Issues regarding sections

[Redcommander]

Hey, I've recently encountered a few issues related to sections

1. NtOpenSection does not work if the filename (ObjectName) starts with \KnownDlls\ (such as \KnownDlls\ntdll.dll)
2. When calling NtMapViewOfSection and the section cannot be mapped to the address specified in the image file STATUS_IMAGE_NOT_AT_BASE should be returned (https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55)
3. When a view of ntdll is mapped, it should not share the same address as the originally loaded ntdll view

I'm not sure how these changes should be best implemented (if at all) into sogen which is why I created an issue instead of a PR.

[momo5502]

STATUS_IMAGE_NOT_AT_BASE should be easily fixable, for the other ones though, good question. could you provide sample code that could be integrated into the tests later that verifies whether these bugs are fixed or not?

[Redcommander]

Sure, here's some sample code that shows the issues. (Technically I cannot be sure the last one is an issue (yet) since the emulator doesn't get to that point, just included it since I saw it being used in an actual program to check whether the mapping succeeded and it could be a problem if it just returns the already mapped section).

#include <Windows.h>
#include <winternl.h>
#include <iostream>

#pragma comment(lib, "ntdll.lib")

#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
const NTSTATUS STATUS_IMAGE_NOT_AT_BASE = 0x40000003;

enum SECTION_INHERIT
{
    ViewShare = 1,
    ViewUnmap = 2,
};

extern "C" NTSTATUS NTAPI NtOpenSection(
    PHANDLE            SectionHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes
);

extern "C" NTSTATUS NTAPI NtMapViewOfSection(
    HANDLE          SectionHandle,
    HANDLE          ProcessHandle,
    PVOID* BaseAddress,
    ULONG_PTR       ZeroBits,
    SIZE_T          CommitSize,
    PLARGE_INTEGER  SectionOffset,
    PSIZE_T         ViewSize,
    SECTION_INHERIT InheritDisposition,
    ULONG           AllocationType,
    ULONG           Win32Protect
);

extern "C" NTSTATUS NTAPI NtUnmapViewOfSection(
    HANDLE ProcessHandle,
    PVOID  BaseAddress
);

int wmain()
{
    PVOID regularBase = reinterpret_cast<PVOID>(GetModuleHandleW(L"ntdll.dll"));
    if (!regularBase)
    {
        return 1;
    }

    UNICODE_STRING us;
    RtlInitUnicodeString(&us, L"\\KnownDlls\\ntdll.dll");

    OBJECT_ATTRIBUTES objAttr;
    InitializeObjectAttributes(&objAttr, &us, OBJ_CASE_INSENSITIVE, nullptr, nullptr);

    HANDLE hSection = nullptr;
    NTSTATUS status = NtOpenSection(&hSection, SECTION_MAP_READ | SECTION_MAP_EXECUTE, &objAttr);

    if (NT_SUCCESS(status))
    {
        std::wcout << L"NtOpenSection with KnownDlls -> PASS" << std::endl;
    }
    else
    {
        std::wcout << L"NtOpenSection with KnownDlls -> FAIL" << std::endl;
        return 1;
    }

    PVOID mappedBase = nullptr;
    SIZE_T viewSize = 0;

    status = NtMapViewOfSection(hSection,
        NtCurrentProcess(),
        &mappedBase,
        0,
        0,
        nullptr,
        &viewSize,
        ViewShare,
        0,
        PAGE_EXECUTE_READ);

    if (status == STATUS_IMAGE_NOT_AT_BASE)
    {
        std::wcout << L"NtMapViewOfSection returns STATUS_IMAGE_NOT_AT_BASE -> PASS" << std::endl;
    }
    else
    {
        std::wcout << L"NtMapViewOfSection returns STATUS_IMAGE_NOT_AT_BASE -> FAIL" << std::endl;
    }

    if (NT_SUCCESS(status) && mappedBase != nullptr && mappedBase != regularBase)
    {
        std::wcout << L"Mapped base != regular base -> PASS" << std::endl;
    }
    else
    {
        std::wcout << L"Mapped base != regular base -> FAIL" << std::endl;
    }

    if (NT_SUCCESS(status) && mappedBase != nullptr)
    {
        NtUnmapViewOfSection(NtCurrentProcess(), mappedBase);
    }

    NtClose(hSection);

    return 0;
}