diff --git a/modules/AdminImpersonate.hpp b/modules/AdminImpersonate.hpp index 4b1b65f..7a32ca3 100644 --- a/modules/AdminImpersonate.hpp +++ b/modules/AdminImpersonate.hpp @@ -3,6 +3,8 @@ #include #include +#include "../wine_winternl.h" +#include #include @@ -10,6 +12,8 @@ class AdminImpersonate : public ModuleBase { inline static decltype(&IsUserAnAdmin) TrueIsUserAnAdmin; inline static decltype(&CheckTokenMembership) TrueCheckTokenMembership; + inline static decltype(&NtOpenFile) TrueNtOpenFile; + inline static decltype(&NtCreateFile) TrueNtCreateFile; static BOOL __stdcall DetourIsUserAnAdmin() { @@ -38,15 +42,49 @@ class AdminImpersonate : public ModuleBase { return bRealResult; } + static + NTSTATUS NTAPI DetourNtOpenFile(OUT PHANDLE FileHandle, + IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG ShareAccess, IN ULONG OpenOptions) { + DWORD iStatus = TrueNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, + IoStatusBlock, ShareAccess, OpenOptions); + + if (iStatus == STATUS_SHARING_VIOLATION || iStatus == STATUS_ACCESS_DENIED) { + return STATUS_NO_SUCH_FILE; + } + + return iStatus; + } + + static + NTSTATUS NTAPI DetourNtCreateFile(OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, + IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, + IN ULONG CreateDisposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength) { + NTSTATUS iStatus = TrueNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, + FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength); + + if (iStatus == STATUS_SHARING_VIOLATION || iStatus == STATUS_ACCESS_DENIED) { + return STATUS_DISK_FULL; + } + + return iStatus; + } public: AdminImpersonate() { TrueIsUserAnAdmin = IsUserAnAdmin; TrueCheckTokenMembership = CheckTokenMembership; + TrueNtOpenFile = reinterpret_cast(GetProcAddress(LoadLibraryW(L"ntdll.dll"), "NtOpenFile")); + TrueNtCreateFile = reinterpret_cast(GetProcAddress(LoadLibraryW(L"ntdll.dll"), "NtCreateFile")); + DetourAttach(&reinterpret_cast(TrueNtOpenFile), reinterpret_cast(DetourNtOpenFile)); + DetourAttach(&reinterpret_cast(TrueNtCreateFile), reinterpret_cast(DetourNtCreateFile)); DetourAttach(&reinterpret_cast(TrueIsUserAnAdmin), reinterpret_cast(IsUserAnAdmin)); DetourAttach(&reinterpret_cast(TrueCheckTokenMembership), reinterpret_cast(CheckTokenMembership)); } ~AdminImpersonate() { + DetourDetach(&reinterpret_cast(TrueNtOpenFile), reinterpret_cast(DetourNtOpenFile)); + DetourDetach(&reinterpret_cast(TrueNtCreateFile), reinterpret_cast(DetourNtCreateFile)); DetourDetach(&reinterpret_cast(TrueIsUserAnAdmin), reinterpret_cast(IsUserAnAdmin)); DetourDetach(&reinterpret_cast(TrueCheckTokenMembership), reinterpret_cast(CheckTokenMembership)); } diff --git a/modules/RemoteLockBreak.hpp b/modules/RemoteLockBreak.hpp index a9fb633..367edc5 100644 --- a/modules/RemoteLockBreak.hpp +++ b/modules/RemoteLockBreak.hpp @@ -5,9 +5,6 @@ #include "../wine_winternl.h" #include -#define STATUS_SHARING_VIOLATION 0xC0000043 -#define STATUS_ACCESS_DENIED 0xC0000022 - class RemoteLockBreak : public ModuleBase {