Prevent DLL search order hijacking for VentoyPlugson.exe and VentoyVlnk.exe

[Ventoy.git] / Plugson / src / main_windows.c

diff --git a/Plugson/src/main_windows.c b/Plugson/src/main_windows.c
index 910dfe53746262d91d49d07e8a3bfe1ca7ce8096..066eb63bfd9784d912303d2ef733cc82a9ce5040 100644 (file)
--- a/Plugson/src/main_windows.c
+++ b/Plugson/src/main_windows.c
@@ -10,6 +10,8 @@
 #include <ventoy_disk.h>\r
 #include <ventoy_http.h>\r
 \r
 #include <ventoy_disk.h>\r
 #include <ventoy_http.h>\r
 \r

+char g_ventoy_dir[MAX_PATH];
+\r

 static BOOL g_running = FALSE;\r
 static HWND g_refresh_button;\r
 static HWND g_start_button;\r
 static BOOL g_running = FALSE;\r
 static HWND g_refresh_button;\r
 static HWND g_start_button;\r


@@ -34,6 +36,7 @@ typedef enum MSGID
        MSGID_BTN_STOP_TIP, \r
        MSGID_BTN_EXIT_TIP,\r
        MSGID_RUNNING_TIP,\r
        MSGID_BTN_STOP_TIP, \r
        MSGID_BTN_EXIT_TIP,\r
        MSGID_RUNNING_TIP,\r

+       MSGID_NO_TARXZ_TIP,\r

 \r
     MSGID_BUTT\r
 }MSGID;\r
 \r
     MSGID_BUTT\r
 }MSGID;\r


@@ -56,6 +59,7 @@ const WCHAR *g_msg_cn[MSGID_BUTT] =
        L"Í£Ö¹ÔËÐкóä¯ÀÀÆ÷Ò³Ã潫»á¹Ø±Õ£¬ÊÇ·ñ¼ÌÐø£¿",\r
        L"µ±Ç°·þÎñÕýÔÚÔËÐУ¬ÊÇ·ñÍ˳ö£¿",\r
        L"ÇëÏȹرÕÕýÔÚÔËÐÐµÄ VentoyPlugson ³ÌÐò£¡",\r
        L"Í£Ö¹ÔËÐкóä¯ÀÀÆ÷Ò³Ã潫»á¹Ø±Õ£¬ÊÇ·ñ¼ÌÐø£¿",\r
        L"µ±Ç°·þÎñÕýÔÚÔËÐУ¬ÊÇ·ñÍ˳ö£¿",\r
        L"ÇëÏȹرÕÕýÔÚÔËÐÐµÄ VentoyPlugson ³ÌÐò£¡",\r

+       L"ventoy\\plugson.tar.xz Îļþ²»´æÔÚ£¬ÇëÔÚÕýÈ·µÄĿ¼ÏÂÔËÐУ¡",\r

 };\r
 const WCHAR *g_msg_en[MSGID_BUTT] =\r
 {\r
 };\r
 const WCHAR *g_msg_en[MSGID_BUTT] =\r
 {\r


@@ -74,6 +78,7 @@ const WCHAR *g_msg_en[MSGID_BUTT] =
        L"The browser page will close after stop, continue?",\r
        L"Service is running, continue?",\r
        L"Please close another running VentoyPlugson instance!",\r
        L"The browser page will close after stop, continue?",\r
        L"Service is running, continue?",\r
        L"Please close another running VentoyPlugson instance!",\r

+       L"ventoy\\plugson.tar.xz does not exist, please run under the correct directory!",\r

 };\r
 \r
 const WCHAR **g_msg_lang = NULL;\r
 };\r
 \r
 const WCHAR **g_msg_lang = NULL;\r


@@ -459,13 +464,70 @@ static int ParseCmdLine(LPSTR lpCmdLine, char *ip, char *port)
        return 0;\r
 }\r
 \r
        return 0;\r
 }\r
 \r

+\r
+\r
+//\r
+//copy from Rufus\r
+//\r
+#include <delayimp.h>\r
+// For delay-loaded DLLs, use LOAD_LIBRARY_SEARCH_SYSTEM32 to avoid DLL search order hijacking.\r
+FARPROC WINAPI dllDelayLoadHook(unsigned dliNotify, PDelayLoadInfo pdli)\r
+{\r
+       if (dliNotify == dliNotePreLoadLibrary) {\r
+               // Windows 7 without KB2533623 does not support the LOAD_LIBRARY_SEARCH_SYSTEM32 flag.\r
+               // That is is OK, because the delay load handler will interrupt the NULL return value\r
+               // to mean that it should perform a normal LoadLibrary.\r
+               return (FARPROC)LoadLibraryExA(pdli->szDll, NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);\r
+       }\r
+       return NULL;\r
+}\r
+\r
+#if defined(_MSC_VER)\r
+// By default the Windows SDK headers have a `const` while MinGW does not.\r
+const\r
+#endif\r
+PfnDliHook __pfnDliNotifyHook2 = dllDelayLoadHook;\r
+\r
+typedef BOOL(WINAPI* SetDefaultDllDirectories_t)(DWORD);\r
+static void DllProtect(void)\r
+{\r
+       SetDefaultDllDirectories_t pfSetDefaultDllDirectories = NULL;\r
+\r
+       // Disable loading system DLLs from the current directory (sideloading mitigation)\r
+       // PS: You know that official MSDN documentation for SetDllDirectory() that explicitly\r
+       // indicates that "If the parameter is an empty string (""), the call removes the current\r
+       // directory from the default DLL search order"? Yeah, that doesn't work. At all.\r
+       // Still, we invoke it, for platforms where the following call might actually work...\r
+       SetDllDirectoryA("");\r
+\r
+       // For libraries on the KnownDLLs list, the system will always load them from System32.\r
+       // For other DLLs we link directly to, we can delay load the DLL and use a delay load\r
+       // hook to load them from System32. Note that, for this to work, something like:\r
+       // 'somelib.dll;%(DelayLoadDLLs)' must be added to the 'Delay Loaded Dlls' option of\r
+       // the linker properties in Visual Studio (which means this won't work with MinGW).\r
+       // For all other DLLs, use SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32).\r
+       // Finally, we need to perform the whole gymkhana below, where we can't call on\r
+       // SetDefaultDllDirectories() directly, because Windows 7 doesn't have the API exposed.\r
+       // Also, no, Coverity, we never need to care about freeing kernel32 as a library.\r
+       // coverity[leaked_storage]\r
+\r
+       pfSetDefaultDllDirectories = (SetDefaultDllDirectories_t)\r
+               GetProcAddress(LoadLibraryW(L"kernel32.dll"), "SetDefaultDllDirectories");\r
+       if (pfSetDefaultDllDirectories != NULL)\r
+               pfSetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32);\r
+}\r
+\r
+\r

 int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, INT nCmdShow)\r
 {\r
     int rc;\r
        HANDLE hMutex;\r
 int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, INT nCmdShow)\r
 {\r
     int rc;\r
        HANDLE hMutex;\r

+       WCHAR CurDir[MAX_PATH];\r

 \r
     UNREFERENCED_PARAMETER(hPrevInstance);\r
 \r
 \r
     UNREFERENCED_PARAMETER(hPrevInstance);\r
 \r

+       DllProtect();\r
+\r

     if (GetUserDefaultUILanguage() == 0x0804)\r
     {\r
         g_sysinfo.language = LANGUAGE_CN;\r
     if (GetUserDefaultUILanguage() == 0x0804)\r
     {\r
         g_sysinfo.language = LANGUAGE_CN;\r


@@ -484,10 +546,18 @@ int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLi
                return 1;\r
        }\r
 \r
                return 1;\r
        }\r
 \r

-       GetCurrentDirectoryA(MAX_PATH, g_cur_dir);\r
+       GetCurrentDirectoryW(MAX_PATH, CurDir);\r
+       WideCharToMultiByte(CP_UTF8, 0, CurDir, -1, g_cur_dir, MAX_PATH, NULL, 0);\r
+\r
+       sprintf_s(g_ventoy_dir, sizeof(g_ventoy_dir), "%s", g_cur_dir);\r

        sprintf_s(g_log_file, sizeof(g_log_file), "%s\\%s", g_cur_dir, LOG_FILE);\r
        ventoy_log_init();\r
 \r
        sprintf_s(g_log_file, sizeof(g_log_file), "%s\\%s", g_cur_dir, LOG_FILE);\r
        ventoy_log_init();\r
 \r

+    if (!ventoy_is_file_exist("%s\\ventoy\\%s", g_ventoy_dir, PLUGSON_TXZ))\r
+    {        \r
+               MessageBoxW(NULL, g_msg_lang[MSGID_NO_TARXZ_TIP], g_msg_lang[MSGID_ERROR], MB_OK | MB_ICONERROR);\r
+        return 1;\r
+    }\r

 \r
        ParseCmdLine(lpCmdLine, g_sysinfo.ip, g_sysinfo.port);\r
        if (g_sysinfo.ip[0] == 0)\r
 \r
        ParseCmdLine(lpCmdLine, g_sysinfo.ip, g_sysinfo.port);\r
        if (g_sysinfo.ip[0] == 0)\r