gsrlabs/sys
1
0
Fork 0
mirror of https://github.com/golang/sys.git synced 2026-02-09 04:06:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

windows: fix constant value of WTD_STATEACTION_VERIFY

Browse Source 
A 0x01 was mistakenly changed to 0x10. This commit rectifies the issue,
while also adding a test to ensure this functionality is behaving as
expected.

Fixes golang/go#46906

Change-Id: I833fe03e69a71283b4f7abb6cf640574d03f5d24
Reviewed-on: https://go-review.googlesource.com/c/sys/+/331010
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This commit is contained in:
Jason A. Donenfeld
2021-06-27 14:13:48 +02:00
parent 7dc0b73dc9
commit 0f9fa26af8
2 changed files with 78 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
windows/syscall_windows_test.go
View File

@@ -624,3 +624,80 @@ func TestCommandLineRecomposition(t *testing.T) {
}
}
}
func TestWinVerifyTrust(t *testing.T) {
system32, err := windows.GetSystemDirectory()
if err != nil {
t.Errorf("unable to find system32 directory: %v", err)
}
ntoskrnl := filepath.Join(system32, "ntoskrnl.exe")
ntoskrnl16, err := windows.UTF16PtrFromString(ntoskrnl)
if err != nil {
t.Fatalf("unable to get utf16 of ntoskrnl.exe: %v", err)
}
data := &windows.WinTrustData{
Size: uint32(unsafe.Sizeof(windows.WinTrustData{})),
UIChoice: windows.WTD_UI_NONE,
RevocationChecks: windows.WTD_REVOKE_NONE, // No revocation checking, in case the tests don't have network connectivity.
UnionChoice: windows.WTD_CHOICE_FILE,
StateAction: windows.WTD_STATEACTION_VERIFY,
FileOrCatalogOrBlobOrSgnrOrCert: unsafe.Pointer(&windows.WinTrustFileInfo{
Size: uint32(unsafe.Sizeof(windows.WinTrustFileInfo{})),
FilePath: ntoskrnl16,
}),
}
verifyErr := windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
data.StateAction = windows.WTD_STATEACTION_CLOSE
closeErr := windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
if verifyErr != nil {
t.Errorf("ntoskrnl.exe did not verify: %v", verifyErr)
}
if closeErr != nil {
t.Errorf("unable to free verification resources: %v", closeErr)
}
// Now that we've verified legitimate ntoskrnl.exe verifies, let's corrupt it and see if it correctly fails.
dir, err := ioutil.TempDir("", "go-build")
if err != nil {
t.Fatalf("failed to create temp directory: %v", err)
}
defer os.RemoveAll(dir)
corruptedNtoskrnl := filepath.Join(dir, "ntoskrnl.exe")
ntoskrnlBytes, err := ioutil.ReadFile(ntoskrnl)
if err != nil {
t.Fatalf("unable to read ntoskrnl.exe bytes: %v", err)
}
if len(ntoskrnlBytes) > 0 {
ntoskrnlBytes[len(ntoskrnlBytes)/2-1]++
}
err = ioutil.WriteFile(corruptedNtoskrnl, ntoskrnlBytes, 0755)
if err != nil {
t.Fatalf("unable to write corrupted ntoskrnl.exe bytes: %v", err)
}
ntoskrnl16, err = windows.UTF16PtrFromString(corruptedNtoskrnl)
if err != nil {
t.Fatalf("unable to get utf16 of ntoskrnl.exe: %v", err)
}
data = &windows.WinTrustData{
Size: uint32(unsafe.Sizeof(windows.WinTrustData{})),
UIChoice: windows.WTD_UI_NONE,
RevocationChecks: windows.WTD_REVOKE_NONE, // No revocation checking, in case the tests don't have network connectivity.
UnionChoice: windows.WTD_CHOICE_FILE,
StateAction: windows.WTD_STATEACTION_VERIFY,
FileOrCatalogOrBlobOrSgnrOrCert: unsafe.Pointer(&windows.WinTrustFileInfo{
Size: uint32(unsafe.Sizeof(windows.WinTrustFileInfo{})),
FilePath: ntoskrnl16,
}),
}
verifyErr = windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
data.StateAction = windows.WTD_STATEACTION_CLOSE
closeErr = windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
if verifyErr != windows.Errno(windows.TRUST_E_BAD_DIGEST) {
t.Errorf("ntoskrnl.exe did not fail to verify as expected: %v", verifyErr)
}
if closeErr != nil {
t.Errorf("unable to free verification resources: %v", closeErr)
}
}

2
windows/types_windows.go
View File

@@ -680,7 +680,7 @@ const (
WTD_CHOICE_CERT = 5
WTD_STATEACTION_IGNORE = 0x00000000
WTD_STATEACTION_VERIFY = 0x00000010
WTD_STATEACTION_VERIFY = 0x00000001
WTD_STATEACTION_CLOSE = 0x00000002
WTD_STATEACTION_AUTO_CACHE = 0x00000003
WTD_STATEACTION_AUTO_CACHE_FLUSH = 0x00000004