-
-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Added /RemoveStreams command to remove any extra alternate data streams. - Adjusted thread local storage to use non-Microsoft syntax. - Removed redundant 'ERROR:' qualifier in some output strings.
- Loading branch information
1 parent
166c151
commit 2d63ee7
Showing
15 changed files
with
163 additions
and
16 deletions.
There are no files selected for viewing
Binary file not shown.
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,76 @@ | ||
#include "OperationRemoveStreams.h" | ||
#include "InputOutput.h" | ||
#include "Functions.h" | ||
|
||
ClassFactory<OperationRemoveStreams> OperationRemoveStreams::RegisteredFactory(GetCommand()); | ||
|
||
OperationRemoveStreams::OperationRemoveStreams(std::queue<std::wstring>& oArgList, const std::wstring& sCommand) : Operation(oArgList) | ||
{ | ||
|
||
// load function pointer to query file information | ||
HMODULE hModule = GetModuleHandle(L"ntdll.dll"); | ||
if (hModule == NULL || (NtQueryInformationFile = (decltype(NtQueryInformationFile)) | ||
GetProcAddress(hModule, "NtQueryInformationFile")) == NULL) | ||
{ | ||
wprintf(L"ERROR: Unable to obtain function pointer in parameter '%s'.\n", GetCommand().c_str()); | ||
exit(-1); | ||
} | ||
|
||
// only flag this to apply to the core object with the file name | ||
AppliesToObject = true; | ||
} | ||
|
||
void OperationRemoveStreams::ProcessObjectAction(ObjectEntry& tObjectEntry) | ||
{ | ||
HANDLE hFile = CreateFile(tObjectEntry.Name.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE, | ||
NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL); | ||
if (hFile == INVALID_HANDLE_VALUE) | ||
{ | ||
InputOutput::AddError(L"Unable open file for stream deletion."); | ||
return; | ||
} | ||
|
||
// loop until we can fill the stream into a buffer | ||
NTSTATUS iStatus; | ||
thread_local std::vector<BYTE> sInfoBuffer(16 * 1024, 0); | ||
for (iStatus = STATUS_BUFFER_OVERFLOW; iStatus == STATUS_BUFFER_OVERFLOW; | ||
sInfoBuffer.resize(sInfoBuffer.size() * 2, 0)) | ||
{ | ||
IO_STATUS_BLOCK tIOStatus = {}; | ||
iStatus = NtQueryInformationFile(hFile, &tIOStatus, sInfoBuffer.data(), (ULONG) sInfoBuffer.size(), FileStreamInformation); | ||
if (iStatus == STATUS_SUCCESS) break; | ||
} | ||
|
||
// cleanup and verify we got the data we needed | ||
CloseHandle(hFile); | ||
if (iStatus != STATUS_SUCCESS) return; | ||
|
||
// Loop for all streams | ||
for (PFILE_STREAM_INFORMATION pStreamInfo = (PFILE_STREAM_INFORMATION)sInfoBuffer.data(); pStreamInfo->StreamNameLength != 0; | ||
pStreamInfo = (PFILE_STREAM_INFORMATION)((LPBYTE)pStreamInfo + pStreamInfo->NextEntryOffset)) | ||
{ | ||
// skip main data stream | ||
const WCHAR sData[] = L"::$DATA"; | ||
if (_countof(sData) - 1 == pStreamInfo->StreamNameLength / sizeof(WCHAR) && | ||
_wcsnicmp(pStreamInfo->StreamName, sData, _countof(sData) - 1) == 0) | ||
{ | ||
if (pStreamInfo->NextEntryOffset == 0) break; | ||
continue; | ||
} | ||
|
||
// remove the stream | ||
std::wstring sStream((const wchar_t *) pStreamInfo->StreamName, (size_t) (pStreamInfo->StreamNameLength / sizeof(WCHAR))); | ||
std::wstring sFullStreamName = (tObjectEntry.Name + sStream); | ||
if (InputOutput::InWhatIfMode() || (SetFileAttributes(sFullStreamName.c_str(), FILE_ATTRIBUTE_NORMAL) != 0 && DeleteFile(sFullStreamName.c_str()) != 0)) | ||
{ | ||
InputOutput::AddInfo(L"Removed stream: " + sStream, L""); | ||
} | ||
else | ||
{ | ||
InputOutput::AddError(L"Unable delete stream: " + sStream); | ||
} | ||
|
||
// break if no next stream | ||
if (pStreamInfo->NextEntryOffset == 0) break; | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
#pragma once | ||
|
||
#define UMDF_USING_NTSTATUS | ||
#include <ntstatus.h> | ||
|
||
#include <regex> | ||
|
||
#include "Operation.h" | ||
|
||
class OperationRemoveStreams : public Operation | ||
{ | ||
private: | ||
|
||
// statics used by command registration utility | ||
static std::wstring GetCommand() { return L"RemoveStreams"; } | ||
static ClassFactory<OperationRemoveStreams> RegisteredFactory; | ||
|
||
// | ||
// Definitions below avoid need to install Windows Driver Development Kit | ||
// | ||
|
||
typedef struct _IO_STATUS_BLOCK { | ||
union { | ||
NTSTATUS Status; | ||
PVOID Pointer; | ||
}; | ||
ULONG_PTR Information; | ||
} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK; | ||
|
||
typedef enum _FILE_INFORMATION_CLASS { | ||
FileStreamInformation = 22 | ||
} FILE_INFORMATION_CLASS, * PFILE_INFORMATION_CLASS; | ||
|
||
#pragma pack(push, 4) | ||
typedef struct _FILE_STREAM_INFORMATION { // Information Class 22 | ||
ULONG NextEntryOffset; | ||
ULONG StreamNameLength; | ||
LARGE_INTEGER EndOfStream; | ||
LARGE_INTEGER AllocationSize; | ||
WCHAR StreamName[1]; | ||
} FILE_STREAM_INFORMATION, * PFILE_STREAM_INFORMATION; | ||
#pragma pack(pop) | ||
|
||
typedef NTSTATUS(NTAPI* NTQUERYINFORMATIONFILE)( | ||
IN HANDLE FileHandle, | ||
OUT PIO_STATUS_BLOCK IoStatusBlock, | ||
OUT PVOID FileInformation, | ||
IN ULONG Length, | ||
IN FILE_INFORMATION_CLASS FileInformationClass); | ||
|
||
NTQUERYINFORMATIONFILE NtQueryInformationFile; | ||
|
||
public: | ||
|
||
// overrides | ||
void ProcessObjectAction(ObjectEntry & tObjectEntry) override; | ||
|
||
// constructors | ||
OperationRemoveStreams(std::queue<std::wstring> & oArgList, const std::wstring & sCommand); | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters