我的CVE-2025-29824"盲测"之旅 | STAR Labs

1
2
3
4
5
6
7

CClfsRequest::Cleanup(PIRP Irp){
    ...
    CClfsLogCcb::AddRef(FsContext2);
    CClfsLogCcb::Cleanup(FsContext2);
    CClfsLogCcb::Release(FsContext2);
    ...
}

1
2
3

CClfsLogCcb::AddRef(FsContext2){
    return _InterlockedIncrement(FsContext2->reference_count);
}

1
2
3
4
5
6
7
8

CClfsLogCcb::Release(FsContext2){
    refcount = _InterlockedDecrement(&FsContext2->reference_count);
    if ( !refcount && FsContext2 ){
        CClfsLogCcb::~CClfsLogCcb(FsContext2);
        ...
    }
    return refcount;
}

1
2
3
4
5

CClfsLogCcb::Cleanup(FsContext2)
{
    ...
    CClfsLogCcb::Release(FsContext2);
}

1
2
3
4
5
6
7

CClfsLogCcb::Cleanup(FsContext2)
{
    ...    
    if(!PatchFlag()){
        CClfsLogCcb::Release(FsContext2);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

CClfsRequest::Close(PIRP Irp){
    CClfsLogFcbCommon *ReservedContext;
    ...
    boolean = ExAcquireResourceExclusiveLite(&ReservedContext->m_resLockFcb, 1u);
    CClfsLogFcbCommon::Close(ReservedContext);
    if (boolean){
        ExReleaseResourceForThreadLite(&ReservedContext->m_resLockFcb, (ERESOURCE_THREAD)KeGetCurrentThread());
    }
    ...
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

CClfsRequest::Close(PIRP Irp){
    CClfsLogFcbCommon *ReservedContext;
    ...
    FileObject = CurrentStackLocation->FileObject;
    if (PatchFlag()){
        FsContext2 = (CClfsLogCcb *)CurrentStackLocation->FileObject->FsContext2;
        v10 = FsContext2;    //保存FsContext2
        if (FsContext2){
            CClfsLogCcb::AddRef(FsContext2);    //递增FsContext2引用计数
            CClfsLogCcb::Close(FsContext2);    //递减FsContext2引用计数
        }
    }
    ...
    boolean = ExAcquireResourceExclusiveLite(&ReservedContext->m_resLockFcb, 1u);
    CClfsLogFcbCommon::Close(ReservedContext);
    if (boolean){
        ExReleaseResourceForThreadLite(&ReservedContext->m_resLockFcb, (ERESOURCE_THREAD)KeGetCurrentThread());
        FsContext2 = v10;    //加载FsContext2
    }
    ...
    if (PatchFlag()){
        FileObject->FsContext = 0;
        FileObject->FsContext2 = 0;
        if (FsContext2){
            CClfsLogCcb::Release(FsContext2);
        }
    }
    ...
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

00000000 struct __unaligned __declspec(align(8)) CClfsLogCcb // sizeof=0x110
00000000 {
00000000     _BYTE gap0[8];
00000008     _LIST_ENTRY list_entry;
00000018     ULONG reference_count;
0000001C     _DWORD flag;
00000020     _BYTE gap20[8];
00000028     unsigned int m_cArchiveRef;
0000002C     _BYTE gap2C[4];
00000030     _QWORD m_hPhysicalHandle;
00000038     _QWORD qword38;
00000040     char *field_40;
00000048     PFILE_OBJECT m_foFileObj;
00000050     _QWORD m_foFileObj2;
00000058     CLFS_LSN clfs_lsn58;
00000060     CLFS_LSN clfs_lsn60;
00000068     _QWORD qword68;
00000070     __int64 field_70;
00000078     // 填充字节
00000080     CClfsBaseFileSnapshot *field_80;
00000088     _BYTE gap88[16];
00000098     ERESOURCE m_Resource;
00000100     struct CClfsLogCcb::ILifetimeListener *m_pltlLifeTimeListener;
00000108     _QWORD qword108;
00000110 };

1
2
3
4
5
6
7
8

CClfsRequest::Cleanup(PIRP Irp){
    ...
    CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation;    //偏移量0x78h
    ...
    //偏移量：FileObject (0x30h), FsContext2 (0x20h)
    FsContext2 = CurrentStackLocation->FileObject->FsContext2;
    ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

CClfsRequest::Dispatch(CClfsRequest *this, PIRP Irp, struct _DEVICE_OBJECT *a3){
    this->m_pIrp = Irp;    //偏移量0x30h
    ...
    switch ( LowPart ){
        case 0x8007A85C:
            appended = CClfsRequest::AdvanceLogBase(this);
            goto LABEL_9;
        case 0x8007A810:
            appended = CClfsRequest::SetArchiveTail(this);
            goto LABEL_9;
    ...
}

1
2
3
4

CClfsRequest::UsefulFunction(this){
    //偏移量：this->0x30->0x78->0x30->0x20
    FsContext2 = this->m_pIrp->Tail.Overlay.CurrentStackLocation->FileObject->FsContext2;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

__int64 __fastcall CClfsRequest::ReserveAndAppendLog(CClfsRequest *this){
    ...
    Irp = this->m_pIrp;    //偏移量0x30h
    CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation;    //偏移量0x78h
    ...
    FsContext2 = CurrentStackLocation->FileObject->FsContext2;
    ...
    v29 = FsContext2[13];    // 潜在的FsContext2解引用
    ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

__int64 __fastcall CClfsRequest::WriteRestart(CClfsRequest *this){
    ...
    Irp = this->m_pIrp;    //偏移量0x30h
    CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation;    //偏移量0x78h
    ...
    this->m_Ccb = CurrentStackLocation->FileObject->FsContext2;
    ...
    if ( this->field_F0 + this->m_Ccb->qword68 >= 0 ){    // 潜在的FsContext2解引用
    ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

__int64 __fastcall CClfsRequest::ReadArchiveMetadata(CClfsRequest *this){
    ...
    Irp = this->m_pIrp;    //偏移量0x30h
    CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation;    //偏移量0x78h
    ...
    FsContext2 = CurrentStackLocation->FileObject->FsContext2;
    ...
    CClfsLogCcb::ReadArchiveMetadata(FsContext2, ...);
    ...
    if ( FsContext2 ){
        CClfsLogCcb::Release(FsContext2);
    }
}

__int64 __fastcall CClfsLogCcb::ReadArchiveMetadata(FsContext2, ...){
    ...
    p_m_Resource = &FsContext2->m_Resource;    // 潜在的FsContext2解引用
    ...
    if ( FsContext2->m_cArchiveRef )    // 潜在的FsContext2解引用
    ...
}