Prevent DLL search order hijacking for VentoyPlugson.exe and VentoyVlnk.exe

[Ventoy.git] / Plugson / src / main_windows.c

diff --git a/Plugson/src/main_windows.c b/Plugson/src/main_windows.c
index 910dfe53746262d91d49d07e8a3bfe1ca7ce8096..066eb63bfd9784d912303d2ef733cc82a9ce5040 100644 (file)
--- a/Plugson/src/main_windows.c
+++ b/Plugson/src/main_windows.c
@@ -10,6 +10,8 @@
 #include <ventoy_disk.h>\r
 #include <ventoy_http.h>\r
 \r
+char g_ventoy_dir[MAX_PATH];
+\r
 static BOOL g_running = FALSE;\r
 static HWND g_refresh_button;\r
 static HWND g_start_button;\r
@@ -34,6 +36,7 @@ typedef enum MSGID
        MSGID_BTN_STOP_TIP, \r
        MSGID_BTN_EXIT_TIP,\r
        MSGID_RUNNING_TIP,\r
+       MSGID_NO_TARXZ_TIP,\r
 \r
     MSGID_BUTT\r
 }MSGID;\r
@@ -56,6 +59,7 @@ const WCHAR *g_msg_cn[MSGID_BUTT] =
        L"Í£Ö¹ÔËÐкóä¯ÀÀÆ÷Ò³Ã潫»á¹Ø±Õ£¬ÊÇ·ñ¼ÌÐø£¿",\r
        L"µ±Ç°·þÎñÕýÔÚÔËÐУ¬ÊÇ·ñÍ˳ö£¿",\r
        L"ÇëÏȹرÕÕýÔÚÔËÐÐµÄ VentoyPlugson ³ÌÐò£¡",\r
+       L"ventoy\\plugson.tar.xz Îļþ²»´æÔÚ£¬ÇëÔÚÕýÈ·µÄĿ¼ÏÂÔËÐУ¡",\r
 };\r
 const WCHAR *g_msg_en[MSGID_BUTT] =\r
 {\r
@@ -74,6 +78,7 @@ const WCHAR *g_msg_en[MSGID_BUTT] =
        L"The browser page will close after stop, continue?",\r
        L"Service is running, continue?",\r
        L"Please close another running VentoyPlugson instance!",\r
+       L"ventoy\\plugson.tar.xz does not exist, please run under the correct directory!",\r
 };\r
 \r
 const WCHAR **g_msg_lang = NULL;\r
@@ -459,13 +464,70 @@ static int ParseCmdLine(LPSTR lpCmdLine, char *ip, char *port)
        return 0;\r
 }\r
 \r
+\r
+\r
+//\r
+//copy from Rufus\r
+//\r
+#include <delayimp.h>\r
+// For delay-loaded DLLs, use LOAD_LIBRARY_SEARCH_SYSTEM32 to avoid DLL search order hijacking.\r
+FARPROC WINAPI dllDelayLoadHook(unsigned dliNotify, PDelayLoadInfo pdli)\r
+{\r
+       if (dliNotify == dliNotePreLoadLibrary) {\r
+               // Windows 7 without KB2533623 does not support the LOAD_LIBRARY_SEARCH_SYSTEM32 flag.\r
+               // That is is OK, because the delay load handler will interrupt the NULL return value\r
+               // to mean that it should perform a normal LoadLibrary.\r
+               return (FARPROC)LoadLibraryExA(pdli->szDll, NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);\r
+       }\r
+       return NULL;\r
+}\r
+\r
+#if defined(_MSC_VER)\r
+// By default the Windows SDK headers have a `const` while MinGW does not.\r
+const\r
+#endif\r
+PfnDliHook __pfnDliNotifyHook2 = dllDelayLoadHook;\r
+\r
+typedef BOOL(WINAPI* SetDefaultDllDirectories_t)(DWORD);\r
+static void DllProtect(void)\r
+{\r
+       SetDefaultDllDirectories_t pfSetDefaultDllDirectories = NULL;\r
+\r
+       // Disable loading system DLLs from the current directory (sideloading mitigation)\r
+       // PS: You know that official MSDN documentation for SetDllDirectory() that explicitly\r
+       // indicates that "If the parameter is an empty string (""), the call removes the current\r
+       // directory from the default DLL search order"? Yeah, that doesn't work. At all.\r
+       // Still, we invoke it, for platforms where the following call might actually work...\r
+       SetDllDirectoryA("");\r
+\r
+       // For libraries on the KnownDLLs list, the system will always load them from System32.\r
+       // For other DLLs we link directly to, we can delay load the DLL and use a delay load\r
+       // hook to load them from System32. Note that, for this to work, something like:\r
+       // 'somelib.dll;%(DelayLoadDLLs)' must be added to the 'Delay Loaded Dlls' option of\r
+       // the linker properties in Visual Studio (which means this won't work with MinGW).\r
+       // For all other DLLs, use SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32).\r
+       // Finally, we need to perform the whole gymkhana below, where we can't call on\r
+       // SetDefaultDllDirectories() directly, because Windows 7 doesn't have the API exposed.\r
+       // Also, no, Coverity, we never need to care about freeing kernel32 as a library.\r
+       // coverity[leaked_storage]\r
+\r
+       pfSetDefaultDllDirectories = (SetDefaultDllDirectories_t)\r
+               GetProcAddress(LoadLibraryW(L"kernel32.dll"), "SetDefaultDllDirectories");\r
+       if (pfSetDefaultDllDirectories != NULL)\r
+               pfSetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32);\r
+}\r
+\r
+\r
 int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, INT nCmdShow)\r
 {\r
     int rc;\r
        HANDLE hMutex;\r
+       WCHAR CurDir[MAX_PATH];\r
 \r
     UNREFERENCED_PARAMETER(hPrevInstance);\r
 \r
+       DllProtect();\r
+\r
     if (GetUserDefaultUILanguage() == 0x0804)\r
     {\r
         g_sysinfo.language = LANGUAGE_CN;\r
@@ -484,10 +546,18 @@ int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLi
                return 1;\r
        }\r
 \r
-       GetCurrentDirectoryA(MAX_PATH, g_cur_dir);\r
+       GetCurrentDirectoryW(MAX_PATH, CurDir);\r
+       WideCharToMultiByte(CP_UTF8, 0, CurDir, -1, g_cur_dir, MAX_PATH, NULL, 0);\r
+\r
+       sprintf_s(g_ventoy_dir, sizeof(g_ventoy_dir), "%s", g_cur_dir);\r
        sprintf_s(g_log_file, sizeof(g_log_file), "%s\\%s", g_cur_dir, LOG_FILE);\r
        ventoy_log_init();\r
 \r
+    if (!ventoy_is_file_exist("%s\\ventoy\\%s", g_ventoy_dir, PLUGSON_TXZ))\r
+    {        \r
+               MessageBoxW(NULL, g_msg_lang[MSGID_NO_TARXZ_TIP], g_msg_lang[MSGID_ERROR], MB_OK | MB_ICONERROR);\r
+        return 1;\r
+    }\r
 \r
        ParseCmdLine(lpCmdLine, g_sysinfo.ip, g_sysinfo.port);\r
        if (g_sysinfo.ip[0] == 0)\r