ntdll: Randomize security cookie when available (try 5)
André Hentschel
nerv at dawncrow.de
Tue Jun 30 13:15:59 CDT 2015
---
dlls/ntdll/virtual.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c
index bc3f7cd..1a7ce2c 100644
--- a/dlls/ntdll/virtual.c
+++ b/dlls/ntdll/virtual.c
@@ -1278,6 +1278,24 @@ static NTSTATUS map_image( HANDLE hmapping, int fd, char *base, SIZE_T total_siz
}
}
+
+ /* randomize security cookie */
+
+ if (IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG < nt->OptionalHeader.NumberOfRvaAndSizes &&
+ (pos = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress))
+ {
+ IMAGE_LOAD_CONFIG_DIRECTORY *loadcfg = (IMAGE_LOAD_CONFIG_DIRECTORY *)(ptr + pos);
+ ULONG_PTR *cookie = (ULONG_PTR *)loadcfg->SecurityCookie;
+ ULONG seed = NtGetTickCount();
+
+ *cookie = RtlRandom( &seed );
+#ifdef _WIN64
+ /* Fill up, but keep the highest word clear */
+ *cookie ^= (ULONG_PTR)RtlRandom( &seed ) << 16;
+#endif
+ }
+
+
/* set the image protections */
VIRTUAL_SetProt( view, ptr, ROUND_SIZE( 0, header_size ), VPROT_COMMITTED | VPROT_READ );
--
1.9.1
More information about the wine-patches
mailing list