Archive for the ‘Vista’ Category

The death of WFP

Tuesday, March 27th, 2007

One of the nicer little changes to Vista is the re-engineering of Windows File Protection into Windows Resource Protection (WRP). As everyone who’s ever tried to construct a partial checked build knows, replacing a file like ndis.sys in older OSes was a pain - you had to edit the registry and boot with the debugger to keep windows from silently clobbering your replaced file.

Windows Vista takes a much more intelligent approach to the problem: it prevents users from deleting these files in the first place, using the built-in security mechanisms of the OS. Protected resources get an ACL that prevents writes/deletes/etc, and the files are owned by a special user.

Now, if you want to replace a file for testing purposes, life is a lot easier - just take ownership of the file, give yourself full control, and re-name the old file. Drop in the new file and you’re done - no need to worry about the watchdog thread any more.

WRP also protects registry keys now using the same mechanism. More info is available at http://msdn2.microsoft.com/en-us/library/aa382503.aspx

Subverting Patchguard v2

Monday, January 15th, 2007

It looks like Ken got bored again recently, which is always bad news for Patchguard. His Subverting Patchguard v2 paper is fantastic, again. In case you missed it, his (and Matt’s) Bypassing Patchguard on Windows x64, covering v1, is a fantastic read.

If you’re lost, this knowledge base article has the background.

Why can’t you un-pend an IRP?

Thursday, November 30th, 2006

I was playing around with SDV and the pending bit the other day, and tried setting and clearing it in back-to-back lines in a dispatch routine. Having CSQ mark the IRP pending (which is automatic, if it succeeds at queuing the IRP) caused SDV to blow up with a very confusing error.

According to a PowerPoint slide by Adrian Oney, here’s the reason:

There is no IoUnmarkIrpPending because a driver above you can legally mark your stack location pending and return STATUS_PENDING

He goes on to say that PoCallDriver does this. News to me! I had always wondered why it was illegal (as opposed to simply immoral) to mark and un-mark an IRP as pending; it’s because in so doing, you would destroy the state of the driver above you who was depending on this.

More fun than dental work: getting a Subversion client working on Vista

Tuesday, November 21st, 2006

For as long as I’ve been making money programming, I have been using CVS for version control. And, while it’s served me faithfully over the years, it is showing its age, having trouble coping with our multi-million line codebase and our ever-growing dev and test teams. Everyone says Subversion is the way to go, so I decided I’d give it a shot for a personal project this week.

Like Ken, I upgraded most of my dev boxes to Vista this week. Why does that matter? Well, I hear from several friends that Cygwin doesn’t work well on Vista, and I only allow network access to source control over SSH, which for me always meant OpenSSH via Cygwin. So, that means going to get Putty and PLink, and associated utilities.

To cut to the chase: I ran into a bunch of little issues, found lots of misinformation on the web, and generally had to goof with this for hours to get it working. So, here’s what I came up with; hopefully it will be helpful to the next person who walks this path.

One more piece of background: the network Subversion server I set up is running on a Debian Sarge server, using Subversion 1.3 from backports.org. I used the stock OpenSSH server. Now, on to the show.

Step 1. First, you need a Subversion client. I downloaded the latest Win32 release from subversion.tigris.org. I haven’t ever been much of a GUI guy, so I can’t really say much about the various other clients; I just tend to stick with the command-line client. That’s what I tested with.

Step 2. Next, you need an SSH client. I got Putty and its associated tools. I put the programs in a directory under Program Files, because it seemed like the right thing to do.

Step 3. Add both the Putty directory and the Subversion binary directory to your path. You should be able to open a command prompt and type putty and svn and have the programs run.

Step 4. While it’s probably not strictly necessary, I generated a private/public key pair using putty’s key generator tool. You can pick whatever algorithm and key length you want (2048-bit RSA if you’re worried). Save the key pair in your home directory. Note that, at least for OpenSSH, you do NOT have to export the key pair to a separate key - the .ppk file that Puttygen leaves you has an appropriate key already.

Step 5. Do the key exchange - open your .ppk file and grab the public key (the part that starts with the AAAA’s) and add it to your .ssh/authorized_keys file on the server. When you’re done, you should be able to connect to the server without supplying credentials, like so: plink server.name. Setting this up for the first time is confusing to a lot of people for some reason. Keep trying until you get it - it will make your subversion experience (or cvs for that matter) a lot more enjoyable.

Step 6. Configure Subversion. On Vista, the config file is in a subdirectory of your home directory, in the AppData\\Remote directory. Find the SSH line and change it to: ssh = plink -i c:\\path\\to\\id.ppk -batch. Note the double-backslashes; they’re important.

That’s all. Try it out by typing svn ls svn+ssh://server.name/repos and make sure it returns something reasonable.

Feel free to drop questions if you have trouble; I’d be glad to help if you ask while I still remember what I’m doing.

More on object lifetimes

Saturday, November 18th, 2006

In an earlier post, I described a subtle race condition resulting from the differing lifetimes of miniport adapters and control device objects. Last week, Gianluca Varenni, the maintainer of WinPcap and one of the brains at CACE technology, pointed out that Microsoft had recently changed the Passthru sample to add reference counting in some instances to adapter objects. I went back and looked, and sure enough, the current DDK WDK sample has additional reference counting built into the driver.

Microsoft didn’t add any comments to the sample describing the reference counting addition, but I found this bug myself a while ago and implemented essentially the same solution. The basic problem is that there is a race between the two different adapter tear-down paths - the one that is initiated from halting the virtual miniport itself and the other that is triggered by the halting of the underlying miniport.

Gianluca also pointed out that nobody in their right mind would write an IM driver from scratch, other than as an educational experience, because it’s entirely too difficult to get the various NDIS synchronization issues right unless you’re an absolute expert at it. Obviously, even Microsoft is still finding bugs.

The good news is that IM’s are dead. Vista has a much-improved lightweight filtering architecture, so the writing is no the wall.

EULA clarifications

Tuesday, November 14th, 2006

A big thanks to Johan Marien from Microsoft for addressing some of the recent licensing questions raised over the WDK samples’ EULA. According to Johan, the license restrictions on redistribution of WDK source were present in the SP1 DDK, and the samples.txt file was added to provide a mechanism for making certain source code redistributable in the future.

His post on NTFSD has all of the details, which I won’t repeat here. He also asks for feedback on which samples you would like to see made available for redistribution, so if you have a business need, it may be worth bringing it up with him. Otherwise, it looks like you shouldn’t distribute source code derived from WDK samples to customers, unless you have a separate agreement with Microsoft.

Check that EULA

Monday, November 13th, 2006

Tony Mason from OSR sent a mail to NTFSD today detailing his concerns about the RTM WDK’s newly improved EULA. I am not a lawyer, and neither is Tony, but it looks like source redistribution has been greatly restricted compared to previous kits. If you depend on samples in the kit, it looks like it would be a good idea to read the RTM EULA carefully (or better yet, send it to your lawyer).

Vista ships

Wednesday, November 8th, 2006

It had to happen eventually. :-) What’s it going to be like getting to ship actual production code with the WDK? I can’t wait to strip out all of the #ifdefs for the old kits…

Congrats to the team(s). Shipping is hard. Shipping something that big is really hard.

I am not a phisherman

Monday, November 6th, 2006

The march of progress continues, and I keep pheeling safer and safer!

It turns out that something about my recent CSQ rules post triggered IE7’s automatic phishing philter. I know of no good reason that it would pick up that post (and only that post!) other than a couple of words in the title of the article it links to (about CONTAINING_RECORD), which I’m not going to repeat here phor phear of being philtered.

Anyway, apologies if you got a nasty warning phrom my site this weekend.

Vista driver verifier enhancements

Tuesday, October 31st, 2006

I just ran across this document that explains the changes present in Vista’s driver verifier. Verifier is one of the Best Things Ever.

Thanks to Dan Mihai from Microsoft for pointing this out on the newsgroups.