mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1292 lines
27 KiB
1292 lines
27 KiB
//
|
|
// Template Driver
|
|
// Copyright (c) Microsoft Corporation, 2000.
|
|
//
|
|
// Module: MapView.c
|
|
// Author: Daniel Mihai (DMihai)
|
|
// Created: 4/6/2000
|
|
//
|
|
// This module contains tests for MmMapViewInSystemSpace & MmMapViewInSessionSpace.
|
|
// Note that SystemViewSize & SessionViewSize are configurable using the registry.
|
|
//
|
|
// SessionPoolTest is exercising the paged pool allocated with SESSION_POOL_MASK.
|
|
// The size of this pool can be also configured using the SsessionViewSize registry
|
|
// value.
|
|
//
|
|
// --- History ---
|
|
//
|
|
// 4/6/2000 (DMihai): initial version.
|
|
//
|
|
|
|
#include <ntddk.h>
|
|
|
|
#include "active.h"
|
|
#include "MapView.h"
|
|
#include "tdriver.h"
|
|
|
|
#if !MAPVIEW_ACTIVE
|
|
|
|
//
|
|
// Dummy implementation if the module is inactive
|
|
//
|
|
|
|
VOID MmMapViewInSystemSpaceLargest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
DbgPrint ("Buggy: MapView module is disabled from active.h\n");
|
|
}
|
|
|
|
VOID MmMapViewInSystemSpaceTotal (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
DbgPrint ("Buggy: MapView module is disabled from active.h\n");
|
|
}
|
|
|
|
VOID MmMapViewInSessionSpaceLargest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
DbgPrint ("Buggy: MapView module is disabled from active.h\n");
|
|
}
|
|
|
|
VOID MmMapViewInSessionSpaceTotal (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
DbgPrint ("Buggy: MapView module is disabled from active.h\n");
|
|
}
|
|
|
|
VOID SessionPoolTest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
DbgPrint ("Buggy: MapView module is disabled from active.h\n");
|
|
}
|
|
|
|
#else
|
|
|
|
const LARGE_INTEGER BuggyFiveSeconds = {(ULONG)(-5 * 1000 * 1000 * 10), -1};
|
|
|
|
|
|
//
|
|
// Real implementation if the module is active
|
|
//
|
|
|
|
#ifndef SESSION_POOL_MASK
|
|
#define SESSION_POOL_MASK 32
|
|
#endif //#ifndef SESSION_POOL_MASK
|
|
|
|
#ifndef SEC_COMMIT
|
|
#define SEC_COMMIT 0x8000000
|
|
#endif //#ifndef SEC_COMMIT
|
|
|
|
#ifndef ZwDeleteFile
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteFile(
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes
|
|
); //#ifndef ZwDeleteFile
|
|
|
|
#endif
|
|
|
|
|
|
#ifndef MmCreateSection
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
MmCreateSection (
|
|
OUT PVOID *SectionObject,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
|
IN PLARGE_INTEGER MaximumSize,
|
|
IN ULONG SectionPageProtection,
|
|
IN ULONG AllocationAttributes,
|
|
IN HANDLE FileHandle OPTIONAL,
|
|
IN PFILE_OBJECT File OPTIONAL
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
MmMapViewInSystemSpace (
|
|
IN PVOID Section,
|
|
OUT PVOID *MappedBase,
|
|
IN PSIZE_T ViewSize
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
MmUnmapViewInSystemSpace (
|
|
IN PVOID MappedBase
|
|
);
|
|
|
|
// begin_ntosp
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
MmMapViewInSessionSpace (
|
|
IN PVOID Section,
|
|
OUT PVOID *MappedBase,
|
|
IN OUT PSIZE_T ViewSize
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
MmUnmapViewInSessionSpace (
|
|
IN PVOID MappedBase
|
|
);
|
|
|
|
#endif //#ifndef MmCreateSection
|
|
|
|
#define BUGGY_TEMPORARY_FILE1 L"\\SystemRoot\\Buggy1.tmp"
|
|
#define BUGGY_TEMPORARY_FILE2 L"\\SystemRoot\\Buggy2.tmp"
|
|
#define BUGGY_TEMPORARY_FILE3 L"\\SystemRoot\\Buggy3.tmp"
|
|
#define BUGGY_TEMPORARY_FILE4 L"\\SystemRoot\\Buggy4.tmp"
|
|
|
|
#define BUGGY_MAX_SECTIONS_TO_MAP ( 8 * 1024 )
|
|
|
|
//
|
|
// global array for mapped sections
|
|
//
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// verify a mapping
|
|
//
|
|
|
|
VOID VerifyMapping( PVOID pBase, SIZE_T uSize )
|
|
{
|
|
SIZE_T *puCrtPage;
|
|
SIZE_T uCrtPageIndex;
|
|
SIZE_T uPages;
|
|
|
|
if( uSize > 100 * 1024 * 1024 )
|
|
{
|
|
DbgPrint ( "Buggy: VerifyMapping: don't try to touch all the %p size to avoid deadlock\n",
|
|
uSize );
|
|
|
|
return;
|
|
}
|
|
|
|
/*
|
|
DbgPrint ( "\nBuggy: Verifying mapping at address %p, size %p...\n",
|
|
pBase,
|
|
(PVOID) uSize );
|
|
*/
|
|
|
|
uPages = uSize / PAGE_SIZE;
|
|
|
|
puCrtPage = (SIZE_T *)pBase;
|
|
|
|
for( uCrtPageIndex = 0; uCrtPageIndex < uPages; uCrtPageIndex++ )
|
|
{
|
|
*puCrtPage = uCrtPageIndex;
|
|
|
|
puCrtPage = (SIZE_T *) ( ( (CHAR*) puCrtPage ) + PAGE_SIZE );
|
|
}
|
|
|
|
while( uCrtPageIndex > 0 )
|
|
{
|
|
uCrtPageIndex --;
|
|
puCrtPage = (SIZE_T *) ( ( (CHAR*) puCrtPage ) - PAGE_SIZE );
|
|
|
|
if( *puCrtPage != uCrtPageIndex )
|
|
{
|
|
DbgPrint ( "\nBuggy: Wrong mapping at address %p\n",
|
|
puCrtPage );
|
|
|
|
DbgBreakPoint();
|
|
}
|
|
}
|
|
|
|
//DbgPrint ( "done\n" );
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
VOID MmMapViewInSystemSpaceLargest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE hFile = NULL;
|
|
SIZE_T SizeToMap;
|
|
SIZE_T SizeToGrow;
|
|
PVOID pMappedBase = NULL;
|
|
PVOID pSection = NULL;
|
|
LARGE_INTEGER MaxSectionSize;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
UNICODE_STRING FileName;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
|
|
//
|
|
// Create BUGGY_TEMPORARY_FILE1
|
|
//
|
|
|
|
RtlInitUnicodeString(
|
|
&FileName,
|
|
BUGGY_TEMPORARY_FILE1
|
|
);
|
|
|
|
InitializeObjectAttributes(
|
|
&ObjectAttributes,
|
|
&FileName,
|
|
OBJ_CASE_INSENSITIVE ,
|
|
NULL,
|
|
NULL
|
|
);
|
|
|
|
Status = ZwCreateFile(
|
|
&hFile,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
NULL,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
0,
|
|
FILE_OVERWRITE_IF,
|
|
FILE_NON_DIRECTORY_FILE,
|
|
NULL,
|
|
0 );
|
|
|
|
/*
|
|
Status = ZwCreateFile(
|
|
&hFile,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
NULL,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
FILE_SHARE_READ,
|
|
FILE_OPEN_IF,
|
|
FILE_WRITE_THROUGH |
|
|
FILE_NO_INTERMEDIATE_BUFFERING |
|
|
FILE_SYNCHRONOUS_IO_NONALERT,
|
|
NULL,
|
|
0
|
|
);
|
|
*/
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwCreateFile failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "Buggy: created file, handle %p\n",
|
|
hFile );
|
|
}
|
|
|
|
//
|
|
// Create a section for the temp file
|
|
//
|
|
|
|
#ifdef _WIN64
|
|
MaxSectionSize.QuadPart = (LONGLONG)0x40000000 * PAGE_SIZE;
|
|
#else
|
|
MaxSectionSize.QuadPart = 0xFFFFFFFF;
|
|
#endif //#ifdef _WIN64
|
|
|
|
do
|
|
{
|
|
Status = MmCreateSection(
|
|
&pSection,
|
|
STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE,
|
|
NULL,
|
|
&MaxSectionSize,
|
|
PAGE_READWRITE,
|
|
SEC_COMMIT,
|
|
hFile,
|
|
NULL );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
if( Status == STATUS_DISK_FULL )
|
|
{
|
|
MaxSectionSize.QuadPart /= 2;
|
|
|
|
DbgPrint ("Buggy: MmCreateSection returned STATUS_DISK_FULL, re-trying with max section size = %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ("Buggy: MmCreateSection failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "Buggy: created section with max size %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
|
|
break;
|
|
}
|
|
|
|
} while( MaxSectionSize.QuadPart > PAGE_SIZE );
|
|
|
|
|
|
DbgPrint ( "Buggy: Using section at %p\n",
|
|
pSection );
|
|
|
|
//
|
|
// try to map the max size section
|
|
//
|
|
|
|
SizeToMap = (SIZE_T) MaxSectionSize.QuadPart;
|
|
|
|
while( SizeToMap > PAGE_SIZE )
|
|
{
|
|
Status = MmMapViewInSystemSpace(
|
|
pSection,
|
|
&pMappedBase,
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmMapViewInSystemSpace failed for size %p, status %X\n",
|
|
SizeToMap,
|
|
Status );
|
|
|
|
SizeToMap /= 2;
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "\n\nFirst result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: MmMapViewInSystemSpace succeeded for size %p, mapped base %p\n",
|
|
SizeToMap,
|
|
pMappedBase );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
VerifyMapping( pMappedBase, SizeToMap );
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
//
|
|
// try to grow the size
|
|
//
|
|
|
|
while( pMappedBase != NULL )
|
|
{
|
|
//
|
|
// unmap the old one
|
|
//
|
|
|
|
Status = MmUnmapViewInSystemSpace(
|
|
pMappedBase );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSystemSpace failed, status %X\n",
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
|
|
break;
|
|
}
|
|
|
|
pMappedBase = NULL;
|
|
|
|
//
|
|
// grow the size
|
|
//
|
|
|
|
SizeToGrow = SizeToMap / 10;
|
|
|
|
if( SizeToGrow < 10 * PAGE_SIZE )
|
|
{
|
|
//
|
|
// don't bother
|
|
//
|
|
|
|
break;
|
|
}
|
|
|
|
SizeToMap += SizeToGrow;
|
|
|
|
//
|
|
// try to use this bigger size
|
|
//
|
|
|
|
Status = MmMapViewInSystemSpace(
|
|
pSection,
|
|
&pMappedBase,
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
/*
|
|
DbgPrint ( "Buggy: MmMapViewInSystemSpace failed for size %p, status %X\n",
|
|
SizeToMap,
|
|
Status );
|
|
*/
|
|
|
|
//
|
|
// can't grow the size anymore
|
|
//
|
|
|
|
break;
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "\n\nBetter result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: MmMapViewInSystemSpace succeeded for size %p, mapped base %p\n",
|
|
SizeToMap,
|
|
pMappedBase );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
VerifyMapping( pMappedBase, SizeToMap );
|
|
}
|
|
}
|
|
|
|
//
|
|
// clean-up
|
|
//
|
|
|
|
cleanup:
|
|
|
|
if( pMappedBase != NULL )
|
|
{
|
|
Status = MmUnmapViewInSystemSpace(
|
|
pMappedBase );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSystemSpace failed, status %X\n",
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
}
|
|
}
|
|
|
|
if( pSection != NULL )
|
|
{
|
|
ObDereferenceObject(
|
|
pSection );
|
|
}
|
|
|
|
if( hFile != NULL )
|
|
{
|
|
ZwClose( hFile );
|
|
|
|
Status = ZwDeleteFile(
|
|
&ObjectAttributes );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwDeleteFile failed - status %X\n",
|
|
Status );
|
|
}
|
|
else
|
|
{
|
|
// DbgPrint ("Buggy: temporary file deleted\n" );
|
|
}
|
|
}
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////
|
|
|
|
PVOID *MappedSections;
|
|
|
|
VOID MmMapViewInSystemSpaceTotal (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE hFile = NULL;
|
|
SIZE_T SizeToMap;
|
|
PVOID pSection = NULL;
|
|
SIZE_T CrtMap;
|
|
LARGE_INTEGER MaxSectionSize;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
UNICODE_STRING FileName;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
|
|
MappedSections = ExAllocatePoolWithTag(
|
|
NonPagedPool,
|
|
BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ),
|
|
TD_POOL_TAG );
|
|
|
|
if( MappedSections == NULL )
|
|
{
|
|
DbgPrint ("Buggy: ExAllocatePoolWithTag failed - bail\n" );
|
|
|
|
return;
|
|
}
|
|
|
|
RtlZeroMemory( MappedSections, BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ) );
|
|
|
|
//
|
|
// Create BUGGY_TEMPORARY_FILE2
|
|
//
|
|
|
|
RtlInitUnicodeString(
|
|
&FileName,
|
|
BUGGY_TEMPORARY_FILE2
|
|
);
|
|
|
|
InitializeObjectAttributes(
|
|
&ObjectAttributes,
|
|
&FileName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL
|
|
);
|
|
|
|
Status = ZwCreateFile(
|
|
&hFile,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
NULL,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
0,
|
|
FILE_OVERWRITE_IF,
|
|
FILE_NON_DIRECTORY_FILE,
|
|
NULL,
|
|
0 );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
/*
|
|
DbgPrint ("Buggy: ZwCreateFile failed - status %X\n",
|
|
Status );
|
|
*/
|
|
|
|
goto cleanup;
|
|
}
|
|
else
|
|
{
|
|
//DbgPrint ( "Buggy: created file\n" );
|
|
}
|
|
|
|
//
|
|
// Create a section for the temp file
|
|
//
|
|
|
|
MaxSectionSize.QuadPart = 1024 * 1024;
|
|
|
|
do
|
|
{
|
|
Status = MmCreateSection(
|
|
&pSection,
|
|
STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE,
|
|
NULL,
|
|
&MaxSectionSize,
|
|
PAGE_READWRITE,
|
|
SEC_COMMIT,
|
|
hFile,
|
|
NULL );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
if( Status == STATUS_DISK_FULL )
|
|
{
|
|
MaxSectionSize.QuadPart /= 2;
|
|
|
|
/*
|
|
DbgPrint ("Buggy: MmCreateSection returned STATUS_DISK_FULL, re-trying with max section size = %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
*/
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ("Buggy: MmCreateSection failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
DbgPrint ( "Buggy: created section with max size %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
*/
|
|
|
|
break;
|
|
}
|
|
|
|
} while( MaxSectionSize.QuadPart > PAGE_SIZE );
|
|
|
|
|
|
//
|
|
// get a pointer to the section
|
|
//
|
|
|
|
DbgPrint ( "Buggy: Using section at %p\n",
|
|
pSection );
|
|
|
|
//
|
|
// try to map the max size section
|
|
//
|
|
|
|
SizeToMap = (SIZE_T) MaxSectionSize.QuadPart;
|
|
|
|
RtlZeroMemory( MappedSections, BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ) );
|
|
|
|
for( CrtMap = 0; CrtMap < BUGGY_MAX_SECTIONS_TO_MAP; CrtMap++ )
|
|
{
|
|
Status = MmMapViewInSystemSpace(
|
|
pSection,
|
|
&MappedSections[ CrtMap ],
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
/*
|
|
DbgPrint ( "Buggy: MmMapViewInSystemSpace failed for size %p, status %X, chunk %p\n",
|
|
SizeToMap,
|
|
Status
|
|
);
|
|
*/
|
|
|
|
break;
|
|
}
|
|
else
|
|
{
|
|
if( CrtMap <= 100 )
|
|
{
|
|
VerifyMapping( MappedSections[ CrtMap ], SizeToMap );
|
|
}
|
|
}
|
|
}
|
|
|
|
DbgPrint ( "\n\nBuggy: Result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: mapped %u sections with size %p, total %p\n",
|
|
CrtMap,
|
|
SizeToMap,
|
|
SizeToMap * (SIZE_T)CrtMap );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
//
|
|
// clean-up
|
|
//
|
|
|
|
cleanup:
|
|
|
|
for( CrtMap = 0; CrtMap < BUGGY_MAX_SECTIONS_TO_MAP; CrtMap++ )
|
|
{
|
|
if( MappedSections[ CrtMap ] == NULL )
|
|
{
|
|
break;
|
|
}
|
|
|
|
Status = MmUnmapViewInSystemSpace(
|
|
MappedSections[ CrtMap ] );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSystemSpace failed for %p, status %X\n",
|
|
MappedSections[ CrtMap ],
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
}
|
|
}
|
|
|
|
DbgPrint ( "Buggy: unmapped %p sections\n",
|
|
CrtMap );
|
|
|
|
if( pSection != NULL )
|
|
{
|
|
ObDereferenceObject(
|
|
pSection );
|
|
|
|
DbgPrint ( "Buggy: dereferenced section at %p\n",
|
|
pSection );
|
|
}
|
|
|
|
if( hFile != NULL )
|
|
{
|
|
ZwClose( hFile );
|
|
|
|
DbgPrint ( "Buggy: calling ZwDeleteFile\n" );
|
|
|
|
Status = ZwDeleteFile(
|
|
&ObjectAttributes );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwDeleteFile failed - status %X\n",
|
|
Status );
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ("Buggy: temporary file deleted\n" );
|
|
}
|
|
}
|
|
|
|
ExFreePool( MappedSections );
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////////////
|
|
|
|
VOID MmMapViewInSessionSpaceLargest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE hFile = NULL;
|
|
SIZE_T SizeToMap;
|
|
SIZE_T SizeToGrow;
|
|
PVOID pMappedBase = NULL;
|
|
PVOID pSection = NULL;
|
|
LARGE_INTEGER MaxSectionSize;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
UNICODE_STRING FileName;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
|
|
// Create BUGGY_TEMPORARY_FILE3
|
|
//
|
|
|
|
RtlInitUnicodeString(
|
|
&FileName,
|
|
BUGGY_TEMPORARY_FILE3
|
|
);
|
|
|
|
InitializeObjectAttributes(
|
|
&ObjectAttributes,
|
|
&FileName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL
|
|
);
|
|
|
|
Status = ZwCreateFile(
|
|
&hFile,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
NULL,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
0,
|
|
FILE_OVERWRITE_IF,
|
|
FILE_NON_DIRECTORY_FILE,
|
|
NULL,
|
|
0 );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
/*
|
|
DbgPrint ("Buggy: ZwCreateFile failed - status %X\n",
|
|
Status );
|
|
*/
|
|
|
|
goto cleanup;
|
|
}
|
|
else
|
|
{
|
|
//DbgPrint ( "Buggy: created file\n" );
|
|
}
|
|
|
|
//
|
|
// Create a section for the temp file
|
|
//
|
|
|
|
#ifdef _WIN64
|
|
MaxSectionSize.QuadPart = (LONGLONG)0x40000000 * PAGE_SIZE;
|
|
#else
|
|
MaxSectionSize.QuadPart = 0xFFFFFFFF;
|
|
#endif //#ifdef _WIN64
|
|
|
|
do
|
|
{
|
|
Status = MmCreateSection(
|
|
&pSection,
|
|
STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE,
|
|
NULL,
|
|
&MaxSectionSize,
|
|
PAGE_READWRITE,
|
|
SEC_COMMIT,
|
|
hFile,
|
|
NULL );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
if( Status == STATUS_DISK_FULL )
|
|
{
|
|
MaxSectionSize.QuadPart /= 2;
|
|
|
|
DbgPrint ("Buggy: MmCreateSection returned STATUS_DISK_FULL, re-trying with max section size = %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ("Buggy: MmCreateSection failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "Buggy: created section with max size %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
|
|
break;
|
|
}
|
|
|
|
} while( MaxSectionSize.QuadPart > PAGE_SIZE );
|
|
|
|
|
|
DbgPrint ( "Buggy: Using section at %p\n",
|
|
pSection );
|
|
|
|
//
|
|
// try to map the max size section
|
|
//
|
|
|
|
SizeToMap = (SIZE_T) MaxSectionSize.QuadPart;
|
|
|
|
while( SizeToMap > PAGE_SIZE )
|
|
{
|
|
Status = MmMapViewInSessionSpace(
|
|
pSection,
|
|
&pMappedBase,
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmMapViewInSessionSpace failed for size %p, status %X\n",
|
|
SizeToMap,
|
|
Status );
|
|
|
|
SizeToMap /= 2;
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "\n\nFirst result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: MmMapViewInSessionSpace succeeded for size %p, mapped base %p\n",
|
|
SizeToMap,
|
|
pMappedBase );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
VerifyMapping( pMappedBase, SizeToMap );
|
|
|
|
break;
|
|
}
|
|
}
|
|
|
|
//
|
|
// try to grow the size
|
|
//
|
|
|
|
while( pMappedBase != NULL )
|
|
{
|
|
//
|
|
// unmap the old one
|
|
//
|
|
|
|
Status = MmUnmapViewInSessionSpace(
|
|
pMappedBase );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSessionSpace failed, status %X\n",
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
|
|
break;
|
|
}
|
|
|
|
pMappedBase = NULL;
|
|
|
|
//
|
|
// grow the size
|
|
//
|
|
|
|
SizeToGrow = SizeToMap / 10;
|
|
|
|
if( SizeToGrow < 10 * PAGE_SIZE )
|
|
{
|
|
//
|
|
// don't bother
|
|
//
|
|
|
|
break;
|
|
}
|
|
|
|
SizeToMap += SizeToGrow;
|
|
|
|
//
|
|
// try to use this bigger size
|
|
//
|
|
|
|
Status = MmMapViewInSessionSpace(
|
|
pSection,
|
|
&pMappedBase,
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmMapViewInSessionSpace failed for size %p, status %X\n",
|
|
SizeToMap,
|
|
Status );
|
|
|
|
//
|
|
// can't grow the size anymore
|
|
//
|
|
|
|
break;
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ( "\n\nBetter result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: MmMapViewInSessionSpace succeeded for size %p, mapped base %p\n",
|
|
SizeToMap,
|
|
pMappedBase );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
VerifyMapping( pMappedBase, SizeToMap );
|
|
}
|
|
}
|
|
|
|
//
|
|
// clean-up
|
|
//
|
|
|
|
cleanup:
|
|
|
|
if( pMappedBase != NULL )
|
|
{
|
|
Status = MmUnmapViewInSessionSpace(
|
|
pMappedBase );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSessionSpace failed, status %X\n",
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
}
|
|
}
|
|
|
|
if( pSection != NULL )
|
|
{
|
|
ObDereferenceObject(
|
|
pSection );
|
|
}
|
|
|
|
if( hFile != NULL )
|
|
{
|
|
ZwClose( hFile );
|
|
|
|
Status = ZwDeleteFile(
|
|
&ObjectAttributes );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwDeleteFile failed - status %X\n",
|
|
Status );
|
|
}
|
|
else
|
|
{
|
|
//DbgPrint ("Buggy: temporary file deleted\n" );
|
|
}
|
|
}
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////
|
|
|
|
VOID MmMapViewInSessionSpaceTotal (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE hFile = NULL;
|
|
SIZE_T SizeToMap;
|
|
PVOID pSection = NULL;
|
|
SIZE_T CrtMap;
|
|
LARGE_INTEGER MaxSectionSize;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
UNICODE_STRING FileName;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
PVOID *MappedSections;
|
|
|
|
MappedSections = ExAllocatePoolWithTag(
|
|
NonPagedPool,
|
|
BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ),
|
|
TD_POOL_TAG );
|
|
|
|
if( MappedSections == NULL )
|
|
{
|
|
DbgPrint ("Buggy: ExAllocatePoolWithTag failed - bail\n" );
|
|
|
|
return;
|
|
}
|
|
|
|
RtlZeroMemory( MappedSections, BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ) );
|
|
|
|
|
|
//
|
|
// Create BUGGY_TEMPORARY_FILE3
|
|
//
|
|
|
|
RtlInitUnicodeString(
|
|
&FileName,
|
|
BUGGY_TEMPORARY_FILE3
|
|
);
|
|
|
|
InitializeObjectAttributes(
|
|
&ObjectAttributes,
|
|
&FileName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL
|
|
);
|
|
|
|
Status = ZwCreateFile(
|
|
&hFile,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
NULL,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
0,
|
|
FILE_OVERWRITE_IF,
|
|
FILE_NON_DIRECTORY_FILE,
|
|
NULL,
|
|
0 );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwCreateFile failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
else
|
|
{
|
|
//DbgPrint ( "Buggy: created file\n" );
|
|
}
|
|
|
|
//
|
|
// Create a section for the temp file
|
|
//
|
|
|
|
MaxSectionSize.QuadPart = 1024 * 1024;
|
|
|
|
do
|
|
{
|
|
Status = MmCreateSection(
|
|
&pSection,
|
|
STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE,
|
|
NULL,
|
|
&MaxSectionSize,
|
|
PAGE_READWRITE,
|
|
SEC_COMMIT,
|
|
hFile,
|
|
NULL );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
if( Status == STATUS_DISK_FULL )
|
|
{
|
|
MaxSectionSize.QuadPart /= 2;
|
|
|
|
/*
|
|
DbgPrint ("Buggy: MmCreateSection returned STATUS_DISK_FULL, re-trying with max section size = %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
*/
|
|
}
|
|
else
|
|
{
|
|
DbgPrint ("Buggy: MmCreateSection failed - status %X\n",
|
|
Status );
|
|
|
|
goto cleanup;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
DbgPrint ( "Buggy: created section with max size %I64X\n",
|
|
MaxSectionSize.QuadPart );
|
|
*/
|
|
|
|
break;
|
|
}
|
|
|
|
} while( MaxSectionSize.QuadPart > PAGE_SIZE );
|
|
|
|
|
|
DbgPrint ( "Buggy: Using section at %p\n",
|
|
pSection );
|
|
|
|
//
|
|
// try to map the max size section
|
|
//
|
|
|
|
SizeToMap = (SIZE_T) MaxSectionSize.QuadPart;
|
|
|
|
RtlZeroMemory( MappedSections, BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ) );
|
|
|
|
for( CrtMap = 0; CrtMap < BUGGY_MAX_SECTIONS_TO_MAP; CrtMap++ )
|
|
{
|
|
Status = MmMapViewInSessionSpace(
|
|
pSection,
|
|
&MappedSections[ CrtMap ],
|
|
&SizeToMap );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
/*
|
|
DbgPrint ( "Buggy: MmMapViewInSessionSpace failed for size %p, status %X, chunk %p\n",
|
|
SizeToMap,
|
|
Status
|
|
);
|
|
*/
|
|
|
|
break;
|
|
}
|
|
else
|
|
{
|
|
if( CrtMap <= 100 )
|
|
{
|
|
VerifyMapping( MappedSections[ CrtMap ], SizeToMap );
|
|
}
|
|
}
|
|
}
|
|
|
|
DbgPrint ( "\n\nBuggy: Result of the test:\n\n" );
|
|
|
|
DbgPrint ( "Buggy: mapped %u sections with size %p, total %p\n",
|
|
CrtMap,
|
|
SizeToMap,
|
|
SizeToMap * (SIZE_T)CrtMap );
|
|
|
|
//DbgPrint ( "\n\n" );
|
|
|
|
//
|
|
// clean-up
|
|
//
|
|
|
|
cleanup:
|
|
|
|
for( CrtMap = 0; CrtMap < BUGGY_MAX_SECTIONS_TO_MAP; CrtMap++ )
|
|
{
|
|
if( MappedSections[ CrtMap ] == NULL )
|
|
{
|
|
break;
|
|
}
|
|
|
|
Status = MmUnmapViewInSessionSpace(
|
|
MappedSections[ CrtMap ] );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ( "Buggy: MmUnmapViewInSessionSpace failed for %p, status %X\n",
|
|
MappedSections[ CrtMap ],
|
|
Status );
|
|
|
|
DbgBreakPoint();
|
|
}
|
|
}
|
|
|
|
if( pSection != NULL )
|
|
{
|
|
ObDereferenceObject(
|
|
pSection );
|
|
}
|
|
|
|
if( hFile != NULL )
|
|
{
|
|
ZwClose( hFile );
|
|
|
|
Status = ZwDeleteFile(
|
|
&ObjectAttributes );
|
|
|
|
if( ! NT_SUCCESS( Status ) )
|
|
{
|
|
DbgPrint ("Buggy: ZwDeleteFile failed - status %X\n",
|
|
Status );
|
|
}
|
|
else
|
|
{
|
|
//DbgPrint ("Buggy: temporary file deleted\n" );
|
|
}
|
|
}
|
|
|
|
ExFreePool( MappedSections );
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////
|
|
|
|
VOID SessionPoolTest (
|
|
PVOID NotUsed
|
|
)
|
|
{
|
|
PVOID *SessionPoolChunks;
|
|
ULONG uCrtPoolChunk;
|
|
|
|
SessionPoolChunks = ExAllocatePoolWithTag(
|
|
NonPagedPool,
|
|
BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ),
|
|
TD_POOL_TAG );
|
|
|
|
if( SessionPoolChunks == NULL )
|
|
{
|
|
DbgPrint ("Buggy: ExAllocatePoolWithTag failed - bail\n" );
|
|
|
|
return;
|
|
}
|
|
|
|
RtlZeroMemory( SessionPoolChunks, BUGGY_MAX_SECTIONS_TO_MAP * sizeof( PVOID ) );
|
|
|
|
for( uCrtPoolChunk = 0; uCrtPoolChunk < BUGGY_MAX_SECTIONS_TO_MAP; uCrtPoolChunk++ )
|
|
{
|
|
SessionPoolChunks[ uCrtPoolChunk ] = ExAllocatePoolWithTag(
|
|
PagedPool | SESSION_POOL_MASK,
|
|
1024 * 1024,
|
|
TD_POOL_TAG );
|
|
|
|
if( SessionPoolChunks[ uCrtPoolChunk ] == NULL )
|
|
{
|
|
DbgPrint ("\n\nBuggy: Result of the test allocated %u chunks with size 1 Mb in the session pool\n\n",
|
|
uCrtPoolChunk );
|
|
break;
|
|
}
|
|
}
|
|
|
|
DbgPrint ( "Buggy: Touching all these pool chuncks...\n" );
|
|
|
|
while( uCrtPoolChunk > 0 )
|
|
{
|
|
uCrtPoolChunk--;
|
|
|
|
if( uCrtPoolChunk <= 100 )
|
|
{
|
|
VerifyMapping( SessionPoolChunks[ uCrtPoolChunk ], 1024 * 1024 );
|
|
}
|
|
|
|
ExFreePool( SessionPoolChunks[ uCrtPoolChunk ] );
|
|
}
|
|
|
|
DbgPrint ( "Done\n" );
|
|
|
|
ExFreePool( SessionPoolChunks );
|
|
}
|
|
|
|
#endif // #if !MAPVIEW_ACTIVE
|
|
|