• R/O
  • HTTP
  • SSH
  • HTTPS

Commit

Tags
Keine Tags

Frequently used words (click to add to your profile)

javac++androidlinuxc#windowsobjective-ccocoa誰得qtpythonphprubygameguibathyscaphec計画中(planning stage)翻訳omegatframeworktwitterdomtestvb.netdirectxゲームエンジンbtronarduinopreviewer

FFFTPのソースコードです。


Commit MetaInfo

Revision1d38d1729082dfaadf5a9e2c1b16afc6789aaceb (tree)
Zeit2011-10-10 19:23:00
Autors_kawamoto <s_kawamoto@user...>
Commiters_kawamoto

Log Message

Add process protection levels (--protect-high by default but --protect-medium and --protect-low mainly for halfway signed modules).

Ändern Zusammenfassung

Diff

Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ
Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ
--- a/main.c
+++ b/main.c
@@ -234,21 +234,37 @@ int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdLi
234234
235235 // プロセス保護
236236 #ifdef ENABLE_PROCESS_PROTECTION
237- BOOL bProtect;
237+ DWORD ProtectLevel;
238238 char* pCommand;
239239 char Option[FMAX_PATH+1];
240- bProtect = FALSE;
240+ ProtectLevel = PROCESS_PROTECTION_NONE;
241241 pCommand = lpszCmdLine;
242242 while(pCommand = GetToken(pCommand, Option))
243243 {
244244 if(strcmp(Option, "--protect") == 0)
245245 {
246- bProtect = TRUE;
246+ ProtectLevel = PROCESS_PROTECTION_DEFAULT;
247+ break;
248+ }
249+ else if(strcmp(Option, "--protect-high") == 0)
250+ {
251+ ProtectLevel = PROCESS_PROTECTION_HIGH;
252+ break;
253+ }
254+ else if(strcmp(Option, "--protect-medium") == 0)
255+ {
256+ ProtectLevel = PROCESS_PROTECTION_MEDIUM;
257+ break;
258+ }
259+ else if(strcmp(Option, "--protect-low") == 0)
260+ {
261+ ProtectLevel = PROCESS_PROTECTION_LOW;
247262 break;
248263 }
249264 }
250- if(bProtect)
265+ if(ProtectLevel != PROCESS_PROTECTION_NONE)
251266 {
267+ SetProcessProtectionLevel(ProtectLevel);
252268 if(!InitializeLoadLibraryHook())
253269 {
254270 MessageBox(NULL, MSGJPN321, "FFFTP", MB_OK | MB_ICONERROR);
@@ -1755,6 +1771,15 @@ static int AnalyzeComLine(char *Str, int *AutoConnect, int *CmdOption, char *unc
17551771 else if(strcmp(Tmp, "--protect") == 0)
17561772 {
17571773 }
1774+ else if(strcmp(Tmp, "--protect-high") == 0)
1775+ {
1776+ }
1777+ else if(strcmp(Tmp, "--protect-medium") == 0)
1778+ {
1779+ }
1780+ else if(strcmp(Tmp, "--protect-low") == 0)
1781+ {
1782+ }
17581783 #endif
17591784 else
17601785 {
--- a/protectprocess.c
+++ b/protectprocess.c
@@ -55,7 +55,7 @@ BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRe
5555 BOOL HookFunctionInIAT(void* pOriginal, void* pNew);
5656 #endif
5757 HANDLE LockExistingFile(LPCWSTR Filename);
58-BOOL FindTrustedModuleMD5Hash(void* pHash);
58+BOOL FindTrustedModuleSHA1Hash(void* pHash);
5959 BOOL VerifyFileSignature(LPCWSTR Filename);
6060 BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename);
6161 BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash);
@@ -96,9 +96,10 @@ _CryptCATAdminCalcHashFromFileHandle p_CryptCATAdminCalcHashFromFileHandle;
9696 #define MAX_TRUSTED_FILENAME_TABLE 16
9797 #define MAX_TRUSTED_MD5_HASH_TABLE 16
9898
99+DWORD g_ProcessProtectionLevel;
99100 DWORD g_LockedThread[MAX_LOCKED_THREAD];
100101 WCHAR* g_pTrustedFilenameTable[MAX_TRUSTED_FILENAME_TABLE];
101-BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][16];
102+BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][20];
102103
103104 // ˆÈ‰ºƒtƒbƒNŠÖ”
104105 // ƒtƒbƒN‘ΏۂðŒÄ‚яo‚·ê‡‚Í‘OŒã‚ÅSTART_HOOK_FUNCTION‚ÆEND_HOOK_FUNCTION‚ðŽÀs‚·‚é•K—v‚ª‚ ‚é
@@ -169,19 +170,15 @@ HMODULE WINAPI h_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFla
169170 hLock = LockExistingFile(lpLibFileName);
170171 FreeLibrary(hModule);
171172 }
172- if(GetModuleHandleW(lpLibFileName))
173+ if((g_ProcessProtectionLevel & PROCESS_PROTECTION_LOADED) && GetModuleHandleW(lpLibFileName))
173174 bTrusted = TRUE;
174175 }
175176 if(!bTrusted)
176177 {
177- if(LockThreadLock())
178+ if(hLock)
178179 {
179- if(hLock)
180- {
181- if(IsModuleTrusted(lpLibFileName))
182- bTrusted = TRUE;
183- }
184- UnlockThreadLock();
180+ if(IsModuleTrusted(lpLibFileName))
181+ bTrusted = TRUE;
185182 }
186183 }
187184 if(bTrusted)
@@ -370,7 +367,7 @@ HANDLE LockExistingFile(LPCWSTR Filename)
370367 }
371368
372369 // DLL‚̃nƒbƒVƒ…‚ðŒŸõ
373-BOOL FindTrustedModuleMD5Hash(void* pHash)
370+BOOL FindTrustedModuleSHA1Hash(void* pHash)
374371 {
375372 BOOL bResult;
376373 int i;
@@ -378,7 +375,7 @@ BOOL FindTrustedModuleMD5Hash(void* pHash)
378375 i = 0;
379376 while(i < MAX_TRUSTED_MD5_HASH_TABLE)
380377 {
381- if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
378+ if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
382379 {
383380 bResult = TRUE;
384381 break;
@@ -395,6 +392,7 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
395392 GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
396393 WINTRUST_FILE_INFO wfi;
397394 WINTRUST_DATA wd;
395+ LONG Error;
398396 bResult = FALSE;
399397 ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
400398 wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
@@ -404,7 +402,12 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
404402 wd.dwUIChoice = WTD_UI_NONE;
405403 wd.dwUnionChoice = WTD_CHOICE_FILE;
406404 wd.pFile = &wfi;
407- if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
405+ Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
406+ if(Error == ERROR_SUCCESS)
407+ bResult = TRUE;
408+ else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
409+ bResult = TRUE;
410+ else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
408411 bResult = TRUE;
409412 return bResult;
410413 }
@@ -416,6 +419,7 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
416419 GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
417420 WINTRUST_CATALOG_INFO wci;
418421 WINTRUST_DATA wd;
422+ LONG Error;
419423 bResult = FALSE;
420424 if(VerifyFileSignature(Catalog))
421425 {
@@ -435,7 +439,12 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
435439 wd.dwUIChoice = WTD_UI_NONE;
436440 wd.dwUnionChoice = WTD_CHOICE_CATALOG;
437441 wd.pCatalog = &wci;
438- if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
442+ Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
443+ if(Error == ERROR_SUCCESS)
444+ bResult = TRUE;
445+ else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
446+ bResult = TRUE;
447+ else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
439448 bResult = TRUE;
440449 }
441450 free(wci.pbCalculatedFileHash);
@@ -635,31 +644,34 @@ BOOL IsSxsModuleTrusted(LPCWSTR Filename)
635644 }
636645
637646 // DLL‚ðŠm”F
638-// ƒnƒbƒVƒ…‚ª“o˜^‚³‚ê‚Ä‚¢‚éAAuthenticode–¼‚ª‚³‚ê‚Ä‚¢‚éA‚Ü‚½‚ÍWFP‚É‚æ‚é•ÛŒì‰º‚É‚ ‚邱‚Æ‚ðŠm”F
639647 BOOL IsModuleTrusted(LPCWSTR Filename)
640648 {
641649 BOOL bResult;
642- BYTE Hash[16];
650+ BYTE Hash[20];
643651 bResult = FALSE;
644- if(GetMD5HashOfFile(Filename, &Hash))
652+ if(LockThreadLock())
645653 {
646- if(FindTrustedModuleMD5Hash(&Hash))
647- bResult = TRUE;
648- }
649- if(!bResult)
650- {
651- if(VerifyFileSignature(Filename))
652- bResult = TRUE;
653- }
654- if(!bResult)
655- {
656- if(IsSxsModuleTrusted(Filename))
657- bResult = TRUE;
658- }
659- if(!bResult)
660- {
661- if(SfcIsFileProtected(NULL, Filename))
662- bResult = TRUE;
654+ if(GetSHA1HashOfFile(Filename, &Hash))
655+ {
656+ if(FindTrustedModuleSHA1Hash(&Hash))
657+ bResult = TRUE;
658+ }
659+ if(!bResult)
660+ {
661+ if((g_ProcessProtectionLevel & PROCESS_PROTECTION_BUILTIN) && VerifyFileSignature(Filename))
662+ bResult = TRUE;
663+ }
664+ if(!bResult)
665+ {
666+ if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SIDE_BY_SIDE) && IsSxsModuleTrusted(Filename))
667+ bResult = TRUE;
668+ }
669+ if(!bResult)
670+ {
671+ if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SYSTEM_FILE) && SfcIsFileProtected(NULL, Filename))
672+ bResult = TRUE;
673+ }
674+ UnlockThreadLock();
663675 }
664676 return bResult;
665677 }
@@ -739,8 +751,13 @@ HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
739751 return r;
740752 }
741753
742-// ƒtƒ@ƒCƒ‹‚ÌMD5ƒnƒbƒVƒ…‚ðŽæ“¾
743-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
754+void SetProcessProtectionLevel(DWORD Level)
755+{
756+ g_ProcessProtectionLevel = Level;
757+}
758+
759+// ƒtƒ@ƒCƒ‹‚ÌSHA1ƒnƒbƒVƒ…‚ðŽæ“¾
760+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash)
744761 {
745762 BOOL bResult;
746763 HCRYPTPROV hProv;
@@ -752,7 +769,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
752769 bResult = FALSE;
753770 if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
754771 {
755- if(CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
772+ if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
756773 {
757774 if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
758775 {
@@ -764,7 +781,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
764781 {
765782 if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
766783 {
767- dw = 16;
784+ dw = 20;
768785 if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
769786 bResult = TRUE;
770787 }
@@ -782,22 +799,22 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
782799 }
783800
784801 // DLL‚̃nƒbƒVƒ…‚ð“o˜^
785-BOOL RegisterTrustedModuleMD5Hash(void* pHash)
802+BOOL RegisterTrustedModuleSHA1Hash(void* pHash)
786803 {
787804 BOOL bResult;
788- BYTE NullHash[16] = {0};
805+ BYTE NullHash[20] = {0};
789806 int i;
790807 bResult = FALSE;
791- if(FindTrustedModuleMD5Hash(pHash))
808+ if(FindTrustedModuleSHA1Hash(pHash))
792809 bResult = TRUE;
793810 else
794811 {
795812 i = 0;
796813 while(i < MAX_TRUSTED_MD5_HASH_TABLE)
797814 {
798- if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 16) == 0)
815+ if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 20) == 0)
799816 {
800- memcpy(&g_TrustedMD5HashTable[i], pHash, 16);
817+ memcpy(&g_TrustedMD5HashTable[i], pHash, 20);
801818 bResult = TRUE;
802819 break;
803820 }
@@ -808,18 +825,18 @@ BOOL RegisterTrustedModuleMD5Hash(void* pHash)
808825 }
809826
810827 // DLL‚̃nƒbƒVƒ…‚Ì“o˜^‚ð‰ðœ
811-BOOL UnregisterTrustedModuleMD5Hash(void* pHash)
828+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash)
812829 {
813830 BOOL bResult;
814- BYTE NullHash[16] = {0};
831+ BYTE NullHash[20] = {0};
815832 int i;
816833 bResult = FALSE;
817834 i = 0;
818835 while(i < MAX_TRUSTED_MD5_HASH_TABLE)
819836 {
820- if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
837+ if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
821838 {
822- memcpy(&g_TrustedMD5HashTable[i], &NullHash, 16);
839+ memcpy(&g_TrustedMD5HashTable[i], &NullHash, 20);
823840 bResult = TRUE;
824841 break;
825842 }
--- a/protectprocess.h
+++ b/protectprocess.h
@@ -44,10 +44,30 @@ EXTERN_HOOK_FUNCTION_VAR(LoadLibraryExW)
4444
4545 #endif
4646
47+// ƒ[ƒhÏ‚݂̃‚ƒWƒ…[ƒ‹‚ÍŒŸ¸‚ðƒpƒX
48+#define PROCESS_PROTECTION_LOADED 0x00000001
49+// ƒ‚ƒWƒ…[ƒ‹‚É–„‚ߍž‚܂ꂽAuthenticode–¼‚ðŒŸ¸
50+#define PROCESS_PROTECTION_BUILTIN 0x00000002
51+// ƒTƒCƒhƒoƒCƒTƒCƒh‚ÌAuthenticode–¼‚ðŒŸ¸
52+#define PROCESS_PROTECTION_SIDE_BY_SIDE 0x00000004
53+// WFP‚É‚æ‚é•ÛŒì‰º‚É‚ ‚é‚©‚ðŒŸ¸
54+#define PROCESS_PROTECTION_SYSTEM_FILE 0x00000008
55+// Authenticode–¼‚Ì—LŒøŠúŒÀ‚𖳎‹
56+#define PROCESS_PROTECTION_EXPIRED 0x00000010
57+// Authenticode–¼‚Ì”­sŒ³‚𖳎‹
58+#define PROCESS_PROTECTION_UNAUTHORIZED 0x00000020
59+
60+#define PROCESS_PROTECTION_NONE 0
61+#define PROCESS_PROTECTION_DEFAULT PROCESS_PROTECTION_HIGH
62+#define PROCESS_PROTECTION_HIGH (PROCESS_PROTECTION_BUILTIN | PROCESS_PROTECTION_SIDE_BY_SIDE | PROCESS_PROTECTION_SYSTEM_FILE)
63+#define PROCESS_PROTECTION_MEDIUM (PROCESS_PROTECTION_HIGH | PROCESS_PROTECTION_LOADED | PROCESS_PROTECTION_EXPIRED)
64+#define PROCESS_PROTECTION_LOW (PROCESS_PROTECTION_MEDIUM | PROCESS_PROTECTION_UNAUTHORIZED)
65+
4766 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
48-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash);
49-BOOL RegisterTrustedModuleMD5Hash(void* pHash);
50-BOOL UnregisterTrustedModuleMD5Hash(void* pHash);
67+void SetProcessProtectionLevel(DWORD Level);
68+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash);
69+BOOL RegisterTrustedModuleSHA1Hash(void* pHash);
70+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash);
5171 BOOL UnloadUntrustedModule();
5272 BOOL InitializeLoadLibraryHook();
5373 BOOL EnableLoadLibraryHook(BOOL bEnable);
--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -67,11 +67,12 @@ BOOL LoadOpenSSL()
6767 if(g_bOpenSSLLoaded)
6868 return FALSE;
6969 #ifdef ENABLE_PROCESS_PROTECTION
70+ // 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること
7071 // ssleay32.dll 1.0.0e
7172 // libssl32.dll 1.0.0e
72- RegisterTrustedModuleMD5Hash("\x8B\xA3\xB7\xB3\xCE\x2E\x4F\x07\x8C\xB8\x93\x7D\x77\xE1\x09\x3A");
73+ RegisterTrustedModuleSHA1Hash("\x4E\xB7\xA0\x22\x14\x4B\x58\x6D\xBC\xF5\x21\x0D\x96\x78\x0D\x79\x7D\x66\xB2\xB0");
7374 // libeay32.dll 1.0.0e
74- RegisterTrustedModuleMD5Hash("\xA6\x4C\xAF\x9E\xF3\xDC\xFC\x68\xAE\xCA\xCC\x61\xD2\xF6\x70\x8B");
75+ RegisterTrustedModuleSHA1Hash("\x01\x32\x7A\xAE\x69\x26\xE6\x58\xC7\x63\x22\x1E\x53\x5A\x78\xBC\x61\xC7\xB5\xC1");
7576 #endif
7677 g_hOpenSSL = LoadLibrary("ssleay32.dll");
7778 if(!g_hOpenSSL)