From 9931511337221dcbfaaf65ed6a460c4812108b3a Mon Sep 17 00:00:00 2001 From: Johnny Shaw Date: Thu, 19 Sep 2024 15:10:43 -0600 Subject: [PATCH] cleanup debug prints --- vfdynf/delayld.c | 22 ++++++------- vfdynf/dllmain.c | 57 ++++++++++++++------------------ vfdynf/except.c | 5 ++- vfdynf/fault.c | 81 +++++++++++++++++----------------------------- vfdynf/fuzz.c | 12 +++---- vfdynf/stop.c | 8 ++--- vfdynf/symprv.c | 84 ++++++++++++++++++++---------------------------- vfdynf/vfdynf.h | 15 +++++++++ 8 files changed, 126 insertions(+), 158 deletions(-) diff --git a/vfdynf/delayld.c b/vfdynf/delayld.c index b7904fc..ba9cdf5 100644 --- a/vfdynf/delayld.c +++ b/vfdynf/delayld.c @@ -90,11 +90,11 @@ BOOLEAN NTAPI AVrfpDelayLoad( status = LdrLoadDll(NULL, NULL, &dllEntry->DllName, &baseAddress); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to delay load %wZ (0x%08x)\n", - &dllEntry->DllName, - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to delay load %wZ (0x%08x)", + &dllEntry->DllName, + status); + goto Exit; } @@ -110,12 +110,12 @@ BOOLEAN NTAPI AVrfpDelayLoad( entry->Store); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to delay load %wZ!%wZ (0x%08x)\n", - &dllEntry->DllName, - &entry->ProcedureName, - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to delay load %wZ!%hZ (0x%08x)", + &dllEntry->DllName, + &entry->ProcedureName, + status); + __debugbreak(); goto Exit; } diff --git a/vfdynf/dllmain.c b/vfdynf/dllmain.c index 343a2b2..bbd8236 100644 --- a/vfdynf/dllmain.c +++ b/vfdynf/dllmain.c @@ -625,9 +625,8 @@ VOID AVrfpRefreshLoadedModuleList( module = RtlAllocateHeap(RtlProcessHeap(), 0, size); if (!module) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to allocate module entry\n"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to allocate module entry"); + __debugbreak(); continue; } @@ -852,9 +851,9 @@ BOOLEAN AVrfpProviderProcessVerifier( desc = (PRTL_VERIFIER_PROVIDER_DESCRIPTOR*)Reserved; if (!desc) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: expected descriptor output parameter is null"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, + "expected descriptor output parameter is null"); + return FALSE; } @@ -863,10 +862,10 @@ BOOLEAN AVrfpProviderProcessVerifier( status = VerifierRegisterProvider(Module, &AVrfpProviderDescriptor); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: provider registration failed (0x%08x)", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "provider registration failed (0x%08x)", + status); + return FALSE; } @@ -885,10 +884,10 @@ BOOLEAN AVrfpProviderProcessAttach( 0); if (err != ERROR_SUCCESS) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: layer registration failed (%lu)", - err); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "layer registration failed (%lu)", + err); + return FALSE; } @@ -906,54 +905,48 @@ BOOLEAN AVrfpProviderProcessAttach( if (!AVrfLinkHooks()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to link hooks"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to link hooks"); + __debugbreak(); return FALSE; } if (!AVrfSymProcessAttach()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to setup symbol provider"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to setup symbol provider"); + __debugbreak(); return FALSE; } if (!AVrfStopProcessAttach()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to setup stop handling"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to setup stop handling"); + __debugbreak(); return FALSE; } if (!AVrfFuzzProcessAttach()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to setup fuzzing"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to setup fuzzing"); + __debugbreak(); return FALSE; } if (!AVrfExceptProcessAttach()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to set exception handler"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to set exception handler"); + __debugbreak(); return FALSE; } if (!AVrfFaultProcessAttach()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to setup fault injection"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to setup fault injection"); + __debugbreak(); return FALSE; } diff --git a/vfdynf/except.c b/vfdynf/except.c index 9b53a04..1090151 100644 --- a/vfdynf/except.c +++ b/vfdynf/except.c @@ -73,9 +73,8 @@ VOID AVrfGuardToConvertToInPageError( } else { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: out of guard page slots!"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "out of guard page slots"); + __debugbreak(); } diff --git a/vfdynf/fault.c b/vfdynf/fault.c index 28ee0c1..e00dfb0 100644 --- a/vfdynf/fault.c +++ b/vfdynf/fault.c @@ -113,9 +113,8 @@ BOOLEAN AVrfpInitExclusionsRegexInternal( count * sizeof(PCRE2_HANDLE)); if (!Exclusion->Regex) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to allocate exclusion regex!\n"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to allocate exclusion regex"); + __debugbreak(); return FALSE; } @@ -137,10 +136,10 @@ BOOLEAN AVrfpInitExclusionsRegexInternal( status = Pcre2Compile(®ex, &pattern); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed processing regex! (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "regex failed to compile (0x%08x)", + status); + __debugbreak(); return FALSE; } @@ -198,10 +197,10 @@ BOOLEAN AVrfpInitIncludeRegex( status = Pcre2Compile(&AVrfpFaultContext.IncludeRegex, &pattern); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed processing regex! (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "regex failed to compile (0x%08x)", + status); + __debugbreak(); return FALSE; } @@ -219,10 +218,10 @@ BOOLEAN AVrfpInitIncludeRegex( status = Pcre2Compile(&AVrfpFaultContext.TypeIncludeRegex[i], &pattern); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed processing regex! (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "regex failed to compile (0x%08x)", + status); + __debugbreak(); return FALSE; } @@ -340,19 +339,11 @@ BOOLEAN AVrfIsCallerIncluded( if (!AVrfpFaultContext.Initialized) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: fault injection not yet initialized\n"); - return FALSE; } if (!CallerAddress) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: caller address is null\n"); - return FALSE; } @@ -486,9 +477,7 @@ VOID AVrfpCacheFaultInjectResult( StackHash); if (!stackEntry) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to insert new stack entry!\n"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "failed to insert new stack entry"); goto Exit; } @@ -526,19 +515,11 @@ BOOLEAN AVrfShouldFaultInject( if (!AVrfpFaultContext.Initialized) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: fault injection not yet initialized\n"); - goto Exit; } if (!CallerAddress) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: caller address is null\n"); - goto Exit; } @@ -609,10 +590,9 @@ BOOLEAN AVrfShouldFaultInject( &AVrfpFaultContext.SymTimeout); if (status != STATUS_SUCCESS) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: AVrfSymGetSymbol failed (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "AVrfSymGetSymbol failed (0x%08x)", + status); goto Exit; } @@ -677,9 +657,9 @@ BOOLEAN AVrfFaultProcessAttach( if (!AVrfpInitRegex()) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to initialized exclusions regex!\n"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, + "failed to initialize exclusions regex"); + __debugbreak(); return FALSE; } @@ -688,10 +668,10 @@ BOOLEAN AVrfFaultProcessAttach( &AVrfpFaultContext.TypeBase); if (err != ERROR_SUCCESS) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to register fault injection provider (%lu)\n", - err); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to register fault injection provider (%lu)", + err); + return FALSE; } @@ -757,10 +737,9 @@ BOOLEAN AVrfFaultProcessAttach( seed = HandleToULong(NtCurrentThreadId()) ^ NtGetTickCount(); rand = RtlRandomEx(&seed); - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_INFO_LEVEL, - "AVRF: generated and using random fault injection seed %lu\n", - rand); + AVrfDbgPrint(DPFLTR_INFO_LEVEL, + "generated and using random fault injection seed %lu", + rand); VerifierSetFaultInjectionSeed(rand); } @@ -771,9 +750,7 @@ BOOLEAN AVrfFaultProcessAttach( AVrfInitializeCriticalSection(&AVrfpFaultContext.CriticalSection); - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_INFO_LEVEL, - "AVRF: dynamic fault injection initialized\n"); + AVrfDbgPuts(DPFLTR_INFO_LEVEL, "dynamic fault injection initialized"); AVrfpFaultContext.Initialized = TRUE; return TRUE; diff --git a/vfdynf/fuzz.c b/vfdynf/fuzz.c index b771cea..9faa41e 100644 --- a/vfdynf/fuzz.c +++ b/vfdynf/fuzz.c @@ -133,10 +133,10 @@ BOOLEAN NTAPI AVrfpFuzzRunOnceRoutine( if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to initialize fuzz vector (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to initialize fuzz vector (0x%08x)", + status); + __debugbreak(); return FALSE; } @@ -607,9 +607,7 @@ PVOID AVrfFuzzMemoryMapping( } else { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: out of fuzzing mmap slots!"); + AVrfDbgPuts(DPFLTR_ERROR_LEVEL, "out of fuzzing mmap slots"); __debugbreak(); RtlFreeHeap(RtlProcessHeap(), 0, baseAddress); diff --git a/vfdynf/stop.c b/vfdynf/stop.c index 3709611..2941ab0 100644 --- a/vfdynf/stop.c +++ b/vfdynf/stop.c @@ -78,10 +78,10 @@ BOOLEAN AVrfStopProcessAttach( status = Pcre2Compile(&AVrfpStopRegex, &pattern); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed processing regex! (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "regex failed to compile (0x%08x)", + status); + __debugbreak(); return FALSE; } diff --git a/vfdynf/symprv.c b/vfdynf/symprv.c index 5eb9314..1b09110 100644 --- a/vfdynf/symprv.c +++ b/vfdynf/symprv.c @@ -178,34 +178,30 @@ BOOL CALLBACK AVrfpSymRegsteredSymbolCallback( { case CBA_DEFERRED_SYMBOL_LOAD_COMPLETE: { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_INFO_LEVEL, - "AVRF: loaded symbols %ls\n", - info->FileName); + AVrfDbgPrint(DPFLTR_INFO_LEVEL, + "loaded symbols %ls", + info->FileName); break; } case CBA_DEFERRED_SYMBOL_LOAD_FAILURE: { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to loaded symbols %ls\n", - info->FileName); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to loaded symbols %ls", + info->FileName); break; } case CBA_DEFERRED_SYMBOL_LOAD_PARTIAL: { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: partially loaded symbols %ls\n", - info->FileName); + AVrfDbgPrint(DPFLTR_WARNING_LEVEL, + "partially loaded symbols %ls", + info->FileName); break; } case CBA_SYMBOLS_UNLOADED: { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_INFO_LEVEL, - "AVRF: unloaded symbols %ls\n", - info->FileName); + AVrfDbgPrint(DPFLTR_INFO_LEVEL, + "unloaded symbols %ls", + info->FileName); break; } default: @@ -232,10 +228,9 @@ BOOLEAN NTAPI AVrfpSymRunOnceRoutine( { if (!Delay_SymInitializeW(NtCurrentProcess(), NULL, FALSE)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to initialize symbols (%lu)\n", - NtCurrentTeb()->LastErrorValue); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to initialize symbols (%lu)", + NtCurrentTeb()->LastErrorValue); result = FALSE; goto Exit; @@ -247,10 +242,9 @@ BOOLEAN NTAPI AVrfpSymRunOnceRoutine( AVrfProperties.SymbolSearchPath, FALSE)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to initialize symbols (%lu)\n", - NtCurrentTeb()->LastErrorValue); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to initialize symbols (%lu)", + NtCurrentTeb()->LastErrorValue); result = FALSE; goto Exit; @@ -396,10 +390,9 @@ NTSTATUS AVrfpSymResolveSymbols( status = RtlAppendUnicodeStringToString(&Sym->StackSymbols, &symbol); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: failed to append symbol to stack string (0x%08x)!\n", - status); + AVrfDbgPrint(DPFLTR_WARNING_LEVEL, + "failed to append symbol to stack string (0x%08x)", + status); status = STATUS_SUCCESS; goto Exit; @@ -408,10 +401,9 @@ NTSTATUS AVrfpSymResolveSymbols( status = RtlAppendUnicodeToString(&Sym->StackSymbols, L"\n"); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: failed to append new line to stack string (0x%08x)!\n", - status); + AVrfDbgPrint(DPFLTR_WARNING_LEVEL, + "failed to append new line to stack string (0x%08x)", + status); status = STATUS_SUCCESS; goto Exit; @@ -474,10 +466,7 @@ NTSTATUS AVrfpSymDllLoad( if (!AVrfEnumLoadedModules(AVrfpSymDllLoadModuleCallback, &context)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to locate %ls\n", - Sym->DllName); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, "failed to locate %ls", Sym->DllName); return STATUS_NOT_FOUND; } @@ -496,11 +485,10 @@ NTSTATUS AVrfpSymDllLoad( 0) && NtCurrentTeb()->LastErrorValue) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_WARNING_LEVEL, - "AVRF: SymLoadModuleExW failed %ls (%lu)\n", - Sym->DllName, - NtCurrentTeb()->LastErrorValue); + AVrfDbgPrint(DPFLTR_WARNING_LEVEL, + "SymLoadModuleExW failed %ls (%lu)", + Sym->DllName, + NtCurrentTeb()->LastErrorValue); } AVrfLeaveCriticalSection(&AVrfpSymContext.CriticalSection); @@ -749,10 +737,9 @@ BOOLEAN AVrfSymProcessAttach( FALSE); if (!NT_SUCCESS(status)) { - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to create symbol provider event (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to create symbol provider event (0x%08x)", + status); return FALSE; } @@ -772,10 +759,9 @@ BOOLEAN AVrfSymProcessAttach( NtClose(AVrfpSymContext.WorkQueueEvent); AVrfpSymContext.WorkQueueEvent = NULL; - DbgPrintEx(DPFLTR_VERIFIER_ID, - DPFLTR_ERROR_LEVEL, - "AVRF: failed to create symbol provider thread (0x%08x)\n", - status); + AVrfDbgPrint(DPFLTR_ERROR_LEVEL, + "failed to create symbol provider thread (0x%08x)", + status); return FALSE; } diff --git a/vfdynf/vfdynf.h b/vfdynf/vfdynf.h index b40e83b..81abba8 100644 --- a/vfdynf/vfdynf.h +++ b/vfdynf/vfdynf.h @@ -49,6 +49,21 @@ #define DPFLTR_VERIFIER_ID 93 #endif DPFLTR_MASK +#define AVrfDbgPrint(level, format, ...) \ +DbgPrintEx(DPFLTR_VERIFIER_ID, \ + level, \ + "AVRF [%04x:%04x]: " format "\n", \ + (USHORT)(ULONG_PTR)NtCurrentProcessId(), \ + (USHORT)(ULONG_PTR)NtCurrentThreadId(), \ + __VA_ARGS__) + +#define AVrfDbgPuts(level, string) \ +DbgPrintEx(DPFLTR_VERIFIER_ID, \ + level, \ + "AVRF [%04x:%04x]: " string "\n", \ + (USHORT)(ULONG_PTR)NtCurrentProcessId(), \ + (USHORT)(ULONG_PTR)NtCurrentThreadId()) + #ifdef _DEBUG #define AVRF_ASSERT(_exp) _Analysis_assume_(_exp); if (!(_exp)) __debugbreak() #else