From f286f2ebedfe8382794541b4ee2a09d5eab8d44e Mon Sep 17 00:00:00 2001 From: henrypp Date: Mon, 9 Sep 2024 19:30:15 +0500 Subject: [PATCH] fixed notification signature check (fix #1871) --- src/helper.c | 79 ++++++++++++++++++++++++++-------------------------- src/helper.h | 9 ++---- 2 files changed, 42 insertions(+), 46 deletions(-) diff --git a/src/helper.c b/src/helper.c index 13f04de1..b5ddf39b 100644 --- a/src/helper.c +++ b/src/helper.c @@ -546,7 +546,7 @@ BOOLEAN _app_isappvalidbinary ( _In_opt_ PR_STRING path ) { - static R_STRINGREF valid_exts = PR_STRINGREF_INIT (L".exe"); + R_STRINGREF valid_exts = PR_STRINGREF_INIT (L".exe"); if (!path) return FALSE; @@ -809,17 +809,16 @@ LONG _app_verifyfromfile ( trust_data.cbStruct = sizeof (trust_data); trust_data.dwUIChoice = WTD_UI_NONE; + trust_data.fdwRevocationChecks = WTD_REVOKE_WHOLECHAIN; trust_data.pPolicyCallbackData = policy_callback; trust_data.dwUnionChoice = union_choice; + trust_data.dwStateAction = WTD_STATEACTION_VERIFY; + trust_data.dwProvFlags = WTD_SAFER_FLAG | WTD_DISABLE_MD2_MD4; + + trust_data.pFile = union_data; if (union_choice == WTD_CHOICE_CATALOG) - { trust_data.pCatalog = union_data; - } - else - { - trust_data.pFile = union_data; - } if (_r_config_getboolean (L"IsOCSPEnabled", FALSE)) { @@ -858,8 +857,7 @@ NTSTATUS _app_verifyfilefromcatalog ( _Out_ PR_STRING_PTR signature_string ) { - static GUID DriverActionVerify = DRIVER_ACTION_VERIFY; - + GUID DriverActionVerify = DRIVER_ACTION_VERIFY; WINTRUST_CATALOG_INFO catalog_info = {0}; DRIVER_VER_INFO ver_info = {0}; CATALOG_INFO ci = {0}; @@ -942,8 +940,7 @@ VOID _app_getfilesignatureinfo ( _Inout_ PITEM_APP_INFO ptr_app_info ) { - static GUID WinTrustActionGenericVerifyV2 = WINTRUST_ACTION_GENERIC_VERIFY_V2; - + GUID WinTrustActionGenericVerifyV2 = WINTRUST_ACTION_GENERIC_VERIFY_V2; WINTRUST_FILE_INFO file_info = {0}; PR_STRING string = NULL; LONG status; @@ -1785,7 +1782,9 @@ VOID _app_getfileinformation ( _r_queuedlock_releaseexclusive (&lock_cache_information); } - _r_workqueue_queueitem (&file_queue, &_app_queue_fileinformation, ptr_app_info); + // check for binary path is valid + if (_app_isappvalidbinary (path)) + _r_workqueue_queueitem (&file_queue, &_app_queue_fileinformation, ptr_app_info); } VOID _app_queue_resolver ( @@ -1808,8 +1807,7 @@ VOID _app_queue_resolver ( } VOID NTAPI _app_queue_fileinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ) { PITEM_APP_INFO ptr_app_info; @@ -1823,10 +1821,6 @@ VOID NTAPI _app_queue_fileinformation ( if (ptr_app_info->is_loaded) return; - // check for binary path is valid - if (!_app_isappvalidbinary (ptr_app_info->path)) - return; - status = _r_fs_openfile (ptr_app_info->path->buffer, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE, 0, FALSE, &hfile); if (!NT_SUCCESS (status)) @@ -1852,13 +1846,10 @@ VOID NTAPI _app_queue_fileinformation ( _app_getfilehashinfo (hfile, ptr_app_info->app_hash); // redraw listview - if (!(busy_count % 4)) // lol, hack!!! + if (_r_wnd_isvisible (hwnd, FALSE)) { - if (_r_wnd_isvisible (hwnd, FALSE)) - { - if (ptr_app_info->listview_id == _app_listview_getcurrent (hwnd)) - _r_listview_redraw (hwnd, ptr_app_info->listview_id); - } + if (ptr_app_info->listview_id == _app_listview_getcurrent (hwnd)) + _r_listview_redraw (hwnd, ptr_app_info->listview_id); } ptr_app_info->is_loaded = TRUE; @@ -1869,20 +1860,20 @@ VOID NTAPI _app_queue_fileinformation ( } VOID NTAPI _app_queue_notifyinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ) { - PITEM_CONTEXT context; PITEM_APP_INFO ptr_app_info; + PITEM_CONTEXT context; PITEM_LOG ptr_log; - PR_STRING address_str; - PR_STRING host_str = NULL; PR_STRING signature_str = NULL; + PR_STRING host_str = NULL; PR_STRING localized_string; + PR_STRING address_str; HANDLE hfile; HICON hicon; HDWP hdefer; + ULONG attempts = 6; BOOLEAN is_iconset = FALSE; NTSTATUS status; @@ -1915,8 +1906,7 @@ VOID NTAPI _app_queue_notifyinformation ( if (NT_SUCCESS (status)) { - if (!ptr_app_info->is_loaded) - _app_getfilesignatureinfo (hfile, ptr_app_info); + _app_getfilesignatureinfo (hfile, ptr_app_info); NtClose (hfile); } @@ -1945,7 +1935,20 @@ VOID NTAPI _app_queue_notifyinformation ( L":" ); - if (!_app_getappinfoparam2 (ptr_log->app_hash, 0, INFO_SIGNATURE_STRING, &signature_str, sizeof (signature_str))) + do + { + if (!_app_getappinfoparam2 (ptr_log->app_hash, 0, INFO_SIGNATURE_STRING, &signature_str, sizeof (signature_str))) + { + _r_sys_sleep (250); + } + else + { + break; + } + } + while (--attempts); + + if (!signature_str) _r_obj_movereference (&signature_str, _r_locale_getstring_ex (IDS_SIGN_UNSIGNED)); hdefer = BeginDeferWindowPos (2); @@ -1994,8 +1997,7 @@ VOID NTAPI _app_queue_notifyinformation ( } VOID NTAPI _app_queue_resolveinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ) { PITEM_NETWORK ptr_network; @@ -2034,13 +2036,10 @@ VOID NTAPI _app_queue_resolveinformation ( } // redraw listview - if (!(busy_count % 4)) // lol, hack!!! + if (_r_wnd_isvisible (context->hwnd, FALSE)) { - if (_r_wnd_isvisible (context->hwnd, FALSE)) - { - if (_app_listview_getcurrent (context->hwnd) == context->listview_id) - _r_listview_redraw (context->hwnd, context->listview_id); - } + if (_app_listview_getcurrent (context->hwnd) == context->listview_id) + _r_listview_redraw (context->hwnd, context->listview_id); } _r_obj_dereference (context->base_address); diff --git a/src/helper.h b/src/helper.h index 82b85bb6..bcd85fbb 100644 --- a/src/helper.h +++ b/src/helper.h @@ -244,18 +244,15 @@ VOID _app_queue_resolver ( ); VOID NTAPI _app_queue_fileinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ); VOID NTAPI _app_queue_notifyinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ); VOID NTAPI _app_queue_resolveinformation ( - _In_ PVOID arglist, - _In_ ULONG busy_count + _In_ PVOID arglist ); BOOLEAN _app_wufixenabled ();