From 237c6f1c9ea31737b9b19cde9ecf5eb5063d8958 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Wed, 13 Sep 2023 23:41:26 +0800 Subject: [PATCH] Processes / LocalIP: try increasing stability --- src/detection/localip/localip_windows.c | 16 ++++++----- src/detection/processes/processes_windows.c | 30 +++++++++++++-------- 2 files changed, 28 insertions(+), 18 deletions(-) diff --git a/src/detection/localip/localip_windows.c b/src/detection/localip/localip_windows.c index c986120ba..841a608e3 100644 --- a/src/detection/localip/localip_windows.c +++ b/src/detection/localip/localip_windows.c @@ -70,14 +70,16 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) { IP_ADAPTER_ADDRESSES* FF_AUTO_FREE adapter_addresses = NULL; - // Start with a 16 KB buffer and resize if needed - - // multiple attempts in case interfaces change while + // Multiple attempts in case interfaces change while // we are in the middle of querying them. - DWORD adapter_addresses_buffer_size = 16 * 1024; - for (int attempts = 0; attempts != 3; ++attempts) + DWORD adapter_addresses_buffer_size = 0; + for (int attempts = 0;; ++attempts) { - adapter_addresses = (IP_ADAPTER_ADDRESSES*)realloc(adapter_addresses, adapter_addresses_buffer_size); - assert(adapter_addresses); + if (adapter_addresses_buffer_size) + { + adapter_addresses = (IP_ADAPTER_ADDRESSES*)realloc(adapter_addresses, adapter_addresses_buffer_size); + assert(adapter_addresses); + } DWORD error = GetAdaptersAddresses( options->showType & FF_LOCALIP_TYPE_IPV4_BIT @@ -90,7 +92,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results) if (error == ERROR_SUCCESS) break; - else if (ERROR_BUFFER_OVERFLOW == error) + else if (ERROR_BUFFER_OVERFLOW == error && attempts < 4) continue; else return "GetAdaptersAddresses() failed"; diff --git a/src/detection/processes/processes_windows.c b/src/detection/processes/processes_windows.c index dc784c5db..fb29cd210 100644 --- a/src/detection/processes/processes_windows.c +++ b/src/detection/processes/processes_windows.c @@ -6,18 +6,26 @@ const char* ffDetectProcesses(uint32_t* result) { + SYSTEM_PROCESS_INFORMATION* FF_AUTO_FREE pstart = NULL; + + // Multiple attempts in case processes change while + // we are in the middle of querying them. ULONG size = 0; - if(NtQuerySystemInformation(SystemProcessInformation, NULL, 0, &size) != STATUS_INFO_LENGTH_MISMATCH) - return "NtQuerySystemInformation(SystemProcessInformation, NULL) failed"; - - size += sizeof(SystemProcessInformation) * 5; //What if new processes are created during two syscalls? - - SYSTEM_PROCESS_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PROCESS_INFORMATION*)malloc(size); - if(!pstart) - return "malloc(size) failed"; - - if(!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, pstart, size, NULL))) - return "NtQuerySystemInformation(SystemProcessInformation, pstart) failed"; + for (int attempts = 0;; ++attempts) + { + if (size) + { + pstart = (SYSTEM_PROCESS_INFORMATION*)realloc(pstart, size); + assert(pstart); + } + NTSTATUS status = NtQuerySystemInformation(SystemProcessInformation, pstart, size, &size); + if(NT_SUCCESS(status)) + break; + else if(status == STATUS_INFO_LENGTH_MISMATCH && attempts < 4) + size += sizeof(SYSTEM_PROCESS_INFORMATION) * 5; + else + return "NtQuerySystemInformation(SystemProcessInformation) failed"; + } *result = 1; //Init with 1 because we test for ptr->NextEntryOffset for (SYSTEM_PROCESS_INFORMATION* ptr = pstart; ptr->NextEntryOffset; ptr = (SYSTEM_PROCESS_INFORMATION*)((uint8_t*)ptr + ptr->NextEntryOffset))