This commit is contained in:
lhodges1 2023-09-23 21:25:48 +10:00
parent ea7110c22c
commit 9683becd5f
4 changed files with 21 additions and 7 deletions

View file

@ -160,7 +160,11 @@ NTSTATUS HandlePeriodicGlobalReportQueueQuery(
KeAcquireGuardedMutex( &report_queue_config.lock );
report = QueuePop( &report_queue_config.head );
report_buffer = ExAllocatePool2( POOL_FLAG_NON_PAGED, 1024 * 2, REPORT_QUEUE_TEMP_BUFFER_TAG );
report_buffer = ExAllocatePool2(
POOL_FLAG_NON_PAGED,
sizeof( INVALID_PROCESS_ALLOCATION_REPORT ) * MAX_REPORTS_PER_IRP + sizeof( GLOBAL_REPORT_QUEUE_HEADER ),
REPORT_QUEUE_TEMP_BUFFER_TAG
);
if ( !report_buffer )
{

View file

@ -71,7 +71,17 @@ namespace server
return new string(stringBuffer);
}
unsafe public static void CopyMemory(ref byte[] source, ref byte[] destination, int size, int offset)
{
if (size > destination.Length)
return;
for (int i=0; i < size; i++)
{
destination[i] = source[i + offset];
}
}
}
}

View file

@ -536,10 +536,7 @@ namespace server.Message
byte[] processStructure = new byte[4096];
for (int i=0;i<4096;i++)
{
processStructure[i] = _buffer[sizeof(PACKET_HEADER) + offset + i];
}
Helper.CopyMemory(ref _buffer, ref processStructure, 4096, sizeof(PACKET_HEADER) + offset);
_logger.Information("received invalid process allocation structure");

View file

@ -178,7 +178,10 @@ VOID kernelmode::Driver::QueryReportQueue()
global::report_structures::ATTACH_PROCESS_REPORT* attach_report;
global::report_structures::INVALID_PROCESS_ALLOCATION_REPORT* allocation_report;
buffer_size = sizeof( global::report_structures::INVALID_PROCESS_ALLOCATION_REPORT ) * MAX_REPORTS_PER_IRP;
buffer_size =
sizeof( global::report_structures::INVALID_PROCESS_ALLOCATION_REPORT ) * MAX_REPORTS_PER_IRP +
sizeof( global::report_structures::REPORT_QUEUE_HEADER );
buffer = malloc( buffer_size );
status = DeviceIoControl(