Get DLL section object
| 23 | |
| 24 | // Get DLL section object |
| 25 | NTSTATUS Section::GetSection(DllStats** ppSectionInfo) { |
| 26 | NTSTATUS status = STATUS_SUCCESS; |
| 27 | |
| 28 | // make sure that Initialize was called! |
| 29 | ASSERT(_type == SectionType::Native || _type == SectionType::Wow); |
| 30 | // Use the single approach |
| 31 | PVOID Context = nullptr; |
| 32 | |
| 33 | status = RtlRunOnceBeginInitialize(&_sectionSingletonState, 0, &Context); |
| 34 | if (!NT_SUCCESS(status)) { |
| 35 | LogError("RtlRunOnceBeginInitialize failed 0x%x", status); |
| 36 | return status; |
| 37 | } |
| 38 | if (status == STATUS_PENDING) { |
| 39 | // We get here only during the first initialization |
| 40 | Context = nullptr; |
| 41 | // Allocate memory |
| 42 | DllStats* pDllState = new (PagedPool, 'mSDk') DllStats; |
| 43 | do |
| 44 | { |
| 45 | if (!pDllState) { |
| 46 | break; |
| 47 | } |
| 48 | |
| 49 | // Need to "trick" the system into creating a KnownDll section for us with the SD of |
| 50 | // the kernel32.dll section |
| 51 | |
| 52 | // Temporarily attach the current thread to the address space of the system process |
| 53 | KAPC_STATE state; |
| 54 | KeStackAttachProcess(PsInitialSystemProcess, &state); |
| 55 | |
| 56 | // Create our KnownDll section to bypass code integrity guard |
| 57 | status = CreateKnownDllSection(*pDllState); |
| 58 | |
| 59 | // Revert back |
| 60 | KeUnstackDetachProcess(&state); |
| 61 | |
| 62 | // Check the result |
| 63 | if (NT_SUCCESS(status)) { |
| 64 | Context = pDllState; |
| 65 | } |
| 66 | else { |
| 67 | LogError("ERROR: (0x%x), sectionType=%d", status, _type); |
| 68 | // Free memory |
| 69 | delete pDllState; |
| 70 | pDllState = nullptr; |
| 71 | } |
| 72 | } while (false); |
| 73 | |
| 74 | // Finilize our singleton |
| 75 | status = RtlRunOnceComplete(&_sectionSingletonState, 0, Context); |
| 76 | if (!NT_SUCCESS(status)) { |
| 77 | // Error |
| 78 | LogError("ERROR: (0x%x) RtlRunOnceComplete, section type=%d", status, _type); |
| 79 | ASSERT(nullptr); |
| 80 | |
| 81 | // Free memory |
| 82 | if (pDllState) { |
no test coverage detected