Windows2003-3790/sdktools/kverify/regutil.cxx
2020-09-30 16:53:55 +02:00

1197 lines
30 KiB
C++

//
// Enable driver verifier support for ntoskrnl
// Copyright (c) Microsoft Corporation, 1999
//
//
// module: regutil.cxx
// author: DMihai
// created: 04/19/99
// description: registry keys manipulation routines
//
extern "C" {
#include "nt.h"
#include "ntrtl.h"
#include "nturtl.h"
}
#include <windows.h>
#include <tchar.h>
#include <stdlib.h>
#include "ResId.hxx"
#include "RegUtil.hxx"
#include "GenUtil.hxx"
#define VRF_MAX_DRIVER_STRING_LENGTH 4196
#define LEVEL2_IO_VERIFIER_ENABLED_VALUE 3
//////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////// Registry Strings
//////////////////////////////////////////////////////////////////////
LPCTSTR RegMemoryManagementKeyName =
TEXT ("System\\CurrentControlSet\\Control\\Session Manager\\Memory Management");
LPCTSTR RegVerifyDriversValueName =
TEXT ("VerifyDrivers");
LPCTSTR RegVerifyDriverLevelValueName =
TEXT ("VerifyDriverLevel");
LPCTSTR RegIOVerifyKeyName =
TEXT ("System\\CurrentControlSet\\Control\\Session Manager\\I/O System");
LPCTSTR RegIOVerifySubKeyName =
TEXT ("I/O System");
LPCTSTR RegIOVerifyLevelValueName =
TEXT ("IoVerifierLevel");
LPCTSTR RegSessionManagerKeyName =
TEXT ("System\\CurrentControlSet\\Control\\Session Manager");
//////////////////////////////////////////////////////////////////////
/////////////// Forward decl for local registry manipulation functions
//////////////////////////////////////////////////////////////////////
BOOL
ReadRegistryValue (
HKEY HKey,
LPCTSTR Name,
DWORD * Value);
BOOL
WriteRegistryValue (
HKEY MmKey,
LPCTSTR Name,
DWORD Value);
BOOL
ReadMmString (
HKEY MmKey,
LPCTSTR Name,
LPTSTR Value);
BOOL
WriteMmString (
HKEY MmKey,
LPCTSTR Name,
LPTSTR Value);
//////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////// Public functions
//////////////////////////////////////////////////////////////////////
void
WriteVerifierKeys(
BOOL bEnableKrnVerifier,
DWORD dwNewVerifierFlags,
DWORD dwNewIoLevel,
TCHAR *strKernelModuleName )
{
HKEY MmKey = NULL;
DWORD dwExitCode;
DWORD dwCrtFlags;
DWORD dwCrtIoLevel;
BOOL bMustAppendName;
BOOL bAlreadyInRegistry;
LONG lOpenResult;
int nKernelModuleNameLen;
int nStringLen;
TCHAR *pstrCrtNameMatch, *pstrSubstring, *pCrtChar;
TCHAR strVrfDriver [VRF_MAX_DRIVER_STRING_LENGTH];
TCHAR strVrfDriverNew [VRF_MAX_DRIVER_STRING_LENGTH];
dwExitCode = EXIT_CODE_NOTHING_CHANGED;
//
// Open the Mm key
//
lOpenResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegMemoryManagementKeyName,
0,
KEY_QUERY_VALUE | KEY_WRITE,
&MmKey);
if (lOpenResult != ERROR_SUCCESS)
{
//
// fatal error
//
dwExitCode = EXIT_CODE_ERROR;
if( lOpenResult == ERROR_ACCESS_DENIED )
{
DisplayMessage( IDS_ACCESS_IS_DENIED );
}
else
{
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegMemoryManagementKeyName,
(DWORD)lOpenResult);
}
}
if( dwExitCode != EXIT_CODE_ERROR != 0 )
{
//
// the IO verifier will be enabled
//
if( dwNewIoLevel != 2 )
{
//
// only levels 1 & 2 are supported
//
dwNewIoLevel = 1;
}
//
// get the current IO level
//
if( GetIoVerificationLevel( &dwCrtIoLevel ) == FALSE )
{
//
// fatal error
//
dwExitCode = EXIT_CODE_ERROR;
}
}
if( dwExitCode != EXIT_CODE_ERROR )
{
if( ReadRegistryValue( MmKey, RegVerifyDriverLevelValueName, &dwCrtFlags ) == FALSE )
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
if( dwNewVerifierFlags != -1 )
{
//
// have some new flags
//
//
// modify the flags in registry
//
if( dwCrtFlags != dwNewVerifierFlags )
{
if( WriteRegistryValue( MmKey, RegVerifyDriverLevelValueName, dwNewVerifierFlags ) == FALSE )
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
dwExitCode = EXIT_CODE_REBOOT;
}
}
if( dwExitCode != EXIT_CODE_ERROR )
{
if( ( dwNewVerifierFlags & DRIVER_VERIFIER_IO_CHECKING ) == 0 )
{
//
// IO verification is not enabled - disable "level 2" value too
//
dwNewIoLevel = 1;
}
//
// the IO verifier will be enabled
//
if( dwCrtIoLevel != dwNewIoLevel )
{
//
// need to switch the IO verification level
//
if( SwitchIoVerificationLevel( dwNewIoLevel ) == TRUE )
{
dwExitCode = EXIT_CODE_REBOOT;
}
else
{
dwExitCode = EXIT_CODE_ERROR;
}
}
}
}
}
if( dwExitCode != EXIT_CODE_ERROR && bEnableKrnVerifier )
{
//
// enable verifier for the kernel
//
if( ReadMmString (MmKey, RegVerifyDriversValueName, strVrfDriver) == FALSE)
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
bAlreadyInRegistry = IsModuleNameAlreadyInRegistry(
strKernelModuleName,
strVrfDriver );
if( bAlreadyInRegistry == FALSE )
{
_tcscpy( strVrfDriverNew, strKernelModuleName );
if( strVrfDriver[ 0 ] != (TCHAR)0 )
{
if( strVrfDriver[ 0 ] != _T( ' ' ) &&
strVrfDriver[ 0 ] != _T( '\t' ) )
{
//
// add a space first
//
_tcscat( strVrfDriverNew, _T( " " ) );
}
//
// add the old verified drivers at the end
//
_tcscat( strVrfDriverNew, strVrfDriver );
}
//
// write the value
//
if (WriteMmString (MmKey, RegVerifyDriversValueName, strVrfDriverNew) == FALSE)
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
dwExitCode = EXIT_CODE_REBOOT;
}
}
}
}
RegCloseKey (MmKey);
}
if( EXIT_CODE_REBOOT == dwExitCode )
{
DisplayMessage( IDS_MUST_REBOOT );
}
else
{
if( EXIT_CODE_NOTHING_CHANGED == dwExitCode )
{
DisplayMessage( IDS_NOTHING_CHANGED );
}
}
exit( dwExitCode );
}
///////////////////////////////////////////////////////////////////
void
RemoveModuleNameFromRegistry(
TCHAR *strKernelModuleName )
{
HKEY MmKey = NULL;
DWORD dwExitCode;
LONG lOpenResult;
int nKernelModuleNameLen;
int nStringLen;
int nLeftToCopy;
TCHAR *pstrCrtNameMatch, *pstrSubstring;
TCHAR strVrfDriver [VRF_MAX_DRIVER_STRING_LENGTH];
TCHAR strVrfDriverNew [VRF_MAX_DRIVER_STRING_LENGTH];
dwExitCode = EXIT_CODE_NOTHING_CHANGED;
//
// Open the Mm key
//
lOpenResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegMemoryManagementKeyName,
0,
KEY_QUERY_VALUE | KEY_WRITE,
&MmKey);
if (lOpenResult != ERROR_SUCCESS)
{
dwExitCode = EXIT_CODE_ERROR;
if( lOpenResult == ERROR_ACCESS_DENIED )
{
DisplayMessage( IDS_ACCESS_IS_DENIED );
}
else
{
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegMemoryManagementKeyName,
(DWORD)lOpenResult);
}
}
else
{
if( ReadMmString (MmKey, RegVerifyDriversValueName, strVrfDriver) == FALSE)
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
pstrCrtNameMatch = strVrfDriver;
do
{
pstrSubstring = _tcsstr( pstrCrtNameMatch, strKernelModuleName );
if( pstrSubstring != NULL )
{
//
// the name seems to be there
//
nKernelModuleNameLen = _tcsclen( strKernelModuleName );
nStringLen = _tcsclen( pstrSubstring );
if( nStringLen > nKernelModuleNameLen &&
pstrSubstring[ nKernelModuleNameLen ] != _TEXT(' ') &&
pstrSubstring[ nKernelModuleNameLen ] != _TEXT('\t') )
{
//
// this is not our name, continue searching
//
pstrCrtNameMatch += nKernelModuleNameLen;
}
else
{
if( pstrSubstring != &strVrfDriver[ 0 ] &&
(* (pstrSubstring - 1) ) != _TEXT(' ') &&
(* (pstrSubstring - 1) ) != _TEXT('\t') )
{
//
// this is not our name, continue searching
//
pstrCrtNameMatch += min( nKernelModuleNameLen, nStringLen );
}
else
{
//
// kernel's module name is in the registry
//
strVrfDriverNew[0] = (TCHAR)0;
_tcsncat(
strVrfDriverNew,
strVrfDriver,
(size_t)(pstrSubstring - &strVrfDriver[0]) );
nLeftToCopy = nStringLen - nKernelModuleNameLen;
pstrSubstring += nKernelModuleNameLen;
while( nLeftToCopy > 0 )
{
if( *pstrSubstring != _TEXT( ' ' ) &&
*pstrSubstring != _TEXT( '\t' ) )
{
//
// append what starts from here
//
_tcscat( strVrfDriverNew, pstrSubstring );
break;
}
else
{
//
// skip spaces
//
pstrSubstring ++;
nLeftToCopy --;
}
}
//
// write the new value to the registry
//
if (WriteMmString (MmKey, RegVerifyDriversValueName, strVrfDriverNew) == FALSE)
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
dwExitCode = EXIT_CODE_REBOOT;
}
break;
}
}
}
}
while( pstrSubstring != NULL );
}
RegCloseKey (MmKey);
}
if( EXIT_CODE_REBOOT == dwExitCode )
{
DisplayMessage( IDS_MUST_REBOOT );
}
else
{
if( EXIT_CODE_NOTHING_CHANGED == dwExitCode )
{
DisplayMessage( IDS_NOTHING_CHANGED );
}
}
exit( dwExitCode );
}
//////////////////////////////////////////////////
void
DumpStatusFromRegistry(
LPCTSTR strKernelModuleName )
{
HKEY MmKey = NULL;
DWORD dwExitCode;
LONG lOpenResult;
DWORD dwCrtFlags;
DWORD dwIoLevel;
int nKernelModuleNameLen;
int nStringLen;
BOOL bKernelVerified;
BOOL bIsModuleNameRegistry;
TCHAR *pstrCrtNameMatch, *pstrSubstring, *pCrtChar;
TCHAR strVrfDriver [VRF_MAX_DRIVER_STRING_LENGTH];
dwExitCode = EXIT_CODE_NOTHING_CHANGED;
bKernelVerified = FALSE;
//
// Open the Mm key
//
lOpenResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegMemoryManagementKeyName,
0,
KEY_QUERY_VALUE,
&MmKey);
if (lOpenResult != ERROR_SUCCESS)
{
dwExitCode = EXIT_CODE_ERROR;
if( lOpenResult == ERROR_ACCESS_DENIED )
{
DisplayMessage( IDS_ACCESS_IS_DENIED );
}
else
{
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegMemoryManagementKeyName,
(DWORD)lOpenResult);
}
}
else
{
if( ReadMmString (MmKey, RegVerifyDriversValueName, strVrfDriver) == FALSE)
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
bIsModuleNameRegistry = IsModuleNameAlreadyInRegistry(
strKernelModuleName,
strVrfDriver );
if( bIsModuleNameRegistry == TRUE )
{
//
// we have 'ntoskrnl.exe' in the registry
//
//
// read the verification flags
//
if( ReadRegistryValue( MmKey, RegVerifyDriverLevelValueName, &dwCrtFlags ) == FALSE )
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
bKernelVerified = TRUE;
if( dwCrtFlags != -1 )
{
if( ( dwCrtFlags & DRIVER_VERIFIER_IO_CHECKING ) != 0 )
{
//
// the IO verification is enabled, check the IO verification level ( 1 or 2 )
//
if( GetIoVerificationLevel( &dwIoLevel ) == FALSE )
{
dwExitCode = EXIT_CODE_ERROR;
}
else
{
if( dwIoLevel != 2 )
{
//
// only levels 1 & 2 are supported
//
dwIoLevel = 1;
}
DisplayMessage(
IDS_VERIFIER_ENABLED_WITH_IO_FORMAT,
strKernelModuleName,
dwCrtFlags,
dwIoLevel );
}
}
else
{
//
// the IO verification is not enabled
//
DisplayMessage(
IDS_VERIFIER_ENABLED_FORMAT,
strKernelModuleName,
dwCrtFlags );
}
}
else
{
DisplayMessage(
IDS_VERIFIER_ENABLED_NOFLAGS_FORMAT,
strKernelModuleName );
}
}
}
if( EXIT_CODE_NOTHING_CHANGED == dwExitCode && ! bKernelVerified )
{
DisplayMessage(
IDS_VERIFIER_NOT_ENABLED_FORMAT,
strKernelModuleName );
}
}
RegCloseKey (MmKey);
}
exit( dwExitCode );
}
//////////////////////////////////////////////////////////////////////
//////////////////////////////// Local registry manipulation functions
//////////////////////////////////////////////////////////////////////
BOOL
ReadRegistryValue (
HKEY HKey,
LPCTSTR Name,
DWORD * Value)
{
LONG Result;
DWORD Reserved;
DWORD Type;
DWORD Size;
//
// default value
//
*Value = -1;
Size = sizeof *Value;
Result = RegQueryValueEx (
HKey,
Name,
0,
&Type,
(LPBYTE)(Value),
&Size);
//
// Deal with a value that is not defined.
//
if (Result == ERROR_FILE_NOT_FOUND)
{
*Value = -1;
return TRUE;
}
if (Result != ERROR_SUCCESS)
{
DisplayMessage (
IDS_REGQUERYVALUEEX_FAILED,
Name,
(DWORD)Result);
return FALSE;
}
if (Type != REG_DWORD)
{
DisplayMessage (
IDS_REGQUERYVALUEEX_UNEXP_TYPE,
Name);
return FALSE;
}
if (Size != sizeof *Value)
{
DisplayMessage (
IDS_REGQUERYVALUEEX_UNEXP_SIZE,
Name);
return FALSE;
}
return TRUE;
}
BOOL
WriteRegistryValue (
HKEY HKey,
LPCTSTR Name,
DWORD Value)
{
LONG Result;
Result = RegSetValueEx (
HKey,
Name,
0,
REG_DWORD,
(LPBYTE)(&Value),
sizeof Value);
if (Result != ERROR_SUCCESS)
{
DisplayMessage (
IDS_REGSETVALUEEX_FAILED,
Name,
(DWORD)Result);
return FALSE;
}
return TRUE;
}
BOOL
ReadMmString (
HKEY MmKey,
LPCTSTR Name,
LPTSTR Value)
{
LONG Result;
DWORD Reserved;
DWORD Type;
DWORD Size;
//
// default value
//
*Value = 0;
Size = VRF_MAX_DRIVER_STRING_LENGTH;
Result = RegQueryValueEx (
MmKey,
Name,
0,
&Type,
(LPBYTE)(Value),
&Size);
//
// Deal with a value that is not defined.
//
if (Result == ERROR_FILE_NOT_FOUND)
{
*Value = 0;
return TRUE;
}
if (Result != ERROR_SUCCESS)
{
DisplayMessage (
IDS_REGQUERYVALUEEX_FAILED,
Name,
(DWORD)Result);
return FALSE;
}
if (Type != REG_SZ)
{
DisplayMessage (
IDS_REGQUERYVALUEEX_UNEXP_TYPE,
Name);
return FALSE;
}
return TRUE;
}
BOOL
WriteMmString (
HKEY MmKey,
LPCTSTR Name,
LPTSTR Value)
{
LONG Result;
DWORD Reserved;
DWORD Type;
DWORD Size;
Result = RegSetValueEx (
MmKey,
Name,
0,
REG_SZ,
(LPBYTE)(Value),
(_tcslen (Value) + 1) * sizeof (TCHAR));
if (Result != ERROR_SUCCESS)
{
DisplayMessage (
IDS_REGSETVALUEEX_FAILED,
Name,
(DWORD)Result);
return FALSE;
}
return TRUE;
}
//////////////////////////////////////////////////
BOOL
IsModuleNameAlreadyInRegistry(
LPCTSTR strKernelModuleName,
LPCTSTR strWholeString )
{
BOOL bAlreadyInRegistry;
int nKernelNameLength;
LPCTSTR strString;
LPCTSTR strSubstring;
TCHAR cBefore;
nKernelNameLength = _tcslen( strKernelModuleName );
//
// let's assume 'ntoskrnl.exe" is not already in the registry
//
bAlreadyInRegistry = FALSE;
//
// parse the string that's already in the registry
//
strString = strWholeString;
while( *strString != (TCHAR)0 )
{
strSubstring = _tcsstr( strString, strKernelModuleName );
if( strSubstring != NULL )
{
//
// the string from the registry includes "ntoskrnl.exe"
//
//
// let's assume it's nothing like "xyzntoskrnl.exe", "ntoskrnl.exexyz", etc.
//
bAlreadyInRegistry = TRUE;
//
// look for a character before the current substring
//
if( strSubstring > strWholeString )
{
//
// have at least one character before "ntoskrnl.exe" - look if it is blanc
//
cBefore = *( strSubstring - 1 );
if( cBefore != _T( ' ' ) && cBefore != _T( '\t' ) )
{
//
// the character before "ntoskrnl.exe" is non-blanc -> not the name we are searching for
//
bAlreadyInRegistry = FALSE;
}
}
//
// look for a character after the current substring
//
if( bAlreadyInRegistry == TRUE &&
strSubstring[ nKernelNameLength ] != (TCHAR)0 &&
strSubstring[ nKernelNameLength ] != _T( ' ' ) &&
strSubstring[ nKernelNameLength ] != _T( '\t' ) )
{
//
// have a non-blanc character after this substring -> not the name we are searching for
//
bAlreadyInRegistry = FALSE;
}
if( bAlreadyInRegistry == FALSE )
{
//
// this is not a real occurence of the name we are serching for, go further on
//
strString = strSubstring + 1;
}
if( bAlreadyInRegistry == TRUE )
{
//
// found it
//
break;
}
}
else
{
//
// the name is not there
//
break;
}
}
return bAlreadyInRegistry;
}
//////////////////////////////////////////////////
BOOL
GetIoVerificationLevel(
DWORD *pdwIoLevel )
{
LONG lResult;
HKEY IoKey = NULL;
DWORD dwCrtIoVerifLevel;
BOOL bFatalError;
bFatalError = FALSE;
//
// default value
//
*pdwIoLevel = 1;
//
// open the "I/O" key
//
lResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegIOVerifyKeyName,
0,
KEY_QUERY_VALUE,
&IoKey);
if (lResult != ERROR_SUCCESS)
{
//
// cannot open the IO key
//
if( lResult != ERROR_FILE_NOT_FOUND )
{
//
// the IO key is there, but we cannot open it
//
if( lResult == ERROR_ACCESS_DENIED )
{
DisplayMessage( IDS_ACCESS_IS_DENIED );
}
else
{
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegIOVerifyKeyName,
(DWORD)lResult);
}
bFatalError = TRUE;
}
// else - the IO key doesn't exist - use default value
}
else
{
//
// read "I/O System\IoVerifierLevel" value
//
if( ReadRegistryValue( IoKey, RegIOVerifyLevelValueName, &dwCrtIoVerifLevel ) )
{
if( LEVEL2_IO_VERIFIER_ENABLED_VALUE == dwCrtIoVerifLevel )
{
//
// we are at level 2 IO verification
//
*pdwIoLevel = 2;
}
}
RegCloseKey (IoKey);
}
return ( ! bFatalError );
}
//////////////////////////////////////////////////
BOOL
SwitchIoVerificationLevel(
DWORD dwNewIoLevel )
{
BOOL bFatalError;
LONG lResult;
HKEY IoKey = NULL;
HKEY SmKey = NULL;
bFatalError = FALSE;
//
// Open the "I/O System" key
//
lResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegIOVerifyKeyName,
0,
KEY_QUERY_VALUE | KEY_WRITE,
&IoKey);
if( lResult != ERROR_SUCCESS )
{
if( dwNewIoLevel == 2 )
{
//
// cannot open the IO key - maybe a fatal error - anyway, we will try to create it
//
bFatalError = TRUE;
if( lResult == ERROR_ACCESS_DENIED )
{
//
// access is denied - fatal error
//
DisplayMessage( IDS_ACCESS_IS_DENIED );
}
else
{
if( lResult == ERROR_FILE_NOT_FOUND )
{
//
// the "I/O System" key doesn't exist, try to create it
//
//
// open the "Session Manager" key
//
lResult = RegOpenKeyEx (
HKEY_LOCAL_MACHINE,
RegSessionManagerKeyName,
0,
KEY_QUERY_VALUE | KEY_WRITE,
&SmKey);
if( lResult != ERROR_SUCCESS )
{
//
// cannot open the "Session Manager" key - fatal error
//
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegSessionManagerKeyName,
(DWORD)lResult);
}
else
{
//
// create the "I/O System" key
//
lResult = RegCreateKeyEx(
SmKey,
RegIOVerifySubKeyName,
0,
NULL,
REG_OPTION_NON_VOLATILE,
KEY_WRITE | KEY_QUERY_VALUE,
NULL,
&IoKey,
NULL );
if( lResult != ERROR_SUCCESS )
{
//
// cannot create key - fatal error
//
DisplayMessage(
IDS_REGCREATEKEYEX_FAILED,
RegIOVerifySubKeyName,
(DWORD)lResult);
}
else
{
//
// key created - reset the error code
//
bFatalError = FALSE;
}
//
// close the "Session Manager" key
//
lResult = RegCloseKey(
SmKey );
}
}
else
{
//
// other error opening the "I/O System" key
//
DisplayMessage(
IDS_REGOPENKEYEX_FAILED,
RegIOVerifyKeyName,
(DWORD)lResult);
}
}
}
else
bFatalError = TRUE;
//else
// we don't actually need the key in this case, we just want to wipe out
// the IO verification registry value
//
}
if( bFatalError == FALSE )
{
if( dwNewIoLevel == 2 )
{
//
// if we reached this point, we should have the IO key opened
//
//
// enable level 2
//
if( WriteRegistryValue( IoKey, RegIOVerifyLevelValueName, LEVEL2_IO_VERIFIER_ENABLED_VALUE ) == FALSE )
{
//
// cannot recover from this
//
bFatalError = TRUE;
}
}
else
{
//
// disable level 2
//
lResult = RegDeleteValue(
IoKey,
RegIOVerifyLevelValueName );
if( lResult != ERROR_SUCCESS && lResult != ERROR_FILE_NOT_FOUND )
{
bFatalError = TRUE;
DisplayMessage(
IDS_REGDELETEVALUE_FAILED,
RegIOVerifyLevelValueName,
(DWORD)lResult);
}
RegCloseKey (IoKey);
}
}
return ( ! bFatalError );
}