Add the LookasideList and ExecutiveResource

Anti-Rootkit/ARK.cpp

@@ -12,7 +12,7 @@
 #include "..\KernelLibrary\SysMon.h"
 #include "..\KernelLibrary\Logging.h"
 
-
+// SE_IMAGE_SIGNATURE_TYPE
 
 // define a tag (because of little endianess, viewed in PoolMon as 'arkv'
 #define DRIVER_TAG 'vkra'

KernelLibrary/AutoLock.h

@@ -11,4 +11,18 @@ struct AutoLock {
 	}
 private:
 	TLock& _lock;
+};
+
+template<typename TLock>
+struct SharedLocker {
+	SharedLocker(TLock& lock) :m_lock(lock) {
+		m_lock.LockShared();
+	}
+
+	~SharedLocker() {
+		m_lock.UnlockShared();
+	}
+
+private:
+	TLock& m_lock;
 };

KernelLibrary/ExecutiveResource.cpp

@@ -0,0 +1,38 @@
+#include "pch.h"
+#include "ExecutiveResource.h"
+
+void ExecutiveResource::Init() {
+	ExInitializeResourceLite(&m_res);
+}
+
+void ExecutiveResource::Delete() {
+	ExDeleteResourceLite(&m_res);
+}
+
+void ExecutiveResource::Lock() {
+	// if normal kernel APCs are disabled
+	m_CritRegion = KeAreApcsDisabled();
+	if (m_CritRegion)
+		ExAcquireResourceExclusiveLite(&m_res, TRUE);
+	else
+		ExEnterCriticalRegionAndAcquireResourceExclusive(&m_res);
+}
+
+void ExecutiveResource::Unlock() {
+	if (m_CritRegion)
+		ExReleaseResourceLite(&m_res);
+	else
+		ExReleaseResourceAndLeaveCriticalRegion(&m_res);
+}
+
+void ExecutiveResource::LockShared() {
+	m_CritRegion = KeAreApcsDisabled();
+	if (m_CritRegion)
+		ExAcquireResourceSharedLite(&m_res, TRUE);
+	else
+		ExEnterCriticalRegionAndAcquireResourceShared(&m_res);
+}
+
+void ExecutiveResource::UnlockShared() {
+	Unlock();
+}

KernelLibrary/ExecutiveResource.h

@@ -0,0 +1,16 @@
+#pragma once
+
+struct ExecutiveResource {
+	void Init();
+	void Delete();
+
+	void Lock();
+	void Unlock();
+
+	void LockShared();
+	void UnlockShared();
+
+private:
+	ERESOURCE m_res;
+	bool m_CritRegion;
+};

KernelLibrary/KernelLibrary.vcxproj

@@ -236,6 +236,7 @@
     <ClInclude Include="CyclicBuffer.h" />
     <ClInclude Include="DbgDefender.h" />
     <ClInclude Include="DevMonManager.h" />
+    <ClInclude Include="ExecutiveResource.h" />
     <ClInclude Include="FastMutex.h" />
     <ClInclude Include="FileManager.h" />
     <ClInclude Include="GuardedRegion.h" />
@@ -246,6 +247,7 @@
     <ClInclude Include="kvector.h" />
     <ClInclude Include="LinkedList.h" />
     <ClInclude Include="Logging.h" />
+    <ClInclude Include="LookasideList.h" />
     <ClInclude Include="Memory.h" />
     <ClInclude Include="Mutex.h" />
     <ClInclude Include="ObjectAttributes.h" />
@@ -268,6 +270,7 @@
     <ClCompile Include="CyclicBuffer.cpp" />
     <ClCompile Include="DbgDefender.cpp" />
     <ClCompile Include="DevMonManager.cpp" />
+    <ClCompile Include="ExecutiveResource.cpp" />
     <ClCompile Include="FastMutex.cpp" />
     <ClCompile Include="FileManager.cpp" />
     <ClCompile Include="GuardedRegion.cpp" />
@@ -277,6 +280,7 @@
     <ClCompile Include="kvector.cpp" />
     <ClCompile Include="LinkedList.cpp" />
     <ClCompile Include="Logging.cpp" />
+    <ClCompile Include="LookasideList.cpp" />
     <ClCompile Include="Memory.cpp" />
     <ClCompile Include="Mutex.cpp" />
     <ClCompile Include="ObjectAttributes.cpp" />

KernelLibrary/KernelLibrary.vcxproj.filters

@@ -124,6 +124,12 @@
     <ClInclude Include="Win10_1903.h">
       <Filter>DbgCore</Filter>
     </ClInclude>
+    <ClInclude Include="ExecutiveResource.h">
+      <Filter>Synchronization</Filter>
+    </ClInclude>
+    <ClInclude Include="LookasideList.h">
+      <Filter>ktl</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="pch.cpp">
@@ -207,5 +213,11 @@
     <ClCompile Include="DbgDefender.cpp">
       <Filter>DbgCore</Filter>
     </ClCompile>
+    <ClCompile Include="ExecutiveResource.cpp">
+      <Filter>Synchronization</Filter>
+    </ClCompile>
+    <ClCompile Include="LookasideList.cpp">
+      <Filter>ktl</Filter>
+    </ClCompile>
   </ItemGroup>
 </Project>

KernelLibrary/LookasideList.cpp

@@ -0,0 +1,2 @@
+#include "pch.h"
+#include "LookasideList.h"

KernelLibrary/LookasideList.h

@@ -0,0 +1,20 @@
+#pragma once
+
+template<typename T>
+struct LookasideList {
+	NTSTATUS Init(POOL_TYPE pool, ULONG tag) {
+		return ExInitializeLookasideListEx(&m_lookaside, nullptr, nullptr,
+			pool, 0, sizeof(T), tag, 0);
+	}
+
+	void Delete() {
+		ExDeleteLookasideListEx(&m_lookaside);
+	}
+
+	T* Alloc() {
+		return (T*)ExAllocateFromLookasideListEx(&m_lookaside);
+	}
+
+private:
+	LOOKASIDE_LIST_EX m_lookaside;
+};