winkernel_mm.c File Reference

#include "winkernel_mm.h"
#include <ntddk.h>
#include <Ntintsafe.h>

Go to the source code of this file.

Classes
struct	_CS_WINKERNEL_MEMBLOCK

Typedefs
typedef struct _CS_WINKERNEL_MEMBLOCK	CS_WINKERNEL_MEMBLOCK

Functions
void CAPSTONE_API	cs_winkernel_free (void *ptr)
void *CAPSTONE_API	cs_winkernel_malloc (size_t size)
void *CAPSTONE_API	cs_winkernel_calloc (size_t n, size_t size)
void *CAPSTONE_API	cs_winkernel_realloc (void *ptr, size_t size)
int CAPSTONE_API	cs_winkernel_vsnprintf (char *buffer, size_t count, const char *format, va_list argptr)

Variables
static const ULONG	CS_WINKERNEL_POOL_TAG = 'kwsC'

Typedef Documentation

CS_WINKERNEL_MEMBLOCK

typedef struct _CS_WINKERNEL_MEMBLOCK CS_WINKERNEL_MEMBLOCK

Function Documentation

cs_winkernel_calloc()

void* CAPSTONE_API cs_winkernel_calloc	(	size_t	n,
		size_t	size
	)

Definition at line 56 of file winkernel_mm.c.

{
    size_t total = n * size;
 
    void *new_ptr = cs_winkernel_malloc(total);
    if (!new_ptr) {
        return NULL;
    }
 
    return RtlFillMemory(new_ptr, total, 0);
}

References cs_winkernel_malloc(), n, NULL, and RtlFillMemory.

cs_winkernel_free()

void CAPSTONE_API cs_winkernel_free

(

void *

ptr

)

Definition at line 21 of file winkernel_mm.c.

{
    if (ptr) {
        ExFreePoolWithTag(CONTAINING_RECORD(ptr, CS_WINKERNEL_MEMBLOCK, data), CS_WINKERNEL_POOL_TAG);
    }
}

References CS_WINKERNEL_POOL_TAG.

Referenced by cs_winkernel_realloc(), and cs_winkernel_vsnprintf().

cs_winkernel_malloc()

void* CAPSTONE_API cs_winkernel_malloc

(

size_t

size

)

Definition at line 29 of file winkernel_mm.c.

{
    // Disallow zero length allocation because they waste pool header space and,
    // in many cases, indicate a potential validation issue in the calling code.
    NT_ASSERT(size);
 
    // FP; a use of NonPagedPool is required for Windows 7 support
    size_t number_of_bytes = 0;
    CS_WINKERNEL_MEMBLOCK *block = NULL;
    // A specially crafted size value can trigger the overflow.
    // If the sum in a value that overflows or underflows the capacity of the type,
    // the function returns NULL.
    if (!NT_SUCCESS(RtlSizeTAdd(size, FIELD_OFFSET(CS_WINKERNEL_MEMBLOCK, data), &number_of_bytes))) {
        return NULL;
    }
#pragma prefast(suppress : 30030)       // Allocating executable POOL_TYPE memory
    block = (CS_WINKERNEL_MEMBLOCK *)ExAllocatePoolWithTag(
            NonPagedPool, number_of_bytes, CS_WINKERNEL_POOL_TAG);
    if (!block) {
        return NULL;
    }
    block->size = size;
 
    return block->data;
}

References CS_WINKERNEL_POOL_TAG, ExAllocatePoolWithTag, NonPagedPool, NT_SUCCESS, NULL, and _CS_WINKERNEL_MEMBLOCK::size.

Referenced by cs_winkernel_calloc(), cs_winkernel_realloc(), and cs_winkernel_vsnprintf().

cs_winkernel_realloc()

void* CAPSTONE_API cs_winkernel_realloc	(	void *	ptr,
		size_t	size
	)

Definition at line 69 of file winkernel_mm.c.

{
    void *new_ptr = NULL;
    size_t current_size = 0;
    size_t smaller_size = 0;
 
    if (!ptr) {
        return cs_winkernel_malloc(size);
    }
 
    new_ptr = cs_winkernel_malloc(size);
    if (!new_ptr) {
        return NULL;
    }
 
    current_size = CONTAINING_RECORD(ptr, CS_WINKERNEL_MEMBLOCK, data)->size;
    smaller_size = (current_size < size) ? current_size : size;
    RtlCopyMemory(new_ptr, ptr, smaller_size);
    cs_winkernel_free(ptr);
 
    return new_ptr;
}

References cs_winkernel_free(), cs_winkernel_malloc(), and NULL.

cs_winkernel_vsnprintf()

int CAPSTONE_API cs_winkernel_vsnprintf	(	char *	buffer,
		size_t	count,
		const char *	format,
		va_list	argptr
	)

Definition at line 99 of file winkernel_mm.c.

{
    int result = _vsnprintf(buffer, count, format, argptr);
 
    // _vsnprintf() returns -1 when a string is truncated, and returns "count"
    // when an entire string is stored but without '\0' at the end of "buffer".
    // In both cases, null-terminator needs to be added manually.
    if (result == -1 || (size_t)result == count) {
        buffer[count - 1] = '\0';
    }
 
    if (result == -1) {
        // In case when -1 is returned, the function has to get and return a number
        // of characters that would have been written. This attempts so by retrying
        // the same conversion with temp buffer that is most likely big enough to
        // complete formatting and get a number of characters that would have been
        // written.
        char* tmp = cs_winkernel_malloc(0x1000);
        if (!tmp) {
            return result;
        }
 
        result = _vsnprintf(tmp, 0x1000, format, argptr);
        NT_ASSERT(result != -1);
        cs_winkernel_free(tmp);
    }
 
    return result;
}

References count, cs_winkernel_free(), cs_winkernel_malloc(), and autogen_x86imm::tmp.

Variable Documentation

CS_WINKERNEL_POOL_TAG

const ULONG CS_WINKERNEL_POOL_TAG = 'kwsC'

static

Definition at line 9 of file winkernel_mm.c.

Referenced by cs_winkernel_free(), and cs_winkernel_malloc().