Ros-diffs January 2025

ros-diffs@reactos.org

23 participants
278 discussions

[reactos] 17/30: [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadControlSpace/SysDbgWriteControlSpace

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0589c178ba91e9151d942… commit 0589c178ba91e9151d9425162dd4b6947f51e0a1 Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sun Sep 22 21:39:33 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:45 2025 +0100 [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadControlSpace/SysDbgWriteControlSpace --- ntoskrnl/kd64/kdapi.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index d6506701841..899e225f013 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2365,7 +2365,63 @@ KdSystemDebugControl( break; case SysDbgReadControlSpace: + if (InputBufferLength != sizeof(SYSDBG_CONTROL_SPACE)) + { + Status = STATUS_INFO_LENGTH_MISMATCH; + } + else + { + SYSDBG_CONTROL_SPACE Request = *(PSYSDBG_CONTROL_SPACE)InputBuffer; + PVOID LockedBuffer; + PMDL LockVariable; + + Status = ExLockUserBuffer(Request.Buffer, + Request.Request, + PreviousMode, + IoWriteAccess, + &LockedBuffer, + &LockVariable); + if (NT_SUCCESS(Status)) + { + Status = KdpSysReadControlSpace(Request.Processor, + Request.Address, + LockedBuffer, + Request.Request, + &Length); + ExUnlockUserBuffer(LockVariable); + } + } + break; + case SysDbgWriteControlSpace: + if (InputBufferLength != sizeof(SYSDBG_CONTROL_SPACE)) + { + Status = STATUS_INFO_LENGTH_MISMATCH; + } + else + { + SYSDBG_CONTROL_SPACE Request = *(PSYSDBG_CONTROL_SPACE)InputBuffer; + PVOID LockedBuffer; + PMDL LockVariable; + + Status = ExLockUserBuffer(Request.Buffer, + Request.Request, + PreviousMode, + IoReadAccess, + &LockedBuffer, + &LockVariable); + if (NT_SUCCESS(Status)) + { + Status = KdpSysWriteControlSpace(Request.Processor, + Request.Address, + LockedBuffer, + Request.Request, + &Length); + ExUnlockUserBuffer(LockVariable); + } + } + break; + case SysDbgReadIoSpace: case SysDbgWriteIoSpace: case SysDbgReadMsr:

1 week, 1 day

[reactos] 16/30: [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadPhysical/SysDbgWritePhysical

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=42e038f227bf0deeb9134… commit 42e038f227bf0deeb9134e19851bf25d74f6472f Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sun Sep 22 21:39:09 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:43 2025 +0100 [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadPhysical/SysDbgWritePhysical --- ntoskrnl/kd64/kdapi.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index f6e375dbc7d..d6506701841 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2335,6 +2335,35 @@ KdSystemDebugControl( case SysDbgReadPhysical: case SysDbgWritePhysical: + if (InputBufferLength != sizeof(SYSDBG_PHYSICAL)) + { + Status = STATUS_INFO_LENGTH_MISMATCH; + } + else + { + SYSDBG_PHYSICAL Request = *(PSYSDBG_PHYSICAL)InputBuffer; + PVOID LockedBuffer; + PMDL LockVariable; + + Status = ExLockUserBuffer(Request.Buffer, + Request.Request, + PreviousMode, + Command == SysDbgReadVirtual ? IoWriteAccess : IoReadAccess, + &LockedBuffer, + &LockVariable); + if (NT_SUCCESS(Status)) + { + Status = KdpCopyMemoryChunks(Request.Address.QuadPart, + Request.Buffer, + Request.Request, + 0, + MMDBG_COPY_PHYSICAL | (Command == SysDbgReadVirtual ? 0 : MMDBG_COPY_WRITE), + &Length); + ExUnlockUserBuffer(LockVariable); + } + } + break; + case SysDbgReadControlSpace: case SysDbgWriteControlSpace: case SysDbgReadIoSpace:

1 week, 1 day

[reactos] 15/30: [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadVirtual/SysDbgWriteVirtual

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=2efaa5ea1e0c3786bfeb6… commit 2efaa5ea1e0c3786bfeb6183e8d5162bab044dbd Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sun Sep 22 21:38:56 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:42 2025 +0100 [NTOS:KD64] Implement KdSystemDebugControl: SysDbgReadVirtual/SysDbgWriteVirtual --- ntoskrnl/kd64/kdapi.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index f604779bc39..f6e375dbc7d 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2304,6 +2304,35 @@ KdSystemDebugControl( case SysDbgReadVirtual: case SysDbgWriteVirtual: + if (InputBufferLength != sizeof(SYSDBG_VIRTUAL)) + { + Status = STATUS_INFO_LENGTH_MISMATCH; + } + else + { + SYSDBG_VIRTUAL Request = *(PSYSDBG_VIRTUAL)InputBuffer; + PVOID LockedBuffer; + PMDL LockVariable; + + Status = ExLockUserBuffer(Request.Buffer, + Request.Request, + PreviousMode, + Command == SysDbgReadVirtual ? IoWriteAccess : IoReadAccess, + &LockedBuffer, + &LockVariable); + if (NT_SUCCESS(Status)) + { + Status = KdpCopyMemoryChunks((ULONG64)(ULONG_PTR)Request.Address, + Request.Buffer, + Request.Request, + 0, + Command == SysDbgReadVirtual ? 0 : MMDBG_COPY_WRITE, + &Length); + ExUnlockUserBuffer(LockVariable); + } + } + break; + case SysDbgReadPhysical: case SysDbgWritePhysical: case SysDbgReadControlSpace:

1 week, 1 day

[reactos] 14/30: [NTOS:KD64] Implement KdSystemDebugControl: SysDbgQueryVersion

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9f97f0b2844695889c061… commit 9f97f0b2844695889c061068de648b5e5f80e3e5 Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sun Sep 22 21:38:35 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:40 2025 +0100 [NTOS:KD64] Implement KdSystemDebugControl: SysDbgQueryVersion --- ntoskrnl/kd64/kdapi.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index e2dce3491e6..f604779bc39 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2291,6 +2291,17 @@ KdSystemDebugControl( switch (Command) { case SysDbgQueryVersion: + if (OutputBufferLength != sizeof(DBGKD_GET_VERSION64)) + { + Status = STATUS_INFO_LENGTH_MISMATCH; + } + else + { + KdpSysGetVersion((PDBGKD_GET_VERSION64)OutputBuffer); + Status = STATUS_SUCCESS; + } + break; + case SysDbgReadVirtual: case SysDbgWriteVirtual: case SysDbgReadPhysical:

1 week, 1 day

[reactos] 13/30: [NTOS:EX] In NtSystemDebugControl, check for SeDebugPrivilege

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=6338d513537a6872ef64c… commit 6338d513537a6872ef64cbe59b453a5e15d0dcc7 Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sat Sep 14 09:15:51 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:39 2025 +0100 [NTOS:EX] In NtSystemDebugControl, check for SeDebugPrivilege --- ntoskrnl/ex/dbgctrl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ntoskrnl/ex/dbgctrl.c b/ntoskrnl/ex/dbgctrl.c index dbb47793ee5..c6553324a80 100644 --- a/ntoskrnl/ex/dbgctrl.c +++ b/ntoskrnl/ex/dbgctrl.c @@ -218,6 +218,10 @@ NtSystemDebugControl( ULONG Length = 0; NTSTATUS Status; + /* Debugger controlling requires the debug privilege */ + if (!SeSinglePrivilegeCheck(SeDebugPrivilege, PreviousMode)) + return STATUS_ACCESS_DENIED; + _SEH2_TRY { if (PreviousMode != KernelMode)

1 week, 1 day

[reactos] 12/30: [NTOS:EX] Improve NtSystemDebugControl

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=9e7c3770e3cc44a45e3ae… commit 9e7c3770e3cc44a45e3aea92cc0d4a7d7bb24470 Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sat Sep 14 08:41:20 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:38 2025 +0100 [NTOS:EX] Improve NtSystemDebugControl - Add SEH probing for user buffer - Mark some classes as i386 only - Explicitly return STATUS_NOT_IMPLEMENTED on disabled classes (must use KdSystemDebugControl instead) - Explicitly return STATUS_NOT_IMPLEMENTED on not implemented classes - Return STATUS_INVALID_INFO_CLASS on all other classes --- ntoskrnl/ex/dbgctrl.c | 121 +++++++++++++++++++++++++++++++++----------------- 1 file changed, 80 insertions(+), 41 deletions(-) diff --git a/ntoskrnl/ex/dbgctrl.c b/ntoskrnl/ex/dbgctrl.c index 3aa65b99a97..dbb47793ee5 100644 --- a/ntoskrnl/ex/dbgctrl.c +++ b/ntoskrnl/ex/dbgctrl.c @@ -214,48 +214,87 @@ NtSystemDebugControl( _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength) { - switch (Command) + KPROCESSOR_MODE PreviousMode = KeGetPreviousMode(); + ULONG Length = 0; + NTSTATUS Status; + + _SEH2_TRY { - case SysDbgQueryModuleInformation: - case SysDbgQueryTraceInformation: - case SysDbgSetTracepoint: - case SysDbgSetSpecialCall: - case SysDbgClearSpecialCalls: - case SysDbgQuerySpecialCalls: - case SysDbgQueryVersion: - case SysDbgReadVirtual: - case SysDbgWriteVirtual: - case SysDbgReadPhysical: - case SysDbgWritePhysical: - case SysDbgReadControlSpace: - case SysDbgWriteControlSpace: - case SysDbgReadIoSpace: - case SysDbgWriteIoSpace: - case SysDbgReadMsr: - case SysDbgWriteMsr: - case SysDbgReadBusData: - case SysDbgWriteBusData: - case SysDbgCheckLowMemory: - case SysDbgGetTriageDump: - return STATUS_NOT_IMPLEMENTED; - case SysDbgBreakPoint: - case SysDbgEnableKernelDebugger: - case SysDbgDisableKernelDebugger: - case SysDbgGetAutoKdEnable: - case SysDbgSetAutoKdEnable: - case SysDbgGetPrintBufferSize: - case SysDbgSetPrintBufferSize: - case SysDbgGetKdUmExceptionEnable: - case SysDbgSetKdUmExceptionEnable: + if (PreviousMode != KernelMode) + { + if (InputBufferLength) + ProbeForRead(InputBuffer, InputBufferLength, sizeof(ULONG)); + if (OutputBufferLength) + ProbeForWrite(OutputBuffer, OutputBufferLength, sizeof(ULONG)); + if (ReturnLength) + ProbeForWriteUlong(ReturnLength); + } + + switch (Command) + { + case SysDbgQueryModuleInformation: + /* Removed in WinNT4 */ + Status = STATUS_INVALID_INFO_CLASS; + break; + +#ifdef _M_IX86 + case SysDbgQueryTraceInformation: + case SysDbgSetTracepoint: + case SysDbgSetSpecialCall: + case SysDbgClearSpecialCalls: + case SysDbgQuerySpecialCalls: + UNIMPLEMENTED; + Status = STATUS_NOT_IMPLEMENTED; + break; +#endif + + case SysDbgQueryVersion: + case SysDbgReadVirtual: + case SysDbgWriteVirtual: + case SysDbgReadPhysical: + case SysDbgWritePhysical: + case SysDbgReadControlSpace: + case SysDbgWriteControlSpace: + case SysDbgReadIoSpace: + case SysDbgWriteIoSpace: + case SysDbgReadMsr: + case SysDbgWriteMsr: + case SysDbgReadBusData: + case SysDbgWriteBusData: + case SysDbgCheckLowMemory: + /* Those are implemented in KdSystemDebugControl */ + Status = STATUS_NOT_IMPLEMENTED; + break; + + case SysDbgBreakPoint: + case SysDbgEnableKernelDebugger: + case SysDbgDisableKernelDebugger: + case SysDbgGetAutoKdEnable: + case SysDbgSetAutoKdEnable: + case SysDbgGetPrintBufferSize: + case SysDbgSetPrintBufferSize: + case SysDbgGetKdUmExceptionEnable: + case SysDbgSetKdUmExceptionEnable: + case SysDbgGetTriageDump: + case SysDbgGetKdBlockEnable: + case SysDbgSetKdBlockEnable: + UNIMPLEMENTED; + Status = STATUS_NOT_IMPLEMENTED; + break; - case SysDbgGetKdBlockEnable: - case SysDbgSetKdBlockEnable: - return KdSystemDebugControl( - Command, - InputBuffer, InputBufferLength, - OutputBuffer, OutputBufferLength, - ReturnLength, KeGetPreviousMode()); - default: - return STATUS_INVALID_INFO_CLASS; + default: + Status = STATUS_INVALID_INFO_CLASS; + break; + } + + if (ReturnLength) + *ReturnLength = Length; + + _SEH2_YIELD(return Status); + } + _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) + { + _SEH2_YIELD(return _SEH2_GetExceptionCode()); } + _SEH2_END; }

1 week, 1 day

[reactos] 11/30: [NTOS:KD64] Improve KdSystemDebugControl

by Hervé Poussineau

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=0f36ef3392ac3cc446404… commit 0f36ef3392ac3cc446404c6d1bf13aabeb19b6d9 Author: Hervé Poussineau <hpoussin(a)reactos.org> AuthorDate: Sat Sep 14 08:32:40 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:37 2025 +0100 [NTOS:KD64] Improve KdSystemDebugControl - Explicitly return STATUS_NOT_IMPLEMENTED on not implemented classes - Return STATUS_INVALID_INFO_CLASS on all other classes --- ntoskrnl/kd64/kdapi.c | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index 36600e4beac..e2dce3491e6 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2222,6 +2222,9 @@ KdSystemDebugControl( _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode) { + NTSTATUS Status; + ULONG Length = 0; + /* Handle some internal commands */ switch ((ULONG)Command) { @@ -2285,9 +2288,35 @@ KdSystemDebugControl( break; } - /* Local kernel debugging is not yet supported */ - DbgPrint("KdSystemDebugControl is unimplemented!\n"); - return STATUS_NOT_IMPLEMENTED; + switch (Command) + { + case SysDbgQueryVersion: + case SysDbgReadVirtual: + case SysDbgWriteVirtual: + case SysDbgReadPhysical: + case SysDbgWritePhysical: + case SysDbgReadControlSpace: + case SysDbgWriteControlSpace: + case SysDbgReadIoSpace: + case SysDbgWriteIoSpace: + case SysDbgReadMsr: + case SysDbgWriteMsr: + case SysDbgReadBusData: + case SysDbgWriteBusData: + case SysDbgCheckLowMemory: + UNIMPLEMENTED; + Status = STATUS_NOT_IMPLEMENTED; + break; + + default: + Status = STATUS_INVALID_INFO_CLASS; + break; + } + + if (ReturnLength) + *ReturnLength = Length; + + return Status; } /*

1 week, 1 day

[reactos] 10/30: [NTOS:EX:KD64] Add Doxygen documentation for Nt/KdSystemDebugControl.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a0b009f1ed9e7711377e6… commit a0b009f1ed9e7711377e6a52a7034c3083a188bf Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Mon Mar 13 01:10:57 2023 +0100 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:36 2025 +0100 [NTOS:EX:KD64] Add Doxygen documentation for Nt/KdSystemDebugControl. Based from external documentation: https://www.ivanlef0u.tuxfamily.org/?p=21 https://www.ivanlef0u.tuxfamily.org/?p=382 http://pds8.egloos.com/pds/200807/09/51/Subverting_Windows_2003_Service_Pac… http://www.nynaeve.net/?p=114 https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Eran… https://vidstromlabs.com/blog/memory-dumping-with-ntsystemdebugcontrol/ https://www.kernelmode.info/forum/viewtopic0aa3.html?t=5317 --- ntoskrnl/ex/dbgctrl.c | 80 ++++++++++++++++++++++++++++++++------------------- ntoskrnl/kd64/kdapi.c | 43 +++++++++++++++++++++++++-- 2 files changed, 91 insertions(+), 32 deletions(-) diff --git a/ntoskrnl/ex/dbgctrl.c b/ntoskrnl/ex/dbgctrl.c index 17dc980f999..3aa65b99a97 100644 --- a/ntoskrnl/ex/dbgctrl.c +++ b/ntoskrnl/ex/dbgctrl.c @@ -146,54 +146,75 @@ ExpDebuggerWorker( } } -/*++ - * @name NtSystemDebugControl - * @implemented +/** + * @brief + * Perform various queries to the kernel debugger. * - * Perform various queries to debugger. - * This API is subject to test-case creation to further evaluate its - * abilities (if needed to at all) + * @param[in] Command + * A SYSDBG_COMMAND value describing the kernel debugger command to perform. * - * See: http://www.osronline.com/showthread.cfm?link=93915 - * http://void.ru/files/Ntexapi.h - * http://www.codeguru.com/code/legacy/system/ntexapi.zip - * http://www.securityfocus.com/bid/9694 + * @param[in] InputBuffer + * Pointer to a user-provided input command-specific buffer, whose length + * is given by InputBufferLength. * - * @param ControlCode - * Description of the parameter. Wrapped to more lines on ~70th - * column. + * @param[in] InputBufferLength + * The size (in bytes) of the buffer pointed by InputBuffer. * - * @param InputBuffer - * FILLME + * @param[out] OutputBuffer + * Pointer to a user-provided command-specific output buffer, whose length + * is given by OutputBufferLength. * - * @param InputBufferLength - * FILLME + * @param[in] OutputBufferLength + * The size (in bytes) of the buffer pointed by OutputBuffer. * - * @param OutputBuffer - * FILLME + * @param[out] ReturnLength + * Optional pointer to a ULONG variable that receives the actual length of + * data written written in the output buffer. It is always zero, except for + * the live dump commands where an actual non-zero length is returned. * - * @param OutputBufferLength - * FILLME + * @return + * STATUS_SUCCESS in case of success, or a proper error code otherwise. * - * @param ReturnLength - * FILLME + * @remarks * - * @return STATUS_SUCCESS in case of success, proper error code otherwise + * - The caller must have SeDebugPrivilege, otherwise the function fails + * with STATUS_ACCESS_DENIED. * - * @remarks None + * - Only the live dump commands: SysDbgGetTriageDump, and SysDbgGetLiveKernelDump + * (Win8.1+) are available even if the debugger is disabled or absent. * - *--*/ + * - The following system-critical commands are not accessible anymore + * for user-mode usage with this API on NT 5.2+ (Windows 2003 SP1 and later) + * systems: + * + * SysDbgQueryVersion, + * SysDbgReadVirtual and SysDbgWriteVirtual, + * SysDbgReadPhysical and SysDbgWritePhysical, + * SysDbgReadControlSpace and SysDbgWriteControlSpace, + * SysDbgReadIoSpace and SysDbgWriteIoSpace, + * SysDbgReadMsr and SysDbgWriteMsr, + * SysDbgReadBusData and SysDbgWriteBusData, + * SysDbgCheckLowMemory. + * + * For these, NtSystemDebugControl() will return STATUS_NOT_IMPLEMENTED. + * They are now available from kernel-mode only with KdSystemDebugControl(). + * + * @note + * See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2339 + * + * @see KdSystemDebugControl() + **/ NTSTATUS NTAPI NtSystemDebugControl( - _In_ SYSDBG_COMMAND ControlCode, + _In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength) { - switch (ControlCode) + switch (Command) { case SysDbgQueryModuleInformation: case SysDbgQueryTraceInformation: @@ -226,10 +247,11 @@ NtSystemDebugControl( case SysDbgSetPrintBufferSize: case SysDbgGetKdUmExceptionEnable: case SysDbgSetKdUmExceptionEnable: + case SysDbgGetKdBlockEnable: case SysDbgSetKdBlockEnable: return KdSystemDebugControl( - ControlCode, + Command, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, ReturnLength, KeGetPreviousMode()); diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index cb0c65bd341..36600e4beac 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2171,9 +2171,46 @@ KdDisableDebugger(VOID) return KdDisableDebuggerWithLock(TRUE); } -/* - * @unimplemented - */ +/** + * @brief + * Perform various queries to the kernel debugger. + * + * @param[in] Command + * A SYSDBG_COMMAND value describing the kernel debugger command to perform. + * + * @param[in] InputBuffer + * Pointer to a user-provided input command-specific buffer, whose length + * is given by InputBufferLength. + * + * @param[in] InputBufferLength + * The size (in bytes) of the buffer pointed by InputBuffer. + * + * @param[out] OutputBuffer + * Pointer to a user-provided command-specific output buffer, whose length + * is given by OutputBufferLength. + * + * @param[in] OutputBufferLength + * The size (in bytes) of the buffer pointed by OutputBuffer. + * + * @param[out] ReturnLength + * Optional pointer to a ULONG variable that receives the actual length of + * data written written in the output buffer. It is always zero, except for + * the live dump commands where an actual non-zero length is returned. + * + * @param[in] PreviousMode + * The processor mode (KernelMode or UserMode) in which the command is being executed. + * + * @return + * STATUS_SUCCESS in case of success, or a proper error code otherwise. + * + * @remarks + * - This is a kernel-mode function, accessible only by kernel-mode drivers. + * + * @note + * See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2339 + * + * @see NtSystemDebugControl() + **/ NTSTATUS NTAPI KdSystemDebugControl(

1 week, 1 day

[reactos] 09/30: [NDK][NTOS:EX:KD64] Add SAL annotations to Kd/Nt/ZwSystemDebugControl.

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=317f1e8391f4f8b8cf03d… commit 317f1e8391f4f8b8cf03d9d4d12e7eaf55afc3fe Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Sun Mar 12 22:11:36 2023 +0100 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:35 2025 +0100 [NDK][NTOS:EX:KD64] Add SAL annotations to Kd/Nt/ZwSystemDebugControl. --- ntoskrnl/ex/dbgctrl.c | 13 +++++++------ ntoskrnl/kd64/kdapi.c | 6 +++--- sdk/include/ndk/kdfuncs.h | 30 +++++++++++++++--------------- 3 files changed, 25 insertions(+), 24 deletions(-) diff --git a/ntoskrnl/ex/dbgctrl.c b/ntoskrnl/ex/dbgctrl.c index f3fc6c0b43b..17dc980f999 100644 --- a/ntoskrnl/ex/dbgctrl.c +++ b/ntoskrnl/ex/dbgctrl.c @@ -185,12 +185,13 @@ ExpDebuggerWorker( *--*/ NTSTATUS NTAPI -NtSystemDebugControl(SYSDBG_COMMAND ControlCode, - PVOID InputBuffer, - ULONG InputBufferLength, - PVOID OutputBuffer, - ULONG OutputBufferLength, - PULONG ReturnLength) +NtSystemDebugControl( + _In_ SYSDBG_COMMAND ControlCode, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, + _In_ ULONG InputBufferLength, + _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, + _In_ ULONG OutputBufferLength, + _Out_opt_ PULONG ReturnLength) { switch (ControlCode) { diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index ba226ce6e17..cb0c65bd341 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -2178,11 +2178,11 @@ NTSTATUS NTAPI KdSystemDebugControl( _In_ SYSDBG_COMMAND Command, - _In_ PVOID InputBuffer, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, - _Out_ PVOID OutputBuffer, + _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, - _Inout_ PULONG ReturnLength, + _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode) { /* Handle some internal commands */ diff --git a/sdk/include/ndk/kdfuncs.h b/sdk/include/ndk/kdfuncs.h index 21681a67674..0ab68c26bcd 100644 --- a/sdk/include/ndk/kdfuncs.h +++ b/sdk/include/ndk/kdfuncs.h @@ -34,11 +34,11 @@ NTSTATUS NTAPI KdSystemDebugControl( _In_ SYSDBG_COMMAND Command, - _In_ PVOID InputBuffer, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, - _Out_ PVOID OutputBuffer, + _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, - _Inout_ PULONG ReturnLength, + _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode ); @@ -74,12 +74,12 @@ NTSYSCALLAPI NTSTATUS NTAPI NtSystemDebugControl( - SYSDBG_COMMAND ControlCode, - PVOID InputBuffer, - ULONG InputBufferLength, - PVOID OutputBuffer, - ULONG OutputBufferLength, - PULONG ReturnLength + _In_ SYSDBG_COMMAND Command, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, + _In_ ULONG InputBufferLength, + _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, + _In_ ULONG OutputBufferLength, + _Out_opt_ PULONG ReturnLength ); NTSYSAPI @@ -103,11 +103,11 @@ NTSYSAPI NTSTATUS NTAPI ZwSystemDebugControl( - SYSDBG_COMMAND ControlCode, - PVOID InputBuffer, - ULONG InputBufferLength, - PVOID OutputBuffer, - ULONG OutputBufferLength, - PULONG ReturnLength + _In_ SYSDBG_COMMAND Command, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, + _In_ ULONG InputBufferLength, + _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, + _In_ ULONG OutputBufferLength, + _Out_opt_ PULONG ReturnLength ); #endif

1 week, 1 day

[reactos] 08/30: [NTOS:KD64] Simplify some code in debugging helpers

by Hermès Bélusca-Maïto

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=5d78952024da9cae29c7b… commit 5d78952024da9cae29c7b1ecb545ead6ae0c20b4 Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> AuthorDate: Sun Sep 29 20:45:25 2024 +0200 Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org> CommitDate: Tue Jan 28 22:00:34 2025 +0100 [NTOS:KD64] Simplify some code in debugging helpers --- ntoskrnl/include/internal/kd64.h | 4 ++-- ntoskrnl/kd64/amd64/kdx64.c | 8 +++---- ntoskrnl/kd64/arm/kdarm.c | 4 ++-- ntoskrnl/kd64/i386/kdx86.c | 50 ++++++++++++++++++---------------------- ntoskrnl/kd64/kdapi.c | 18 +++++---------- 5 files changed, 36 insertions(+), 48 deletions(-) diff --git a/ntoskrnl/include/internal/kd64.h b/ntoskrnl/include/internal/kd64.h index 060832423ba..d9be3e72cc3 100644 --- a/ntoskrnl/include/internal/kd64.h +++ b/ntoskrnl/include/internal/kd64.h @@ -401,13 +401,13 @@ NTSTATUS NTAPI KdpSysReadMsr( _In_ ULONG Msr, - _Out_ PLARGE_INTEGER MsrValue); + _Out_ PULONGLONG MsrValue); NTSTATUS NTAPI KdpSysWriteMsr( _In_ ULONG Msr, - _In_ PLARGE_INTEGER MsrValue); + _In_ PULONGLONG MsrValue); // // Bus diff --git a/ntoskrnl/kd64/amd64/kdx64.c b/ntoskrnl/kd64/amd64/kdx64.c index b403bfa5918..c19505f634a 100644 --- a/ntoskrnl/kd64/amd64/kdx64.c +++ b/ntoskrnl/kd64/amd64/kdx64.c @@ -95,12 +95,12 @@ NTSTATUS NTAPI KdpSysReadMsr( _In_ ULONG Msr, - _Out_ PLARGE_INTEGER MsrValue) + _Out_ PULONGLONG MsrValue) { /* Use SEH to protect from invalid MSRs */ _SEH2_TRY { - MsrValue->QuadPart = __readmsr(Msr); + *MsrValue = __readmsr(Msr); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { @@ -115,12 +115,12 @@ NTSTATUS NTAPI KdpSysWriteMsr( _In_ ULONG Msr, - _In_ PLARGE_INTEGER MsrValue) + _In_ PULONGLONG MsrValue) { /* Use SEH to protect from invalid MSRs */ _SEH2_TRY { - __writemsr(Msr, MsrValue->QuadPart); + __writemsr(Msr, *MsrValue); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { diff --git a/ntoskrnl/kd64/arm/kdarm.c b/ntoskrnl/kd64/arm/kdarm.c index e322726c548..5a8674046a0 100644 --- a/ntoskrnl/kd64/arm/kdarm.c +++ b/ntoskrnl/kd64/arm/kdarm.c @@ -37,7 +37,7 @@ NTSTATUS NTAPI KdpSysReadMsr( _In_ ULONG Msr, - _Out_ PLARGE_INTEGER MsrValue) + _Out_ PULONGLONG MsrValue) { UNIMPLEMENTED; return STATUS_UNSUCCESSFUL; @@ -47,7 +47,7 @@ NTSTATUS NTAPI KdpSysWriteMsr( _In_ ULONG Msr, - _In_ PLARGE_INTEGER MsrValue) + _In_ PULONGLONG MsrValue) { UNIMPLEMENTED; return STATUS_UNSUCCESSFUL; diff --git a/ntoskrnl/kd64/i386/kdx86.c b/ntoskrnl/kd64/i386/kdx86.c index 64736cc8ef6..8fc77ebcf6e 100644 --- a/ntoskrnl/kd64/i386/kdx86.c +++ b/ntoskrnl/kd64/i386/kdx86.c @@ -93,22 +93,19 @@ NTSTATUS NTAPI KdpSysReadMsr( _In_ ULONG Msr, - _Out_ PLARGE_INTEGER MsrValue) + _Out_ PULONGLONG MsrValue) { - /* Wrap this in SEH in case the MSR doesn't exist */ + /* Use SEH to protect from invalid MSRs */ _SEH2_TRY { - /* Read from the MSR */ - MsrValue->QuadPart = __readmsr(Msr); + *MsrValue = __readmsr(Msr); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Invalid MSR */ _SEH2_YIELD(return STATUS_NO_SUCH_DEVICE); } _SEH2_END; - /* Success */ return STATUS_SUCCESS; } @@ -116,22 +113,19 @@ NTSTATUS NTAPI KdpSysWriteMsr( _In_ ULONG Msr, - _In_ PLARGE_INTEGER MsrValue) + _In_ PULONGLONG MsrValue) { - /* Wrap this in SEH in case the MSR doesn't exist */ + /* Use SEH to protect from invalid MSRs */ _SEH2_TRY { - /* Write to the MSR */ - __writemsr(Msr, MsrValue->QuadPart); + __writemsr(Msr, *MsrValue); } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) { - /* Invalid MSR */ _SEH2_YIELD(return STATUS_NO_SUCH_DEVICE); } _SEH2_END; - /* Success */ return STATUS_SUCCESS; } @@ -155,7 +149,7 @@ KdpSysReadBusData( Length); /* Return status */ - return *ActualLength != 0 ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL; + return (*ActualLength != 0 ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL); } NTSTATUS @@ -178,7 +172,7 @@ KdpSysWriteBusData( Length); /* Return status */ - return *ActualLength != 0 ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL; + return (*ActualLength != 0 ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL); } NTSTATUS @@ -272,9 +266,7 @@ KdpSysReadIoSpace( NTSTATUS Status; /* Verify parameters */ - if ((InterfaceType != Isa) || - (BusNumber != 0) || - (AddressSpace != 1)) + if ((InterfaceType != Isa) || (BusNumber != 0) || (AddressSpace != 1)) { /* Fail, we don't support this */ *ActualDataSize = 0; @@ -285,16 +277,17 @@ KdpSysReadIoSpace( switch (DataSize) { case sizeof(UCHAR): - + { /* Read 1 byte */ *(PUCHAR)DataValue = READ_PORT_UCHAR((PUCHAR)(ULONG_PTR)IoAddress); *ActualDataSize = sizeof(UCHAR); Status = STATUS_SUCCESS; break; + } case sizeof(USHORT): - + { /* Make sure the address is aligned */ if ((IoAddress & (sizeof(USHORT) - 1)) != 0) { @@ -310,9 +303,10 @@ KdpSysReadIoSpace( *ActualDataSize = sizeof(USHORT); Status = STATUS_SUCCESS; break; + } case sizeof(ULONG): - + { /* Make sure the address is aligned */ if ((IoAddress & (sizeof(ULONG) - 1)) != 0) { @@ -328,9 +322,9 @@ KdpSysReadIoSpace( *ActualDataSize = sizeof(ULONG); Status = STATUS_SUCCESS; break; + } default: - /* Invalid size, fail */ *ActualDataSize = 0; Status = STATUS_INVALID_PARAMETER; @@ -354,9 +348,7 @@ KdpSysWriteIoSpace( NTSTATUS Status; /* Verify parameters */ - if ((InterfaceType != Isa) || - (BusNumber != 0) || - (AddressSpace != 1)) + if ((InterfaceType != Isa) || (BusNumber != 0) || (AddressSpace != 1)) { /* Fail, we don't support this */ *ActualDataSize = 0; @@ -367,16 +359,17 @@ KdpSysWriteIoSpace( switch (DataSize) { case sizeof(UCHAR): - + { /* Write 1 byte */ WRITE_PORT_UCHAR((PUCHAR)(ULONG_PTR)IoAddress, *(PUCHAR)DataValue); *ActualDataSize = sizeof(UCHAR); Status = STATUS_SUCCESS; break; + } case sizeof(USHORT): - + { /* Make sure the address is aligned */ if ((IoAddress & (sizeof(USHORT) - 1)) != 0) { @@ -392,9 +385,10 @@ KdpSysWriteIoSpace( *ActualDataSize = sizeof(USHORT); Status = STATUS_SUCCESS; break; + } case sizeof(ULONG): - + { /* Make sure the address is aligned */ if ((IoAddress & (sizeof(ULONG) - 1)) != 0) { @@ -410,9 +404,9 @@ KdpSysWriteIoSpace( *ActualDataSize = sizeof(ULONG); Status = STATUS_SUCCESS; break; + } default: - /* Invalid size, fail */ *ActualDataSize = 0; Status = STATUS_INVALID_PARAMETER; diff --git a/ntoskrnl/kd64/kdapi.c b/ntoskrnl/kd64/kdapi.c index bd27655346b..ba226ce6e17 100644 --- a/ntoskrnl/kd64/kdapi.c +++ b/ntoskrnl/kd64/kdapi.c @@ -961,7 +961,7 @@ KdpReadMachineSpecificRegister(IN PDBGKD_MANIPULATE_STATE64 State, { STRING Header; PDBGKD_READ_WRITE_MSR ReadMsr = &State->u.ReadWriteMsr; - LARGE_INTEGER MsrValue; + ULARGE_INTEGER MsrValue; /* Setup the header */ Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); @@ -969,8 +969,7 @@ KdpReadMachineSpecificRegister(IN PDBGKD_MANIPULATE_STATE64 State, ASSERT(Data->Length == 0); /* Call the internal routine */ - State->ReturnStatus = KdpSysReadMsr(ReadMsr->Msr, - &MsrValue); + State->ReturnStatus = KdpSysReadMsr(ReadMsr->Msr, &MsrValue.QuadPart); /* Return the data */ ReadMsr->DataValueLow = MsrValue.LowPart; @@ -991,7 +990,7 @@ KdpWriteMachineSpecificRegister(IN PDBGKD_MANIPULATE_STATE64 State, { STRING Header; PDBGKD_READ_WRITE_MSR WriteMsr = &State->u.ReadWriteMsr; - LARGE_INTEGER MsrValue; + ULARGE_INTEGER MsrValue; /* Setup the header */ Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); @@ -1001,8 +1000,7 @@ KdpWriteMachineSpecificRegister(IN PDBGKD_MANIPULATE_STATE64 State, /* Call the internal routine */ MsrValue.LowPart = WriteMsr->DataValueLow; MsrValue.HighPart = WriteMsr->DataValueHigh; - State->ReturnStatus = KdpSysWriteMsr(WriteMsr->Msr, - &MsrValue); + State->ReturnStatus = KdpSysWriteMsr(WriteMsr->Msr, &MsrValue.QuadPart); /* Send the reply */ KdSendPacket(PACKET_TYPE_KD_STATE_MANIPULATE, @@ -1062,7 +1060,6 @@ KdpSetBusData(IN PDBGKD_MANIPULATE_STATE64 State, { STRING Header; PDBGKD_GET_SET_BUS_DATA SetBusData = &State->u.GetSetBusData; - ULONG Length; /* Setup the header */ Header.Length = sizeof(DBGKD_MANIPULATE_STATE64); @@ -1075,10 +1072,7 @@ KdpSetBusData(IN PDBGKD_MANIPULATE_STATE64 State, SetBusData->Offset, Data->Buffer, SetBusData->Length, - &Length); - - /* Return the actual length written */ - SetBusData->Length = Length; + &SetBusData->Length); /* Send the reply */ KdSendPacket(PACKET_TYPE_KD_STATE_MANIPULATE, @@ -1926,7 +1920,7 @@ KdEnterDebugger(IN PKTRAP_FRAME TrapFrame, /* Freeze all CPUs, raising also the IRQL to HIGH_LEVEL */ Enable = KeFreezeExecution(TrapFrame, ExceptionFrame); - /* Lock the port, save the state and set debugger entered */ + /* Lock the port, save its state and set the debugger entered flag */ KdpPortLocked = KeTryToAcquireSpinLockAtDpcLevel(&KdpDebuggerLock); KdSave(FALSE); KdEnteredDebugger = TRUE;

1 week, 1 day

← Newer
1
2
3
4
5
6
7
...
28
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Ros-diffs January 2025