From c859a6df99a65b9a728f986c4b29fd27bea2a6fd Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Sat, 11 Oct 2014 13:15:10 +0000 Subject: [PATCH 1/1] [NTOS:KE] - Implement KiRaiseSecurityCheckFailure[Handler] to handle int 0x29 (__fastfail). Based on patch by Timo Kreuzer. (Yes, this is a Windows 8 feature. However all it does is improve the debugging experience, and we have a need for that) CORE-8419 svn path=/trunk/; revision=64665 --- reactos/include/reactos/mc/bugcodes.mc | 14 +++++++-- reactos/ntoskrnl/ke/i386/trap.s | 7 +++-- reactos/ntoskrnl/ke/i386/traphdlr.c | 40 ++++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 5 deletions(-) diff --git a/reactos/include/reactos/mc/bugcodes.mc b/reactos/include/reactos/mc/bugcodes.mc index 5278321235d..d9ae74ffd43 100644 --- a/reactos/include/reactos/mc/bugcodes.mc +++ b/reactos/include/reactos/mc/bugcodes.mc @@ -1128,7 +1128,7 @@ Language=English Run a system diagnostic utility supplied by your hardware manufacturer. In particular, run a memory check, and check for faulty or mismatched memory. Try changing video adapters. - + Disable or remove any newly installed hardware and drivers. Disable or remove any newly installed software. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select @@ -1322,7 +1322,7 @@ Facility=System SymbolicName=DRIVER_CORRUPTED_EXPOOL Language=English A device driver has pool. - + Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any ReactOS updates you might need. @@ -1478,7 +1478,7 @@ If Parameter1 == 0, an executive worker item was found in memory which must not contain such items. Usually this is memory being freed. This is usually caused by a device driver that has not cleaned up properly before freeing memory. - + If Parameter1 == 1, an attempt was made to queue an executive worker item with a usermode execution routine. . @@ -1570,3 +1570,11 @@ SymbolicName=ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY Language=English An attempt was made to execute to non-executable memory. . + +MessageId=0x139 +Severity=Success +Facility=System +SymbolicName=KERNEL_SECURITY_CHECK_FAILURE +Language=English +A critical kernel security check failed. +. diff --git a/reactos/ntoskrnl/ke/i386/trap.s b/reactos/ntoskrnl/ke/i386/trap.s index 733451d7db3..d8533be0f6f 100644 --- a/reactos/ntoskrnl/ke/i386/trap.s +++ b/reactos/ntoskrnl/ke/i386/trap.s @@ -59,9 +59,11 @@ idt _KiTrap10, INT_32_DPL0 /* INT 10: x87 FPU Error (#MF) */ idt _KiTrap11, INT_32_DPL0 /* INT 11: Align Check Exception (#AC) */ idt _KiTrap0F, INT_32_DPL0 /* INT 12: Machine Check Exception (#MC)*/ idt _KiTrap0F, INT_32_DPL0 /* INT 13: SIMD FPU Exception (#XF) */ -REPEAT 22 -idt _KiTrap0F, INT_32_DPL0 /* INT 14-29: UNDEFINED INTERRUPTS */ +REPEAT 21 +idt _KiTrap0F, INT_32_DPL0 /* INT 14-28: UNDEFINED INTERRUPTS */ ENDR +idt _KiRaiseSecurityCheckFailure, INT_32_DPL3 + /* INT 29: Handler for __fastfail */ idt _KiGetTickCount, INT_32_DPL3 /* INT 2A: Get Tick Count Handler */ idt _KiCallbackReturn, INT_32_DPL3 /* INT 2B: User-Mode Callback Return */ idt _KiRaiseAssertion, INT_32_DPL3 /* INT 2C: Debug Assertion Handler */ @@ -113,6 +115,7 @@ TRAP_ENTRY KiTrap0F, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiTrap10, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiTrap11, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiTrap13, KI_PUSH_FAKE_ERROR_CODE +TRAP_ENTRY KiRaiseSecurityCheckFailure, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiGetTickCount, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiCallbackReturn, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiRaiseAssertion, KI_PUSH_FAKE_ERROR_CODE diff --git a/reactos/ntoskrnl/ke/i386/traphdlr.c b/reactos/ntoskrnl/ke/i386/traphdlr.c index 1341c82d4d0..80ab6374c91 100644 --- a/reactos/ntoskrnl/ke/i386/traphdlr.c +++ b/reactos/ntoskrnl/ke/i386/traphdlr.c @@ -1460,6 +1460,46 @@ KiTrap13Handler(IN PKTRAP_FRAME TrapFrame) /* SOFTWARE SERVICES **********************************************************/ +VOID +FASTCALL +KiRaiseSecurityCheckFailureHandler(IN PKTRAP_FRAME TrapFrame) +{ + /* Save trap frame */ + KiEnterTrap(TrapFrame); + + /* Decrement EIP to point to the INT29 instruction (2 bytes, not 1 like INT3) */ + TrapFrame->Eip -= 2; + + /* Check if this is a user trap */ + if (KiUserTrap(TrapFrame)) + { + /* Dispatch exception to user mode */ + KiDispatchException1Args(STATUS_STACK_BUFFER_OVERRUN, + TrapFrame->Eip, + TrapFrame->Ecx, + TrapFrame); + } + else + { + EXCEPTION_RECORD ExceptionRecord; + + /* Bugcheck the system */ + ExceptionRecord.ExceptionCode = STATUS_STACK_BUFFER_OVERRUN; + ExceptionRecord.ExceptionFlags = EXCEPTION_NONCONTINUABLE; + ExceptionRecord.ExceptionRecord = NULL; + ExceptionRecord.ExceptionAddress = (PVOID)TrapFrame->Eip; + ExceptionRecord.NumberParameters = 1; + ExceptionRecord.ExceptionInformation[0] = TrapFrame->Ecx; + + KeBugCheckWithTf(KERNEL_SECURITY_CHECK_FAILURE, + TrapFrame->Ecx, + (ULONG_PTR)TrapFrame, + (ULONG_PTR)&ExceptionRecord, + 0, + TrapFrame); + } +} + VOID FASTCALL KiGetTickCountHandler(IN PKTRAP_FRAME TrapFrame) -- 2.17.1