Skip to content

Commit 42b7a92

Browse files
hugsyhugsy
authored
[CFB::Driver] Fix null input data bug (#30)
 * restored old behavior for data capture * fix str <-> wstr issue in utils * added screenshot to readme
1 parent 792252f commit 42b7a92

File tree

7 files changed

+189
-181
lines changed

7 files changed

+189
-181
lines changed

‎Broker/Source/Connectors/JsonQueue.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,19 +24,20 @@ JsonQueue::Name() const
2424
Result<u32>
2525
JsonQueue::IrpCallback(CFB::Comms::CapturedIrp const& Irp)
2626
{
27+
std::scoped_lock(m_Lock);
2728
m_Queue.push(std::make_unique<CFB::Comms::CapturedIrp>(Irp));
2829
return Ok(0);
2930
}
3031

3132
std::unique_ptr<CFB::Comms::CapturedIrp>
3233
JsonQueue::Pop()
3334
{
35+
std::scoped_lock(m_Lock);
3436
if ( m_Queue.empty() )
3537
{
3638
return nullptr;
3739
}
3840

39-
std::scoped_lock(m_Lock);
4041
auto Irp = std::move(m_Queue.front());
4142
m_Queue.pop();
4243

‎Broker/Source/DriverManager.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -304,15 +304,15 @@ DriverManager::ExecuteCommand(json const& Request)
304304
break;
305305
}
306306

307-
if ( RequestId != CFB::Comms::RequestId::GetPendingIrp )
307+
// if ( RequestId != CFB::Comms::RequestId::GetPendingIrp )
308308
{
309309
info(
310310
"Request[%llu] %s => %s",
311311
m_RequestNumber,
312312
CFB::Utils::ToString(RequestId).c_str(),
313313
boolstr(Response["success"]));
314314

315-
dbg("Request[%llu] => %s", m_RequestNumber, Response.dump().c_str());
315+
info("Request[%llu] => %s", m_RequestNumber, Response.dump().c_str());
316316
}
317317

318318
return Ok(Response);

‎Common/Source/Utils.cpp

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -173,40 +173,40 @@ IrqlToString(u32 type)
173173
#ifdef CFB_KERNEL_DRIVER
174174
#else
175175
std::string
176-
ToString(std::wstring const& WideString)
176+
ToString(std::wstring const& wide_string)
177177
{
178-
// auto converter = std::wstring_convert<std::codecvt_utf8<wchar_t> >();
179-
// return converter.to_bytes(input);
178+
int size_needed =
179+
::WideCharToMultiByte(CP_UTF8, 0, wide_string.data(), (int)wide_string.size(), nullptr, 0, nullptr, nullptr);
180180

181-
// HACK improve
182-
std::string s;
183-
std::for_each(
184-
WideString.cbegin(),
185-
WideString.cend(),
186-
[&s](auto c)
187-
{
188-
s += (char)c;
189-
});
190-
return s;
181+
std::string str(size_needed, 0);
182+
183+
if ( 0 == ::WideCharToMultiByte(
184+
CP_UTF8,
185+
0,
186+
wide_string.data(),
187+
(int)wide_string.size(),
188+
str.data(),
189+
(int)str.size(),
190+
nullptr,
191+
nullptr) )
192+
{
193+
str.clear();
194+
}
195+
return str;
191196
}
192197

193198
std::wstring
194-
ToWideString(std::string const& String)
199+
ToWideString(std::string const& str)
195200
{
196-
// auto converter = std::wstring_convert<std::codecvt_utf8<wchar_t> >();
197-
// return converter.from_bytes(input);
201+
int size_needed = ::MultiByteToWideChar(CP_UTF8, 0, str.data(), (int)str.size(), nullptr, 0);
198202

199-
// HACK improve
203+
std::wstring wstr(size_needed, 0);
200204

201-
std::wstring s;
202-
std::for_each(
203-
String.cbegin(),
204-
String.cend(),
205-
[&s](auto c)
206-
{
207-
s += (wchar_t)c;
208-
});
209-
return s;
205+
if ( 0 == ::MultiByteToWideChar(CP_UTF8, 0, str.data(), (int)str.size(), wstr.data(), (int)wstr.size()) )
206+
{
207+
wstr.clear();
208+
}
209+
return wstr;
210210
}
211211

212212
std::string

‎Driver/Headers/Context.hpp

Lines changed: 96 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,96 +1,96 @@
1-
#pragma once
2-
3-
// clang-format off
4-
#include "Common.hpp"
5-
#include "DriverUtils.hpp"
6-
#include "Log.hpp"
7-
8-
#include "CapturedIrpManager.hpp"
9-
#include "HookedDriverManager.hpp"
10-
// clang-format on
11-
12-
13-
#define CFB_MAX_HEXDUMP_BYTE 128
14-
15-
namespace Driver = CFB::Driver;
16-
namespace Utils = CFB::Driver::Utils;
17-
18-
struct GlobalContext
19-
{
20-
///
21-
/// @brief Any critical read/write operation to the global context structure must acquire this lock.
22-
///
23-
Utils::KQueuedSpinLock ContextLock;
24-
25-
///
26-
/// @brief A pointer to the device object
27-
///
28-
PDRIVER_OBJECT DriverObject;
29-
30-
///
31-
/// @brief A pointer to the device object
32-
///
33-
PDEVICE_OBJECT DeviceObject;
34-
35-
///
36-
/// @brief A pointer to the EPROCESS of the broker. Not more than one handle to the
37-
/// device is allowed.
38-
///
39-
PEPROCESS Owner;
40-
41-
///
42-
/// @brief Incremental session ID number.
43-
///
44-
ULONG SessionId;
45-
46-
///
47-
/// @brief Manages the hooked drivers
48-
///
49-
Driver::HookedDriverManager DriverManager;
50-
51-
///
52-
/// @brief Where all the intercepted IRPs are stored
53-
///
54-
Driver::CapturedIrpManager IrpManager;
55-
56-
57-
GlobalContext() : DriverObject {nullptr}, DeviceObject {nullptr}, Owner {nullptr}, ContextLock {}, SessionId(-1)
58-
{
59-
dbg("Creating GlobalContext");
60-
}
61-
62-
63-
~GlobalContext()
64-
{
65-
dbg("Destroying GlobalContext");
66-
DriverObject = nullptr;
67-
DeviceObject = nullptr;
68-
Owner = nullptr;
69-
}
70-
71-
static void*
72-
operator new(usize sz)
73-
{
74-
void* Memory = ::ExAllocatePoolWithTag(NonPagedPoolNx, sz, CFB_DEVICE_TAG);
75-
if ( Memory )
76-
{
77-
dbg("Allocated GlobalContext at %p", Memory);
78-
::RtlSecureZeroMemory(Memory, sz);
79-
}
80-
return Memory;
81-
}
82-
83-
static void
84-
operator delete(void* m)
85-
{
86-
dbg("Deallocating GlobalContext");
87-
::ExFreePoolWithTag(m, CFB_DEVICE_TAG);
88-
m = nullptr;
89-
return;
90-
}
91-
};
92-
93-
///
94-
/// @brief Reference to the global driver context.
95-
///
96-
extern struct GlobalContext* Globals;
1+
#pragma once
2+
3+
// clang-format off
4+
#include "Common.hpp"
5+
#include "DriverUtils.hpp"
6+
#include "Log.hpp"
7+
8+
#include "CapturedIrpManager.hpp"
9+
#include "HookedDriverManager.hpp"
10+
// clang-format on
11+
12+
13+
#define CFB_MAX_HEXDUMP_BYTE 64
14+
15+
namespace Driver = CFB::Driver;
16+
namespace Utils = CFB::Driver::Utils;
17+
18+
struct GlobalContext
19+
{
20+
///
21+
/// @brief Any critical read/write operation to the global context structure must acquire this lock.
22+
///
23+
Utils::KQueuedSpinLock ContextLock;
24+
25+
///
26+
/// @brief A pointer to the device object
27+
///
28+
PDRIVER_OBJECT DriverObject;
29+
30+
///
31+
/// @brief A pointer to the device object
32+
///
33+
PDEVICE_OBJECT DeviceObject;
34+
35+
///
36+
/// @brief A pointer to the EPROCESS of the broker. Not more than one handle to the
37+
/// device is allowed.
38+
///
39+
PEPROCESS Owner;
40+
41+
///
42+
/// @brief Incremental session ID number.
43+
///
44+
ULONG SessionId;
45+
46+
///
47+
/// @brief Manages the hooked drivers
48+
///
49+
Driver::HookedDriverManager DriverManager;
50+
51+
///
52+
/// @brief Where all the intercepted IRPs are stored
53+
///
54+
Driver::CapturedIrpManager IrpManager;
55+
56+
57+
GlobalContext() : DriverObject {nullptr}, DeviceObject {nullptr}, Owner {nullptr}, ContextLock {}, SessionId(-1)
58+
{
59+
dbg("Creating GlobalContext");
60+
}
61+
62+
63+
~GlobalContext()
64+
{
65+
dbg("Destroying GlobalContext");
66+
DriverObject = nullptr;
67+
DeviceObject = nullptr;
68+
Owner = nullptr;
69+
}
70+
71+
static void*
72+
operator new(usize sz)
73+
{
74+
void* Memory = ::ExAllocatePoolWithTag(NonPagedPoolNx, sz, CFB_DEVICE_TAG);
75+
if ( Memory )
76+
{
77+
dbg("Allocated GlobalContext at %p", Memory);
78+
::RtlSecureZeroMemory(Memory, sz);
79+
}
80+
return Memory;
81+
}
82+
83+
static void
84+
operator delete(void* m)
85+
{
86+
dbg("Deallocating GlobalContext");
87+
::ExFreePoolWithTag(m, CFB_DEVICE_TAG);
88+
m = nullptr;
89+
return;
90+
}
91+
};
92+
93+
///
94+
/// @brief Reference to the global driver context.
95+
///
96+
extern struct GlobalContext* Globals;

0 commit comments

Comments
 (0)