From ac1e48dc30d30f0700e3c8cbab382c3bfa4cba80 Mon Sep 17 00:00:00 2001 From: 87owo <85057800+87owo@users.noreply.github.com> Date: Sun, 12 Apr 2026 13:49:40 +0800 Subject: [PATCH] Add files via upload --- Plugins/Filter/DriverCommon.h | 23 +++-- Plugins/Filter/DriverEntry.cpp | 6 ++ Plugins/Filter/ProtectFile.cpp | 132 ++++++++++++++++------------- Plugins/Filter/ProtectProcess.cpp | 4 - Plugins/Filter/ProtectRegistry.cpp | 96 +++++++++++---------- Plugins/Filter/ProtectRules.cpp | 27 +++--- 6 files changed, 151 insertions(+), 137 deletions(-) diff --git a/Plugins/Filter/DriverCommon.h b/Plugins/Filter/DriverCommon.h index 2ed4f7b..13a2621 100644 --- a/Plugins/Filter/DriverCommon.h +++ b/Plugins/Filter/DriverCommon.h @@ -43,25 +43,25 @@ constexpr auto PYAS_POOL_TAG = 'SAYP'; #define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) #endif #ifndef PROCESS_SET_QUOTA -#define PROCESS_SET_QUOTA (0x0100) +#define PROCESS_SET_QUOTA (0x0100) #endif #ifndef THREAD_TERMINATE -#define THREAD_TERMINATE (0x0001) +#define THREAD_TERMINATE (0x0001) #endif #ifndef THREAD_SUSPEND_RESUME -#define THREAD_SUSPEND_RESUME (0x0002) +#define THREAD_SUSPEND_RESUME (0x0002) #endif #ifndef THREAD_SET_CONTEXT -#define THREAD_SET_CONTEXT (0x0010) +#define THREAD_SET_CONTEXT (0x0010) #endif #ifndef THREAD_SET_INFORMATION -#define THREAD_SET_INFORMATION (0x0020) +#define THREAD_SET_INFORMATION (0x0020) #endif #ifndef THREAD_SET_THREAD_TOKEN -#define THREAD_SET_THREAD_TOKEN (0x0080) +#define THREAD_SET_THREAD_TOKEN (0x0080) #endif #ifndef POOL_FLAG_NON_PAGED -#define POOL_FLAG_NON_PAGED 0x0000000000000040UI64 +#define POOL_FLAG_NON_PAGED 0x0000000000000040UI64 #endif #ifndef FSCTL_MANAGE_BYPASS_IO @@ -136,6 +136,9 @@ VOID UninitializeRegistryProtection(); NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath); VOID UnloadRules(); +VOID InitializeRulesEngine(); +VOID UninitializeRulesEngine(); + VOID ImageLoadNotify(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo); NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName); @@ -152,13 +155,7 @@ BOOLEAN CheckRansomActivity(HANDLE ProcessId, PUNICODE_STRING FileName, PVOID Wr NTSTATUS SendMessageToUser(ULONG Code, ULONG Pid, PWCHAR Path, USHORT PathSize); FORCEINLINE PVOID PyasAllocate(SIZE_T Size) { -#if (NTDDI_VERSION >= NTDDI_WIN10_VB) return ExAllocatePool2(POOL_FLAG_NON_PAGED, Size, PYAS_POOL_TAG); -#else - PVOID Buffer = ExAllocatePoolWithTag(NonPagedPoolNx, Size, PYAS_POOL_TAG); - if (Buffer) RtlZeroMemory(Buffer, Size); - return Buffer; -#endif } FORCEINLINE VOID PyasFree(PVOID Ptr) { diff --git a/Plugins/Filter/DriverEntry.cpp b/Plugins/Filter/DriverEntry.cpp index c8204db..c9a096b 100644 --- a/Plugins/Filter/DriverEntry.cpp +++ b/Plugins/Filter/DriverEntry.cpp @@ -48,6 +48,7 @@ static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) { ExWaitForRundownProtectionRelease(&GlobalData.PortRundown); UnloadRules(); + UninitializeRulesEngine(); return STATUS_SUCCESS; } @@ -120,11 +121,14 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg ExInitializeRundownProtection(&GlobalData.PortRundown); + InitializeRulesEngine(); + status = LoadRulesFromDisk(RegistryPath); status = FltRegisterFilter(DriverObject, &FilterRegistration, &GlobalData.FilterHandle); if (!NT_SUCCESS(status)) { UnloadRules(); + UninitializeRulesEngine(); return status; } @@ -142,6 +146,7 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg GlobalData.FilterHandle = NULL; } UnloadRules(); + UninitializeRulesEngine(); return status; } @@ -166,6 +171,7 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg } UnloadRules(); + UninitializeRulesEngine(); } return status; diff --git a/Plugins/Filter/ProtectFile.cpp b/Plugins/Filter/ProtectFile.cpp index e36833f..063092f 100644 --- a/Plugins/Filter/ProtectFile.cpp +++ b/Plugins/Filter/ProtectFile.cpp @@ -123,39 +123,38 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreSetInfo(PFLT_CALLBACK_DATA Data, PCFLT_ } PFLT_FILE_NAME_INFORMATION nameInfo = NULL; + FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo); - if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK; + if (!NT_SUCCESS(status) || !nameInfo) goto cleanup; status = FltParseFileNameInformation(nameInfo); - if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) { - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_SUCCESS_NO_CALLBACK; - } + if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup; HANDLE Pid = PsGetCurrentProcessId(); if (!IsProcessTrusted(Pid)) { - if (CheckProtectedPathRule(&nameInfo->Name)) { SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length); Data->IoStatus.Status = STATUS_ACCESS_DENIED; - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_COMPLETE; + callbackStatus = FLT_PREOP_COMPLETE; + goto cleanup; } if (CheckFileExtensionRule(&nameInfo->Name)) { if (CheckRansomActivity(Pid, &nameInfo->Name, NULL, 0, FALSE)) { SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length); Data->IoStatus.Status = STATUS_ACCESS_DENIED; - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_COMPLETE; + callbackStatus = FLT_PREOP_COMPLETE; + goto cleanup; } } } + +cleanup: if (nameInfo) { FltReleaseFileNameInformation(nameInfo); } - return FLT_PREOP_SUCCESS_NO_CALLBACK; + return callbackStatus; } FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) { @@ -166,15 +165,13 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT if (KeGetCurrentIrql() > APC_LEVEL) return FLT_PREOP_SUCCESS_NO_CALLBACK; PFLT_FILE_NAME_INFORMATION nameInfo = NULL; + FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo); - if (!NT_SUCCESS(status) || !nameInfo) return FLT_PREOP_SUCCESS_NO_CALLBACK; + if (!NT_SUCCESS(status) || !nameInfo) goto cleanup; status = FltParseFileNameInformation(nameInfo); - if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) { - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_SUCCESS_NO_CALLBACK; - } + if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup; SECURITY_INFORMATION SecurityInfo = Data->Iopb->Parameters.SetSecurity.SecurityInformation; @@ -184,18 +181,22 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_SetSecurity(PFLT_CALLBACK_DATA Data, PCFLT if (!IsProcessTrusted(Pid)) { SendMessageToUser(2001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length); Data->IoStatus.Status = STATUS_ACCESS_DENIED; - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_COMPLETE; + callbackStatus = FLT_PREOP_COMPLETE; + goto cleanup; } } } - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_SUCCESS_NO_CALLBACK; +cleanup: + if (nameInfo) { + FltReleaseFileNameInformation(nameInfo); + } + return callbackStatus; } FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* CompletionContext) { UNREFERENCED_PARAMETER(CompletionContext); + UNREFERENCED_PARAMETER(FltObjects); if (Data->RequestorMode == KernelMode) return FLT_PREOP_SUCCESS_NO_CALLBACK; @@ -207,43 +208,45 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_PreWrite(PFLT_CALLBACK_DATA Data, PCFLT_RE if (WriteLength == 0) return FLT_PREOP_SUCCESS_NO_CALLBACK; PFLT_FILE_NAME_INFORMATION nameInfo = NULL; + FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; NTSTATUS status = FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo); - FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; + if (!NT_SUCCESS(status) || !nameInfo) goto cleanup; - if (NT_SUCCESS(status) && nameInfo) { - status = FltParseFileNameInformation(nameInfo); - if (NT_SUCCESS(status) && nameInfo->Name.Buffer) { + status = FltParseFileNameInformation(nameInfo); + if (!NT_SUCCESS(status) || !nameInfo->Name.Buffer) goto cleanup; - if (CheckFileExtensionRule(&nameInfo->Name)) { - HANDLE Pid = PsGetCurrentProcessId(); + if (CheckFileExtensionRule(&nameInfo->Name)) { + HANDLE Pid = PsGetCurrentProcessId(); - if (!IsProcessTrusted(Pid)) { - PVOID SystemBuffer = NULL; - PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress; + if (!IsProcessTrusted(Pid)) { + PVOID SystemBuffer = NULL; + PMDL Mdl = Data->Iopb->Parameters.Write.MdlAddress; - if (!Mdl) { - if (Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) { - if (NT_SUCCESS(FltLockUserBuffer(Data))) { - Mdl = Data->Iopb->Parameters.Write.MdlAddress; - } - } - } - - if (Mdl) { - SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute); - } - - if (SystemBuffer) { - if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) { - SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length); - Data->IoStatus.Status = STATUS_ACCESS_DENIED; - callbackStatus = FLT_PREOP_COMPLETE; - } + if (!Mdl) { + if (Data->Iopb->Parameters.Write.WriteBuffer && KeGetCurrentIrql() <= APC_LEVEL) { + if (NT_SUCCESS(FltLockUserBuffer(Data))) { + Mdl = Data->Iopb->Parameters.Write.MdlAddress; } } } + + if (Mdl) { + SystemBuffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority | MdlMappingNoExecute); + } + + if (SystemBuffer) { + if (CheckRansomActivity(Pid, &nameInfo->Name, SystemBuffer, WriteLength, TRUE)) { + SendMessageToUser(5001, (ULONG)(ULONG_PTR)Pid, nameInfo->Name.Buffer, nameInfo->Name.Length); + Data->IoStatus.Status = STATUS_ACCESS_DENIED; + callbackStatus = FLT_PREOP_COMPLETE; + } + } } + } + +cleanup: + if (nameInfo) { FltReleaseFileNameInformation(nameInfo); } return callbackStatus; @@ -260,24 +263,31 @@ FLT_PREOP_CALLBACK_STATUS ProtectFile_FileSystemControl(PFLT_CALLBACK_DATA Data, PFS_BPIO_INPUT InputBuffer = (PFS_BPIO_INPUT)Data->Iopb->Parameters.FileSystemControl.Neither.InputBuffer; if (!InputBuffer) return FLT_PREOP_SUCCESS_NO_CALLBACK; + FS_BPIO_OPERATIONS Operation; + __try { - if (InputBuffer->Operation == FS_BPIO_OP_ENABLE) { - PFLT_FILE_NAME_INFORMATION nameInfo = NULL; - if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) { - if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) { - if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) { - Data->IoStatus.Status = STATUS_NOT_SUPPORTED; - FltReleaseFileNameInformation(nameInfo); - return FLT_PREOP_COMPLETE; - } - } - FltReleaseFileNameInformation(nameInfo); - } - } + Operation = InputBuffer->Operation; } __except (EXCEPTION_EXECUTE_HANDLER) { return FLT_PREOP_SUCCESS_NO_CALLBACK; } - return FLT_PREOP_SUCCESS_NO_CALLBACK; + PFLT_FILE_NAME_INFORMATION nameInfo = NULL; + FLT_PREOP_CALLBACK_STATUS callbackStatus = FLT_PREOP_SUCCESS_NO_CALLBACK; + + if (Operation == FS_BPIO_OP_ENABLE) { + if (NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &nameInfo)) && nameInfo) { + if (NT_SUCCESS(FltParseFileNameInformation(nameInfo))) { + if (CheckFileExtensionRule(&nameInfo->Name) || CheckProtectedPathRule(&nameInfo->Name)) { + Data->IoStatus.Status = STATUS_NOT_SUPPORTED; + callbackStatus = FLT_PREOP_COMPLETE; + } + } + } + } + + if (nameInfo) { + FltReleaseFileNameInformation(nameInfo); + } + return callbackStatus; } \ No newline at end of file diff --git a/Plugins/Filter/ProtectProcess.cpp b/Plugins/Filter/ProtectProcess.cpp index 2e68d35..7d71d18 100644 --- a/Plugins/Filter/ProtectProcess.cpp +++ b/Plugins/Filter/ProtectProcess.cpp @@ -100,11 +100,9 @@ static OB_PREOP_CALLBACK_STATUS PreOpenProcess(PVOID RegistrationContext, POB_PR PROCESS_SET_QUOTA; OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask; - OperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess &= ~DenyMask; if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) { OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask; - OperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess &= ~DenyMask; } } @@ -147,11 +145,9 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE THREAD_SET_THREAD_TOKEN; OperationInformation->Parameters->CreateHandleInformation.DesiredAccess &= ~DenyMask; - OperationInformation->Parameters->CreateHandleInformation.OriginalDesiredAccess &= ~DenyMask; if (OperationInformation->Operation == OB_OPERATION_HANDLE_DUPLICATE) { OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess &= ~DenyMask; - OperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess &= ~DenyMask; } } diff --git a/Plugins/Filter/ProtectRegistry.cpp b/Plugins/Filter/ProtectRegistry.cpp index 1886262..e6dd87f 100644 --- a/Plugins/Filter/ProtectRegistry.cpp +++ b/Plugins/Filter/ProtectRegistry.cpp @@ -142,36 +142,38 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A PCUNICODE_STRING KeyName = NULL; if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) { - if (KeyName && KeyName->Buffer) { - if (!IsBamRegistryPath(KeyName)) { - ULONG FullSize = KeyName->Length + sizeof(WCHAR) + - (Info->ValueName ? Info->ValueName->Length : 0) + - sizeof(WCHAR); + if (KeyName) { + if (KeyName->Buffer) { + if (!IsBamRegistryPath(KeyName)) { + ULONG FullSize = KeyName->Length + sizeof(WCHAR) + + (Info->ValueName ? Info->ValueName->Length : 0) + + sizeof(WCHAR); - PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize); - if (Buffer) { - UNICODE_STRING FullPath; - FullPath.Buffer = Buffer; - FullPath.Length = 0; - FullPath.MaximumLength = (USHORT)FullSize; + PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize); + if (Buffer) { + UNICODE_STRING FullPath; + FullPath.Buffer = Buffer; + FullPath.Length = 0; + FullPath.MaximumLength = (USHORT)FullSize; - RtlCopyUnicodeString(&FullPath, KeyName); + RtlCopyUnicodeString(&FullPath, KeyName); - if (Info->ValueName && Info->ValueName->Length > 0) { - if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') { - RtlAppendUnicodeToString(&FullPath, L"\\"); + if (Info->ValueName && Info->ValueName->Length > 0) { + if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') { + RtlAppendUnicodeToString(&FullPath, L"\\"); + } + RtlAppendUnicodeStringToString(&FullPath, Info->ValueName); } - RtlAppendUnicodeStringToString(&FullPath, Info->ValueName); - } - if (CheckRegistryRule(&FullPath)) { - HANDLE Pid = PsGetCurrentProcessId(); - if (!IsProcessTrusted(Pid)) { - SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length); - status = STATUS_ACCESS_DENIED; + if (CheckRegistryRule(&FullPath)) { + HANDLE Pid = PsGetCurrentProcessId(); + if (!IsProcessTrusted(Pid)) { + SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length); + status = STATUS_ACCESS_DENIED; + } } + PyasFree(Buffer); } - PyasFree(Buffer); } } CmCallbackReleaseKeyObjectIDEx(KeyName); @@ -185,36 +187,38 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A PCUNICODE_STRING KeyName = NULL; if (NT_SUCCESS(CmCallbackGetKeyObjectIDEx(&Cookie, Info->Object, NULL, &KeyName, 0))) { - if (KeyName && KeyName->Buffer) { - if (!IsBamRegistryPath(KeyName)) { - ULONG FullSize = KeyName->Length + sizeof(WCHAR) + - (Info->ValueName ? Info->ValueName->Length : 0) + - sizeof(WCHAR); + if (KeyName) { + if (KeyName->Buffer) { + if (!IsBamRegistryPath(KeyName)) { + ULONG FullSize = KeyName->Length + sizeof(WCHAR) + + (Info->ValueName ? Info->ValueName->Length : 0) + + sizeof(WCHAR); - PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize); - if (Buffer) { - UNICODE_STRING FullPath; - FullPath.Buffer = Buffer; - FullPath.Length = 0; - FullPath.MaximumLength = (USHORT)FullSize; + PWCHAR Buffer = (PWCHAR)PyasAllocate(FullSize); + if (Buffer) { + UNICODE_STRING FullPath; + FullPath.Buffer = Buffer; + FullPath.Length = 0; + FullPath.MaximumLength = (USHORT)FullSize; - RtlCopyUnicodeString(&FullPath, KeyName); + RtlCopyUnicodeString(&FullPath, KeyName); - if (Info->ValueName && Info->ValueName->Length > 0) { - if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') { - RtlAppendUnicodeToString(&FullPath, L"\\"); + if (Info->ValueName && Info->ValueName->Length > 0) { + if (FullPath.Length > 0 && FullPath.Buffer[(FullPath.Length / sizeof(WCHAR)) - 1] != L'\\') { + RtlAppendUnicodeToString(&FullPath, L"\\"); + } + RtlAppendUnicodeStringToString(&FullPath, Info->ValueName); } - RtlAppendUnicodeStringToString(&FullPath, Info->ValueName); - } - if (CheckRegistryRule(&FullPath)) { - HANDLE Pid = PsGetCurrentProcessId(); - if (!IsProcessTrusted(Pid)) { - SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length); - status = STATUS_ACCESS_DENIED; + if (CheckRegistryRule(&FullPath)) { + HANDLE Pid = PsGetCurrentProcessId(); + if (!IsProcessTrusted(Pid)) { + SendMessageToUser(3001, (ULONG)(ULONG_PTR)Pid, FullPath.Buffer, FullPath.Length); + status = STATUS_ACCESS_DENIED; + } } + PyasFree(Buffer); } - PyasFree(Buffer); } } CmCallbackReleaseKeyObjectIDEx(KeyName); diff --git a/Plugins/Filter/ProtectRules.cpp b/Plugins/Filter/ProtectRules.cpp index e1232b6..341490f 100644 --- a/Plugins/Filter/ProtectRules.cpp +++ b/Plugins/Filter/ProtectRules.cpp @@ -101,9 +101,10 @@ static BOOLEAN HasSuffix(PCUNICODE_STRING String, PCWSTR Suffix) { BOOLEAN WildcardMatch(PCWSTR Pattern, PCWSTR String, USHORT StringLengthBytes) { if (!Pattern || !String) return FALSE; + USHORT StringLenChars = StringLengthBytes / sizeof(WCHAR); PCWSTR mp = NULL; PCWSTR cp = NULL; - PCWSTR StringEnd = (PCWSTR)((PUCHAR)String + StringLengthBytes); + PCWSTR StringEnd = String + StringLenChars; while (String < StringEnd) { if (*Pattern == L'*') { @@ -248,6 +249,18 @@ static VOID ParseAndLoadRules(PCHAR JsonContent, ULONG ContentLength, PCSTR KeyN } } +VOID InitializeRulesEngine() { + ExInitializeResourceLite(&RuleLock); + ExInitializeFastMutex(&TrustCacheLock); + RtlZeroMemory(TrustCache, sizeof(TrustCache)); + g_CacheInitialized = TRUE; +} + +VOID UninitializeRulesEngine() { + ExDeleteResourceLite(&RuleLock); + g_CacheInitialized = FALSE; +} + NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) { NTSTATUS status = STATUS_SUCCESS; HANDLE FileHandle = NULL; @@ -263,7 +276,6 @@ NTSTATUS LoadRulesFromDisk(PUNICODE_STRING RegistryPath) { UNICODE_STRING FinalPath = { 0 }; RtlInitUnicodeString(&ImagePathName, L"ImagePath"); - ExInitializeResourceLite(&RuleLock); InitializeObjectAttributes(&RegOa, RegistryPath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL); status = ZwOpenKey(&RegHandle, KEY_READ, &RegOa); @@ -395,7 +407,6 @@ VOID UnloadRules() { FreeList(&g_FileExceptionPaths); FreeList(&g_FileRansomExts); ExReleaseResourceLite(&RuleLock); - ExDeleteResourceLite(&RuleLock); } NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName) { @@ -412,13 +423,6 @@ NTSTATUS GetProcessImageName(HANDLE ProcessId, PUNICODE_STRING* ImageName) { return status; } -static VOID InitTrustCache() { - if (g_CacheInitialized) return; - ExInitializeFastMutex(&TrustCacheLock); - RtlZeroMemory(TrustCache, sizeof(TrustCache)); - g_CacheInitialized = TRUE; -} - static BOOLEAN IsWindowsSystemApp(PCWSTR Buffer, USHORT Length) { if (WildcardMatch(L"*\\Windows\\SystemApps\\*", Buffer, Length)) return TRUE; if (WildcardMatch(L"*\\Windows\\ImmersiveControlPanel\\*", Buffer, Length)) return TRUE; @@ -452,9 +456,6 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) { } ExReleaseFastMutex(&TrustCacheLock); } - else { - InitTrustCache(); - } PUNICODE_STRING imageFileName = NULL; NTSTATUS status = GetProcessImageName(ProcessId, &imageFileName);