You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3348 lines
112 KiB
3348 lines
112 KiB
/*++
|
|
|
|
Copyright (c) 1997-1999 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
wmi.c
|
|
|
|
Abstract:
|
|
|
|
Device driver interface for WMI
|
|
|
|
Author:
|
|
|
|
AlanWar
|
|
|
|
Environment:
|
|
|
|
Kernel mode
|
|
|
|
Revision History:
|
|
|
|
|
|
--*/
|
|
|
|
#include "wmikmp.h"
|
|
#ifndef MEMPHIS
|
|
#include "evntrace.h"
|
|
#include "tracep.h"
|
|
#endif
|
|
|
|
NTSTATUS
|
|
WmipOpenCloseCleanup(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
);
|
|
NTSTATUS
|
|
WmipIoControl(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
NTSTATUS WmipObjectToPDO(
|
|
PFILE_OBJECT FileObject,
|
|
PDEVICE_OBJECT DeviceObject,
|
|
PDEVICE_OBJECT *PDO
|
|
);
|
|
|
|
BOOLEAN
|
|
WmipFastIoDeviceControl(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN BOOLEAN Wait,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength,
|
|
IN ULONG IoControlCode,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
NTSTATUS
|
|
DriverEntry(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PUNICODE_STRING RegistryPath
|
|
);
|
|
|
|
|
|
NTSTATUS WmipProbeWnodeAllData(
|
|
PWNODE_ALL_DATA Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen
|
|
);
|
|
|
|
NTSTATUS WmipProbeWnodeSingleInstance(
|
|
PWNODE_SINGLE_INSTANCE Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen,
|
|
BOOLEAN OutBound
|
|
);
|
|
|
|
NTSTATUS WmipProbeWnodeSingleItem(
|
|
PWNODE_SINGLE_ITEM Wnode,
|
|
ULONG InBufferLen
|
|
);
|
|
|
|
|
|
NTSTATUS WmipProbeWnodeMethodItem(
|
|
PWNODE_METHOD_ITEM Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen
|
|
);
|
|
|
|
NTSTATUS WmipProbeWnodeWorker(
|
|
PWNODE_HEADER WnodeHeader,
|
|
ULONG MinWnodeSize,
|
|
ULONG InstanceNameOffset,
|
|
ULONG DataBlockOffset,
|
|
ULONG DataBlockSize,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen,
|
|
BOOLEAN CheckOutBound,
|
|
BOOLEAN CheckInBound
|
|
);
|
|
|
|
|
|
NTSTATUS
|
|
WmipSystemControl(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
NTSTATUS WmipSendWmiIrp(
|
|
UCHAR MinorFunction,
|
|
ULONG ProviderId,
|
|
PVOID DataPath,
|
|
ULONG BufferLength,
|
|
PVOID Buffer,
|
|
PIO_STATUS_BLOCK Iosb
|
|
);
|
|
|
|
NTSTATUS WmipProbeWmiRegRequest(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PWMIREGREQUEST Buffer,
|
|
IN ULONG InBufferLen,
|
|
IN ULONG OutBufferLen,
|
|
OUT PBOOLEAN MofIgnored
|
|
);
|
|
|
|
|
|
#ifdef ALLOC_PRAGMA
|
|
#pragma alloc_text(INIT,WmipDriverEntry)
|
|
#pragma alloc_text(INIT,DriverEntry)
|
|
|
|
#pragma alloc_text(PAGE,WmipOpenCloseCleanup)
|
|
#pragma alloc_text(PAGE,WmipIoControl)
|
|
#pragma alloc_text(PAGE,WmipForwardWmiIrp)
|
|
#pragma alloc_text(PAGE,WmipObjectToPDO)
|
|
#pragma alloc_text(PAGE,WmipTranslateFileHandle)
|
|
#pragma alloc_text(PAGE,WmipProbeWnodeAllData)
|
|
#pragma alloc_text(PAGE,WmipProbeWnodeSingleInstance)
|
|
#pragma alloc_text(PAGE,WmipProbeWnodeSingleItem)
|
|
#pragma alloc_text(PAGE,WmipProbeWnodeMethodItem)
|
|
#pragma alloc_text(PAGE,WmipProbeWnodeWorker)
|
|
#pragma alloc_text(PAGE,WmipProbeWmiOpenGuidBlock)
|
|
#pragma alloc_text(PAGE,WmipProbeAndCaptureGuidObjectAttributes)
|
|
#pragma alloc_text(PAGE,WmipUpdateDeviceStackSize)
|
|
#pragma alloc_text(PAGE,WmipSystemControl)
|
|
#pragma alloc_text(PAGE,WmipGetDevicePDO)
|
|
#pragma alloc_text(PAGE,WmipSendWmiIrp)
|
|
#pragma alloc_text(PAGE,WmipProbeWmiRegRequest)
|
|
|
|
#ifndef MEMPHIS
|
|
#pragma alloc_text(PAGE,WmipFastIoDeviceControl)
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
PDEVICE_OBJECT WmipServiceDeviceObject;
|
|
PDEVICE_OBJECT WmipAdminDeviceObject;
|
|
|
|
//
|
|
// This specifies the maximum size that an event can be
|
|
ULONG WmipMaxKmWnodeEventSize = DEFAULTMAXKMWNODEEVENTSIZE;
|
|
|
|
|
|
|
|
#ifdef ALLOC_DATA_PRAGMA
|
|
#pragma data_seg("PAGEDATA")
|
|
#endif
|
|
|
|
#if defined(_AMD64_) || defined(_IA64_) || defined(i386)
|
|
PVOID WmipDockUndockNotificationEntry;
|
|
#endif
|
|
|
|
KMUTEX WmipSMMutex;
|
|
KMUTEX WmipTLMutex;
|
|
|
|
//
|
|
// This maintains the registry path for the wmi device
|
|
UNICODE_STRING WmipRegistryPath;
|
|
|
|
#ifndef MEMPHIS
|
|
FAST_IO_DISPATCH WmipFastIoDispatch;
|
|
#endif
|
|
|
|
#ifdef ALLOC_DATA_PRAGMA
|
|
#pragma const_seg("PAGECONST")
|
|
#endif
|
|
|
|
NTSTATUS
|
|
DriverEntry(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PUNICODE_STRING RegistryPath
|
|
)
|
|
{
|
|
UNREFERENCED_PARAMETER(DriverObject);
|
|
UNREFERENCED_PARAMETER(RegistryPath);
|
|
// Never called
|
|
return(STATUS_SUCCESS);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
WmipDriverEntry(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PUNICODE_STRING RegistryPath
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This is the callback function when we call IoCreateDriver to create a
|
|
WMI Driver Object. In this function, we need to remember the
|
|
DriverObject, create a device object and then create a Win32 visible
|
|
symbolic link name so that the WMI user mode component can access us.
|
|
|
|
Arguments:
|
|
|
|
DriverObject - Pointer to the driver object created by the system.
|
|
|
|
RegistryPath - is NULL.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
UNICODE_STRING DeviceName;
|
|
UNICODE_STRING ServiceSymbolicLinkName;
|
|
UNICODE_STRING AdminSymbolicLinkName;
|
|
#ifndef MEMPHIS
|
|
PSECURITY_DESCRIPTOR AdminDeviceSd;
|
|
PFAST_IO_DISPATCH fastIoDispatch;
|
|
#endif
|
|
ANSI_STRING AnsiString;
|
|
|
|
PAGED_CODE();
|
|
UNREFERENCED_PARAMETER(RegistryPath);
|
|
|
|
//
|
|
// First thing to do is make sure our critical section has been initalized
|
|
//
|
|
KeInitializeMutex(&WmipSMMutex, 0);
|
|
KeInitializeMutex(&WmipTLMutex, 0);
|
|
|
|
//
|
|
// Initialize internal WMI data structrurs
|
|
//
|
|
WmipInitializeRegistration(0);
|
|
WmipInitializeNotifications();
|
|
Status = WmipInitializeDataStructs();
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
return(Status);
|
|
}
|
|
|
|
//
|
|
// Since Io does not pass a registry path for this device we need to make
|
|
// up one
|
|
RtlInitAnsiString(&AnsiString,
|
|
"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\WMI");
|
|
Status = RtlAnsiStringToUnicodeString(&WmipRegistryPath,
|
|
&AnsiString,
|
|
TRUE);
|
|
#ifndef MEMPHIS
|
|
Status = WmipInitializeSecurity();
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
return(Status);
|
|
}
|
|
|
|
//
|
|
// We allocate a security descriptor to be placed on the Admin device.
|
|
// It will allow only Administrators access to the device and
|
|
// no access to anyone else.
|
|
//
|
|
Status = WmipCreateAdminSD(&AdminDeviceSd);
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
return(Status);
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// Create the service device object and symbolic link
|
|
//
|
|
RtlInitUnicodeString( &DeviceName, WMIServiceDeviceObjectName );
|
|
Status = IoCreateDevice(
|
|
DriverObject,
|
|
0,
|
|
&DeviceName,
|
|
FILE_DEVICE_UNKNOWN,
|
|
#ifdef MEMPHIS
|
|
0,
|
|
#else
|
|
FILE_DEVICE_SECURE_OPEN, // No standard device characteristics
|
|
#endif
|
|
FALSE, // This isn't an exclusive device
|
|
&WmipServiceDeviceObject
|
|
);
|
|
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
ExFreePool(AdminDeviceSd);
|
|
return(Status);
|
|
}
|
|
|
|
RtlInitUnicodeString( &ServiceSymbolicLinkName,
|
|
WMIServiceSymbolicLinkName );
|
|
Status = IoCreateSymbolicLink( &ServiceSymbolicLinkName,
|
|
&DeviceName );
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
IoDeleteDevice( WmipServiceDeviceObject );
|
|
ExFreePool(AdminDeviceSd);
|
|
return(Status);
|
|
}
|
|
|
|
|
|
//
|
|
// Now create an admin-only device object and symbolic link
|
|
//
|
|
RtlInitUnicodeString( &DeviceName, WMIAdminDeviceObjectName );
|
|
Status = IoCreateDevice(
|
|
DriverObject,
|
|
0,
|
|
&DeviceName,
|
|
FILE_DEVICE_UNKNOWN,
|
|
FILE_DEVICE_SECURE_OPEN, // No standard device characteristics
|
|
FALSE, // This isn't an exclusive device
|
|
&WmipAdminDeviceObject
|
|
);
|
|
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
IoDeleteDevice( WmipServiceDeviceObject );
|
|
IoDeleteSymbolicLink(&ServiceSymbolicLinkName);
|
|
ExFreePool(AdminDeviceSd);
|
|
return(Status);
|
|
}
|
|
|
|
|
|
Status = ObSetSecurityObjectByPointer(WmipAdminDeviceObject,
|
|
DACL_SECURITY_INFORMATION |
|
|
OWNER_SECURITY_INFORMATION,
|
|
AdminDeviceSd);
|
|
|
|
ExFreePool(AdminDeviceSd);
|
|
AdminDeviceSd = NULL;
|
|
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
IoDeleteDevice( WmipServiceDeviceObject );
|
|
IoDeleteDevice( WmipAdminDeviceObject );
|
|
IoDeleteSymbolicLink(&ServiceSymbolicLinkName);
|
|
return(Status);
|
|
}
|
|
|
|
RtlInitUnicodeString( &AdminSymbolicLinkName,
|
|
WMIAdminSymbolicLinkName );
|
|
Status = IoCreateSymbolicLink( &AdminSymbolicLinkName,
|
|
&DeviceName );
|
|
if (! NT_SUCCESS(Status))
|
|
{
|
|
IoDeleteSymbolicLink( &ServiceSymbolicLinkName );
|
|
IoDeleteDevice( WmipServiceDeviceObject );
|
|
IoDeleteDevice( WmipAdminDeviceObject );
|
|
return(Status);
|
|
}
|
|
|
|
//
|
|
// Establish an initial irp stack size
|
|
WmipServiceDeviceObject->StackSize = WmiDeviceStackSize;
|
|
WmipAdminDeviceObject->StackSize = WmiDeviceStackSize;
|
|
|
|
//
|
|
// Create dispatch entrypoints
|
|
//
|
|
DriverObject->MajorFunction[IRP_MJ_CREATE] = WmipOpenCloseCleanup;
|
|
DriverObject->MajorFunction[IRP_MJ_CLOSE] = WmipOpenCloseCleanup;
|
|
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = WmipIoControl;
|
|
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = WmipOpenCloseCleanup;
|
|
DriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = WmipSystemControl;
|
|
DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = WmipShutdown;
|
|
|
|
//
|
|
// Register for notification of docking events
|
|
#if defined(_AMD64_) || defined(_IA64_) || defined(i386)
|
|
IoRegisterPlugPlayNotification(
|
|
EventCategoryHardwareProfileChange,
|
|
0,
|
|
NULL,
|
|
DriverObject,
|
|
WmipDockUndockEventCallback,
|
|
NULL,
|
|
&WmipDockUndockNotificationEntry);
|
|
#endif
|
|
//
|
|
// We reset this flag to let the IO manager know that the device
|
|
// is ready to receive requests. We only do this for the kernel
|
|
// dll since the IO manager does it when WMI loads as a normal
|
|
// device.
|
|
WmipServiceDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
|
|
WmipAdminDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
|
|
|
|
#ifndef MEMPHIS
|
|
IoWMIRegistrationControl(WmipServiceDeviceObject,
|
|
WMIREG_ACTION_REGISTER);
|
|
#endif
|
|
|
|
#ifndef MEMPHIS
|
|
fastIoDispatch = &WmipFastIoDispatch;
|
|
RtlZeroMemory(fastIoDispatch, sizeof(FAST_IO_DISPATCH));
|
|
fastIoDispatch->SizeOfFastIoDispatch = sizeof(FAST_IO_DISPATCH);
|
|
fastIoDispatch->FastIoDeviceControl = WmipFastIoDeviceControl;
|
|
DriverObject->FastIoDispatch = fastIoDispatch;
|
|
RtlZeroMemory(&WmipRefCount[0], MAXLOGGERS*sizeof(ULONG));
|
|
RtlZeroMemory(&WmipLoggerContext[0], MAXLOGGERS*sizeof(PWMI_LOGGER_CONTEXT));
|
|
WmipStartGlobalLogger(); // Try and see if we need to start this
|
|
IoRegisterShutdownNotification(WmipServiceDeviceObject);
|
|
#endif // MEMPHIS
|
|
|
|
SharedUserData->TraceLogging = 0; //Initialize the Heap and Crisec Coll tracing status off
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS
|
|
WmipOpenCloseCleanup(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
)
|
|
{
|
|
PAGED_CODE();
|
|
UNREFERENCED_PARAMETER(DeviceObject);
|
|
|
|
Irp->IoStatus.Status = STATUS_SUCCESS;
|
|
Irp->IoStatus.Information = 0;
|
|
|
|
IoCompleteRequest( Irp, IO_NO_INCREMENT );
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
void WmipUpdateDeviceStackSize(
|
|
CCHAR NewStackSize
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will update the stack size that is specified in the WMI
|
|
device's device object. This needs to be protected since it can be updated
|
|
when a device registers and whenever an irp is forwarded to a device.
|
|
WMI needs to maintain a stack size one greater than the stack size of the
|
|
largest device stack to which it forwards irps to. Consider a bottom
|
|
driver that registers with WMI and has a stack size of 1. If 2 device
|
|
attach on top of it then WMI will forward to the topmost in the stack
|
|
which would need a stack size of 3, so the original WMI irp (ie the one
|
|
created by the IOCTL to the WMI device) would need a stack size of 4.
|
|
|
|
Arguments:
|
|
|
|
NewStackSize is the new stack size needed
|
|
|
|
Return Value:
|
|
|
|
NT status ccode
|
|
|
|
--*/
|
|
{
|
|
PAGED_CODE();
|
|
|
|
WmipEnterSMCritSection();
|
|
if (WmipServiceDeviceObject->StackSize < NewStackSize)
|
|
{
|
|
WmipServiceDeviceObject->StackSize = NewStackSize;
|
|
}
|
|
WmipLeaveSMCritSection();
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
WmipIoControl(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
|
|
ULONG InBufferLen = irpStack->Parameters.DeviceIoControl.InputBufferLength;
|
|
ULONG OutBufferLen = irpStack->Parameters.DeviceIoControl.OutputBufferLength;
|
|
PVOID Buffer = Irp->AssociatedIrp.SystemBuffer;
|
|
PWNODE_HEADER Wnode = (PWNODE_HEADER)Buffer;
|
|
ULONG Ioctl;
|
|
|
|
PAGED_CODE();
|
|
|
|
Ioctl = irpStack->Parameters.DeviceIoControl.IoControlCode;
|
|
|
|
switch (Ioctl)
|
|
{
|
|
#ifndef MEMPHIS
|
|
case IOCTL_WMI_OPEN_GUID:
|
|
case IOCTL_WMI_OPEN_GUID_FOR_QUERYSET:
|
|
case IOCTL_WMI_OPEN_GUID_FOR_EVENTS:
|
|
{
|
|
OBJECT_ATTRIBUTES CapturedObjectAttributes;
|
|
UNICODE_STRING CapturedGuidString;
|
|
WCHAR CapturedGuidBuffer[WmiGuidObjectNameLength + 1];
|
|
PWMIOPENGUIDBLOCK InGuidBlock;
|
|
HANDLE Handle;
|
|
ULONG DesiredAccess;
|
|
|
|
InGuidBlock = (PWMIOPENGUIDBLOCK)Buffer;
|
|
|
|
Status = WmipProbeWmiOpenGuidBlock(&CapturedObjectAttributes,
|
|
&CapturedGuidString,
|
|
CapturedGuidBuffer,
|
|
&DesiredAccess,
|
|
InGuidBlock,
|
|
InBufferLen,
|
|
OutBufferLen);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipOpenBlock(Ioctl,
|
|
UserMode,
|
|
&CapturedObjectAttributes,
|
|
DesiredAccess,
|
|
&Handle);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
((PWMIOPENGUIDBLOCK32)InGuidBlock)->Handle.Handle32 = PtrToUlong(Handle);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
InGuidBlock->Handle.Handle = Handle;
|
|
}
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
case IOCTL_WMI_QUERY_ALL_DATA:
|
|
{
|
|
if (OutBufferLen < sizeof(WNODE_ALL_DATA))
|
|
{
|
|
//
|
|
// WMI will not send any request whose output buffer is not
|
|
// at least the size of a WNODE_ALL_DATA.
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
break;
|
|
}
|
|
|
|
Status = WmipProbeWnodeAllData((PWNODE_ALL_DATA)Wnode,
|
|
InBufferLen,
|
|
OutBufferLen);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipQueryAllData(NULL,
|
|
Irp,
|
|
UserMode,
|
|
(PWNODE_ALL_DATA)Wnode,
|
|
OutBufferLen,
|
|
&OutBufferLen);
|
|
|
|
} else {
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Invalid IOCTL_WMI_QUERY_ALL_DATA Wnode\n"));
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_QAD_MULTIPLE:
|
|
{
|
|
PWMIQADMULTIPLE QadMultiple;
|
|
|
|
if ((InBufferLen >= sizeof(WMIQADMULTIPLE)) &&
|
|
(OutBufferLen >= sizeof(WNODE_TOO_SMALL)))
|
|
{
|
|
QadMultiple = (PWMIQADMULTIPLE)Buffer;
|
|
if ((QadMultiple->HandleCount < QUERYMULIPLEHANDLELIMIT) &&
|
|
(InBufferLen >= (FIELD_OFFSET(WMIQADMULTIPLE, Handles) +
|
|
(QadMultiple->HandleCount * sizeof(HANDLE3264)))))
|
|
{
|
|
Status = WmipQueryAllDataMultiple(0,
|
|
NULL,
|
|
Irp,
|
|
UserMode,
|
|
Buffer,
|
|
OutBufferLen,
|
|
QadMultiple,
|
|
&OutBufferLen);
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
case IOCTL_WMI_QUERY_SINGLE_INSTANCE:
|
|
{
|
|
if (OutBufferLen < sizeof(WNODE_TOO_SMALL))
|
|
{
|
|
//
|
|
// WMI will not send any request whose output buffer is not
|
|
// at least the size of a WNODE_TOO_SMALL.
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
break;
|
|
}
|
|
|
|
Status = WmipProbeWnodeSingleInstance((PWNODE_SINGLE_INSTANCE)Wnode,
|
|
InBufferLen,
|
|
OutBufferLen,
|
|
TRUE);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipQuerySetExecuteSI(NULL,
|
|
Irp,
|
|
UserMode,
|
|
IRP_MN_QUERY_SINGLE_INSTANCE,
|
|
Wnode,
|
|
OutBufferLen,
|
|
&OutBufferLen);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
WmipAssert(Irp->IoStatus.Information <= OutBufferLen);
|
|
}
|
|
} else {
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Invalid IOCTL_WMI_SINGLE_INSTANCE Wnode\n"));
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_QSI_MULTIPLE:
|
|
{
|
|
PWMIQSIMULTIPLE QsiMultiple;
|
|
|
|
if ((InBufferLen >= sizeof(WMIQSIMULTIPLE)) &&
|
|
(OutBufferLen >= sizeof(WNODE_TOO_SMALL)))
|
|
{
|
|
QsiMultiple = (PWMIQSIMULTIPLE)Buffer;
|
|
|
|
if ((QsiMultiple->QueryCount < QUERYMULIPLEHANDLELIMIT) &&
|
|
(InBufferLen >= (FIELD_OFFSET(WMIQSIMULTIPLE, QsiInfo) +
|
|
(QsiMultiple->QueryCount * sizeof(WMIQSIINFO)))))
|
|
{
|
|
Status = WmipQuerySingleMultiple(Irp,
|
|
UserMode,
|
|
Buffer,
|
|
OutBufferLen,
|
|
QsiMultiple,
|
|
QsiMultiple->QueryCount,
|
|
NULL,
|
|
NULL,
|
|
&OutBufferLen);
|
|
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_SET_SINGLE_INSTANCE:
|
|
{
|
|
Status = WmipProbeWnodeSingleInstance((PWNODE_SINGLE_INSTANCE)Wnode,
|
|
InBufferLen,
|
|
OutBufferLen,
|
|
FALSE);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipQuerySetExecuteSI(NULL,
|
|
Irp,
|
|
UserMode,
|
|
IRP_MN_CHANGE_SINGLE_INSTANCE,
|
|
Wnode,
|
|
InBufferLen,
|
|
&OutBufferLen);
|
|
|
|
OutBufferLen = 0;
|
|
} else {
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Invalid IOCTL_WMI_SET_SINGLE_INSTANCE Wnode\n"));
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
case IOCTL_WMI_SET_SINGLE_ITEM:
|
|
{
|
|
Status = WmipProbeWnodeSingleItem((PWNODE_SINGLE_ITEM)Wnode,
|
|
InBufferLen);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipQuerySetExecuteSI(NULL,
|
|
Irp,
|
|
UserMode,
|
|
IRP_MN_CHANGE_SINGLE_ITEM,
|
|
Wnode,
|
|
InBufferLen,
|
|
&OutBufferLen);
|
|
|
|
OutBufferLen = 0;
|
|
} else {
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Invalid IOCTL_WMI_SET_SINGLE_ITEM Wnode\n"));
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_EXECUTE_METHOD:
|
|
{
|
|
//
|
|
// The buffer passed is the InputWnode directly followed by the
|
|
// method wnode. This is so that the driver can fill in the
|
|
// output WNODE directly on top of the input wnode.
|
|
PWNODE_METHOD_ITEM MethodWnode = (PWNODE_METHOD_ITEM)Wnode;
|
|
|
|
Status = WmipProbeWnodeMethodItem(MethodWnode,
|
|
InBufferLen,
|
|
OutBufferLen);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipQuerySetExecuteSI(NULL,
|
|
Irp,
|
|
UserMode,
|
|
IRP_MN_EXECUTE_METHOD,
|
|
Wnode,
|
|
OutBufferLen,
|
|
&OutBufferLen);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
WmipAssert(Irp->IoStatus.Information <= OutBufferLen);
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_TRANSLATE_FILE_HANDLE:
|
|
{
|
|
if (InBufferLen != FIELD_OFFSET(WMIFHTOINSTANCENAME,
|
|
InstanceNames))
|
|
{
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
} else {
|
|
Status = WmipTranslateFileHandle((PWMIFHTOINSTANCENAME)Buffer,
|
|
&OutBufferLen,
|
|
NULL,
|
|
NULL,
|
|
NULL,
|
|
NULL);
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_GET_VERSION:
|
|
{
|
|
if (OutBufferLen < sizeof(WMIVERSIONINFO))
|
|
{
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
} else {
|
|
((PWMIVERSIONINFO)Buffer)->Version = WMI_CURRENT_VERSION;
|
|
OutBufferLen = sizeof(WMIVERSIONINFO);
|
|
Status = STATUS_SUCCESS;
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
case IOCTL_WMI_ENUMERATE_GUIDS_AND_PROPERTIES:
|
|
case IOCTL_WMI_ENUMERATE_GUIDS:
|
|
{
|
|
if (OutBufferLen < FIELD_OFFSET(WMIGUIDLISTINFO, GuidList))
|
|
{
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
} else {
|
|
Status = WmipEnumerateGuids(Ioctl,
|
|
(PWMIGUIDLISTINFO)Buffer,
|
|
OutBufferLen,
|
|
&OutBufferLen);
|
|
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_QUERY_GUID_INFO:
|
|
{
|
|
if (OutBufferLen < sizeof(WMIQUERYGUIDINFO))
|
|
{
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
} else {
|
|
Status = WmipQueryGuidInfo((PWMIQUERYGUIDINFO)Buffer);
|
|
OutBufferLen = sizeof(WMIQUERYGUIDINFO);
|
|
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_ENUMERATE_MOF_RESOURCES:
|
|
{
|
|
if (OutBufferLen >= sizeof(WMIMOFLIST))
|
|
{
|
|
Status = WmipEnumerateMofResources((PWMIMOFLIST)Buffer,
|
|
OutBufferLen,
|
|
&OutBufferLen);
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_RECEIVE_NOTIFICATIONS:
|
|
{
|
|
PWMIRECEIVENOTIFICATION ReceiveNotification;
|
|
ULONG CountExpected;
|
|
|
|
if ((InBufferLen >= sizeof(WMIRECEIVENOTIFICATION)) &&
|
|
(OutBufferLen >= sizeof(WNODE_TOO_SMALL)))
|
|
{
|
|
ReceiveNotification = (PWMIRECEIVENOTIFICATION)Buffer;
|
|
|
|
CountExpected = (InBufferLen -
|
|
FIELD_OFFSET(WMIRECEIVENOTIFICATION, Handles)) /
|
|
sizeof(HANDLE3264);
|
|
|
|
if (ReceiveNotification->HandleCount <= CountExpected)
|
|
{
|
|
Status = WmipReceiveNotifications(ReceiveNotification,
|
|
&OutBufferLen,
|
|
Irp);
|
|
} else {
|
|
//
|
|
// Input buffer not large enough which is an error
|
|
//
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
}
|
|
} else {
|
|
//
|
|
// Input and or output buffers not large enough
|
|
// which is an error
|
|
//
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_MARK_HANDLE_AS_CLOSED:
|
|
{
|
|
PWMIMARKASCLOSED MarkAsClosed;
|
|
|
|
if (InBufferLen >= sizeof(WMIMARKASCLOSED))
|
|
{
|
|
MarkAsClosed = (PWMIMARKASCLOSED)Buffer;
|
|
Status = WmipMarkHandleAsClosed(MarkAsClosed->Handle.Handle);
|
|
OutBufferLen = 0;
|
|
} else {
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
}
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_NOTIFY_LANGUAGE_CHANGE:
|
|
{
|
|
LPGUID LanguageGuid;
|
|
PWMILANGUAGECHANGE LanguageChange;
|
|
|
|
if (DeviceObject == WmipAdminDeviceObject)
|
|
{
|
|
//
|
|
// Only allow this ioctl to be executed on the admin
|
|
// device object
|
|
//
|
|
if (InBufferLen == sizeof(WMILANGUAGECHANGE))
|
|
{
|
|
LanguageChange = (PWMILANGUAGECHANGE)Buffer;
|
|
if (LanguageChange->Flags & WMILANGUAGECHANGE_FLAG_ADDED)
|
|
{
|
|
LanguageGuid = &GUID_MOF_RESOURCE_ADDED_NOTIFICATION;
|
|
} else if (LanguageChange->Flags & WMILANGUAGECHANGE_FLAG_REMOVED) {
|
|
LanguageGuid = &GUID_MOF_RESOURCE_REMOVED_NOTIFICATION;
|
|
} else {
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
break;
|
|
}
|
|
|
|
//
|
|
// Ensure that language is nul terminated
|
|
//
|
|
LanguageChange->Language[MAX_LANGUAGE_SIZE-1] = 0;
|
|
WmipGenerateMofResourceNotification(LanguageChange->Language,
|
|
L"",
|
|
LanguageGuid,
|
|
MOFEVENT_ACTION_LANGUAGE_CHANGE);
|
|
|
|
OutBufferLen = 0;
|
|
Status = STATUS_SUCCESS;
|
|
} else {
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
}
|
|
} else {
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
#ifndef MEMPHIS
|
|
// Event trace logging IOCTLS
|
|
|
|
case IOCTL_WMI_UNREGISTER_GUIDS:
|
|
{
|
|
if ((InBufferLen == sizeof(WMIUNREGGUIDS)) &&
|
|
(OutBufferLen == sizeof(WMIUNREGGUIDS)))
|
|
{
|
|
Status = WmipUnregisterGuids((PWMIUNREGGUIDS)Buffer);
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_REGISTER_GUIDS:
|
|
{
|
|
BOOLEAN MofIgnored = FALSE;
|
|
//
|
|
// Register guids for user mode provider
|
|
//
|
|
Status = WmipProbeWmiRegRequest(
|
|
DeviceObject,
|
|
Buffer,
|
|
InBufferLen,
|
|
OutBufferLen,
|
|
&MofIgnored
|
|
);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
HANDLE RequestHandle;
|
|
PWMIREGREQUEST WmiRegRequest;
|
|
PWMIREGINFOW WmiRegInfo;
|
|
ULONG WmiRegInfoSize;
|
|
ULONG GuidCount;
|
|
PWMIREGRESULTS WmiRegResults;
|
|
PWMIREGINFOW WmiRegInfoThunk = NULL;
|
|
|
|
WmiRegRequest = (PWMIREGREQUEST)Buffer;
|
|
WmiRegInfo = (PWMIREGINFOW)OffsetToPtr(Buffer, sizeof(WMIREGREQUEST));
|
|
WmiRegInfoSize = InBufferLen - sizeof(WMIREGREQUEST);
|
|
GuidCount = WmiRegInfo->GuidCount;
|
|
WmiRegResults = (PWMIREGRESULTS)Buffer;
|
|
|
|
//
|
|
// For WOW64, WMIREGINFOW and WMIREGGUIDW structures both need
|
|
// to be thunked here because of padding and ULONG_PTR in them.
|
|
//
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
ULONG SizeNeeded, SizeToCopy, i;
|
|
PWMIREGGUIDW WmiRegGuid;
|
|
PUCHAR pSource, pTarget;
|
|
ULONG ImageNameLength = 0;
|
|
ULONG ResourceNameLength = 0;
|
|
ULONG Offset = 0;
|
|
//
|
|
// Find the GuidCount and allocate storage here.
|
|
//
|
|
|
|
if (WmiRegInfo->RegistryPath > 0)
|
|
{
|
|
pSource = OffsetToPtr(WmiRegInfo, WmiRegInfo->RegistryPath);
|
|
ImageNameLength = *( (PUSHORT) pSource) + sizeof(USHORT);
|
|
}
|
|
|
|
if (WmiRegInfo->MofResourceName > 0)
|
|
{
|
|
pSource = OffsetToPtr(WmiRegInfo, WmiRegInfo->MofResourceName);
|
|
ResourceNameLength = *((PUSHORT)pSource) + sizeof(USHORT);
|
|
}
|
|
|
|
SizeNeeded = sizeof(WMIREGINFOW) +
|
|
GuidCount * sizeof(WMIREGGUIDW) +
|
|
ImageNameLength + ResourceNameLength;
|
|
|
|
SizeNeeded = (SizeNeeded + 7) & ~7;
|
|
|
|
WmiRegInfoThunk = (PWMIREGINFOW) WmipAlloc(SizeNeeded);
|
|
|
|
if (WmiRegInfoThunk == NULL)
|
|
{
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
RtlZeroMemory(WmiRegInfoThunk, SizeNeeded);
|
|
pTarget = (PUCHAR)WmiRegInfoThunk;
|
|
pSource = (PUCHAR)WmiRegInfo;
|
|
SizeToCopy = WmiRegRequest->WmiRegInfo32Size;
|
|
RtlCopyMemory(pTarget, pSource, SizeToCopy);
|
|
|
|
pTarget += FIELD_OFFSET(WMIREGINFOW, WmiRegGuid);
|
|
pSource += SizeToCopy;
|
|
SizeToCopy = WmiRegRequest->WmiRegGuid32Size;
|
|
Offset = FIELD_OFFSET(WMIREGINFOW, WmiRegGuid);
|
|
|
|
for (i=0; i < GuidCount; i++)
|
|
{
|
|
RtlCopyMemory(pTarget, pSource, SizeToCopy);
|
|
|
|
//
|
|
// The InstanceCount checks are done here because the
|
|
// source may not be aligned.
|
|
//
|
|
WmiRegGuid = (PWMIREGGUIDW) pTarget;
|
|
if ( (WmiRegGuid->InstanceCount > 0) ||
|
|
(WmiRegGuid->InstanceNameList > 0) )
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
pTarget += sizeof(WMIREGGUIDW);
|
|
pSource += SizeToCopy;
|
|
Offset += sizeof(WMIREGGUIDW);
|
|
}
|
|
|
|
if (ImageNameLength > 0)
|
|
{
|
|
pSource = OffsetToPtr(WmiRegInfo, WmiRegInfo->RegistryPath);
|
|
RtlCopyMemory(pTarget, pSource, ImageNameLength);
|
|
pTarget += ImageNameLength;
|
|
WmiRegInfoThunk->RegistryPath = Offset;
|
|
Offset += ImageNameLength;
|
|
}
|
|
|
|
if (ResourceNameLength > 0)
|
|
{
|
|
pSource = OffsetToPtr(WmiRegInfo, WmiRegInfo->MofResourceName);
|
|
RtlCopyMemory(pTarget, pSource, ResourceNameLength);
|
|
pTarget += ResourceNameLength;
|
|
WmiRegInfoThunk->MofResourceName = Offset;
|
|
Offset += ResourceNameLength;
|
|
}
|
|
|
|
WmiRegInfo = WmiRegInfoThunk;
|
|
WmiRegInfoSize = SizeNeeded;
|
|
WmiRegInfo->BufferSize = SizeNeeded;
|
|
}
|
|
#endif
|
|
|
|
Status = WmipRegisterUMGuids(WmiRegRequest->ObjectAttributes,
|
|
WmiRegRequest->Cookie,
|
|
WmiRegInfo,
|
|
WmiRegInfoSize,
|
|
&RequestHandle,
|
|
&WmiRegResults->LoggerContext);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
WmiRegResults->RequestHandle.Handle64 = 0;
|
|
WmiRegResults->RequestHandle.Handle32 = PtrToUlong(RequestHandle);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
WmiRegResults->RequestHandle.Handle = RequestHandle;
|
|
}
|
|
WmiRegResults->MofIgnored = MofIgnored;
|
|
|
|
OutBufferLen = sizeof(WMIREGRESULTS);
|
|
}
|
|
|
|
if (WmiRegInfoThunk != NULL)
|
|
{
|
|
WmipFree(WmiRegInfoThunk);
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_CREATE_UM_LOGGER:
|
|
{
|
|
//
|
|
// Create User mode logger
|
|
//
|
|
PWNODE_HEADER Wnode;
|
|
ULONG MinLength;
|
|
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
ULONG SizeNeeded;
|
|
PUCHAR src, dest;
|
|
PWMICREATEUMLOGGER32 WmiCreateUmLogger32 = (PWMICREATEUMLOGGER32)Buffer;
|
|
PWMICREATEUMLOGGER WmiCreateUmLoggerThunk;
|
|
|
|
MinLength = sizeof(WMICREATEUMLOGGER32) + sizeof(WNODE_HEADER);
|
|
if (InBufferLen < MinLength) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
|
|
Wnode = (PWNODE_HEADER)((PUCHAR)WmiCreateUmLogger32 + sizeof(WMICREATEUMLOGGER32));
|
|
|
|
if (Wnode->BufferSize > (InBufferLen-sizeof(WMICREATEUMLOGGER32)) ) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
|
|
SizeNeeded = InBufferLen + sizeof(WMICREATEUMLOGGER) - sizeof(WMICREATEUMLOGGER32);
|
|
|
|
SizeNeeded = (SizeNeeded + 7) & ~7;
|
|
|
|
WmiCreateUmLoggerThunk = (PWMICREATEUMLOGGER) WmipAlloc(SizeNeeded);
|
|
|
|
if (WmiCreateUmLoggerThunk == NULL)
|
|
{
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
|
|
RtlZeroMemory(WmiCreateUmLoggerThunk, SizeNeeded);
|
|
WmiCreateUmLoggerThunk->ObjectAttributes =
|
|
UlongToPtr(WmiCreateUmLogger32->ObjectAttributes);
|
|
WmiCreateUmLoggerThunk->ControlGuid = WmiCreateUmLogger32->ControlGuid;
|
|
|
|
dest = (PUCHAR)WmiCreateUmLoggerThunk + sizeof(WMICREATEUMLOGGER);
|
|
src = (PUCHAR)WmiCreateUmLogger32 + sizeof(WMICREATEUMLOGGER32);
|
|
|
|
RtlCopyMemory(dest, src, Wnode->BufferSize);
|
|
|
|
Status = WmipCreateUMLogger(WmiCreateUmLoggerThunk);
|
|
WmiCreateUmLogger32->ReplyHandle.Handle64 = 0;
|
|
WmiCreateUmLogger32->ReplyHandle.Handle32 = PtrToUlong(WmiCreateUmLoggerThunk->ReplyHandle.Handle);
|
|
WmiCreateUmLogger32->ReplyCount = WmiCreateUmLoggerThunk->ReplyCount;
|
|
|
|
WmipFree(WmiCreateUmLoggerThunk);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
MinLength = sizeof(WMICREATEUMLOGGER) + sizeof(WNODE_HEADER);
|
|
if (InBufferLen < MinLength) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
|
|
Wnode = (PWNODE_HEADER) ((PUCHAR)Buffer + sizeof(WMICREATEUMLOGGER));
|
|
|
|
if (Wnode->BufferSize > (InBufferLen-sizeof(WMICREATEUMLOGGER)) ) {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
OutBufferLen = 0;
|
|
break;
|
|
}
|
|
Status = WmipCreateUMLogger((PWMICREATEUMLOGGER)Buffer);
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_MB_REPLY:
|
|
{
|
|
//
|
|
// MB Reply message
|
|
//
|
|
PUCHAR Message;
|
|
ULONG MessageSize;
|
|
PWMIMBREPLY WmiMBReply;
|
|
|
|
if (InBufferLen >= FIELD_OFFSET(WMIMBREPLY, Message))
|
|
{
|
|
WmiMBReply = (PWMIMBREPLY)Buffer;
|
|
Message = (PUCHAR)Buffer + FIELD_OFFSET(WMIMBREPLY, Message);
|
|
MessageSize = InBufferLen - FIELD_OFFSET(WMIMBREPLY, Message);
|
|
|
|
Status = WmipMBReply(WmiMBReply->Handle.Handle,
|
|
WmiMBReply->ReplyIndex,
|
|
Message,
|
|
MessageSize);
|
|
} else {
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
OutBufferLen = 0;
|
|
}
|
|
|
|
|
|
case IOCTL_WMI_ENABLE_DISABLE_TRACELOG:
|
|
{
|
|
PWMITRACEENABLEDISABLEINFO TraceEnableInfo;
|
|
|
|
OutBufferLen = 0;
|
|
if (InBufferLen == sizeof(WMITRACEENABLEDISABLEINFO))
|
|
{
|
|
TraceEnableInfo = (PWMITRACEENABLEDISABLEINFO)Buffer;
|
|
Status = WmipEnableDisableTrace(Ioctl,
|
|
TraceEnableInfo);
|
|
} else {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
case IOCTL_WMI_START_LOGGER:
|
|
{
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
#ifdef _WIN64
|
|
ULONG LoggerBuf, LogFileBuf;
|
|
#endif
|
|
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
if ( !(Wnode->Flags & WNODE_FLAG_TRACED_GUID) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
LoggerInfo = (PWMI_LOGGER_INFORMATION) Wnode;
|
|
LoggerInfo->Wow = FALSE;
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
LoggerBuf = ( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer;
|
|
LoggerInfo->LoggerName.Buffer = UlongToPtr(LoggerBuf);
|
|
LogFileBuf = ( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer;
|
|
LoggerInfo->LogFileName.Buffer = UlongToPtr(LogFileBuf);
|
|
LoggerInfo->Wow = TRUE;
|
|
}
|
|
else {
|
|
LoggerBuf = 0;
|
|
LogFileBuf = 0;
|
|
}
|
|
#endif
|
|
Status = WmipStartLogger( LoggerInfo );
|
|
OutBufferLen = sizeof (WMI_LOGGER_INFORMATION);
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer = LoggerBuf;
|
|
( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer = LogFileBuf;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_STOP_LOGGER:
|
|
{
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
#ifdef _WIN64
|
|
ULONG LoggerBuf, LogFileBuf;
|
|
#endif
|
|
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
if ( !(Wnode->Flags & WNODE_FLAG_TRACED_GUID) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
LoggerInfo = (PWMI_LOGGER_INFORMATION) Wnode;
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
LoggerBuf = ( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer;
|
|
LoggerInfo->LoggerName.Buffer = UlongToPtr(LoggerBuf);
|
|
LogFileBuf = ( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer;
|
|
LoggerInfo->LogFileName.Buffer = UlongToPtr(LogFileBuf);
|
|
}
|
|
else {
|
|
LoggerBuf = 0;
|
|
LogFileBuf = 0;
|
|
}
|
|
#endif
|
|
Status = WmiStopTrace( LoggerInfo );
|
|
OutBufferLen = sizeof (WMI_LOGGER_INFORMATION);
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer = LoggerBuf;
|
|
( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer = LogFileBuf;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_QUERY_LOGGER:
|
|
{
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
#ifdef _WIN64
|
|
ULONG LoggerBuf, LogFileBuf;
|
|
#endif
|
|
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
if ( !(Wnode->Flags & WNODE_FLAG_TRACED_GUID) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
LoggerInfo = (PWMI_LOGGER_INFORMATION) Wnode;
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
LoggerBuf = ( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer;
|
|
LoggerInfo->LoggerName.Buffer = UlongToPtr(LoggerBuf);
|
|
LogFileBuf = ( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer;
|
|
LoggerInfo->LogFileName.Buffer = UlongToPtr(LogFileBuf);
|
|
}
|
|
else {
|
|
LoggerBuf = 0;
|
|
LogFileBuf = 0;
|
|
}
|
|
#endif
|
|
Status = WmipQueryLogger( LoggerInfo, NULL );
|
|
OutBufferLen = sizeof (WMI_LOGGER_INFORMATION);
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer = LoggerBuf;
|
|
( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer = LogFileBuf;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_UPDATE_LOGGER:
|
|
{
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
#ifdef _WIN64
|
|
ULONG LoggerBuf, LogFileBuf;
|
|
#endif
|
|
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
if ( !(Wnode->Flags & WNODE_FLAG_TRACED_GUID) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
LoggerInfo = (PWMI_LOGGER_INFORMATION) Wnode;
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
LoggerBuf = ( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer;
|
|
LoggerInfo->LoggerName.Buffer = UlongToPtr(LoggerBuf);
|
|
LogFileBuf = ( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer;
|
|
LoggerInfo->LogFileName.Buffer = UlongToPtr(LogFileBuf);
|
|
}
|
|
else {
|
|
LoggerBuf = 0;
|
|
LogFileBuf = 0;
|
|
}
|
|
#endif
|
|
Status = WmiUpdateTrace( LoggerInfo );
|
|
OutBufferLen = sizeof (WMI_LOGGER_INFORMATION);
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer = LoggerBuf;
|
|
( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer = LogFileBuf;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_FLUSH_LOGGER:
|
|
{
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
#ifdef _WIN64
|
|
ULONG LoggerBuf, LogFileBuf;
|
|
#endif
|
|
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
if ( !(Wnode->Flags & WNODE_FLAG_TRACED_GUID) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
LoggerInfo = (PWMI_LOGGER_INFORMATION) Wnode;
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
LoggerBuf = ( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer;
|
|
LoggerInfo->LoggerName.Buffer = UlongToPtr(LoggerBuf);
|
|
LogFileBuf = ( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer;
|
|
LoggerInfo->LogFileName.Buffer = UlongToPtr(LogFileBuf);
|
|
}
|
|
else {
|
|
LoggerBuf = 0;
|
|
LogFileBuf = 0;
|
|
}
|
|
#endif
|
|
Status = WmiFlushTrace( LoggerInfo );
|
|
OutBufferLen = sizeof (WMI_LOGGER_INFORMATION);
|
|
#ifdef _WIN64
|
|
if (IoIs32bitProcess(Irp)) {
|
|
( (PUNICODE_STRING32) &LoggerInfo->LoggerName)->Buffer = LoggerBuf;
|
|
( (PUNICODE_STRING32) &LoggerInfo->LogFileName)->Buffer = LogFileBuf;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_TRACE_EVENT:
|
|
{ // NOTE: This relies on WmiTraceEvent to probe the buffer!
|
|
OutBufferLen = 0;
|
|
if ( InBufferLen < sizeof(WNODE_HEADER) ) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
Status = WmiTraceEvent(
|
|
(PWNODE_HEADER)
|
|
irpStack->Parameters.DeviceIoControl.Type3InputBuffer,
|
|
KeGetPreviousMode()
|
|
);
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_TRACE_MESSAGE:
|
|
{ // NOTE: This relies on WmiTraceUserMessage to probe the buffer!
|
|
OutBufferLen = 0;
|
|
if ( InBufferLen < sizeof(MESSAGE_TRACE_USER) ) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
Status = WmiTraceUserMessage(
|
|
(PMESSAGE_TRACE_USER)
|
|
irpStack->Parameters.DeviceIoControl.Type3InputBuffer,
|
|
InBufferLen
|
|
);
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_SET_MARK:
|
|
{
|
|
OutBufferLen = 0;
|
|
if ( InBufferLen <= FIELD_OFFSET(WMI_SET_MARK_INFORMATION, Mark)) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
Status = WmiSetMark( (PVOID) Wnode, InBufferLen );
|
|
break;
|
|
}
|
|
|
|
case IOCTL_WMI_CLOCK_TYPE:
|
|
{
|
|
if ((InBufferLen < sizeof(WMI_LOGGER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(WMI_LOGGER_INFORMATION))) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_INFO_LENGTH_MISMATCH;
|
|
break;
|
|
}
|
|
|
|
WmipValidateClockType((PWMI_LOGGER_INFORMATION) Wnode);
|
|
|
|
Status = STATUS_SUCCESS;
|
|
break;
|
|
}
|
|
|
|
#ifdef NTPERF
|
|
case IOCTL_WMI_SWITCH_BUFFER:
|
|
{
|
|
if ((InBufferLen < sizeof(PWMI_SWITCH_BUFFER_INFORMATION)) ||
|
|
(OutBufferLen < sizeof(PWMI_SWITCH_BUFFER_INFORMATION)) ) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
Status = WmipSwitchPerfmemBuffer((PWMI_SWITCH_BUFFER_INFORMATION) Wnode );
|
|
OutBufferLen = sizeof (PVOID);
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
|
|
|
|
#endif // if not MEMPHIS
|
|
case IOCTL_WMI_NTDLL_LOGGERINFO:
|
|
{
|
|
|
|
if ((InBufferLen < sizeof(WMINTDLLLOGGERINFO)) ||
|
|
(OutBufferLen < sizeof(WMINTDLLLOGGERINFO))) {
|
|
OutBufferLen = 0;
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
break;
|
|
}
|
|
|
|
Status = WmipNtDllLoggerInfo((PWMINTDLLLOGGERINFO)Buffer);
|
|
|
|
break;
|
|
}
|
|
|
|
default:
|
|
{
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Unsupported IOCTL %x\n",
|
|
irpStack->Parameters.DeviceIoControl.IoControlCode));
|
|
|
|
Status = STATUS_INVALID_DEVICE_REQUEST;
|
|
|
|
}
|
|
}
|
|
|
|
if (Status != STATUS_PENDING)
|
|
{
|
|
Irp->IoStatus.Status = Status;
|
|
Irp->IoStatus.Information = NT_SUCCESS(Status) ? OutBufferLen : 0;
|
|
IoCompleteRequest( Irp, IO_NO_INCREMENT );
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS
|
|
WmipSystemControl(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
)
|
|
{
|
|
PAGED_CODE();
|
|
|
|
return(IoWMISystemControl((PWMILIB_INFO)&WmipWmiLibInfo,
|
|
DeviceObject,
|
|
Irp));
|
|
}
|
|
|
|
|
|
NTSTATUS WmipWmiIrpCompletion(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp,
|
|
IN PVOID Context
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
WMI forwarded IRP completion routine. Set an event and return
|
|
STATUS_MORE_PROCESSING_REQUIRED. WmipForwardWmiIrp will wait on this
|
|
event and then re-complete the irp after cleaning up.
|
|
|
|
Arguments:
|
|
|
|
DeviceObject is the device object of the WMI driver
|
|
Irp is the WMI irp that was just completed
|
|
Context is a PKEVENT that WmipForwardWmiIrp will wait on
|
|
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PIRPCOMPCTX IrpCompCtx;
|
|
PREGENTRY RegEntry;
|
|
PKEVENT Event;
|
|
|
|
UNREFERENCED_PARAMETER(DeviceObject);
|
|
UNREFERENCED_PARAMETER(Irp);
|
|
|
|
IrpCompCtx = (PIRPCOMPCTX)Context;
|
|
RegEntry = IrpCompCtx->RegEntry;
|
|
Event = &IrpCompCtx->Event;
|
|
|
|
WmipDecrementIrpCount(RegEntry);
|
|
|
|
KeSetEvent(Event, IO_NO_INCREMENT, FALSE);
|
|
|
|
return(STATUS_MORE_PROCESSING_REQUIRED);
|
|
}
|
|
|
|
NTSTATUS WmipGetDevicePDO(
|
|
PDEVICE_OBJECT DeviceObject,
|
|
PDEVICE_OBJECT *PDO
|
|
)
|
|
{
|
|
PIRP Irp;
|
|
PIO_STACK_LOCATION IrpSp;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
PDEVICE_RELATIONS DeviceRelations;
|
|
NTSTATUS Status;
|
|
KEVENT Event;
|
|
|
|
PAGED_CODE();
|
|
|
|
*PDO = NULL;
|
|
KeInitializeEvent( &Event,
|
|
NotificationEvent,
|
|
FALSE );
|
|
|
|
Irp = IoBuildSynchronousFsdRequest(IRP_MJ_PNP,
|
|
DeviceObject,
|
|
NULL,
|
|
0,
|
|
NULL,
|
|
&Event,
|
|
&IoStatusBlock );
|
|
|
|
if (Irp == NULL)
|
|
{
|
|
return(STATUS_INSUFFICIENT_RESOURCES);
|
|
}
|
|
|
|
IrpSp = IoGetNextIrpStackLocation( Irp );
|
|
IrpSp->MinorFunction = IRP_MN_QUERY_DEVICE_RELATIONS;
|
|
IrpSp->Parameters.QueryDeviceRelations.Type = TargetDeviceRelation;
|
|
|
|
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
|
|
|
|
Status = IoCallDriver( DeviceObject, Irp );
|
|
|
|
if (Status == STATUS_PENDING)
|
|
{
|
|
KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL );
|
|
Status = IoStatusBlock.Status;
|
|
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
DeviceRelations = (PDEVICE_RELATIONS)IoStatusBlock.Information;
|
|
ASSERT(DeviceRelations);
|
|
ASSERT(DeviceRelations->Count == 1);
|
|
*PDO = DeviceRelations->Objects[0];
|
|
ExFreePool(DeviceRelations);
|
|
}
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipObjectToPDO(
|
|
PFILE_OBJECT FileObject,
|
|
PDEVICE_OBJECT DeviceObject,
|
|
PDEVICE_OBJECT *PDO
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will determine the PDO which is the target of a file handle.
|
|
The mechananism is to build a IRP_MJ_PNP irp with IRP_MN_QUERY_RELATIONS
|
|
and query for TargetDeviceRelation. This irp is supposed to be passed down
|
|
a device stack until it hits the PDO which will fill in its device object
|
|
and return. Note that some drivers may not support this.
|
|
|
|
Arguments:
|
|
|
|
FileObject is the file object for device that is being queried
|
|
|
|
DeviceObject is the device object that is being queried
|
|
|
|
*PDO returns with the PDO that is targeted by the file object. When
|
|
the caller has finished using the PDO it must ObDereferenceObject it.
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
|
|
if (DeviceObject == NULL)
|
|
{
|
|
DeviceObject = IoGetRelatedDeviceObject(FileObject);
|
|
}
|
|
|
|
if (DeviceObject != NULL)
|
|
{
|
|
Status = WmipGetDevicePDO(DeviceObject, PDO);
|
|
} else {
|
|
Status = STATUS_NO_SUCH_DEVICE;
|
|
}
|
|
return(Status);
|
|
}
|
|
|
|
|
|
NTSTATUS WmipForwardWmiIrp(
|
|
PIRP Irp,
|
|
UCHAR MinorFunction,
|
|
ULONG ProviderId,
|
|
PVOID DataPath,
|
|
ULONG BufferLength,
|
|
PVOID Buffer
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
If the provider is a driver then this routine will allocate a new irp
|
|
with the correct stack size and send it to the driver. If the provider
|
|
is a callback then it is called directly.
|
|
|
|
It is assumed that the caller has performed any security checks required
|
|
|
|
Arguments:
|
|
|
|
Irp is the IOCTL irp that initiated the request
|
|
MinorFunction specifies the minor function code of the WMI Irp
|
|
WmiRegistrationId is the id passed by the user mode code. This routine
|
|
will look it up to determine the device object pointer.
|
|
DataPath is the value for the DataPath parameter of the WMI irp
|
|
BufferLength is the value for the BufferLength parameter of the WMI irp
|
|
Buffer is the value for the Buffer parameter of the WMI irp
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PREGENTRY RegEntry;
|
|
NTSTATUS Status;
|
|
PIO_STACK_LOCATION irpStack;
|
|
PDEVICE_OBJECT TargetDeviceObject;
|
|
CCHAR DeviceStackSize;
|
|
IRPCOMPCTX IrpCompCtx;
|
|
PWNODE_HEADER Wnode = (PWNODE_HEADER)Buffer;
|
|
LOGICAL IsPnPIdRequest;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
|
|
PAGED_CODE();
|
|
|
|
|
|
WmipAssert( (MinorFunction >= IRP_MN_QUERY_ALL_DATA) &&
|
|
(MinorFunction <= IRP_MN_REGINFO_EX) );
|
|
|
|
irpStack = IoGetCurrentIrpStackLocation(Irp);
|
|
|
|
//
|
|
// For non-file handle based requests we get the registration entry
|
|
// to validate the target and check for a callback
|
|
|
|
RegEntry = WmipFindRegEntryByProviderId(ProviderId, TRUE);
|
|
|
|
if (RegEntry != NULL)
|
|
{
|
|
if (RegEntry->Flags & REGENTRY_FLAG_NOT_ACCEPTING_IRPS)
|
|
{
|
|
WmipUnreferenceRegEntry(RegEntry);
|
|
WmipDecrementIrpCount(RegEntry);
|
|
|
|
if ((MinorFunction == IRP_MN_QUERY_SINGLE_INSTANCE) ||
|
|
(MinorFunction == IRP_MN_CHANGE_SINGLE_INSTANCE))
|
|
{
|
|
Status = STATUS_WMI_INSTANCE_NOT_FOUND;
|
|
} else {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
DeviceObject = RegEntry->DeviceObject;
|
|
|
|
#ifndef MEMPHIS
|
|
if (RegEntry->Flags & REGENTRY_FLAG_CALLBACK)
|
|
{
|
|
ULONG Size = 0;
|
|
//
|
|
// This guy registered as a callback so do the callback and go.
|
|
Status = (*RegEntry->WmiEntry)(MinorFunction,
|
|
DataPath,
|
|
BufferLength,
|
|
Buffer,
|
|
RegEntry->WmiEntry,
|
|
&Size
|
|
);
|
|
Irp->IoStatus.Status = Status;
|
|
Irp->IoStatus.Information = Size;
|
|
|
|
WmipUnreferenceRegEntry(RegEntry);
|
|
WmipDecrementIrpCount(RegEntry);
|
|
|
|
return(Status);
|
|
}
|
|
#endif
|
|
} else {
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: Invalid device object passed from user mode %x\n",
|
|
ProviderId));
|
|
if ((MinorFunction == IRP_MN_QUERY_SINGLE_INSTANCE) ||
|
|
(MinorFunction == IRP_MN_CHANGE_SINGLE_INSTANCE))
|
|
{
|
|
Status = STATUS_WMI_INSTANCE_NOT_FOUND;
|
|
} else {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
//
|
|
// Determine if this is a query for the device pnp id guid
|
|
IsPnPIdRequest = ((MinorFunction != IRP_MN_REGINFO) &&
|
|
(MinorFunction != IRP_MN_REGINFO_EX)) &&
|
|
((IsEqualGUID(&Wnode->Guid, &WmipDataProviderPnpidGuid)) ||
|
|
(IsEqualGUID(&Wnode->Guid, &WmipDataProviderPnPIdInstanceNamesGuid)));
|
|
if (IsPnPIdRequest && (RegEntry->PDO != NULL))
|
|
{
|
|
//
|
|
// Its the PnPId request and WMI is handling it on behalf of the
|
|
// device then switch the device object to our own
|
|
DeviceObject = WmipServiceDeviceObject;
|
|
IsPnPIdRequest = FALSE;
|
|
}
|
|
|
|
//
|
|
// Get the top of the device stack for our targer WMI device. Note that
|
|
// IoGetAttachedDeviceReference also takes an object reference
|
|
// which we get rid of after the the irp is completed by the
|
|
// data provider driver.
|
|
TargetDeviceObject = IoGetAttachedDeviceReference(DeviceObject);
|
|
DeviceStackSize = TargetDeviceObject->StackSize + 1;
|
|
|
|
//
|
|
// Check that there are enough stack locations in our irp so that we
|
|
// can forward it to the top of the device stack. We must also check
|
|
// if our target device is the WMI data or service device otherwise
|
|
// the number of stack locations for it will keep increementing until
|
|
// the machine crashes
|
|
if ((DeviceStackSize <= WmipServiceDeviceObject->StackSize) ||
|
|
(TargetDeviceObject == WmipServiceDeviceObject))
|
|
{
|
|
//
|
|
// There are enough stack locations in the WMI irp to forward
|
|
// Remember some context information in our irp stack and use
|
|
// it as our completion context value
|
|
|
|
KeInitializeEvent( &IrpCompCtx.Event,
|
|
SynchronizationEvent,
|
|
FALSE );
|
|
|
|
IrpCompCtx.RegEntry = RegEntry;
|
|
|
|
IoSetCompletionRoutine(Irp,
|
|
WmipWmiIrpCompletion,
|
|
(PVOID)&IrpCompCtx,
|
|
TRUE,
|
|
TRUE,
|
|
TRUE);
|
|
|
|
//
|
|
// Setup next irp stack location with WMI irp info
|
|
irpStack = IoGetNextIrpStackLocation(Irp);
|
|
irpStack->MajorFunction = IRP_MJ_SYSTEM_CONTROL;
|
|
irpStack->MinorFunction = MinorFunction;
|
|
irpStack->Parameters.WMI.ProviderId = (ULONG_PTR)DeviceObject;
|
|
irpStack->Parameters.WMI.DataPath = DataPath;
|
|
irpStack->Parameters.WMI.BufferSize = BufferLength;
|
|
irpStack->Parameters.WMI.Buffer = Buffer;
|
|
|
|
//
|
|
// Initialize irp status to STATUS_NOT_SUPPORTED so that we can
|
|
// detect the case where no data provider responded to the irp
|
|
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
|
|
|
|
IoMarkIrpPending(Irp);
|
|
Status = IoCallDriver(TargetDeviceObject, Irp);
|
|
|
|
if (Status == STATUS_PENDING) {
|
|
KeWaitForSingleObject( &IrpCompCtx.Event,
|
|
Executive,
|
|
KernelMode,
|
|
FALSE,
|
|
(PLARGE_INTEGER) NULL );
|
|
Status = Irp->IoStatus.Status;
|
|
}
|
|
|
|
//
|
|
// Check if the status code is still STATUS_NOT_SUPPORTED. If this is
|
|
// the case then most likely no data provider responded to the irp.
|
|
// So we want to change the status code to something more relevant
|
|
// to WMI like STATUS_WMI_GUID_NOT_FOUND
|
|
if (Status == STATUS_NOT_SUPPORTED)
|
|
{
|
|
Status = STATUS_WMI_GUID_NOT_FOUND;
|
|
Irp->IoStatus.Status = STATUS_WMI_GUID_NOT_FOUND;
|
|
}
|
|
|
|
#if DBG
|
|
if (((MinorFunction == IRP_MN_REGINFO) || (MinorFunction == IRP_MN_REGINFO_EX)) &&
|
|
(NT_SUCCESS(Status)) &&
|
|
(Irp->IoStatus.Information == 0))
|
|
{
|
|
WmipDebugPrintEx((DPFLTR_WMICORE_ID, DPFLTR_INFO_LEVEL,"WMI: %p completed IRP_MN_REGINFO with size 0 (%p, %x)\n",
|
|
DeviceObject, Buffer, BufferLength));
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// If this was a registration request then we need to see if there are
|
|
// any PDOs that need to be translated into static instance names.
|
|
if (((MinorFunction == IRP_MN_REGINFO) ||
|
|
(MinorFunction == IRP_MN_REGINFO_EX)) &&
|
|
(NT_SUCCESS(Status)) &&
|
|
(Irp->IoStatus.Information > FIELD_OFFSET(WMIREGINFOW,
|
|
WmiRegGuid)))
|
|
{
|
|
WmipTranslatePDOInstanceNames(Irp,
|
|
MinorFunction,
|
|
BufferLength,
|
|
RegEntry);
|
|
}
|
|
|
|
//
|
|
// Dereference regentry which was taken when forwarding the irp
|
|
WmipUnreferenceRegEntry(RegEntry);
|
|
} else {
|
|
//
|
|
// There are not enough stack locations to forward this irp.
|
|
// We bump the stack count for the WMI device and return
|
|
// an error asking to try the irp again.
|
|
WmipUnreferenceRegEntry(RegEntry);
|
|
WmipDecrementIrpCount(RegEntry);
|
|
|
|
WmipUpdateDeviceStackSize(DeviceStackSize);
|
|
Status = STATUS_WMI_TRY_AGAIN;
|
|
}
|
|
|
|
//
|
|
// Dereference the target device which was the top of the stack to
|
|
// which we forwarded the irp.
|
|
ObDereferenceObject(TargetDeviceObject);
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipSendWmiIrp(
|
|
UCHAR MinorFunction,
|
|
ULONG ProviderId,
|
|
PVOID DataPath,
|
|
ULONG BufferLength,
|
|
PVOID Buffer,
|
|
PIO_STATUS_BLOCK Iosb
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will allocate a new irp and then forward it on as a WMI
|
|
irp appropriately. The routine handles the case where the stack size
|
|
is too small and will retry the irp.
|
|
|
|
Arguments:
|
|
|
|
See WmipForwardWmiIrp
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PIRP Irp;
|
|
PIO_STACK_LOCATION IrpStack;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
Irp = NULL;
|
|
do
|
|
{
|
|
Irp = IoAllocateIrp((CCHAR)(WmipServiceDeviceObject->StackSize+1),
|
|
FALSE);
|
|
|
|
if (Irp == NULL)
|
|
{
|
|
return(STATUS_INSUFFICIENT_RESOURCES);
|
|
}
|
|
|
|
IoSetNextIrpStackLocation(Irp);
|
|
IrpStack = IoGetCurrentIrpStackLocation(Irp);
|
|
IrpStack->DeviceObject = WmipServiceDeviceObject;
|
|
Irp->Tail.Overlay.Thread = PsGetCurrentThread();
|
|
Irp->AssociatedIrp.SystemBuffer = Buffer;
|
|
|
|
Status = WmipForwardWmiIrp(
|
|
Irp,
|
|
MinorFunction,
|
|
ProviderId,
|
|
DataPath,
|
|
BufferLength,
|
|
Buffer);
|
|
|
|
*Iosb = Irp->IoStatus;
|
|
|
|
IoFreeIrp(Irp);
|
|
} while (Status == STATUS_WMI_TRY_AGAIN);
|
|
|
|
return(Status);
|
|
}
|
|
|
|
|
|
NTSTATUS WmipTranslateFileHandle(
|
|
IN OUT PWMIFHTOINSTANCENAME FhToInstanceName,
|
|
IN OUT PULONG OutBufferLen,
|
|
IN HANDLE FileHandle,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PWMIGUIDOBJECT GuidObject,
|
|
OUT PUNICODE_STRING InstanceNameString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will translate a file handle or device object into the
|
|
device instance name for the target PDO of the device object
|
|
pointed to by the file handle.
|
|
|
|
Arguments:
|
|
|
|
FhToInstanceName passes in the file handle and returns the device
|
|
instance name.
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PDEVICE_OBJECT PDO;
|
|
UNICODE_STRING DeviceInstanceName;
|
|
PFILE_OBJECT FileObject = NULL;
|
|
NTSTATUS Status;
|
|
ULONG SizeNeeded;
|
|
PWCHAR InstanceName;
|
|
ULONG Length;
|
|
PWCHAR HandleName;
|
|
ULONG HandleNameLen;
|
|
PWCHAR BaseName;
|
|
SIZE_T BaseNameLen;
|
|
PBGUIDENTRY GuidEntry;
|
|
PLIST_ENTRY InstanceSetList;
|
|
PBINSTANCESET InstanceSet;
|
|
ULONG BaseIndex;
|
|
|
|
PAGED_CODE();
|
|
|
|
|
|
if (FhToInstanceName != NULL)
|
|
{
|
|
WmipAssert(FileHandle == NULL);
|
|
WmipAssert(GuidObject == NULL);
|
|
WmipAssert(InstanceNameString == NULL);
|
|
WmipAssert(DeviceObject == NULL);
|
|
FileHandle = FhToInstanceName->FileHandle.Handle;
|
|
if (FileHandle == NULL)
|
|
{
|
|
return(STATUS_INVALID_HANDLE);
|
|
}
|
|
}
|
|
|
|
if (FileHandle != NULL)
|
|
{
|
|
//
|
|
// Make reference to the file object so it doesn't go away
|
|
//
|
|
Status = ObReferenceObjectByHandle(FileHandle,
|
|
0,
|
|
IoFileObjectType,
|
|
KernelMode,
|
|
&FileObject,
|
|
NULL);
|
|
} else {
|
|
//
|
|
// Make reference to the device object so it doesn't go away
|
|
//
|
|
Status = ObReferenceObjectByPointer(DeviceObject,
|
|
FILE_ALL_ACCESS,
|
|
NULL,
|
|
KernelMode);
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipObjectToPDO(FileObject,
|
|
DeviceObject,
|
|
&PDO);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// Map file object to PDO
|
|
Status = WmipPDOToDeviceInstanceName(PDO,
|
|
&DeviceInstanceName);
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// Now see if we can find an instance name
|
|
//
|
|
HandleName = DeviceInstanceName.Buffer;
|
|
HandleNameLen = DeviceInstanceName.Length / sizeof(WCHAR);
|
|
if (FhToInstanceName != NULL)
|
|
{
|
|
Status = ObReferenceObjectByHandle(FhToInstanceName->KernelHandle.Handle,
|
|
WMIGUID_QUERY,
|
|
WmipGuidObjectType,
|
|
UserMode,
|
|
&GuidObject,
|
|
NULL);
|
|
} else {
|
|
Status = ObReferenceObjectByPointer(GuidObject,
|
|
WMIGUID_QUERY,
|
|
WmipGuidObjectType,
|
|
KernelMode);
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = STATUS_WMI_INSTANCE_NOT_FOUND;
|
|
GuidEntry = GuidObject->GuidEntry;
|
|
BaseIndex = 0;
|
|
|
|
WmipEnterSMCritSection();
|
|
if (GuidEntry->ISCount > 0)
|
|
{
|
|
InstanceSetList = GuidEntry->ISHead.Flink;
|
|
while ((InstanceSetList != &GuidEntry->ISHead) &&
|
|
! NT_SUCCESS(Status))
|
|
{
|
|
InstanceSet = CONTAINING_RECORD(InstanceSetList,
|
|
INSTANCESET,
|
|
GuidISList);
|
|
if (InstanceSet->Flags & IS_INSTANCE_BASENAME)
|
|
{
|
|
BaseName = InstanceSet->IsBaseName->BaseName;
|
|
BaseNameLen = wcslen(BaseName);
|
|
|
|
//
|
|
// If the instance set has a base name
|
|
// and the beginning of it matches the
|
|
// PnPId and it has only an _ after it
|
|
// then we have got a match
|
|
//
|
|
if ((_wcsnicmp(BaseName,
|
|
HandleName,
|
|
HandleNameLen) == 0) &&
|
|
(BaseNameLen == (HandleNameLen+1)) &&
|
|
(BaseName[BaseNameLen-1] == L'_'))
|
|
{
|
|
BaseIndex = InstanceSet->IsBaseName->BaseIndex;
|
|
Status = STATUS_SUCCESS;
|
|
}
|
|
}
|
|
InstanceSetList = InstanceSetList->Flink;
|
|
}
|
|
}
|
|
|
|
WmipLeaveSMCritSection();
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
if (FhToInstanceName != NULL)
|
|
{
|
|
FhToInstanceName->BaseIndex = BaseIndex;
|
|
SizeNeeded = DeviceInstanceName.Length + 2 * sizeof(WCHAR) +
|
|
FIELD_OFFSET(WMIFHTOINSTANCENAME,
|
|
InstanceNames);
|
|
if (*OutBufferLen >= SizeNeeded)
|
|
{
|
|
InstanceName = &FhToInstanceName->InstanceNames[0];
|
|
Length = DeviceInstanceName.Length;
|
|
|
|
FhToInstanceName->InstanceNameLength = (USHORT)(Length + 2 * sizeof(WCHAR));
|
|
RtlCopyMemory(InstanceName,
|
|
DeviceInstanceName.Buffer,
|
|
DeviceInstanceName.Length);
|
|
|
|
//
|
|
// Double NUL terminate string
|
|
//
|
|
Length /= 2;
|
|
InstanceName[Length++] = UNICODE_NULL;
|
|
InstanceName[Length] = UNICODE_NULL;
|
|
|
|
*OutBufferLen = SizeNeeded;
|
|
} else if (*OutBufferLen >= sizeof(ULONG)) {
|
|
FhToInstanceName->SizeNeeded = SizeNeeded;
|
|
*OutBufferLen = sizeof(ULONG);
|
|
} else {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
} else {
|
|
InstanceNameString->MaximumLength = DeviceInstanceName.Length + 32;
|
|
InstanceName = ExAllocatePoolWithTag(PagedPool,
|
|
InstanceNameString->MaximumLength,
|
|
WmipInstanceNameTag);
|
|
if (InstanceName != NULL)
|
|
{
|
|
StringCbPrintf(InstanceName,
|
|
InstanceNameString->MaximumLength,
|
|
L"%ws_%d",
|
|
DeviceInstanceName.Buffer,
|
|
BaseIndex);
|
|
InstanceNameString->Buffer = InstanceName;
|
|
InstanceNameString->Length = (USHORT)wcslen(InstanceName) * sizeof(WCHAR);
|
|
} else {
|
|
Status = STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
}
|
|
}
|
|
|
|
ObDereferenceObject(GuidObject);
|
|
}
|
|
RtlFreeUnicodeString(&DeviceInstanceName);
|
|
}
|
|
ObDereferenceObject(PDO);
|
|
}
|
|
|
|
if (FileHandle != NULL)
|
|
{
|
|
ObDereferenceObject(FileObject);
|
|
} else {
|
|
ObDereferenceObject(DeviceObject);
|
|
}
|
|
}
|
|
return(Status);
|
|
}
|
|
|
|
#ifndef MEMPHIS
|
|
BOOLEAN
|
|
WmipFastIoDeviceControl(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN BOOLEAN Wait,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength,
|
|
IN ULONG IoControlCode,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
)
|
|
{
|
|
PAGED_CODE();
|
|
|
|
UNREFERENCED_PARAMETER(FileObject);
|
|
UNREFERENCED_PARAMETER(Wait);
|
|
UNREFERENCED_PARAMETER(OutputBuffer);
|
|
UNREFERENCED_PARAMETER(OutputBufferLength);
|
|
UNREFERENCED_PARAMETER(DeviceObject);
|
|
|
|
if (IoControlCode == IOCTL_WMI_TRACE_EVENT) {
|
|
if (InputBufferLength < sizeof(EVENT_TRACE_HEADER))
|
|
return FALSE;
|
|
|
|
IoStatus->Status = WmiTraceEvent( InputBuffer, KeGetPreviousMode() );
|
|
return TRUE;
|
|
} else if (IoControlCode == IOCTL_WMI_TRACE_MESSAGE) {
|
|
if (InputBufferLength < sizeof(MESSAGE_TRACE_USER))
|
|
return FALSE;
|
|
|
|
IoStatus->Status = WmiTraceUserMessage( InputBuffer, InputBufferLength );
|
|
return TRUE;
|
|
}
|
|
return FALSE;
|
|
}
|
|
#endif
|
|
|
|
NTSTATUS WmipProbeWnodeWorker(
|
|
PWNODE_HEADER WnodeHeader,
|
|
ULONG MinWnodeSize,
|
|
ULONG InstanceNameOffset,
|
|
ULONG DataBlockOffset,
|
|
ULONG DataBlockSize,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen,
|
|
BOOLEAN CheckOutBound,
|
|
BOOLEAN CheckInBound
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming Wnode to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the Wnode is properly formed.
|
|
|
|
This routine assumes that the input and output buffers has been
|
|
probed enough to determine that it is at least as large as
|
|
MinWnodeSize and MinWnodeSize must be at least as large as
|
|
sizeof(WNODE_HEADER)
|
|
|
|
WNODE Rules:
|
|
|
|
9. For outbound data WnodeDataBlockOffset != 0
|
|
5. For inbound Wnode->DataBlockOffset must be 0 (implying no data) or
|
|
Wnode->DataBlockOffset must be <= incoming buffer size and >=
|
|
sizeof(WNODE_SINGLE_INSTANCE), that is
|
|
the data block must start in the incoming buffer, but after the
|
|
WNODE_SINGLE_INSTANCE header.
|
|
6. Wnode and Wnode->DataBlockOffset must be aligned on an 8 byte boundry.
|
|
7. For inbound data (SetSingleInstance) (Wnode->DataBlockOffset +
|
|
Wnode->DataBlockSize) < incoming buffer length. That is the entire
|
|
data block must fit within the incoming buffer.
|
|
8. For outbound data (QuerySingleInstance) Wnode->DataBlockOffset
|
|
must be <= outgoing buffer length. That is the start of the outgoing
|
|
data block must fit within the outgoing data buffer. Note that it is
|
|
the provider's responsibility to determine if there will be enough
|
|
space in the outgoing buffer to write the returned data.
|
|
|
|
10. Wnode->OffsetInstanceNames must be aligned on a 2 byte boundry
|
|
11. Wnode->OffsetInstanceNames must be <= (incoming buffer size) +
|
|
sizeof(USHORT), that is it must start within the incoming buffer and
|
|
the USHORT that specifies the length must be within the incoming
|
|
buffer.
|
|
12. The entire instance name string must fit with the incoming buffer
|
|
13. For outbound data (QuerySingleInstance) the entire instance name
|
|
must start and fit within the output buffer.
|
|
14. Wnode->DataBlockOffset must be placed after any instance name and
|
|
not overlap the instance name.
|
|
|
|
|
|
|
|
Arguments:
|
|
|
|
WnodeHeader - pointer to WNODE to be probed
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
OutBufferLen - Size of the outgoing buffer
|
|
|
|
MinWnodeSize - minimum size that the WNODE can be
|
|
|
|
InstanceNameOffset - Offset within WNODE to instance name
|
|
|
|
DataBlockOffset - Offset within WNODE to data block
|
|
|
|
DataBlockSize - Size of data block
|
|
|
|
CheckOutBound - If TRUE, WNODE needs to be validated for provider to
|
|
return data.
|
|
|
|
CheckInBound - If TRUE WNODE needs to be validated for provider to
|
|
receive data
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
PWCHAR InstanceNamePtr;
|
|
|
|
PAGED_CODE();
|
|
|
|
if (InstanceNameOffset != 0)
|
|
{
|
|
//
|
|
// Validate instance name begins beyond WNODE header
|
|
if (InstanceNameOffset < MinWnodeSize)
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Validate InstanceName is aligned properly. This is left
|
|
// in the free build since alphas may have alignment requiremnts
|
|
// in handling USHORTs and WCHARs
|
|
|
|
//
|
|
// Validate that USHORT holding instance name length is within
|
|
// WNODE
|
|
if (( ! WmipIsAligned(InstanceNameOffset, 2)) ||
|
|
(InstanceNameOffset > InBufferLen - sizeof(USHORT)) )
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Validate Dynamic Instance Name text is fully within
|
|
// input buffer and output buffer for outbound WNODEs
|
|
InstanceNamePtr = (PWCHAR)OffsetToPtr(WnodeHeader,
|
|
InstanceNameOffset);
|
|
InstanceNameOffset += sizeof(USHORT) + *InstanceNamePtr;
|
|
if ( (InstanceNameOffset > InBufferLen) ||
|
|
( (CheckOutBound) && (InstanceNameOffset > OutBufferLen)) )
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// If data block is specified then it must be placed after the
|
|
// end of the instance name
|
|
if ((DataBlockOffset != 0) &&
|
|
(DataBlockOffset < InstanceNameOffset))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
}
|
|
|
|
//
|
|
// Ensure data block offset is placed after the WNODE header
|
|
// header
|
|
if ((DataBlockOffset != 0) &&
|
|
(DataBlockOffset < MinWnodeSize))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Ensure data block is aligned properly
|
|
if (! WmipIsAligned(DataBlockOffset, 8))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// For incoming WNODE, make sure the data block
|
|
// does not extend beyond the input buffer.
|
|
if ((CheckInBound) &&
|
|
(DataBlockOffset != 0) &&
|
|
( (DataBlockSize > InBufferLen) ||
|
|
(DataBlockOffset > InBufferLen - DataBlockSize) ) )
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
if (CheckOutBound)
|
|
{
|
|
//
|
|
// For outgoing WNODE make sure there is
|
|
// enough room to write the WNODE header
|
|
|
|
//
|
|
// For outgoing WNODE make sure the data block
|
|
// offset is within the bounds of the output buffer
|
|
if ( (OutBufferLen < MinWnodeSize) ||
|
|
(DataBlockOffset > OutBufferLen) )
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Make sure that the data block offset is specified so provider
|
|
// can know where to write data
|
|
if (DataBlockOffset == 0)
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
NTSTATUS WmipProbeWnodeAllData(
|
|
PWNODE_ALL_DATA Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming WNODE_ALL_DATA to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the WNODE_ALL_DATA is properly formed.
|
|
|
|
This routine MUST succeed before any fields in the WNODE_ALL_DATA can be
|
|
used by any kernel components when passed in from user mode. Note that
|
|
we can trust that the input and output buffer are properly sized since
|
|
the WMI IOCTLs are METHOD_BUFFERED and the IO manager does that for us.
|
|
|
|
|
|
WNODE_ALL_DATA_RULES:
|
|
|
|
1. Wnode is aligned on a 8 byte boundry
|
|
2. The incoming buffer must be at least as large as sizeof(WNODE_HEADER)
|
|
3. The outgoing buffer must be at least as large as sizeof(WNODE_ALL_DATA)
|
|
5. WnodeHeader->BufferSize must equal incoming bufffer size
|
|
|
|
Arguments:
|
|
|
|
Wnode - WNODE_ALL_DATA to be validated
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
OutBufferLen - Size of the outgoing buffer
|
|
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
PWNODE_HEADER WnodeHeader = (PWNODE_HEADER)Wnode;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Io is supposed to guarantee this
|
|
//
|
|
WmipAssert(WmipIsAligned(Wnode, 8));
|
|
|
|
//
|
|
// Make sure that enough of the WNODE_ALL_DATA was passed so that we
|
|
// can look at it and the drivers can fill it in
|
|
//
|
|
if (OutBufferLen < sizeof(WNODE_ALL_DATA))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
Status = WmipValidateWnodeHeader(WnodeHeader,
|
|
InBufferLen,
|
|
sizeof(WNODE_HEADER),
|
|
WNODE_FLAG_ALL_DATA,
|
|
0xffffff7e);
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipProbeWnodeSingleInstance(
|
|
PWNODE_SINGLE_INSTANCE Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen,
|
|
BOOLEAN OutBound
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming WNODE_SINGLE_INSTANCE to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the WNODE_SINGLE_INSTANCE is properly formed.
|
|
|
|
This routine MUST succeed before any fields in the WNODE_SINGLE_INSTANCE
|
|
can be used by any kernel components when passed in from user mode.
|
|
Note that we can trust that the input and output buffer are properly
|
|
sized since the WMI IOCTLs are METHOD_BUFFERED and the IO manager does
|
|
that for us.
|
|
|
|
WNODE_SINGLE_INSTANCE Rules:
|
|
|
|
1. The incoming buffer must be at least as large as
|
|
sizeof(WNODE_SINGLE_INSTANCE)
|
|
2. The outgoing buffer must be at least as large as
|
|
sizeof(WNODE_SINGLE_INSTANCE)
|
|
3. WnodeHeader->ProviderId must be non null, Actual value validated when
|
|
irp is forwarded.
|
|
4. WnodeHeader->BufferSize must equal incoming bufffer size
|
|
5. Wnode->DataBlockOffset must be 0 (implying no data) or
|
|
Wnode->DataBlockOffset must be <= incoming buffer size and >=
|
|
sizeof(WNODE_SINGLE_INSTANCE), that is
|
|
the data block must start in the incoming buffer, but after the
|
|
WNODE_SINGLE_INSTANCE header.
|
|
6. Wnode and Wnode->DataBlockOffset must be aligned on an 8 byte boundry.
|
|
7. For inbound data (SetSingleInstance) (Wnode->DataBlockOffset +
|
|
Wnode->DataBlockSize) <= incoming buffer length. That is the entire
|
|
data block must fit within the incoming buffer.
|
|
8. For outbound data (QuerySingleInstance) Wnode->DataBlockOffset
|
|
must be <= outgoing buffer length. That is the start of the outgoing
|
|
data block must fit within the outgoing data buffer. Note that it is
|
|
the provider's responsibility to determine if there will be enough
|
|
space in the outgoing buffer to write the returned data.
|
|
9. For outbound data (QuerySingleInstance) WnodeDataBlockOffset != 0
|
|
|
|
10. Wnode->OffsetInstanceNames must be aligned on a 2 byte boundry
|
|
11. Wnode->OffsetInstanceNames + sizeof(USHORT) must be <= incoming
|
|
buffer size, that is it must start within the incoming buffer and
|
|
the USHORT that specifies the length must be within the incoming
|
|
buffer.
|
|
12. The entire instance name string must fit with the incoming buffer
|
|
13. For outbound data (QuerySingleInstance) the entire instance name
|
|
must start and fit within the output buffer.
|
|
14. Wnode->DataBlockOffset must be placed after any instance name and
|
|
not overlap the instance name.
|
|
|
|
|
|
|
|
Arguments:
|
|
|
|
Wnode - WNODE_SINGLE_INSTANCE to be validated
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
OutBufferLen - Size of the outgoing buffer
|
|
|
|
OutBound - If FALSE, WNODE_SINGLE_INSTANCE has inbound data that must be
|
|
validated to be within the input buffer. If FALSE,
|
|
WNODE_SINGLE_INSTANCE is expected to be filled with data
|
|
by the driver so insure that data buffer is validated to
|
|
be within the output buffer.
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PWNODE_HEADER WnodeHeader = (PWNODE_HEADER)Wnode;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Io makes sure WNODE is on a 8 byte boundry
|
|
//
|
|
WmipAssert(WmipIsAligned((PUCHAR)Wnode, 8));
|
|
|
|
//
|
|
// Make sure that enough of the WNODE_SINGLE_INSTANCE was passed
|
|
// so that we can look at it
|
|
//
|
|
if ((InBufferLen < FIELD_OFFSET(WNODE_SINGLE_INSTANCE, VariableData)) ||
|
|
( (OutBound) && (OutBufferLen < FIELD_OFFSET(WNODE_SINGLE_INSTANCE,
|
|
VariableData))))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
|
|
Status = WmipProbeWnodeWorker(WnodeHeader,
|
|
FIELD_OFFSET(WNODE_SINGLE_INSTANCE,
|
|
VariableData),
|
|
Wnode->OffsetInstanceName,
|
|
Wnode->DataBlockOffset,
|
|
Wnode->SizeDataBlock,
|
|
InBufferLen,
|
|
OutBufferLen,
|
|
OutBound,
|
|
(BOOLEAN)(! OutBound));
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipValidateWnodeHeader(WnodeHeader,
|
|
InBufferLen,
|
|
FIELD_OFFSET(WNODE_SINGLE_INSTANCE,
|
|
VariableData),
|
|
WNODE_FLAG_SINGLE_INSTANCE,
|
|
0xffffff7d);
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipProbeWnodeSingleItem(
|
|
PWNODE_SINGLE_ITEM Wnode,
|
|
ULONG InBufferLen
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming WNODE_SINGLE_ITEM to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the WNODE_SINGLE_ITEM is properly formed.
|
|
|
|
This routine MUST succeed before any fields in the WNODE_SINGLE_INSTANCE
|
|
can be used by any kernel components when passed in from user mode.
|
|
Note that we can trust that the input and output buffer are properly
|
|
sized since the WMI IOCTLs are METHOD_BUFFERED and the IO manager does
|
|
that for us.
|
|
|
|
WNODE_SINGLE_ITEM rules:
|
|
|
|
1. The incoming buffer must be at least as large as
|
|
sizeof(WNODE_SINGLE_ITEM)
|
|
2. The outgoing buffer must be at least as large as
|
|
sizeof(WNODE_SINGLE_ITEM)
|
|
3. WnodeHeader->ProviderId must be non null, Actual value validated when
|
|
irp is forwarded.
|
|
4. WnodeHeader->BufferSize must equal incoming bufffer size
|
|
5. Wnode->DataBlockOffset must be 0 (implying no data) or
|
|
Wnode->DataBlockOffset must be <= incoming buffer size and >=
|
|
sizeof(WNODE_SINGLE_ITEM), that is
|
|
the data block must start in the incoming buffer, but after the
|
|
WNODE_SINGLE_ITEM header.
|
|
6. Wnode and Wnode->DataBlockOffset must be aligned on an 8 byte boundry.
|
|
7. (Wnode->DataBlockOffset + Wnode->SizeDataItem) <
|
|
incoming buffer length. That is the entire
|
|
data block must fit within the incoming buffer.
|
|
8. Wnode->DataItemId must not be 0
|
|
|
|
9. Wnode->OffsetInstanceNames must be aligned on a 2 byte boundry
|
|
10. Wnode->OffsetInstanceNames must be <= (incoming buffer size) +
|
|
sizeof(USHORT), that is it must start within the incoming buffer and
|
|
the USHORT that specifies the length must be within the incoming
|
|
buffer.
|
|
11. The entire instance name string must fit with the incoming buffer
|
|
12. Wnode->DataBlockOffset must be placed after any instance name and
|
|
not overlap the instance name.
|
|
|
|
Arguments:
|
|
|
|
Wnode - WNODE_SINGLE_ITEM to be validated
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PWNODE_HEADER WnodeHeader = (PWNODE_HEADER)Wnode;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Io Makes sure WNODE is on a 8 byte boundry
|
|
//
|
|
WmipAssert(WmipIsAligned((PUCHAR)Wnode, 8));
|
|
|
|
//
|
|
// Make sure that enough of the WNODE_SINGLE_ITEM was passed
|
|
// so that we can look at it
|
|
//
|
|
if (InBufferLen < FIELD_OFFSET(WNODE_SINGLE_ITEM, VariableData))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
|
|
//
|
|
// We don't use sizeof(WNODE_SINGLE_ITEM), but rather use the offset
|
|
// to the variable data since in the case of WNODE_SINGLE_ITEM they are
|
|
// different. The C compiler will round up the packing to 8 bytes so
|
|
// the former is 48 and the later is 44.
|
|
//
|
|
Status = WmipProbeWnodeWorker(WnodeHeader,
|
|
(ULONG)((ULONG_PTR)(&((PWNODE_SINGLE_ITEM)0)->VariableData)),
|
|
Wnode->OffsetInstanceName,
|
|
Wnode->DataBlockOffset,
|
|
Wnode->SizeDataItem,
|
|
InBufferLen,
|
|
0,
|
|
FALSE,
|
|
TRUE);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipValidateWnodeHeader(WnodeHeader,
|
|
InBufferLen,
|
|
FIELD_OFFSET(WNODE_SINGLE_ITEM,
|
|
VariableData),
|
|
WNODE_FLAG_SINGLE_ITEM,
|
|
0xffffff7b);
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
|
|
NTSTATUS WmipProbeWnodeMethodItem(
|
|
PWNODE_METHOD_ITEM Wnode,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming WNODE_METHOD_ITEM to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the WNODE_METHOD_ITEM is properly formed.
|
|
|
|
This routine MUST succeed before any fields in the WNODE_METHOD_INSTANCE
|
|
can be used by any kernel components when passed in from user mode.
|
|
Note that we can trust that the input and output buffer are properly
|
|
sized since the WMI IOCTLs are METHOD_BUFFERED and the IO manager does
|
|
that for us.
|
|
|
|
WNODE_METHOD_ITEM Rules:
|
|
|
|
1. The incoming buffer must be at least as large as
|
|
sizeof(WNODE_METHOD_ITEM)
|
|
2. The outgoing buffer must be at least as large as
|
|
sizeof(WNODE_METHOD_ITEM)
|
|
3. WnodeHeader->ProviderId must be non null, Actual value validated when
|
|
irp is forwarded and Wnode->MethodId must not be 0
|
|
4. WnodeHeader->BufferSize must equal incoming bufffer size
|
|
5. Wnode->DataBlockOffset must be 0 (implying no data) or
|
|
Wnode->DataBlockOffset must be <= incoming buffer size and >=
|
|
sizeof(WNODE_METHOD_ITEM), that is
|
|
the data block must start in the incoming buffer, but after the
|
|
WNODE_METHOD_ITEM header.
|
|
6. Wnode and Wnode->DataBlockOffset must be aligned on an 8 byte boundry.
|
|
7. For inbound data (Wnode->DataBlockOffset +
|
|
Wnode->DataBlockSize) < incoming buffer length. That is the entire
|
|
data block must fit within the incoming buffer.
|
|
8. For outbound data Wnode->DataBlockOffset
|
|
must be <= outgoing buffer length. That is the start of the outgoing
|
|
data block must fit within the outgoing data buffer. Note that it is
|
|
the provider's responsibility to determine if there will be enough
|
|
space in the outgoing buffer to write the returned data.
|
|
9. WnodeDataBlockOffset != 0
|
|
|
|
10. Wnode->OffsetInstanceNames must be aligned on a 2 byte boundry
|
|
11. Wnode->OffsetInstanceNames must be <= (incoming buffer size) +
|
|
sizeof(USHORT), that is it must start within the incoming buffer and
|
|
the USHORT that specifies the length must be within the incoming
|
|
buffer.
|
|
12. The entire instance name string must fit with the incoming buffer
|
|
13. For outbound data the entire instance name
|
|
must start and fit within the output buffer.
|
|
14. Wnode->DataBlockOffset must be placed after any instance name and
|
|
not overlap the instance name.
|
|
|
|
|
|
Arguments:
|
|
|
|
Wnode - WNODE_METHOD_ITEM to be validated
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
OutBufferLen - Size of the Output buffer
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
{
|
|
PWNODE_HEADER WnodeHeader = (PWNODE_HEADER)Wnode;
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Make sure WNODE is on a 8 byte boundry
|
|
//
|
|
WmipAssert(WmipIsAligned((PUCHAR)Wnode, 8));
|
|
|
|
//
|
|
// Make sure that enough of the WNODE_METHOD_ITEM was passed
|
|
// so that we can look at it
|
|
//
|
|
if (InBufferLen < FIELD_OFFSET(WNODE_METHOD_ITEM, VariableData))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
Status = WmipProbeWnodeWorker(WnodeHeader,
|
|
(ULONG)((ULONG_PTR)(&((PWNODE_METHOD_ITEM)0)->VariableData)),
|
|
Wnode->OffsetInstanceName,
|
|
Wnode->DataBlockOffset,
|
|
Wnode->SizeDataBlock,
|
|
InBufferLen,
|
|
OutBufferLen,
|
|
TRUE,
|
|
TRUE);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
Status = WmipValidateWnodeHeader(WnodeHeader,
|
|
InBufferLen,
|
|
FIELD_OFFSET(WNODE_METHOD_ITEM,
|
|
VariableData),
|
|
WNODE_FLAG_METHOD_ITEM,
|
|
0xffff7f7f);
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipProbeAndCaptureGuidObjectAttributes(
|
|
POBJECT_ATTRIBUTES CapturedObjectAttributes,
|
|
PUNICODE_STRING CapturedGuidString,
|
|
PWCHAR CapturedGuidBuffer,
|
|
POBJECT_ATTRIBUTES ObjectAttributes
|
|
)
|
|
{
|
|
PAGED_CODE();
|
|
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
POBJECT_ATTRIBUTES32 ObjectAttributes32;
|
|
PUNICODE_STRING32 GuidString32;
|
|
|
|
//
|
|
// Probe the embedded object attributes and string name
|
|
//
|
|
ObjectAttributes32 = (POBJECT_ATTRIBUTES32)ObjectAttributes;
|
|
|
|
try
|
|
{
|
|
//
|
|
// Probe, capture and validate the OBJECT_ATTRIBUTES
|
|
//
|
|
ProbeForRead( ObjectAttributes32,
|
|
sizeof(OBJECT_ATTRIBUTES32),
|
|
sizeof(ULONG) );
|
|
|
|
CapturedObjectAttributes->Length = sizeof(OBJECT_ATTRIBUTES);
|
|
CapturedObjectAttributes->RootDirectory = UlongToPtr(ObjectAttributes32->RootDirectory);
|
|
CapturedObjectAttributes->Attributes = ObjectAttributes32->Attributes;
|
|
CapturedObjectAttributes->SecurityDescriptor = UlongToPtr(ObjectAttributes32->SecurityDescriptor);
|
|
CapturedObjectAttributes->SecurityQualityOfService = UlongToPtr(ObjectAttributes32->SecurityQualityOfService);
|
|
|
|
//
|
|
// Now probe and validate the guid nane string passed
|
|
//
|
|
GuidString32 = UlongToPtr(ObjectAttributes32->ObjectName);
|
|
ProbeForRead(GuidString32,
|
|
sizeof(UNICODE_STRING32),
|
|
sizeof(ULONG));
|
|
|
|
CapturedGuidString->Length = GuidString32->Length;
|
|
CapturedGuidString->MaximumLength = GuidString32->MaximumLength;
|
|
CapturedGuidString->Buffer = UlongToPtr(GuidString32->Buffer);
|
|
|
|
if (CapturedGuidString->Length != ((WmiGuidObjectNameLength) * sizeof(WCHAR)))
|
|
{
|
|
return(STATUS_INVALID_PARAMETER);
|
|
}
|
|
|
|
ProbeForRead(CapturedGuidString->Buffer,
|
|
CapturedGuidString->Length,
|
|
sizeof(UCHAR));
|
|
|
|
RtlCopyMemory(CapturedGuidBuffer,
|
|
CapturedGuidString->Buffer,
|
|
WmiGuidObjectNameLength * sizeof(WCHAR));
|
|
|
|
CapturedGuidBuffer[WmiGuidObjectNameLength] = UNICODE_NULL;
|
|
CapturedGuidString->Buffer = CapturedGuidBuffer;
|
|
} except(EXCEPTION_EXECUTE_HANDLER) {
|
|
return(GetExceptionCode());
|
|
}
|
|
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
PUNICODE_STRING GuidString;
|
|
|
|
//
|
|
// Probe the embedded object attributes and string name
|
|
//
|
|
try
|
|
{
|
|
//
|
|
// Probe, capture and validate the OBJECT_ATTRIBUTES
|
|
//
|
|
*CapturedObjectAttributes = ProbeAndReadStructure( ObjectAttributes,
|
|
OBJECT_ATTRIBUTES);
|
|
|
|
//
|
|
// Now probe and validate the guid nane string passed
|
|
//
|
|
GuidString = CapturedObjectAttributes->ObjectName;
|
|
*CapturedGuidString = ProbeAndReadUnicodeString(GuidString);
|
|
|
|
if (CapturedGuidString->Length != ((WmiGuidObjectNameLength) * sizeof(WCHAR)))
|
|
{
|
|
return(STATUS_INVALID_PARAMETER);
|
|
}
|
|
|
|
ProbeForRead(CapturedGuidString->Buffer,
|
|
CapturedGuidString->Length,
|
|
sizeof(UCHAR));
|
|
|
|
RtlCopyMemory(CapturedGuidBuffer,
|
|
CapturedGuidString->Buffer,
|
|
WmiGuidObjectNameLength * sizeof(WCHAR));
|
|
|
|
CapturedGuidBuffer[WmiGuidObjectNameLength] = UNICODE_NULL;
|
|
CapturedGuidString->Buffer = CapturedGuidBuffer;
|
|
|
|
} except(EXCEPTION_EXECUTE_HANDLER) {
|
|
return(GetExceptionCode());
|
|
}
|
|
}
|
|
|
|
CapturedObjectAttributes->ObjectName = CapturedGuidString;
|
|
|
|
return(STATUS_SUCCESS);
|
|
}
|
|
|
|
NTSTATUS WmipProbeWmiOpenGuidBlock(
|
|
POBJECT_ATTRIBUTES CapturedObjectAttributes,
|
|
PUNICODE_STRING CapturedGuidString,
|
|
PWCHAR CapturedGuidBuffer,
|
|
PULONG DesiredAccess,
|
|
PWMIOPENGUIDBLOCK InGuidBlock,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
POBJECT_ATTRIBUTES ObjectAttributes;
|
|
|
|
PAGED_CODE();
|
|
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
PWMIOPENGUIDBLOCK32 InGuidBlock32;
|
|
|
|
if ((InBufferLen != sizeof(WMIOPENGUIDBLOCK32)) ||
|
|
(OutBufferLen != sizeof(WMIOPENGUIDBLOCK32)))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Probe the embedded object attributes and string name
|
|
//
|
|
InGuidBlock32 = (PWMIOPENGUIDBLOCK32)InGuidBlock;
|
|
ObjectAttributes = ULongToPtr(InGuidBlock32->ObjectAttributes);
|
|
*DesiredAccess = InGuidBlock32->DesiredAccess;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
//
|
|
// Ensure the input and output buffer sizes are correct
|
|
//
|
|
if ((InBufferLen != sizeof(WMIOPENGUIDBLOCK)) ||
|
|
(OutBufferLen != sizeof(WMIOPENGUIDBLOCK)))
|
|
{
|
|
return(STATUS_UNSUCCESSFUL);
|
|
}
|
|
|
|
//
|
|
// Probe the embedded object attributes and string name
|
|
//
|
|
ObjectAttributes = InGuidBlock->ObjectAttributes;
|
|
*DesiredAccess = InGuidBlock->DesiredAccess;
|
|
}
|
|
|
|
Status = WmipProbeAndCaptureGuidObjectAttributes(CapturedObjectAttributes,
|
|
CapturedGuidString,
|
|
CapturedGuidBuffer,
|
|
ObjectAttributes);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
if ((CapturedObjectAttributes->RootDirectory != NULL) ||
|
|
(CapturedObjectAttributes->Attributes != 0) ||
|
|
(CapturedObjectAttributes->SecurityDescriptor != NULL) ||
|
|
(CapturedObjectAttributes->SecurityQualityOfService != NULL))
|
|
{
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
}
|
|
}
|
|
|
|
return(Status);
|
|
}
|
|
|
|
NTSTATUS WmipProbeWmiRegRequest(
|
|
PDEVICE_OBJECT DeviceObject,
|
|
PWMIREGREQUEST Buffer,
|
|
ULONG InBufferLen,
|
|
ULONG OutBufferLen,
|
|
PBOOLEAN pMofIgnored
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Probe the incoming WMIREGREQUEST to ensure that any offsets in the
|
|
header point to memory that is valid within the buffer. Also validate
|
|
that the WMIREGINFO is properly formed.
|
|
|
|
This routine MUST succeed before any fields in the WMI_REG_INFO
|
|
can be used by any kernel components when passed in from user mode.
|
|
Note that we can trust that the input and output buffer are properly
|
|
sized since the WMI IOCTLs are METHOD_BUFFERED and the IO manager does
|
|
that for us.
|
|
|
|
WMIREGREQUEST Rules:
|
|
|
|
1. The incoming buffer must be at least as large as
|
|
sizeof(WMIREGREQUEST) + sizeof(WMIREGINFOW)
|
|
2. The outgoing buffer must be at least as large as
|
|
sizeof(WMIREGRESULTS)
|
|
3. WmiRegInfo->BufferSize must be less than incoming Buffer size minus
|
|
sizeof(WMIREGREQUEST)
|
|
4. GuidCount must be at least 1 and less than MAXWMIGUIDCOUNT
|
|
5. WmiRegInfo->BufferSize must be greater than equal to
|
|
sizeof(WMIREGINFOW) + WmiRegInfo->GuidCount * sizeof(WMIREGGUIDW)
|
|
5. WmiRegInfo->RegistryPath offset must be within the incoming buffer
|
|
6. WmiRegInfo->MofResourcePath offset must be within the incomoing buffer
|
|
7. RegistryPath and MofResourceName strings are counted unicode strings.
|
|
Their length must be within the incoming buffer
|
|
8. For WOW64, RefInfo32Size and RegGuid32Size passed in must be non-zero and
|
|
cannot be larger than their 64 bit counter part.
|
|
9. Since we decipher the counted strings at a buffer offset, the offset
|
|
must be aligned to 2 bytes (for USHORT).
|
|
10. Trace Registrations do not use InstanceNames within REGGUIDW.
|
|
Therefore InstanceCount and InstanceNameList fields must be zero.
|
|
|
|
Arguments:
|
|
|
|
Buffer - WMIREGREQUEST to be validated
|
|
|
|
InBufferLen - Size of the incoming buffer
|
|
|
|
OutBufferLen - Size of the Output buffer
|
|
|
|
Return Value:
|
|
|
|
NT status code
|
|
|
|
--*/
|
|
|
|
{
|
|
ULONG WmiRegInfoSize;
|
|
PWMIREGINFOW WmiRegInfo;
|
|
PWMIREGREQUEST WmiRegRequest;
|
|
PWMIREGGUIDW WmiRegGuid;
|
|
ULONG GuidCount;
|
|
ULONG SizeNeeded;
|
|
ULONG ImageNameLength=0;
|
|
ULONG ResourceNameLength=0;
|
|
PUCHAR pSource;
|
|
ULONG i;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Incoming Buffer must be atleast the sizeof WMIREGREQUEST + WMIREGINFO
|
|
//
|
|
*pMofIgnored = FALSE;
|
|
|
|
if (InBufferLen >= (sizeof(WMIREGREQUEST) + sizeof(WMIREGINFO)))
|
|
{
|
|
WmiRegRequest = (PWMIREGREQUEST)Buffer;
|
|
WmiRegInfo = (PWMIREGINFOW) OffsetToPtr (Buffer, sizeof(WMIREGREQUEST));
|
|
WmiRegInfoSize = WmiRegInfo->BufferSize;
|
|
|
|
GuidCount = WmiRegInfo->GuidCount;
|
|
|
|
//
|
|
// BufferSize specified must be within the size of incoming Buffer.
|
|
//
|
|
|
|
if (WmiRegInfoSize <= (InBufferLen - sizeof(WMIREGREQUEST)) )
|
|
{
|
|
if ((GuidCount == 0) || (GuidCount > WMIMAXREGGUIDCOUNT))
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// If the Registration call came through Admin device, we are
|
|
// okay to send the BinaryMof through. If it came through the
|
|
// DataDevice, then we need to disable the Binary MOF. We do
|
|
// that by simply zapping the MofResourceName and RegistryPath
|
|
//
|
|
if (DeviceObject != WmipAdminDeviceObject)
|
|
{
|
|
if (WmiRegInfo->MofResourceName > 0)
|
|
{
|
|
*pMofIgnored = TRUE;
|
|
}
|
|
WmiRegInfo->RegistryPath = 0;
|
|
WmiRegInfo->MofResourceName = 0;
|
|
}
|
|
|
|
//
|
|
// Make sure the RegistryPath and MofResourceName offsets are
|
|
// within the REGINFO buffer.
|
|
//
|
|
|
|
if ( (WmiRegInfo->RegistryPath >= WmiRegInfoSize) ||
|
|
(WmiRegInfo->MofResourceName >= WmiRegInfoSize) ) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// Validate the Counted Strings.
|
|
//
|
|
|
|
if (WmiRegInfo->RegistryPath > 0)
|
|
{
|
|
//
|
|
// String Offsets need to be aligned to 2 Bytes
|
|
//
|
|
if (( WmiRegInfo->RegistryPath & 1) != 0)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
ImageNameLength = *((PUSHORT)OffsetToPtr(WmiRegInfo, WmiRegInfo->RegistryPath) );
|
|
ImageNameLength += sizeof(USHORT);
|
|
|
|
if ((WmiRegInfo->RegistryPath + ImageNameLength ) > WmiRegInfoSize)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
}
|
|
|
|
if (WmiRegInfo->MofResourceName > 0)
|
|
{
|
|
if ((WmiRegInfo->MofResourceName & 1) != 0)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
ResourceNameLength = *((PUSHORT)OffsetToPtr(WmiRegInfo, WmiRegInfo->MofResourceName));
|
|
ResourceNameLength += sizeof(USHORT);
|
|
|
|
if ( (WmiRegInfo->MofResourceName + ResourceNameLength) > WmiRegInfoSize)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
}
|
|
// Note: If the ImagePath and MofResource trample over each other but stayed
|
|
// within BufferSize , we will not catch it.
|
|
|
|
#if defined(_WIN64)
|
|
if (IoIs32bitProcess(NULL))
|
|
{
|
|
//
|
|
// Check to make sure the 32 bit structure sizes passed in
|
|
// by the caller is comparable to the 64-bit counterparts
|
|
//
|
|
|
|
if ((WmiRegRequest->WmiRegInfo32Size == 0) ||
|
|
(WmiRegRequest->WmiRegInfo32Size > sizeof(WMIREGINFOW)) )
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
if ((WmiRegRequest->WmiRegGuid32Size == 0) ||
|
|
(WmiRegRequest->WmiRegGuid32Size > sizeof(WMIREGGUIDW)) )
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// InstanceCount and InstanceNameList in
|
|
// WMIREGGUIDW structure must be zero. This check is
|
|
// done after thunking gor WOW64.
|
|
//
|
|
|
|
|
|
SizeNeeded = WmiRegRequest->WmiRegInfo32Size +
|
|
GuidCount * WmiRegRequest->WmiRegGuid32Size +
|
|
ImageNameLength +
|
|
ResourceNameLength;
|
|
if (SizeNeeded > WmiRegInfoSize) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
|
|
SizeNeeded = sizeof(WMIREGINFOW) +
|
|
GuidCount * sizeof(WMIREGGUIDW) +
|
|
ImageNameLength +
|
|
ResourceNameLength;
|
|
|
|
if (SizeNeeded > WmiRegInfoSize) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// Check to see if the InstanceCount and InstanceNameList in
|
|
// WMIREGGUIDW structure is zero
|
|
//
|
|
pSource = OffsetToPtr(WmiRegInfo, sizeof(WMIREGINFOW) );
|
|
for (i=0; i < GuidCount; i++) {
|
|
WmiRegGuid = (PWMIREGGUIDW) pSource;
|
|
if ( (WmiRegGuid->InstanceCount > 0) ||
|
|
(WmiRegGuid->InstanceNameList > 0) )
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
pSource += sizeof(WMIREGGUIDW);
|
|
}
|
|
|
|
}
|
|
|
|
//
|
|
// Now validate the OutBuffer size needed
|
|
//
|
|
|
|
if (sizeof(WMIREGRESULTS) > OutBufferLen)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// All tests passed. Return SUCCESS
|
|
//
|
|
return STATUS_SUCCESS;
|
|
}
|
|
}
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
#ifdef ALLOC_DATA_PRAGMA
|
|
#pragma data_seg()
|
|
#pragma const_seg()
|
|
#endif
|
|
|