libc.cpp

Go to the documentation of this file.

 
#include "libc.h"
#include <memory>
#include <Ntintsafe.h>
 
#pragma warning(push)               
#pragma warning (disable : 4565)
 
#ifndef _LIBC_POOL_TAG
#define _LIBC_POOL_TAG  'colM'
#endif
 
// very nice for debug forensics!
struct MEMBLOCK
{
        size_t  size;
#pragma warning(push)               
#pragma warning (disable : 4200)
        __declspec(align(MEMORY_ALLOCATION_ALIGNMENT))
        char data[0]; 
#pragma warning(pop)
};
 
EXTERN_C
__drv_when(return!=0, __drv_allocatesMem(pBlock))
__checkReturn
__drv_maxIRQL(DISPATCH_LEVEL)
__bcount_opt(size)
void* 
__cdecl malloc(
        __in size_t size
        )
{
        /* A specially crafted size value can trigger the overflow.
        If the sum in a value that overflows or underflows the capacity of the type,
        the function returns nullptr. */
        size_t number_of_bytes = 0;
        if (!NT_SUCCESS(RtlSizeTAdd(size, sizeof(MEMBLOCK), &number_of_bytes))){
                return nullptr;
        }
        MEMBLOCK *pBlock = static_cast<MEMBLOCK*>(
                ExAllocatePoolWithTag(
                        NonPagedPoolNxCacheAligned, 
                        number_of_bytes, 
                        _LIBC_POOL_TAG));
 
        if (nullptr == pBlock)
                return nullptr;
 
        pBlock->size = size;    
        return pBlock->data;
}
 
EXTERN_C
__drv_when(return != 0, __drv_allocatesMem(p))
__checkReturn
__drv_maxIRQL(DISPATCH_LEVEL)
__bcount_opt(size * n)
void*
__cdecl calloc(size_t n, size_t size)
{
        size_t total = n * size;
        void *p = malloc(total);
 
        if (!p) return NULL;
 
        return memset(p, 0, total);
}
 
EXTERN_C
__drv_when(return!=0, __drv_allocatesMem(inblock))
__checkReturn
__drv_maxIRQL(DISPATCH_LEVEL)
__bcount_opt(size)
void* 
__cdecl realloc(
        __in_opt void* ptr, 
        __in size_t size
        )
{
        if (!ptr)
                return malloc(size);
 
        std::unique_ptr<unsigned char> inblock = std::unique_ptr<unsigned char>(static_cast<unsigned char*>(ptr));
 
        // alloc new block
        void* mem = malloc(size);
        if (!mem)
                return nullptr;
 
        // copy from old one, not overflow ..
        memcpy(mem, inblock.get(), min(CONTAINING_RECORD(inblock.get(), MEMBLOCK, data)->size, size));
        return mem;
}
 
EXTERN_C
__drv_maxIRQL(DISPATCH_LEVEL)
void 
__cdecl free(
        __inout_opt __drv_freesMem(Mem) void* ptr
        )
{
        if (ptr)
                ExFreePoolWithTag(CONTAINING_RECORD(ptr, MEMBLOCK, data), _LIBC_POOL_TAG);
}
 
#pragma warning(pop)
 
__drv_when(return!=0, __drv_allocatesMem(ptr))
__checkReturn
__drv_maxIRQL(DISPATCH_LEVEL)
__bcount_opt(size)
void* 
__cdecl operator new(
        __in size_t size
        )
{
        return malloc(size);
}
 
__drv_maxIRQL(DISPATCH_LEVEL)
void 
__cdecl operator delete(
        __inout void* ptr
        )
{
        free(ptr);
}
 
int 
__cdecl vsnprintf(
        char *buffer,
        size_t count,
        const char *format,
        va_list argptr
)
{       
        return vsprintf_s(buffer, count, format, argptr);
}