implement lookaside lists

This commit is contained in:
lhodges1 2024-01-14 15:31:19 +11:00
parent 4315233537
commit 643072e867
17 changed files with 538 additions and 116 deletions

View file

@ -78,7 +78,7 @@ bcdedit /debug on
1. Clone the project i.e `git clone git@github.com:donnaskiez/ac.git`
2. Open the project in visual studio
3. Select `Release - No Server`
3. Select `Release - No Server - Win10` or `Release - No Server - Win11` depending on the version of Windows you will be running the driver on.
4. Build the project in visual studio, if you experience any build issues - check the drivers project settings are the following:
- `Inf2Cat -> General -> Use Local Time` to `Yes`
- `C/C++ -> Treat Warnings As Errors` to `No`

156
ac.sln
View file

@ -19,10 +19,14 @@ Global
Debug|ARM64 = Debug|ARM64
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release - No Server|Any CPU = Release - No Server|Any CPU
Release - No Server|ARM64 = Release - No Server|ARM64
Release - No Server|x64 = Release - No Server|x64
Release - No Server|x86 = Release - No Server|x86
Release - No Server - Win10|Any CPU = Release - No Server - Win10|Any CPU
Release - No Server - Win10|ARM64 = Release - No Server - Win10|ARM64
Release - No Server - Win10|x64 = Release - No Server - Win10|x64
Release - No Server - Win10|x86 = Release - No Server - Win10|x86
Release - No Server - Win11|Any CPU = Release - No Server - Win11|Any CPU
Release - No Server - Win11|ARM64 = Release - No Server - Win11|ARM64
Release - No Server - Win11|x64 = Release - No Server - Win11|x64
Release - No Server - Win11|x86 = Release - No Server - Win11|x86
Release|Any CPU = Release|Any CPU
Release|ARM64 = Release|ARM64
Release|x64 = Release|x64
@ -37,14 +41,22 @@ Global
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Debug|x64.Build.0 = Debug|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Debug|x86.ActiveCfg = Debug|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Debug|x86.Build.0 = Debug|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|Any CPU.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|Any CPU.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|ARM64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|ARM64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|x64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|x64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|x86.ActiveCfg = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server|x86.Build.0 = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|Any CPU.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|Any CPU.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|ARM64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|ARM64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|x64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|x64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|x86.ActiveCfg = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win10|x86.Build.0 = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|Any CPU.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|Any CPU.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|ARM64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|ARM64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|x64.ActiveCfg = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|x64.Build.0 = Release - No Server|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|x86.ActiveCfg = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release - No Server - Win11|x86.Build.0 = Release - No Server|Win32
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release|Any CPU.ActiveCfg = Release|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release|Any CPU.Build.0 = Release|x64
{3C8194C7-9F20-4FF8-8C4C-B26C3D053611}.Release|ARM64.ActiveCfg = Release|x64
@ -65,18 +77,30 @@ Global
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Debug|x86.ActiveCfg = Debug|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Debug|x86.Build.0 = Debug|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Debug|x86.Deploy.0 = Debug|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|Any CPU.ActiveCfg = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|Any CPU.Build.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|Any CPU.Deploy.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|ARM64.ActiveCfg = Release - No Server|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|ARM64.Build.0 = Release - No Server|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|ARM64.Deploy.0 = Release - No Server|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x64.ActiveCfg = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x64.Build.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x64.Deploy.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x86.ActiveCfg = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x86.Build.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server|x86.Deploy.0 = Release - No Server|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|Any CPU.ActiveCfg = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|Any CPU.Build.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|Any CPU.Deploy.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|ARM64.ActiveCfg = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|ARM64.Build.0 = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|ARM64.Deploy.0 = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x64.ActiveCfg = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x64.Build.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x64.Deploy.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x86.ActiveCfg = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x86.Build.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win10|x86.Deploy.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|Any CPU.ActiveCfg = Release - Win11|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|Any CPU.Build.0 = Release - Win11|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|Any CPU.Deploy.0 = Release - Win11|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|ARM64.ActiveCfg = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|ARM64.Build.0 = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|ARM64.Deploy.0 = Release - Win10|ARM64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x64.ActiveCfg = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x64.Build.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x64.Deploy.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x86.ActiveCfg = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x86.Build.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release - No Server - Win11|x86.Deploy.0 = Release - Win10|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release|Any CPU.ActiveCfg = Release|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release|Any CPU.Build.0 = Release|x64
{0AE83EC6-DDEA-4EDE-B1B2-1B2AB1E8BB54}.Release|Any CPU.Deploy.0 = Release|x64
@ -97,14 +121,22 @@ Global
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Debug|x64.Build.0 = Debug|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Debug|x86.ActiveCfg = Debug|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Debug|x86.Build.0 = Debug|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|Any CPU.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|Any CPU.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|ARM64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|ARM64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|x64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|x64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|x86.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server|x86.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|Any CPU.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|Any CPU.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|ARM64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|ARM64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|x64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|x64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|x86.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win10|x86.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|Any CPU.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|Any CPU.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|ARM64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|ARM64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|x64.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|x64.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|x86.ActiveCfg = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release - No Server - Win11|x86.Build.0 = Release - No Server|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release|Any CPU.Build.0 = Release|Any CPU
{6228E9DD-E1EA-45D8-8054-A00FC2D63414}.Release|ARM64.ActiveCfg = Release|Any CPU
@ -121,14 +153,22 @@ Global
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Debug|x64.Build.0 = Debug|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Debug|x86.ActiveCfg = Debug|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Debug|x86.Build.0 = Debug|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|Any CPU.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|Any CPU.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|ARM64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|ARM64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|x64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|x64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|x86.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server|x86.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|Any CPU.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|Any CPU.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|ARM64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|ARM64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|x64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|x64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|x86.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win10|x86.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|Any CPU.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|Any CPU.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|ARM64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|ARM64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|x64.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|x64.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|x86.ActiveCfg = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release - No Server - Win11|x86.Build.0 = Release - No Server|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release|Any CPU.ActiveCfg = Release|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release|Any CPU.Build.0 = Release|Any CPU
{4D0777F0-2D3D-4FD7-9C0F-CD4DEC1A99E9}.Release|ARM64.ActiveCfg = Release|Any CPU
@ -149,18 +189,30 @@ Global
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Debug|x86.ActiveCfg = Debug|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Debug|x86.Build.0 = Debug|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Debug|x86.Deploy.0 = Debug|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|Any CPU.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|Any CPU.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|Any CPU.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|ARM64.ActiveCfg = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|ARM64.Build.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|ARM64.Deploy.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x64.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x64.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x64.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x86.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x86.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server|x86.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|Any CPU.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|Any CPU.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|Any CPU.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|ARM64.ActiveCfg = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|ARM64.Build.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|ARM64.Deploy.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x64.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x64.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x64.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x86.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x86.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win10|x86.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|Any CPU.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|Any CPU.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|Any CPU.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|ARM64.ActiveCfg = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|ARM64.Build.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|ARM64.Deploy.0 = Release - No Server|ARM64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x64.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x64.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x64.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x86.ActiveCfg = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x86.Build.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release - No Server - Win11|x86.Deploy.0 = Release - No Server|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release|Any CPU.ActiveCfg = Release|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release|Any CPU.Build.0 = Release|x64
{3CE9C9B1-1FB1-4770-ABBB-EE4E6AA949B0}.Release|Any CPU.Deploy.0 = Release|x64

View file

@ -43,16 +43,41 @@ CleanupThreadListFreeCallback(_In_ PTHREAD_LIST_ENTRY ThreadListEntry)
}
VOID
CleanupProcessListOnDriverUnload()
UnregisterProcessCreateNotifyRoutine()
{
PPROCESS_LIST_HEAD list = GetProcessList();
InterlockedExchange(&list->active, FALSE);
ImpPsSetCreateProcessNotifyRoutine(ProcessCreateNotifyRoutine, TRUE);
}
VOID
UnregisterImageLoadNotifyRoutine()
{
PDRIVER_LIST_HEAD list = GetDriverList();
InterlockedExchange(&list->active, FALSE);
PsRemoveLoadImageNotifyRoutine(ImageLoadNotifyRoutineCallback);
}
VOID
UnregisterThreadCreateNotifyRoutine()
{
PTHREAD_LIST_HEAD list = GetThreadList();
InterlockedExchange(&list->active, FALSE);
ImpPsRemoveCreateThreadNotifyRoutine(ThreadCreateNotifyRoutine);
}
VOID
CleanupProcessListOnDriverUnload()
{
PPROCESS_LIST_HEAD list = GetProcessList();
for (;;)
{
if (!ListFreeFirstEntry(&list->start, &list->lock, CleanupProcessListFreeCallback))
if (!LookasideListFreeFirstEntry(
&list->start, &list->lock, CleanupProcessListFreeCallback))
{
ExDeleteLookasideListEx(&list->lookaside_list);
return;
}
}
}
@ -60,13 +85,14 @@ VOID
CleanupThreadListOnDriverUnload()
{
PTHREAD_LIST_HEAD list = GetThreadList();
InterlockedExchange(&list->active, FALSE);
ImpPsRemoveCreateThreadNotifyRoutine(ThreadCreateNotifyRoutine);
for (;;)
{
if (!ListFreeFirstEntry(&list->start, &list->lock, CleanupThreadListFreeCallback))
if (!LookasideListFreeFirstEntry(
&list->start, &list->lock, CleanupThreadListFreeCallback))
{
ExDeleteLookasideListEx(&list->lookaside_list);
return;
}
}
}
@ -74,9 +100,6 @@ VOID
CleanupDriverListOnDriverUnload()
{
PDRIVER_LIST_HEAD list = GetDriverList();
InterlockedExchange(&list->active, FALSE);
PsRemoveLoadImageNotifyRoutine(ImageLoadNotifyRoutineCallback);
for (;;)
{
if (!ListFreeFirstEntry(&list->start, &list->lock, NULL))
@ -225,10 +248,11 @@ ImageLoadNotifyRoutineCallback(_In_opt_ PUNICODE_STRING FullImageName,
_In_ HANDLE ProcessId,
_In_ PIMAGE_INFO ImageInfo)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
PDRIVER_LIST_ENTRY entry = NULL;
RTL_MODULE_EXTENDED_INFO module = {0};
PDRIVER_LIST_HEAD list = GetDriverList();
NTSTATUS status = STATUS_UNSUCCESSFUL;
PDRIVER_LIST_ENTRY entry = NULL;
RTL_MODULE_EXTENDED_INFO module = {0};
PDRIVER_LIST_HEAD list = GetDriverList();
ANSI_STRING ansi_path = {0};
if (InterlockedExchange(&list->active, list->active) == FALSE)
return;
@ -257,6 +281,14 @@ ImageLoadNotifyRoutineCallback(_In_opt_ PUNICODE_STRING FullImageName,
module.ImageBase = ImageInfo->ImageBase;
module.ImageSize = ImageInfo->ImageSize;
// if (FullImageName)
//{
// status = RtlUnicodeStringToAnsiString(&ansi_path, FullImageName, TRUE);
// if (!NT_SUCCESS(status))
// DEBUG_ERROR("RtlUnicodeStringToAnsiString failed with status %x", status);
//}
status = HashModule(&module, &entry->text_hash);
if (status == STATUS_INVALID_IMAGE_WIN_32)
@ -273,20 +305,56 @@ ImageLoadNotifyRoutineCallback(_In_opt_ PUNICODE_STRING FullImageName,
ListInsert(&list->start, entry, &list->lock);
}
VOID
NTSTATUS
InitialiseProcessList()
{
PPROCESS_LIST_HEAD list = GetProcessList();
NTSTATUS status = STATUS_UNSUCCESSFUL;
PPROCESS_LIST_HEAD list = GetProcessList();
status = ExInitializeLookasideListEx(&list->lookaside_list,
NULL,
NULL,
POOL_NX_ALLOCATION,
0,
sizeof(PROCESS_LIST_ENTRY),
POOL_TAG_PROCESS_LIST,
0);
if (!NT_SUCCESS(status))
{
DEBUG_ERROR("ExInitializeLookasideListEx failed with status %x", status);
return status;
}
InterlockedExchange(&list->active, TRUE);
ListInit(&list->start, &list->lock);
return status;
}
VOID
NTSTATUS
InitialiseThreadList()
{
PTHREAD_LIST_HEAD list = GetThreadList();
NTSTATUS status = STATUS_UNSUCCESSFUL;
PTHREAD_LIST_HEAD list = GetThreadList();
status = ExInitializeLookasideListEx(&list->lookaside_list,
NULL,
NULL,
POOL_NX_ALLOCATION,
0,
sizeof(THREAD_LIST_ENTRY),
POOL_TAG_PROCESS_LIST,
0);
if (!NT_SUCCESS(status))
{
DEBUG_ERROR("ExInitializeLookasideListEx failed with status %x", status);
return status;
}
InterlockedExchange(&list->active, TRUE);
ListInit(&list->start, &list->lock);
return status;
}
VOID
@ -354,8 +422,7 @@ ProcessCreateNotifyRoutine(_In_ HANDLE ParentId, _In_ HANDLE ProcessId, _In_ BOO
if (Create)
{
entry = ImpExAllocatePool2(
POOL_FLAG_NON_PAGED, sizeof(PROCESS_LIST_ENTRY), POOL_TAG_THREAD_LIST);
entry = ExAllocateFromLookasideListEx(&list->lookaside_list);
if (!entry)
return;
@ -378,7 +445,7 @@ ProcessCreateNotifyRoutine(_In_ HANDLE ParentId, _In_ HANDLE ProcessId, _In_ BOO
ImpObDereferenceObject(entry->parent);
ImpObDereferenceObject(entry->process);
ListRemoveEntry(&list->start, entry, &list->lock);
LookasideThreadListRemoveEntry(&list->start, entry, &list->lock);
}
}
@ -391,7 +458,7 @@ ThreadCreateNotifyRoutine(_In_ HANDLE ProcessId, _In_ HANDLE ThreadId, _In_ BOOL
PTHREAD_LIST_HEAD list = GetThreadList();
/* ensure we don't insert new entries if we are unloading */
if (InterlockedExchange(&list->active, list->active) == FALSE)
if (!list->active)
return;
ImpPsLookupThreadByThreadId(ThreadId, &thread);
@ -402,8 +469,7 @@ ThreadCreateNotifyRoutine(_In_ HANDLE ProcessId, _In_ HANDLE ThreadId, _In_ BOOL
if (Create)
{
entry = ImpExAllocatePool2(
POOL_FLAG_NON_PAGED, sizeof(THREAD_LIST_ENTRY), POOL_TAG_THREAD_LIST);
entry = ExAllocateFromLookasideListEx(&list->lookaside_list);
if (!entry)
return;
@ -428,7 +494,7 @@ ThreadCreateNotifyRoutine(_In_ HANDLE ProcessId, _In_ HANDLE ThreadId, _In_ BOOL
ImpObDereferenceObject(entry->thread);
ImpObDereferenceObject(entry->owning_process);
ListRemoveEntry(&list->start, entry, &list->lock);
LookasideThreadListRemoveEntry(&list->start, entry, &list->lock);
}
}
@ -774,7 +840,7 @@ TimerObjectWorkItemRoutine(_In_ PDEVICE_OBJECT DeviceObject, _In_opt_ PVOID Cont
PDRIVER_LIST_HEAD list = GetDriverList();
if (!list->active)
return;
goto end;
DEBUG_VERBOSE("Integrity check timer callback invoked.");
@ -788,7 +854,8 @@ TimerObjectWorkItemRoutine(_In_ PDEVICE_OBJECT DeviceObject, _In_opt_ PVOID Cont
if (!NT_SUCCESS(status))
DEBUG_ERROR("ValidateOurDriverImage failed with status %x", status);
InterlockedDecrement(&timer->state);
end:
InterlockedExchange(&timer->state, FALSE);
}
/*
@ -808,7 +875,7 @@ TimerObjectCallbackRoutine(_In_ PKDPC Dpc,
/* we queue a work item because DPCs run at IRQL = DISPATCH_LEVEL and we need certain
* routines which cannot be run at an IRQL this high.*/
InterlockedIncrement(&timer->state);
InterlockedExchange(&timer->state, TRUE);
IoQueueWorkItem(timer->work_item, TimerObjectWorkItemRoutine, BackgroundWorkQueue, timer);
}

View file

@ -75,10 +75,10 @@ ObPreOpCallbackRoutine(_In_ PVOID RegistrationContext,
NTSTATUS
EnumerateProcessHandles(_In_ PPROCESS_LIST_ENTRY ProcessListEntry, _In_opt_ PVOID Context);
VOID
NTSTATUS
InitialiseThreadList();
VOID
NTSTATUS
InitialiseProcessList();
VOID
@ -122,4 +122,13 @@ InitialiseTimerObject(_Out_ PTIMER_OBJECT Timer);
VOID
CleanupDriverTimerObjects(_Out_ PTIMER_OBJECT Timer);
VOID
UnregisterProcessCreateNotifyRoutine();
VOID
UnregisterImageLoadNotifyRoutine();
VOID
UnregisterThreadCreateNotifyRoutine();
#endif

View file

@ -49,6 +49,7 @@ typedef struct _THREAD_LIST_HEAD
SINGLE_LIST_ENTRY start;
volatile BOOLEAN active;
KGUARDED_MUTEX lock;
LOOKASIDE_LIST_EX lookaside_list;
} THREAD_LIST_HEAD, *PTHREAD_LIST_HEAD;
@ -57,6 +58,7 @@ typedef struct _PROCESS_LIST_HEAD
SINGLE_LIST_ENTRY start;
volatile BOOLEAN active;
KGUARDED_MUTEX lock;
LOOKASIDE_LIST_EX lookaside_list;
} PROCESS_LIST_HEAD, *PPROCESS_LIST_HEAD;
@ -210,9 +212,10 @@ typedef struct _IRP_QUEUE_ENTRY
#define MODULES_REPORT_POOL_TAG 'modu'
#define POOL_TAG_LIST_ITEM 'tsil'
#define POOL_TAG_THREAD_LIST 'list'
#define POOL_TAG_PROCESS_LIST 'plis'
#define POOL_TAG_DRIVER_LIST 'drvl'
#define POOL_TAG_IRP_QUEUE 'irpp'
#define POOL_TAG_TIMER 'time'
#define POOL_TAG_TIMER 'time'
#define IA32_APERF_MSR 0x000000E8

View file

@ -347,15 +347,6 @@ ProcCloseClearProcessConfiguration()
// ImpKeReleaseGuardedMutex(&process_config.lock);
// }
/*
* The CALLBACKS_CONFIGURATION structure was being paged out, aswell as enabling a race condition
* to occur by being encapsulated in the callbacks.c file, so to solve both these problems I have
* moved them here. This way, we can make use of both locks (which is very ugly and I am pretty sure
* means I have made a mistake implementation wise but alas) ensuring we get rid of any race
* conditions aswell as the sturcture being paged out as we allocate in a non-paged pool meaning
* theres no chance our mutex will cause an IRQL bug check due to being paged out during
* acquisition.
*/
NTSTATUS
ProcLoadEnableObCallbacks()
{
@ -549,9 +540,15 @@ DriverUnload(_In_ PDRIVER_OBJECT DriverObject)
DrvUnloadFreeTimerObject();
DrvUnloadFreeModuleValidationContext();
DrvUnloadUnregisterObCallbacks();
UnregisterThreadCreateNotifyRoutine();
UnregisterProcessCreateNotifyRoutine();
UnregisterImageLoadNotifyRoutine();
DrvUnloadFreeThreadList();
DrvUnloadFreeProcessList();
DrvUnloadFreeDriverList();
DrvUnloadFreeConfigStrings();
DrvUnloadFreeGlobalReportQueue();
DrvUnloadFreeSymbolicLink();
@ -572,10 +569,6 @@ DrvLoadEnableNotifyRoutines()
DEBUG_VERBOSE("Enabling driver wide notify routines.");
InitialiseDriverList();
InitialiseThreadList();
InitialiseProcessList();
status = PsSetLoadImageNotifyRoutine(ImageLoadNotifyRoutineCallback);
if (!NT_SUCCESS(status))
@ -607,6 +600,47 @@ DrvLoadEnableNotifyRoutines()
return status;
}
STATIC
NTSTATUS
DrvLoadSetupDriverLists()
{
PAGED_CODE();
NTSTATUS status = STATUS_UNSUCCESSFUL;
status = InitialiseDriverList();
if (!NT_SUCCESS(status))
{
UnregisterImageLoadNotifyRoutine();
DEBUG_ERROR("InitialiseDriverList failed with status %x", status);
return status;
}
status = InitialiseThreadList();
if (!NT_SUCCESS(status))
{
DEBUG_ERROR("InitialiseThreadList failed with status %x", status);
UnregisterThreadCreateNotifyRoutine();
UnregisterImageLoadNotifyRoutine();
return status;
}
status = InitialiseProcessList();
if (!NT_SUCCESS(status))
{
DEBUG_ERROR("InitialiseProcessList failed with status %x", status);
UnregisterProcessCreateNotifyRoutine();
UnregisterThreadCreateNotifyRoutine();
UnregisterImageLoadNotifyRoutine();
return status;
}
return status;
}
STATIC
NTSTATUS
DrvLoadInitialiseObCbConfig()
@ -1075,6 +1109,16 @@ DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
return STATUS_FAILED_DRIVER_ENTRY;
}
status = DrvLoadSetupDriverLists();
if (!NT_SUCCESS(status))
{
DEBUG_ERROR("DrvLoadSetupDriverLists failed with status %x", status);
DrvUnloadFreeConfigStrings();
ImpIoDeleteSymbolicLink(&g_DriverConfig->device_symbolic_link);
ImpIoDeleteDevice(DriverObject->DeviceObject);
}
DEBUG_VERBOSE("Driver Entry Complete.");
return STATUS_SUCCESS;
}

View file

@ -5,12 +5,20 @@
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server|ARM64">
<Configuration>Release - No Server</Configuration>
<ProjectConfiguration Include="Release - Win10|ARM64">
<Configuration>Release - Win10</Configuration>
<Platform>ARM64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server|x64">
<Configuration>Release - No Server</Configuration>
<ProjectConfiguration Include="Release - Win10|x64">
<Configuration>Release - Win10</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - Win11|ARM64">
<Configuration>Release - Win11</Configuration>
<Platform>ARM64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - Win11|x64">
<Configuration>Release - Win11</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
@ -55,7 +63,7 @@
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|x64'" Label="Configuration">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|x64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
@ -64,6 +72,17 @@
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|x64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<NTDDI_VERSION>NTDDI_WIN10_VB</NTDDI_VERSION>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
<_NT_TARGET_VERSION>0xA00000C</_NT_TARGET_VERSION>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
@ -80,7 +99,15 @@
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|ARM64'" Label="Configuration">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
@ -108,7 +135,14 @@
<EnableClangTidyCodeAnalysis>false</EnableClangTidyCodeAnalysis>
<EnableMicrosoftCodeAnalysis>false</EnableMicrosoftCodeAnalysis>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|x64'">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<RunCodeAnalysis>true</RunCodeAnalysis>
<EnableClangTidyCodeAnalysis>false</EnableClangTidyCodeAnalysis>
<EnableMicrosoftCodeAnalysis>false</EnableMicrosoftCodeAnalysis>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<RunCodeAnalysis>true</RunCodeAnalysis>
@ -122,7 +156,10 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|ARM64'">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@ -152,7 +189,21 @@
<AdditionalDependencies>Cng.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|x64'">
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|x64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
<ClCompile>
<TreatWarningAsError>false</TreatWarningAsError>
<EnablePREfast>true</EnablePREfast>
</ClCompile>
<Link />
<Link>
<AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
<AdditionalDependencies>Cng.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|x64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
@ -171,7 +222,12 @@
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|ARM64'">
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win11|ARM64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - Win10|ARM64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>

View file

@ -1583,6 +1583,13 @@ ValidateOurDriverImage()
goto end;
}
if (entry->hashed == FALSE)
{
DEBUG_WARNING("Our module has not been hashed, returning.");
status = STATUS_HASH_NOT_PRESENT;
goto end;
}
status = HashModule(module_info, memory_hash);
if (!NT_SUCCESS(status))

View file

@ -1495,9 +1495,9 @@ ValidateDpcCapturedStack(_In_ PSYSTEM_MODULES Modules, _In_ PDPC_CONTEXT Context
report->kthread_address = PsGetCurrentThread();
report->invalid_rip = Context[core].stack_frame[frame];
RtlCopyMemory(report->driver,
(UINT64)Context[core].stack_frame[frame] - 0x500,
APC_STACKWALK_BUFFER_SIZE);
//RtlCopyMemory(report->driver,
// (UINT64)Context[core].stack_frame[frame] - 0x50,
// APC_STACKWALK_BUFFER_SIZE);
InsertReportToQueue(report);
}

View file

@ -33,7 +33,7 @@ typedef struct _NMI_CALLBACK_FAILURE
} NMI_CALLBACK_FAILURE, *PNMI_CALLBACK_FAILURE;
#define APC_STACKWALK_BUFFER_SIZE 4096
#define APC_STACKWALK_BUFFER_SIZE 0x50
typedef struct _DPC_STACKWALK_REPORT
{

View file

@ -381,3 +381,68 @@ ListRemoveEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
unlock:
ImpKeReleaseGuardedMutex(Lock);
}
VOID
LookasideThreadListRemoveEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
_Inout_ PSINGLE_LIST_ENTRY Entry,
_In_ PKGUARDED_MUTEX Lock)
{
ImpKeAcquireGuardedMutex(Lock);
PTHREAD_LIST_HEAD head = GetThreadList();
PSINGLE_LIST_ENTRY entry = Head->Next;
if (!entry)
goto unlock;
if (entry == Entry)
{
Head->Next = entry->Next;
ExFreeToLookasideListEx(&head->lookaside_list, Entry);
goto unlock;
}
while (entry->Next)
{
if (entry->Next == Entry)
{
entry->Next = Entry->Next;
ExFreeToLookasideListEx(&head->lookaside_list, Entry);
goto unlock;
}
entry = entry->Next;
}
unlock:
ImpKeReleaseGuardedMutex(Lock);
}
BOOLEAN
LookasideListFreeFirstEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
_In_ PKGUARDED_MUTEX Lock,
_In_opt_ PVOID CallbackRoutine)
{
ImpKeAcquireGuardedMutex(Lock);
PTHREAD_LIST_HEAD head = GetThreadList();
BOOLEAN result = FALSE;
if (Head->Next)
{
PSINGLE_LIST_ENTRY entry = Head->Next;
if (CallbackRoutine)
{
VOID (*callback_function_ptr)(PVOID) = CallbackRoutine;
(*callback_function_ptr)(entry);
}
Head->Next = Head->Next->Next;
ExFreeToLookasideListEx(&head->lookaside_list, entry);
result = TRUE;
}
ImpKeReleaseGuardedMutex(Lock);
return result;
}

View file

@ -91,4 +91,14 @@ ListRemoveEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
VOID
FreeGlobalReportQueueObjects();
VOID
LookasideThreadListRemoveEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
_Inout_ PSINGLE_LIST_ENTRY Entry,
_In_ PKGUARDED_MUTEX Lock);
BOOLEAN
LookasideListFreeFirstEntry(_Inout_ PSINGLE_LIST_ENTRY Head,
_In_ PKGUARDED_MUTEX Lock,
_In_opt_ PVOID CallbackRoutine);
#endif

View file

@ -88,13 +88,13 @@ DetectAttachedThreadsProcessCallback(_In_ PTHREAD_LIST_ENTRY ThreadListEntry,
apc_state = (PKAPC_STATE)((UINT64)ThreadListEntry->thread + KTHREAD_APC_STATE_OFFSET);
/*
* Just a sanity check even though it doesnt really make sense for internal threads of our
* protected process to attach..
*
* We don't care if a thread owned by our protected process is attached
*
* todo: this is filterless and will just report anything, need to have a look into what
* processes actually attach to real games
*/
if (apc_state->Process == protected_process)
if (apc_state->Process == protected_process &&
ThreadListEntry->owning_process != protected_process)
{
DEBUG_WARNING("Thread is attached to our protected process: %llx",
(UINT64)ThreadListEntry->thread);
@ -117,5 +117,6 @@ VOID
DetectThreadsAttachedToProtectedProcess()
{
PAGED_CODE();
DEBUG_VERBOSE("Detecting threads attached to our process...");
EnumerateThreadListWithCallbackRoutine(DetectAttachedThreadsProcessCallback, NULL);
}

View file

@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<AllowUnsafeBlocks>True</AllowUnsafeBlocks>
<Configurations>Debug;Release;Release - No Server</Configurations>
<Configurations>Debug;Release;Release - No Server;Release - No Server - Win11</Configurations>
</PropertyGroup>
<ItemGroup>

View file

@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<UserSecretsId>dotnet-service-ab667d6f-8728-45a8-a87c-ae511852674a</UserSecretsId>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
<Configurations>Debug;Release;Release - No Server</Configurations>
<Configurations>Debug;Release;Release - No Server;Release - No Server - Win11</Configurations>
</PropertyGroup>
<ItemGroup>

View file

@ -5,6 +5,14 @@
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server - Win11|ARM64">
<Configuration>Release - No Server - Win11</Configuration>
<Platform>ARM64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server - Win11|x64">
<Configuration>Release - No Server - Win11</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server|ARM64">
<Configuration>Release - No Server</Configuration>
<Platform>ARM64</Platform>
@ -63,6 +71,15 @@
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>true</UseDebugLibraries>
@ -87,6 +104,14 @@
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|ARM64'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
@ -107,6 +132,11 @@
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<Inf2CatUseLocalTime>true</Inf2CatUseLocalTime>
<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
@ -116,6 +146,9 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|ARM64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@ -138,6 +171,14 @@
<TreatWarningAsError>false</TreatWarningAsError>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
<ClCompile>
<TreatWarningAsError>false</TreatWarningAsError>
</ClCompile>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@ -148,6 +189,11 @@
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|ARM64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
</DriverSign>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
<DriverSign>
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>

View file

@ -5,6 +5,14 @@
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server - Win11|Win32">
<Configuration>Release - No Server - Win11</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server - Win11|x64">
<Configuration>Release - No Server - Win11</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release - No Server|Win32">
<Configuration>Release - No Server</Configuration>
<Platform>Win32</Platform>
@ -54,6 +62,13 @@
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
@ -74,6 +89,13 @@
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
@ -88,6 +110,9 @@
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|Win32'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|Win32'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
@ -97,6 +122,9 @@
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
@ -142,6 +170,22 @@
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
@ -193,6 +237,24 @@
<AdditionalLibraryDirectories>C:\Users\lachuie\source\repos\ac\x64\Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release - No Server - Win11|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;NO_SERVER;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>Imagehlp.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>C:\Users\lachuie\source\repos\ac\x64\Debug;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="pipe.cpp" />
<ClCompile Include="km\driver.cpp" />