState", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDeviceState); }
else if(CharUtil_StrEquals(vi.uszName, "DriverId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDriverId); }
else if(CharUtil_StrEquals(vi.uszName, "DriverName", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDriverName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverPackageStrongName", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDriverPackageStrongName); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVerDate", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDriverVerDate); }
else if(CharUtil_StrEquals(vi.uszName, "DriverVerVersion", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszDriverVerVersion); }
else if(CharUtil_StrEquals(vi.uszName, "Enumerator", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszEnumerator); }
else if(CharUtil_StrEquals(vi.uszName, "HWID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pObValue, ctx->psm, &pe->uszHWID, NULL, NULL); }
else if(CharUtil_StrEquals(vi.uszName, "Inf", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszInf); }
else if(CharUtil_StrEquals(vi.uszName, "InstallState", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszInstallState); }
else if(CharUtil_StrEquals(vi.uszName, "Manufacturer", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszManufacturer); }
else if(CharUtil_StrEquals(vi.uszName, "MatchingID", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszMatchingID); }
else if(CharUtil_StrEquals(vi.uszName, "Model", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszModel); }
else if(CharUtil_StrEquals(vi.uszName, "ParentId", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszParentId); }
else if(CharUtil_StrEquals(vi.uszName, "ProblemCode", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszProblemCode); }
else if(CharUtil_StrEquals(vi.uszName, "Provider", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszProvider); }
else if(CharUtil_StrEquals(vi.uszName, "Service", TRUE)) { MFcAmcache_PushString(H, pHive, pObValue, ctx->psm, &pe->uszService); }
else if(CharUtil_StrEquals(vi.uszName, "STACKID", TRUE)) { MFcAmcache_ReadListString(H, pHive, pObValue, ctx->psm, &pe->uszSTACKID, NULL, NULL); }
Ob_DECREF(pObValue);
}
}
Ob_DECREF(pmValues);
vmm/modules/m_fc_ntfs.c
+2
View File
@@ -692,11 +692,13 @@ VOID FcNtfs2_Init1(_In_ VMM_HANDLE H, POB_FCNTFS2_INIT_CONTEXT ctx)
while((pObFile = ObMap_Pop(pmObMft))) {
VmmLog(H, ctx->MID, LOGLEVEL_5_DEBUG, "Ingesting $Mft file:[%s] size:[%llu] va:[0x%llx]", pObFile->uszPath, pObFile->cb, pObFile->va);
FcNtfs2_InitMft(H, ctx, pObFile);
Ob_DECREF(pObFile);
}
// ingest $Directory files:
while((pObFile = ObMap_Pop(pmObDirectory))) {
VmmLog(H, ctx->MID, LOGLEVEL_5_DEBUG, "Ingesting $Directory file:[%s] size:[%llu] va:[0x%llx]", pObFile->uszPath, pObFile->cb, pObFile->va);
FcNtfs2_InitDir(H, ctx, pObFile);
Ob_DECREF(pObFile);
}
fail:
Ob_DECREF(psObDuplicates);
vmm/modules/m_fc_prefetch.c
+1
View File
@@ -264,6 +264,7 @@ fail:
Ob_DECREF(ctx->psm);
Ob_DECREF(ctx->pmPf);
Ob_DECREF(ctx->psDuplicate);
LocalFree(ctx);
}
Ob_DECREF(pmObFiles);
return pObMap;
vmm/modules/m_fc_web.c
+2 -1
View File
@@ -406,7 +406,8 @@ NTSTATUS MWeb_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Out_wri
PVMMOB_MAP_WEB pObWebMap = NULL;
if(!(pObWebMap = MWeb_GetWebMap(H, ctxP))) { goto finish; }
if(!_stricmp("readme.txt", ctxP->uszPath)) {
return VMMDLL_UtilVfsReadFile_FromPBYTE(szMWEB_README, strlen(szMWEB_README), pb, cb, pcbRead, cbOffset);
nt = VMMDLL_UtilVfsReadFile_FromPBYTE(szMWEB_README, strlen(szMWEB_README), pb, cb, pcbRead, cbOffset);
goto finish;
}
if(!_stricmp(ctxP->uszPath, "web.txt")) {
nt = Util_VfsLineVariable_Read(
vmm/modules/m_misc_procinfo.c
+1 -1
View File
@@ -93,7 +93,7 @@ NTSTATUS MMiscProcInfo_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP,
POB_PMMISCINFO_CONTEXT ctxOb = MMiscProcInfo_GetContext(H, ctxP);
if(ctxOb) {
if(!_stricmp(ctxP->uszPath, "progress_percent.txt")) {
return Util_VfsReadFile_FromNumber(ctxOb->dwProgressPercent, pb, cb, pcbRead, cbOffset);
nt = Util_VfsReadFile_FromNumber(ctxOb->dwProgressPercent, pb, cb, pcbRead, cbOffset);
}
if(!_stricmp(ctxP->uszPath, "dtb.txt")) {
nt = ctxOb->pmfDTB ? ObMemFile_ReadFile(ctxOb->pmfDTB, pb, cb, pcbRead, cbOffset) : VMMDLL_STATUS_END_OF_FILE;
vmm/modules/m_proc_heap.c
+4 -1
View File
@@ -121,6 +121,7 @@ static NTSTATUS MHeap_Write(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP,
goto finish;
}
finish:
Ob_DECREF(pObHeapAllocMap);
return VMM_STATUS_SUCCESS;
}
@@ -149,7 +150,8 @@ static NTSTATUS MHeap_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP,
ctx.pProcess = (PVMM_PROCESS)ctxP->pProcess;
// module root - heap info files
if(!_stricmp(ctxP->uszPath, "readme.txt")) {
return Util_VfsReadFile_FromStrA(szMHEAP_README, pb, cb, pcbRead, cbOffset);
nt = Util_VfsReadFile_FromStrA(szMHEAP_README, pb, cb, pcbRead, cbOffset);
goto finish;
}
if(!_stricmp(ctxP->uszPath, "heaps.txt")) {
nt = Util_VfsLineFixed_Read(
@@ -196,6 +198,7 @@ static NTSTATUS MHeap_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP,
}
finish:
Ob_DECREF(pObHeapMap);
Ob_DECREF(pObHeapAllocMap);
return nt;
}
vmm/modules/m_proc_minidump.c
+1 -1
View File
@@ -1043,7 +1043,7 @@ POB_M_MINIDUMP_CONTEXT M_MiniDump_GetContext(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLU
goto finish;
}
// ctx is aged out
ObMap_RemoveByKey(ctxM, qwKey);
Ob_DECREF(ObMap_RemoveByKey(ctxM, qwKey));
Ob_DECREF_NULL(&pObCtx);
}
EnterCriticalSection(&pProcess->LockPlugin);
vmm/modules/m_proc_thread.c
+1 -1
View File
@@ -163,8 +163,8 @@ NTSTATUS MThread_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Out_
VmmMap_GetThreadCallstack(H, pProcess, pe, 0, &pObThreadCallstackMap);
if(pObThreadCallstackMap && pObThreadCallstackMap->uszText) {
nt = Util_VfsReadFile_FromPBYTE(pObThreadCallstackMap->uszText, pObThreadCallstackMap->cbText, pb, cb, pcbRead, cbOffset);
Ob_DECREF_NULL(&pObThreadCallstackMap);
}
Ob_DECREF_NULL(&pObThreadCallstackMap);
goto finish;
}
// impersonation token:
vmm/modules/m_proc_winterm.c
+1 -1
View File
@@ -1728,8 +1728,8 @@ VOID M_ProcWinTerm_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO
{
if((pRI->magic != VMMDLL_PLUGIN_REGINFO_MAGIC) || (pRI->wVersion != VMMDLL_PLUGIN_REGINFO_VERSION)) { return; }
if((pRI->tpSystem != VMMDLL_SYSTEM_WINDOWS_64) || (pRI->tpMemoryModel != VMMDLL_MEMORYMODEL_X64)) { return; }
if(!(pRI->reg_info.ctxM = (PVMMDLL_PLUGIN_INTERNAL_CONTEXT)ObMap_New(H, OB_MAP_FLAGS_OBJECT_OB))) { return; }
if(H->vmm.kernel.dwVersionBuild < 22000) { return; } // WT parsing supported on win11+
if(!(pRI->reg_info.ctxM = (PVMMDLL_PLUGIN_INTERNAL_CONTEXT)ObMap_New(H, OB_MAP_FLAGS_OBJECT_OB))) { return; }
strcpy_s(pRI->reg_info.uszPathName, 128, "\\winterm");
pRI->reg_info.fRootModule = FALSE;
pRI->reg_info.fProcessModule = TRUE;
vmm/modules/m_sys_netdns.c
+1
View File
@@ -771,6 +771,7 @@ static VOID MSysNetDns_FcLogCSV(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT c
);
}
}
Ob_DECREF(pObDnsMap);
}
static VOID MSysNetDns_FcLogJSON(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_ VOID(*pfnLogJSON)(_In_ VMM_HANDLE H, _In_ PVMMDLL_FORENSIC_JSONDATA pData))
vmm/modules/m_sys_svc.c
+3 -1
View File
@@ -231,7 +231,8 @@ NTSTATUS MSysSvc_Read(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _Out_
if(!_strnicmp("registry", uszSvcSubPath, 8)) {
i = (uszSvcSubPath[8] == '\\') ? 9 : 8;
_snprintf_s(usz, MAX_PATH, _TRUNCATE, "registry\\HKLM\\SYSTEM\\ControlSet001\\Services\\%s\\%s", pe->uszServiceName, uszSvcSubPath + i);
return PluginManager_Read(H, NULL, usz, pb, cb, pcbRead, cbOffset);
nt = PluginManager_Read(H, NULL, usz, pb, cb, pcbRead, cbOffset);
goto finish;
}
}
}
@@ -371,6 +372,7 @@ VOID MSysSvc_FcLogCSV(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_
);
}
}
Ob_DECREF(pObSvcMap);
}
VOID M_SysSvc_Initialize(_In_ VMM_HANDLE H, _Inout_ PVMMDLL_PLUGIN_REGINFO pRI)
vmm/modules/m_sys_syscall.c
+2 -2
View File
@@ -110,14 +110,14 @@ VOID MSyscall_Initialize(_In_ VMM_HANDLE H, PMSYSCALL_CONTEXT ctxM)
(ctxM->ServiceDescriptorTable32[i].NumberOfServices < 0x800) &&
VMM_KADDR32(ctxM->ServiceDescriptorTable32[i].ParamTableBase) &&
(ctxM->ServiceDescriptorTable32[i].ServiceTableBase < ctxM->ServiceDescriptorTable32[i].ParamTableBase);
if(!f) { return; }
if(!f) { goto fail; }
} else {
f = VMM_KADDR64_8(ctxM->ServiceDescriptorTable64[i].ServiceTableBase) &&
(ctxM->ServiceDescriptorTable64[i].ServiceCounterTableBase == 0) &&
(ctxM->ServiceDescriptorTable64[i].NumberOfServices < 0x800) &&
VMM_KADDR64(ctxM->ServiceDescriptorTable64[i].ParamTableBase) &&
(ctxM->ServiceDescriptorTable64[i].ServiceTableBase < ctxM->ServiceDescriptorTable64[i].ParamTableBase);
if(!f) { return; }
if(!f) { goto fail; }
}
}
// fetch win32k infos
vmm/modules/m_sys_task.c
+1
View File
@@ -714,6 +714,7 @@ VOID MSysTask_FcLogCSV(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_
);
}
}
Ob_DECREF(pObTaskMap);
}
VOID MSysTask_Notify(_In_ VMM_HANDLE H, _In_ PVMMDLL_PLUGIN_CONTEXT ctxP, _In_ DWORD fEvent, _In_opt_ PVOID pvEvent, _In_opt_ DWORD cbEvent)
vmm/ob/ob_cachemap.c
+4 -1
View File
@@ -142,6 +142,10 @@ BOOL _ObCacheMap_Push(_In_ POB_CACHEMAP pcm, _In_ QWORD qwKey, _In_ PVOID pvObje
}
// 3: add new object
if(!(pe = LocalAlloc(0, sizeof(OB_CACHEMAPENTRY)))) { return FALSE; }
if(!ObMap_Push(pcm->pm, qwKey, pe)) {
LocalFree(pe);
return FALSE;
}
if(pcm->fObjectsOb) { Ob_INCREF(pvObject); }
pe->pvObject = pvObject;
pe->qwContext = qwContextInitial;
@@ -153,7 +157,6 @@ BOOL _ObCacheMap_Push(_In_ POB_CACHEMAP pcm, _In_ QWORD qwKey, _In_ PVOID pvObje
} else {
pe->BLink = pe->FLink = pe;
}
ObMap_Push(pcm->pm, qwKey, pe);
pcm->AgeListHead = pe;
pcm->c++;
return TRUE;
vmm/ob/ob_counter.c
+6 -1
View File
@@ -545,9 +545,14 @@ BOOL _ObCounter_Grow(_In_ POB_COUNTER pm)
{
DWORD iEntry;
PDWORD pdwNewAllocHashMap;
PPOB_COUNTER_ENTRY ppNewAllocTable;
if(!(pdwNewAllocHashMap = LocalAlloc(LMEM_ZEROINIT, 2 * sizeof(DWORD) * pm->cHashMax))) { return FALSE; }
if(!pm->fLargeMode) {
if(!(pm->Directory[0] = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_COUNTER_ENTRY) * OB_COUNTER_ENTRIES_TABLE))) { return FALSE; }
if(!(ppNewAllocTable = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_COUNTER_ENTRY) * OB_COUNTER_ENTRIES_TABLE))) {
LocalFree(pdwNewAllocHashMap);
return FALSE;
}
pm->Directory[0] = ppNewAllocTable;
pm->Directory[0][0] = pm->Store00;
ZeroMemory(pm->_SmallHashMap, sizeof(pm->_SmallHashMap));
pm->pHashMapKey = NULL;
vmm/ob/ob_map.c
+6 -1
View File
@@ -805,9 +805,14 @@ BOOL _ObMap_Grow(_In_ POB_MAP pm)
{
DWORD iEntry;
PDWORD pdwNewAllocHashMap;
PPOB_MAP_ENTRY ppNewAllocTable;
if(!(pdwNewAllocHashMap = LocalAlloc(LMEM_ZEROINIT, 2 * sizeof(DWORD) * pm->cHashMax * (pm->fKey ? 2 : 1)))) { return FALSE; }
if(!pm->fLargeMode) {
if(!(pm->Directory[0] = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_MAP_ENTRY) * OB_MAP_ENTRIES_TABLE))) { return FALSE; }
if(!(ppNewAllocTable = LocalAlloc(LMEM_ZEROINIT, sizeof(POB_MAP_ENTRY) * OB_MAP_ENTRIES_TABLE))) {
LocalFree(pdwNewAllocHashMap);
return FALSE;
}
pm->Directory[0] = ppNewAllocTable;
pm->Directory[0][0] = pm->Store00;
ZeroMemory(pm->_SmallHashMap, sizeof(pm->_SmallHashMap));
pm->pHashMapKey = NULL;
vmm/ob/ob_strmap.c
+2 -3
View File
@@ -119,7 +119,6 @@ POB_STRMAP_ENTRY _ObStrMap_PushStr(_In_ POB_STRMAP psm, _In_opt_ LPCSTR usz, _In
}
if((psm->cbu > 0x40000000) || !cbu || (cbu > 0x00100000)) { return NULL; }
if(!(pStrEntry = LocalAlloc(LMEM_ZEROINIT, sizeof(OB_STRMAP_ENTRY) + cbu))) { return NULL; }
psm->cbu += cbu;
pStrEntry->cbu = cbu;
if(usz) {
f = CharUtil_UtoU(usz, -1, pStrEntry->usz, cbu, NULL, NULL, CHARUTIL_FLAG_TRUNCATE | CHARUTIL_FLAG_STR_BUFONLY);
@@ -128,8 +127,8 @@ POB_STRMAP_ENTRY _ObStrMap_PushStr(_In_ POB_STRMAP psm, _In_opt_ LPCSTR usz, _In
} else {
f = CharUtil_AtoU(sz, -1, pStrEntry->usz, cbu, NULL, NULL, CHARUTIL_FLAG_TRUNCATE | CHARUTIL_FLAG_STR_BUFONLY);
}
if(f) {
ObMap_Push(psm->pm, qwHash, pStrEntry);
if(f && ObMap_Push(psm->pm, qwHash, pStrEntry)) {
psm->cbu += cbu;
} else {
LocalFree(pStrEntry);
pStrEntry = NULL;
vmm/pdb.c
+4 -1
View File
@@ -1747,7 +1747,10 @@ BOOL PDB_DisplayTypeNt(
return FALSE;
}
hPDB = PDB_GetHandleFromModuleName(H, "ntoskrnl");
if(!(pObPdbEntry = ObMap_GetByKey(ctxOb->pmPdbByHash, hPDB))) { return FALSE; }
if(!(pObPdbEntry = ObMap_GetByKey(ctxOb->pmPdbByHash, hPDB))) {
Ob_DECREF(ctxOb);
return FALSE;
}
EnterCriticalSection(&ctxOb->Lock);
if(!PDB_LoadEnsureEx(H, ctxOb, pObPdbEntry)) { goto fail; }
// flag: object header -> type == _OBJECT_HEADER + adjust va type base.
vmm/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 6
#define VERSION_BUILD 245
#define VERSION_REVISION 7
#define VERSION_BUILD 246
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Core"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmm/vmm.c
+33 -5
View File
@@ -1014,6 +1014,14 @@ VOID VmmProcess_CloseObCallback(_In_ PVOID pVmmOb)
VOID VmmProcessClone_CloseObCallback(_In_ PVOID pVmmOb)
{
PVMM_PROCESS pProcessClone = (PVMM_PROCESS)pVmmOb;
// release maps owned by the clone, including maps initialized after cloning
Ob_DECREF(pProcessClone->Map.pObPte);
Ob_DECREF(pProcessClone->Map.pObVad);
Ob_DECREF(pProcessClone->Map.pObModule);
Ob_DECREF(pProcessClone->Map.pObUnloadedModule);
Ob_DECREF(pProcessClone->Map.pObHeap);
Ob_DECREF(pProcessClone->Map.pObThread);
Ob_DECREF(pProcessClone->Map.pObHandle);
// decref clone parent
Ob_DECREF(pProcessClone->VmmInternal.pObProcessCloneParent);
// delete lock
@@ -1048,8 +1056,17 @@ PVMM_PROCESS VmmProcessClone(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess)
if(pProcess->VmmInternal.pObProcessCloneParent) { return NULL; }
pObProcessClone = (PVMM_PROCESS)Ob_AllocEx(H, OB_TAG_VMM_PROCESS_CLONE, LMEM_ZEROINIT, sizeof(VMM_PROCESS), VmmProcessClone_CloseObCallback, NULL);
if(!pObProcessClone) { return NULL; }
EnterCriticalSection(&pProcess->LockUpdate);
memcpy((PBYTE)pObProcessClone + sizeof(OB), (PBYTE)pProcess + sizeof(OB), pProcess->ObHdr.cbData);
Ob_INCREF(pObProcessClone->Map.pObPte);
Ob_INCREF(pObProcessClone->Map.pObVad);
Ob_INCREF(pObProcessClone->Map.pObModule);
Ob_INCREF(pObProcessClone->Map.pObUnloadedModule);
Ob_INCREF(pObProcessClone->Map.pObHeap);
Ob_INCREF(pObProcessClone->Map.pObThread);
Ob_INCREF(pObProcessClone->Map.pObHandle);
pObProcessClone->VmmInternal.pObProcessCloneParent = Ob_INCREF(pProcess);
LeaveCriticalSection(&pProcess->LockUpdate);
InitializeCriticalSection(&pObProcessClone->LockUpdate);
InitializeCriticalSection(&pObProcessClone->LockPlugin);
return pObProcessClone;
@@ -1187,6 +1204,7 @@ fail:
_Success_(return)
BOOL VmmProcessCreateTerminatedFakeEntry(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _In_ DWORD dwPPID, _In_ QWORD ftCreate, _In_ QWORD ftExit, _In_reads_(15) LPSTR szShortName, _In_ LPSTR uszLongName)
{
BOOL fResult = FALSE;
PVMM_PROCESS pTProc = NULL;
PVMMOB_PROCESS_PERSISTENT pProcPers = NULL;
PVMMOB_PROCESS_TABLE ptOld = NULL, ptNew = NULL;
@@ -1202,14 +1220,14 @@ BOOL VmmProcessCreateTerminatedFakeEntry(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _I
memcpy(pbE + H->vmm.offset.EPROCESS.Name, szShortName, 15);
// 2: Allocate new 'Process Table' (if not already existing) and copy over all existing processes:
ptOld = (PVMMOB_PROCESS_TABLE)ObContainer_GetOb(H->vmm.pObCPROC);
if(!ptOld) { return FALSE; }
if(!ptOld) { goto fail; }
ptNew = (PVMMOB_PROCESS_TABLE)ObContainer_GetOb(ptOld->pObCNewPROC);
if(!ptNew) {
ptNew = (PVMMOB_PROCESS_TABLE)Ob_AllocEx(H, OB_TAG_VMM_PROCESSTABLE, LMEM_ZEROINIT, sizeof(VMMOB_PROCESS_TABLE), (OB_CLEANUP_CB)VmmProcessTable_CloseObCallback, NULL);
if(!ptNew) { return FALSE; }
if(!ptNew) { goto fail; }
ptNew->pObCNewPROC = ObContainer_New();
ptNew->pObProcessMap = ObMap_New(H, OB_MAP_FLAGS_OBJECT_OB);
if(!ptNew->pObCNewPROC || !ptNew->pObProcessMap) { return FALSE; }
if(!ptNew->pObCNewPROC || !ptNew->pObProcessMap) { goto fail; }
ObContainer_SetOb(ptOld->pObCNewPROC, ptNew);
// move all old processes to new table:
ObMap_PushAll(ptNew->pObProcessMap, ptOld->pObProcessMap);
@@ -1227,8 +1245,12 @@ BOOL VmmProcessCreateTerminatedFakeEntry(_In_ VMM_HANDLE H, _In_ DWORD dwPID, _I
pProcPers->uszNameLong = (LPSTR)CharUtil_PathSplitLast(pProcPers->uszPathKernel);
pProcPers->cuszNameLong = (WORD)strlen(pProcPers->uszNameLong);
}
fResult = TRUE;
fail:
Ob_DECREF(pTProc);
return TRUE;
Ob_DECREF(ptNew);
Ob_DECREF(ptOld);
return fResult;
}
/*
@@ -2124,7 +2146,13 @@ BOOL VmmInitialize(_In_ VMM_HANDLE H)
ReleaseSRWLockExclusive(&LockSRW);
return TRUE;
fail:
VmmClose(H);
// Only process-table and cache initialization can fail before full setup.
Ob_DECREF_NULL(&H->vmm.pObCPROC);
VmmCacheClose(H, VMM_CACHE_TAG_TLB);
VmmCacheClose(H, VMM_CACHE_TAG_PHYS);
VmmCacheClose(H, VMM_CACHE_TAG_PAGING);
Ob_DECREF_NULL(&H->vmm.Cache.PAGING_FAILED);
Ob_DECREF_NULL(&H->vmm.Cache.pmPrototypePte);
ReleaseSRWLockExclusive(&LockSRW);
return FALSE;
}
vmm/vmmdll.c
+5 -2
View File
@@ -550,15 +550,18 @@ VOID VMMDLL_VfsListBlob_Impl_AddFile(_Inout_ HANDLE h, _In_ LPCSTR uszName, _In_
PVMMDLL_VFS_FILELISTBLOB_CREATE_CONTEXT ctx = (PVMMDLL_VFS_FILELISTBLOB_CREATE_CONTEXT)h;
PVMMDLL_VFS_FILELISTBLOB_ENTRY pe = NULL;
if(!(pe = LocalAlloc(LMEM_ZEROINIT, sizeof(VMMDLL_VFS_FILELISTBLOB_ENTRY)))) { return; }
if(!ObStrMap_PushPtrUU(ctx->psm, uszName, (LPSTR*)&pe->ouszName, NULL)) {
if(!ObMap_Push(ctx->pme, (QWORD)pe, pe)) {
LocalFree(pe);
return;
}
if(!ObStrMap_PushPtrUU(ctx->psm, uszName, (LPSTR*)&pe->ouszName, NULL)) {
LocalFree(ObMap_RemoveByKey(ctx->pme, (QWORD)pe));
return;
}
if(pExInfo) {
memcpy(&pe->ExInfo, pExInfo, sizeof(VMMDLL_VFS_FILELIST_EXINFO));
}
pe->cbFileSize = cb;
ObMap_Push(ctx->pme, (QWORD)pe, pe); // reference to pe overtaken by ctx->pme
}
VOID VMMDLL_VfsListBlob_Impl_AddDirectory(_Inout_ HANDLE h, _In_ LPCSTR uszName, _In_opt_ PVMMDLL_VFS_FILELIST_EXINFO pExInfo)
vmm/vmmwin.c
+19 -10
View File
@@ -209,12 +209,17 @@ fail:
_Success_(return != NULL)
PVMMOB_MAP_EAT VmmWinEAT_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ PVMM_MAP_MODULEENTRY pModule)
{
BOOL f;
static SRWLOCK InitLockSRW = { 0 };
PVMMOB_MAP_EAT pObMap = NULL;
QWORD qwKey = (pProcess->dwPID ^ ((QWORD)pProcess->dwPID << 48) ^ pModule->vaBase);
f = H->vmm.pObCacheMapEAT ||
(H->vmm.pObCacheMapEAT = ObCacheMap_New(H, 0x20, VmmWinEATIAT_Callback_ValidEntry, OB_CACHEMAP_FLAGS_OBJECT_OB));
if(!f) { return NULL; }
if(!H->vmm.pObCacheMapEAT) {
AcquireSRWLockExclusive(&InitLockSRW);
if(!H->vmm.pObCacheMapEAT) {
H->vmm.pObCacheMapEAT = ObCacheMap_New(H, 0x20, VmmWinEATIAT_Callback_ValidEntry, OB_CACHEMAP_FLAGS_OBJECT_OB);
}
ReleaseSRWLockExclusive(&InitLockSRW);
if(!H->vmm.pObCacheMapEAT) { return NULL; }
}
if((pObMap = ObCacheMap_GetByKey(H->vmm.pObCacheMapEAT, qwKey))) { return pObMap; }
EnterCriticalSection(&pProcess->LockUpdate);
pObMap = ObCacheMap_GetByKey(H->vmm.pObCacheMapEAT, qwKey);
@@ -383,12 +388,17 @@ fail:
_Success_(return != NULL)
PVMMOB_MAP_IAT VmmWinIAT_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _In_ PVMM_MAP_MODULEENTRY pModule)
{
BOOL f;
static SRWLOCK InitLockSRW = { 0 };
PVMMOB_MAP_IAT pObMap = NULL;
QWORD qwKey = (pProcess->dwPID ^ ((QWORD)pProcess->dwPID << 48) ^ pModule->vaBase);
f = H->vmm.pObCacheMapIAT ||
(H->vmm.pObCacheMapIAT = ObCacheMap_New(H, 0x20, VmmWinEATIAT_Callback_ValidEntry, OB_CACHEMAP_FLAGS_OBJECT_OB));
if(!f) { return NULL; }
if(!H->vmm.pObCacheMapIAT) {
AcquireSRWLockExclusive(&InitLockSRW);
if(!H->vmm.pObCacheMapIAT) {
H->vmm.pObCacheMapIAT = ObCacheMap_New(H, 0x20, VmmWinEATIAT_Callback_ValidEntry, OB_CACHEMAP_FLAGS_OBJECT_OB);
}
ReleaseSRWLockExclusive(&InitLockSRW);
if(!H->vmm.pObCacheMapIAT) { return NULL; }
}
if((pObMap = ObCacheMap_GetByKey(H->vmm.pObCacheMapIAT, qwKey))) { return pObMap; }
EnterCriticalSection(&pProcess->LockUpdate);
pObMap = ObCacheMap_GetByKey(H->vmm.pObCacheMapIAT, qwKey);
@@ -922,8 +932,7 @@ BOOL VmmWinLdrModule_Initialize(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _
fail:
if(!pProcess->Map.pObModule) {
// try set up zero-sized module map on fail
pObMap = Ob_AllocEx(H, OB_TAG_MAP_MODULE, LMEM_ZEROINIT, sizeof(VMMOB_MAP_MODULE), NULL, NULL);
pProcess->Map.pObModule = pObMap;
pProcess->Map.pObModule = Ob_AllocEx(H, OB_TAG_MAP_MODULE, LMEM_ZEROINIT, sizeof(VMMOB_MAP_MODULE), NULL, NULL);
}
LeaveCriticalSection(&pProcess->LockUpdate);
Ob_DECREF(pmObModules);
vmm/vmmwinobj.c
+3 -2
View File
@@ -358,7 +358,6 @@ VOID VmmWinObjFile_Initialize_FileObjects(_In_ VMM_HANDLE H, _In_ POB_VMMWINOBJ_
DWORD cbPath, dwIndex = 0;
QWORD vaSectionObjectPointers, vaFileNameBuffer, cbFile, qwHashDuplicateCheck;
POB_MAP pmObFiles = NULL;
POB_SET psvaObSectionObjectPointers = NULL;
POB_VMMWINOBJ_FILE peObFile = NULL;
WCHAR wszNameBuffer[MAX_PATH + 1] = { 0 };
PVMM_OFFSET_FILE po = &H->vmm.offset.FILE;
@@ -486,7 +485,8 @@ VOID VmmWinObjFile_Initialize_FileObjects(_In_ VMM_HANDLE H, _In_ POB_VMMWINOBJ_
Ob_DECREF(peObFile);
}
fail:
Ob_DECREF(psvaObSectionObjectPointers);
Ob_DECREF(psObCA);
Ob_DECREF(psObSCM);
Ob_DECREF(pmObFiles);
Ob_DECREF(hObScatter2);
Ob_DECREF(hObScatterFO);
@@ -582,6 +582,7 @@ BOOL VmmWinObjFile_GetByProcess(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess, _
for(i = 0, iMax = pObData->ObHdr.cbData / sizeof(QWORD); i < iMax; i++) {
if((pObFile = (POB_VMMWINOBJ_FILE)VmmWinObj_CacheGet(H, ctxOb, VMMWINOBJ_TYPE_FILE, pObData->pqw[i]))) {
ObMap_Push(pmObFiles, pObFile->va, pObFile);
Ob_DECREF_NULL(&pObFile);
}
}
Ob_DECREF_NULL(&pObData);
vmm/vmmwinreg.c
+10 -2
View File
@@ -2063,10 +2063,17 @@ VOID VmmWinReg_KeyInfo2(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE pHive, _In_ PO
CHAR uszPath[MAX_PATH*2] = { 0 };
VmmWinReg_KeyInfo(pHive, pKey, pKeyInfo);
if(!(ps = ObSet_New(H))) { return; }
ObSet_Push(ps, (QWORD)Ob_INCREF(pKey));
if(!ObSet_Push(ps, (QWORD)pKey)) {
Ob_DECREF(ps);
return;
}
Ob_INCREF(pKey);
qwHashKeyParent = pKey->qwHashKeyParent;
while((pObKey = ObMap_GetByKey(pHive->Snapshot.pmKeyHash, qwHashKeyParent))) {
ObSet_Push(ps, (QWORD)pObKey);
if(!ObSet_Push(ps, (QWORD)pObKey)) {
Ob_DECREF(pObKey);
goto finish;
}
qwHashKeyParent = pObKey->qwHashKeyParent;
}
Ob_DECREF((POB_REGISTRY_KEY)ObSet_Pop(ps)); // skip "root"
@@ -2085,6 +2092,7 @@ VOID VmmWinReg_KeyInfo2(_In_ VMM_HANDLE H, _In_ POB_REGISTRY_HIVE pHive, _In_ PO
cuszPath += status;
}
}
finish:
while((pObKey = (POB_REGISTRY_KEY)ObSet_Pop(ps))) {
Ob_DECREF(pObKey);
}
vmm/vmmwinthread.c
+2
View File
@@ -668,6 +668,7 @@ PVMMOB_MAP_THREADCALLSTACK VmmWinThreadCs_UnwindScanCallstack(_In_ VMM_HANDLE H,
VmmLog(H, MID_THREADCS, LOGLEVEL_5_DEBUG, "\n%s", uszText);
}
end:
Ob_DECREF(psmOb);
LocalFree(pFullCallStack);
LocalFree(uszText);
return pObCS;
@@ -981,6 +982,7 @@ BOOL VmmWinThreadCs_GetCallstack(_In_ VMM_HANDLE H, _In_ PVMM_PROCESS pProcess,
QWORD qwKey = ((QWORD)pProcess->dwPID << 32) | pThread->dwTID;
if(fNoCache || !(pObCS = ObMap_GetByKey(H->vmm.pmObThreadCallback, qwKey)) || fRequireCache) {
AcquireSRWLockExclusive(&H->vmm.LockSRW.ThreadCallback);
Ob_DECREF(pObCS); pObCS = NULL;
if(fNoCache || !(pObCS = ObMap_GetByKey(H->vmm.pmObThreadCallback, qwKey))) {
pObCS = VmmWinThreadCs_UnwindScanCallstack(H, pProcess, pThread); // fetch the callstack
if(!pObCS && (pObCS = Ob_AllocEx(H, OB_TAG_THREAD_CALLSTACK, LMEM_ZEROINIT, sizeof(VMMOB_MAP_THREADCALLSTACK), NULL, NULL))) {
vmm/vmmwork.c
+7
View File
@@ -113,6 +113,13 @@ BOOL VmmWork_Initialize(_In_ VMM_HANDLE H)
}
return TRUE;
fail:
if(ctx) {
Ob_DECREF(ctx->pmUnit);
Ob_DECREF(ctx->pmUnitLow);
Ob_DECREF(ctx->psThreadAll);
Ob_DECREF(ctx->psThreadExit);
Ob_DECREF(ctx->psThreadAvail);
}
LocalFree(ctx);
return FALSE;
}
vmmpyc/version.h
+2 -2
View File
@@ -3,8 +3,8 @@
#define VERSION_MAJOR 5
#define VERSION_MINOR 18
#define VERSION_REVISION 6
#define VERSION_BUILD 245
#define VERSION_REVISION 7
#define VERSION_BUILD 246
#define VER_FILE_DESCRIPTION_STR "MemProcFS : Python API"
#define VER_FILE_VERSION VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD
vmmrust/leechcore_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "leechcore_example"
version = "5.18.6"
version = "5.18.7"
edition = "2021"
publish = false
vmmrust/m_example_plugin/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "m_example_plugin"
version = "5.18.6"
version = "5.18.7"
edition = "2021"
publish = false
vmmrust/memprocfs/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs"
version = "5.18.6"
version = "5.18.7"
edition = "2021"
description = "MemProcFS - Physical Memory Analysis Framework"
documentation = "https://docs.rs/memprocfs"
vmmrust/memprocfs_example/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "memprocfs_example"
version = "5.18.6"
version = "5.18.7"
edition = "2021"
publish = false
vmmsharp/vmmsharp/Properties/AssemblyInfo.cs
+2 -2
View File
@@ -32,5 +32,5 @@ using System.Runtime.Versioning;
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("5.18.6.245")]
[assembly: AssemblyFileVersion("5.18.6.245")]
[assembly: AssemblyVersion("5.18.7.246")]
[assembly: AssemblyFileVersion("5.18.7.246")]
vmmsharp/vmmsharp/vmmsharp.csproj
+1 -1
View File
@@ -109,7 +109,7 @@
<None Include="logo.png" Pack="true" Visible="true" PackagePath="" />
</ItemGroup>
<PropertyGroup>
<Version>5.18.6</Version>
<Version>5.18.7</Version>
<RepositoryUrl>https://github.com/ufrisk/MemProcFS</RepositoryUrl>
<RepositoryType>git</RepositoryType>
<PackageLicenseFile>LICENSE</PackageLicenseFile>