Commit: 1d38d1729082dfaadf5a9e2c1b16afc6789aaceb - ffftp (git)

FFFTPのソースコードです。

Commit MetaInfo

• Revisão: 1d38d1729082dfaadf5a9e2c1b16afc6789aaceb (tree)
• Hora: 2011-10-10 19:23:00
• Autor: s_kawamoto <s_kawamoto@user...>
• Commiter: s_kawamoto

Mensagem de Log

Add process protection levels (--protect-high by default but --protect-medium and --protect-low mainly for halfway signed modules).

Mudança Sumário

• modified: FFFTP_Eng_Release/FFFTP.exe
• modified: Release/FFFTP.exe
• modified: main.c
• modified: protectprocess.c
• modified: protectprocess.h
• modified: socketwrapper.c

Diff

Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ

Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ

--- a/main.c
+++ b/main.c
@@ -234,21 +234,37 @@ int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdLi
 
 	// プロセス保護
 #ifdef ENABLE_PROCESS_PROTECTION
-	BOOL bProtect;
+	DWORD ProtectLevel;
 	char* pCommand;
 	char Option[FMAX_PATH+1];
-	bProtect = FALSE;
+	ProtectLevel = PROCESS_PROTECTION_NONE;
 	pCommand = lpszCmdLine;
 	while(pCommand = GetToken(pCommand, Option))
 	{
 		if(strcmp(Option, "--protect") == 0)
 		{
-			bProtect = TRUE;
+			ProtectLevel = PROCESS_PROTECTION_DEFAULT;
+			break;
+		}
+		else if(strcmp(Option, "--protect-high") == 0)
+		{
+			ProtectLevel = PROCESS_PROTECTION_HIGH;
+			break;
+		}
+		else if(strcmp(Option, "--protect-medium") == 0)
+		{
+			ProtectLevel = PROCESS_PROTECTION_MEDIUM;
+			break;
+		}
+		else if(strcmp(Option, "--protect-low") == 0)
+		{
+			ProtectLevel = PROCESS_PROTECTION_LOW;
 			break;
 		}
 	}
-	if(bProtect)
+	if(ProtectLevel != PROCESS_PROTECTION_NONE)
 	{
+		SetProcessProtectionLevel(ProtectLevel);
 		if(!InitializeLoadLibraryHook())
 		{
 			MessageBox(NULL, MSGJPN321, "FFFTP", MB_OK | MB_ICONERROR);
@@ -1755,6 +1771,15 @@ static int AnalyzeComLine(char *Str, int *AutoConnect, int *CmdOption, char *unc
 			else if(strcmp(Tmp, "--protect") == 0)
 			{
 			}
+			else if(strcmp(Tmp, "--protect-high") == 0)
+			{
+			}
+			else if(strcmp(Tmp, "--protect-medium") == 0)
+			{
+			}
+			else if(strcmp(Tmp, "--protect-low") == 0)
+			{
+			}
 #endif
 			else
 			{

--- a/protectprocess.c
+++ b/protectprocess.c
@@ -55,7 +55,7 @@ BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRe
 BOOL HookFunctionInIAT(void* pOriginal, void* pNew);
 #endif
 HANDLE LockExistingFile(LPCWSTR Filename);
-BOOL FindTrustedModuleMD5Hash(void* pHash);
+BOOL FindTrustedModuleSHA1Hash(void* pHash);
 BOOL VerifyFileSignature(LPCWSTR Filename);
 BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename);
 BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash);
@@ -96,9 +96,10 @@ _CryptCATAdminCalcHashFromFileHandle p_CryptCATAdminCalcHashFromFileHandle;
 #define MAX_TRUSTED_FILENAME_TABLE 16
 #define MAX_TRUSTED_MD5_HASH_TABLE 16
 
+DWORD g_ProcessProtectionLevel;
 DWORD g_LockedThread[MAX_LOCKED_THREAD];
 WCHAR* g_pTrustedFilenameTable[MAX_TRUSTED_FILENAME_TABLE];
-BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][16];
+BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][20];
 
 // 以下フック関数
 // フック対象を呼び出す場合は前後でSTART_HOOK_FUNCTIONとEND_HOOK_FUNCTIONを実行する必要がある
@@ -169,19 +170,15 @@ HMODULE WINAPI h_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFla
 			hLock = LockExistingFile(lpLibFileName);
 			FreeLibrary(hModule);
 		}
-		if(GetModuleHandleW(lpLibFileName))
+		if((g_ProcessProtectionLevel & PROCESS_PROTECTION_LOADED) && GetModuleHandleW(lpLibFileName))
 			bTrusted = TRUE;
 	}
 	if(!bTrusted)
 	{
-		if(LockThreadLock())
+		if(hLock)
 		{
-			if(hLock)
-			{
-				if(IsModuleTrusted(lpLibFileName))
-					bTrusted = TRUE;
-			}
-			UnlockThreadLock();
+			if(IsModuleTrusted(lpLibFileName))
+				bTrusted = TRUE;
 		}
 	}
 	if(bTrusted)
@@ -370,7 +367,7 @@ HANDLE LockExistingFile(LPCWSTR Filename)
 }
 
 // DLLのハッシュを検索
-BOOL FindTrustedModuleMD5Hash(void* pHash)
+BOOL FindTrustedModuleSHA1Hash(void* pHash)
 {
 	BOOL bResult;
 	int i;
@@ -378,7 +375,7 @@ BOOL FindTrustedModuleMD5Hash(void* pHash)
 	i = 0;
 	while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 	{
-		if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
+		if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
 		{
 			bResult = TRUE;
 			break;
@@ -395,6 +392,7 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
 	GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
 	WINTRUST_FILE_INFO wfi;
 	WINTRUST_DATA wd;
+	LONG Error;
 	bResult = FALSE;
 	ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
 	wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
@@ -404,7 +402,12 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
 	wd.dwUIChoice = WTD_UI_NONE;
 	wd.dwUnionChoice = WTD_CHOICE_FILE;
 	wd.pFile = &wfi;
-	if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
+	Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
+	if(Error == ERROR_SUCCESS)
+		bResult = TRUE;
+	else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
+		bResult = TRUE;
+	else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
 		bResult = TRUE;
 	return bResult;
 }
@@ -416,6 +419,7 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
 	GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
 	WINTRUST_CATALOG_INFO wci;
 	WINTRUST_DATA wd;
+	LONG Error;
 	bResult = FALSE;
 	if(VerifyFileSignature(Catalog))
 	{
@@ -435,7 +439,12 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
 					wd.dwUIChoice = WTD_UI_NONE;
 					wd.dwUnionChoice = WTD_CHOICE_CATALOG;
 					wd.pCatalog = &wci;
-					if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
+					Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
+					if(Error == ERROR_SUCCESS)
+						bResult = TRUE;
+					else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
+						bResult = TRUE;
+					else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
 						bResult = TRUE;
 				}
 				free(wci.pbCalculatedFileHash);
@@ -635,31 +644,34 @@ BOOL IsSxsModuleTrusted(LPCWSTR Filename)
 }
 
 // DLLを確認
-// ハッシュが登録されている、Authenticode署名がされている、またはWFPによる保護下にあることを確認
 BOOL IsModuleTrusted(LPCWSTR Filename)
 {
 	BOOL bResult;
-	BYTE Hash[16];
+	BYTE Hash[20];
 	bResult = FALSE;
-	if(GetMD5HashOfFile(Filename, &Hash))
+	if(LockThreadLock())
 	{
-		if(FindTrustedModuleMD5Hash(&Hash))
-			bResult = TRUE;
-	}
-	if(!bResult)
-	{
-		if(VerifyFileSignature(Filename))
-			bResult = TRUE;
-	}
-	if(!bResult)
-	{
-		if(IsSxsModuleTrusted(Filename))
-			bResult = TRUE;
-	}
-	if(!bResult)
-	{
-		if(SfcIsFileProtected(NULL, Filename))
-			bResult = TRUE;
+		if(GetSHA1HashOfFile(Filename, &Hash))
+		{
+			if(FindTrustedModuleSHA1Hash(&Hash))
+				bResult = TRUE;
+		}
+		if(!bResult)
+		{
+			if((g_ProcessProtectionLevel & PROCESS_PROTECTION_BUILTIN) && VerifyFileSignature(Filename))
+				bResult = TRUE;
+		}
+		if(!bResult)
+		{
+			if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SIDE_BY_SIDE) && IsSxsModuleTrusted(Filename))
+				bResult = TRUE;
+		}
+		if(!bResult)
+		{
+			if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SYSTEM_FILE) && SfcIsFileProtected(NULL, Filename))
+				bResult = TRUE;
+		}
+		UnlockThreadLock();
 	}
 	return bResult;
 }
@@ -739,8 +751,13 @@ HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
 	return r;
 }
 
-// ファイルのMD5ハッシュを取得
-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
+void SetProcessProtectionLevel(DWORD Level)
+{
+	g_ProcessProtectionLevel = Level;
+}
+
+// ファイルのSHA1ハッシュを取得
+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash)
 {
 	BOOL bResult;
 	HCRYPTPROV hProv;
@@ -752,7 +769,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
 	bResult = FALSE;
 	if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
 	{
-		if(CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
+		if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
 		{
 			if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
 			{
@@ -764,7 +781,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
 					{
 						if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
 						{
-							dw = 16;
+							dw = 20;
 							if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
 								bResult = TRUE;
 						}
@@ -782,22 +799,22 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
 }
 
 // DLLのハッシュを登録
-BOOL RegisterTrustedModuleMD5Hash(void* pHash)
+BOOL RegisterTrustedModuleSHA1Hash(void* pHash)
 {
 	BOOL bResult;
-	BYTE NullHash[16] = {0};
+	BYTE NullHash[20] = {0};
 	int i;
 	bResult = FALSE;
-	if(FindTrustedModuleMD5Hash(pHash))
+	if(FindTrustedModuleSHA1Hash(pHash))
 		bResult = TRUE;
 	else
 	{
 		i = 0;
 		while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 		{
-			if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 16) == 0)
+			if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 20) == 0)
 			{
-				memcpy(&g_TrustedMD5HashTable[i], pHash, 16);
+				memcpy(&g_TrustedMD5HashTable[i], pHash, 20);
 				bResult = TRUE;
 				break;
 			}
@@ -808,18 +825,18 @@ BOOL RegisterTrustedModuleMD5Hash(void* pHash)
 }
 
 // DLLのハッシュの登録を解除
-BOOL UnregisterTrustedModuleMD5Hash(void* pHash)
+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash)
 {
 	BOOL bResult;
-	BYTE NullHash[16] = {0};
+	BYTE NullHash[20] = {0};
 	int i;
 	bResult = FALSE;
 	i = 0;
 	while(i < MAX_TRUSTED_MD5_HASH_TABLE)
 	{
-		if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
+		if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
 		{
-			memcpy(&g_TrustedMD5HashTable[i], &NullHash, 16);
+			memcpy(&g_TrustedMD5HashTable[i], &NullHash, 20);
 			bResult = TRUE;
 			break;
 		}

--- a/protectprocess.h
+++ b/protectprocess.h
@@ -44,10 +44,30 @@ EXTERN_HOOK_FUNCTION_VAR(LoadLibraryExW)
 
 #endif
 
+// ロード済みのモジュールは検査をパス
+#define PROCESS_PROTECTION_LOADED 0x00000001
+// モジュールに埋め込まれたAuthenticode署名を検査
+#define PROCESS_PROTECTION_BUILTIN 0x00000002
+// サイドバイサイドのAuthenticode署名を検査
+#define PROCESS_PROTECTION_SIDE_BY_SIDE 0x00000004
+// WFPによる保護下にあるかを検査
+#define PROCESS_PROTECTION_SYSTEM_FILE 0x00000008
+// Authenticode署名の有効期限を無視
+#define PROCESS_PROTECTION_EXPIRED 0x00000010
+// Authenticode署名の発行元を無視
+#define PROCESS_PROTECTION_UNAUTHORIZED 0x00000020
+
+#define PROCESS_PROTECTION_NONE 0
+#define PROCESS_PROTECTION_DEFAULT PROCESS_PROTECTION_HIGH
+#define PROCESS_PROTECTION_HIGH (PROCESS_PROTECTION_BUILTIN | PROCESS_PROTECTION_SIDE_BY_SIDE | PROCESS_PROTECTION_SYSTEM_FILE)
+#define PROCESS_PROTECTION_MEDIUM (PROCESS_PROTECTION_HIGH | PROCESS_PROTECTION_LOADED | PROCESS_PROTECTION_EXPIRED)
+#define PROCESS_PROTECTION_LOW (PROCESS_PROTECTION_MEDIUM | PROCESS_PROTECTION_UNAUTHORIZED)
+
 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash);
-BOOL RegisterTrustedModuleMD5Hash(void* pHash);
-BOOL UnregisterTrustedModuleMD5Hash(void* pHash);
+void SetProcessProtectionLevel(DWORD Level);
+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash);
+BOOL RegisterTrustedModuleSHA1Hash(void* pHash);
+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash);
 BOOL UnloadUntrustedModule();
 BOOL InitializeLoadLibraryHook();
 BOOL EnableLoadLibraryHook(BOOL bEnable);

--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -67,11 +67,12 @@ BOOL LoadOpenSSL()
 	if(g_bOpenSSLLoaded)
 		return FALSE;
 #ifdef ENABLE_PROCESS_PROTECTION
+	// 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること
 	// ssleay32.dll 1.0.0e
 	// libssl32.dll 1.0.0e
-	RegisterTrustedModuleMD5Hash("\x8B\xA3\xB7\xB3\xCE\x2E\x4F\x07\x8C\xB8\x93\x7D\x77\xE1\x09\x3A");
+	RegisterTrustedModuleSHA1Hash("\x4E\xB7\xA0\x22\x14\x4B\x58\x6D\xBC\xF5\x21\x0D\x96\x78\x0D\x79\x7D\x66\xB2\xB0");
 	// libeay32.dll 1.0.0e
-	RegisterTrustedModuleMD5Hash("\xA6\x4C\xAF\x9E\xF3\xDC\xFC\x68\xAE\xCA\xCC\x61\xD2\xF6\x70\x8B");
+	RegisterTrustedModuleSHA1Hash("\x01\x32\x7A\xAE\x69\x26\xE6\x58\xC7\x63\x22\x1E\x53\x5A\x78\xBC\x61\xC7\xB5\xC1");
 #endif
 	g_hOpenSSL = LoadLibrary("ssleay32.dll");
 	if(!g_hOpenSSL)