core.c

/*
 * core.c — Minifilter entry point. No KMDF, no device objects.
 *
 * Registers as a Minifilter for:
 *   1. File system interception (fs.c)
 *   2. Magic-file handshake for comm (comm.c)
 *   3. Self-file hiding (stealth.c)
 *
 * Lifecycle contract summary
 * --------------------------
 * - DriverEntry owns the mandatory startup prefix:
 *     FltRegisterFilter -> CommInitialize -> AuthModuleInitialize
 *     -> FltStartFiltering.
 * - If any mandatory step fails, DriverEntry rolls back only the prefix that
 *   has already succeeded and returns failure without setting g_Initialized.
 * - After FltStartFiltering succeeds, callback routing is live. The remaining
 *   subsystem initializers are best-effort and may fail without failing load.
 * - CoreFilterUnload is the full-success teardown path. It clears
 *   g_Initialized first, unregisters the filter if present, and then invokes
 *   each subsystem uninitializer so later tasks can reason about the steady
 *   state and partial-init boundary explicitly.
 */

#include <fltKernel.h>
#include <ntifs.h>
#include <ntstrsafe.h>
#include "edr_shared.h"
#include "core.h"

/*
 * Shared core resources. Ownership and phase semantics are defined in core.h.
 */
PFLT_FILTER     g_FilterHandle = NULL;
PDRIVER_OBJECT  g_DriverObject = NULL;
volatile LONG   g_Initialized  = 0;

typedef enum _CORE_STARTUP_PHASE {
    CoreStartupPhasePreEntry = 0,
    CoreStartupPhaseFilterRegistered,
    CoreStartupPhaseCommInitialized,
    CoreStartupPhaseAuthInitialized,
    CoreStartupPhaseFilteringActive,
    CoreStartupPhaseOptionalInitializationComplete,
    CoreStartupPhaseTeardown
} CORE_STARTUP_PHASE;

#define CORE_STATE_FILTER_REGISTERED  0x00000001UL
#define CORE_STATE_COMM_INITIALIZED   0x00000002UL
#define CORE_STATE_AUTH_INITIALIZED   0x00000004UL
#define CORE_STATE_FILTERING_ACTIVE   0x00000008UL
#define CORE_STATE_FS_INITIALIZED     0x00000010UL
#define CORE_STATE_MEM_INITIALIZED    0x00000020UL
#define CORE_STATE_PROC_INITIALIZED   0x00000040UL
#define CORE_STATE_REG_INITIALIZED    0x00000080UL
#define CORE_STATE_STEALTH_INITIALIZED 0x00000100UL

static volatile LONG g_CoreStartupPhase = CoreStartupPhasePreEntry;
static volatile LONG g_CoreInitState = 0;

static VOID
CoreSetStartupPhase(
    _In_ CORE_STARTUP_PHASE Phase
);

static VOID
CoreMarkInitialized(
    _In_ ULONG StateBit
);

static BOOLEAN
CoreWasInitialized(
    _In_ ULONG StateBit
);

static VOID
CoreCleanupFromState(
    _In_ BOOLEAN PublishTeardownPhase
);

static VOID
CoreLogOptionalInitFailure(
    _In_z_ PCSTR ModuleName,
    _In_ NTSTATUS Status
);

static FLT_PREOP_CALLBACK_STATUS
CoreCompleteCreateRequest(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ NTSTATUS Status
);

static FLT_PREOP_CALLBACK_STATUS
CoreRouteCreateAfterHandshake(
    _Inout_ PFLT_CALLBACK_DATA Data
);

FLT_PREOP_CALLBACK_STATUS
CorePreCreate(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
);

FLT_POSTOP_CALLBACK_STATUS
CorePostDirControl(
    _Inout_  PFLT_CALLBACK_DATA Data,
    _In_     PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_     FLT_POST_OPERATION_FLAGS Flags
);

FLT_PREOP_CALLBACK_STATUS
CorePreWrite(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
);

FLT_PREOP_CALLBACK_STATUS
CorePreSetInfo(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
);

NTSTATUS CoreFilterUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags);

NTSTATUS
CoreInstanceSetup(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
    _In_ DEVICE_TYPE VolumeDeviceType,
    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
);

static const FLT_OPERATION_REGISTRATION g_Callbacks[] = {
    {
        IRP_MJ_CREATE,
        0,
        CorePreCreate,
        NULL
    },
    {
        IRP_MJ_WRITE,
        0,
        CorePreWrite,
        NULL
    },
    {
        IRP_MJ_SET_INFORMATION,
        0,
        CorePreSetInfo,
        NULL
    },
    {
        IRP_MJ_DIRECTORY_CONTROL,
        0,
        NULL,
        CorePostDirControl
    },
    { IRP_MJ_OPERATION_END }
};

/*
 * Callback routing contract:
 * - IRP_MJ_CREATE routes through CorePreCreate.
 * - CorePreCreate must preserve handshake-before-policy ordering so the comm
 *   rendezvous path is classified before fs.c access rules run.
 * - IRP_MJ_WRITE and IRP_MJ_SET_INFORMATION remain pre-op fs.c policy hooks.
 * - IRP_MJ_DIRECTORY_CONTROL remains a post-op fs.c visibility hook.
 */

static const FLT_REGISTRATION g_FilterRegistration = {
    sizeof(FLT_REGISTRATION),
    FLT_REGISTRATION_VERSION,
    0,
    NULL,
    g_Callbacks,
    CoreFilterUnload,
    CoreInstanceSetup,
    NULL,
    NULL,
    NULL,
    NULL, NULL, NULL
};

static VOID
CoreSetStartupPhase(
    _In_ CORE_STARTUP_PHASE Phase
)
{
    InterlockedExchange(&g_CoreStartupPhase, (LONG)Phase);
}

static VOID
CoreMarkInitialized(
    _In_ ULONG StateBit
)
{
    InterlockedOr(&g_CoreInitState, (LONG)StateBit);
}

static BOOLEAN
CoreWasInitialized(
    _In_ ULONG StateBit
)
{
    return (InterlockedOr(&g_CoreInitState, 0) & (LONG)StateBit) != 0;
}

static VOID
CoreLogOptionalInitFailure(
    _In_z_ PCSTR ModuleName,
    _In_ NTSTATUS Status
)
{
    DbgPrintEx(
        DPFLTR_DEFAULT_ID,
        DPFLTR_WARNING_LEVEL,
        "edragent: %s failed 0x%08X\n",
        ModuleName,
        Status
    );
}

static VOID
CoreCleanupFromState(
    _In_ BOOLEAN PublishTeardownPhase
)
{
    BOOLEAN filterWasLive;

    if (PublishTeardownPhase) {
        CoreSetStartupPhase(CoreStartupPhaseTeardown);
    }

    InterlockedExchange(&g_Initialized, 0);

    filterWasLive = CoreWasInitialized(CORE_STATE_FILTERING_ACTIVE);

    if (filterWasLive &&
        CoreWasInitialized(CORE_STATE_FILTER_REGISTERED) &&
        g_FilterHandle) {
        FltUnregisterFilter(g_FilterHandle);
        g_FilterHandle = NULL;
    }

    if (CoreWasInitialized(CORE_STATE_STEALTH_INITIALIZED)) {
        StealthUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_STEALTH_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_REG_INITIALIZED)) {
        RegModuleUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_REG_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_PROC_INITIALIZED)) {
        ProcModuleUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_PROC_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_MEM_INITIALIZED)) {
        MemModuleUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_MEM_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_FS_INITIALIZED)) {
        FsModuleUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_FS_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_COMM_INITIALIZED)) {
        CommUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_COMM_INITIALIZED);
    }

    if (CoreWasInitialized(CORE_STATE_AUTH_INITIALIZED)) {
        AuthModuleUninitialize();
        InterlockedAnd(&g_CoreInitState, ~(LONG)CORE_STATE_AUTH_INITIALIZED);
    }

    if (!filterWasLive &&
        CoreWasInitialized(CORE_STATE_FILTER_REGISTERED) &&
        g_FilterHandle) {
        FltUnregisterFilter(g_FilterHandle);
        g_FilterHandle = NULL;
    }

    InterlockedAnd(
        &g_CoreInitState,
        ~((LONG)CORE_STATE_FILTER_REGISTERED | (LONG)CORE_STATE_FILTERING_ACTIVE)
    );

    if (!PublishTeardownPhase) {
        CoreSetStartupPhase(CoreStartupPhasePreEntry);
    }
}

static FLT_PREOP_CALLBACK_STATUS
CoreCompleteCreateRequest(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ NTSTATUS Status
)
{
    Data->IoStatus.Status = Status;
    if (!NT_SUCCESS(Status)) {
        Data->IoStatus.Information = 0;
    }

    return FLT_PREOP_COMPLETE;
}

static FLT_PREOP_CALLBACK_STATUS
CoreRouteCreateAfterHandshake(
    _Inout_ PFLT_CALLBACK_DATA Data
)
{
    BOOLEAN blockFile = FALSE;

    FsPreCreate(Data, &blockFile);
    if (blockFile) {
        return CoreCompleteCreateRequest(Data, STATUS_ACCESS_DENIED);
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

NTSTATUS
CoreInstanceSetup(
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _In_ FLT_INSTANCE_SETUP_FLAGS Flags,
    _In_ DEVICE_TYPE VolumeDeviceType,
    _In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType
)
{
    UNREFERENCED_PARAMETER(FltObjects);
    UNREFERENCED_PARAMETER(Flags);
    UNREFERENCED_PARAMETER(VolumeFilesystemType);

    if (VolumeDeviceType != FILE_DEVICE_DISK_FILE_SYSTEM) {
        return STATUS_FLT_DO_NOT_ATTACH;
    }
    return STATUS_SUCCESS;
}

NTSTATUS CoreFilterUnload(_In_ FLT_FILTER_UNLOAD_FLAGS Flags)
{
    UNREFERENCED_PARAMETER(Flags);

    /* Publish teardown, then release only what startup actually acquired. */
    CoreCleanupFromState(TRUE);

    return STATUS_SUCCESS;
}

FLT_PREOP_CALLBACK_STATUS
CorePreCreate(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
{
    NTSTATUS status;
    BOOLEAN isHandshake = FALSE;

    UNREFERENCED_PARAMETER(FltObjects);
    *CompletionContext = NULL;

    /* Handshake classification is mandatory and must run before fs policy. */
    status = CommCheckHandshake(Data, &isHandshake);
    if (isHandshake) {
        return CoreCompleteCreateRequest(Data, status);
    }

    /* Non-handshake creates fall through to file-policy enforcement. */
    return CoreRouteCreateAfterHandshake(Data);
}

FLT_PREOP_CALLBACK_STATUS
CorePreWrite(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
{
    UNREFERENCED_PARAMETER(FltObjects);
    *CompletionContext = NULL;

    BOOLEAN blockWrite = FALSE;
    FsPreWrite(Data, &blockWrite);
    if (blockWrite) {
        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
        Data->IoStatus.Information = 0;
        return FLT_PREOP_COMPLETE;
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

FLT_PREOP_CALLBACK_STATUS
CorePreSetInfo(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_    PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
{
    UNREFERENCED_PARAMETER(FltObjects);
    *CompletionContext = NULL;

    BOOLEAN blockSetInfo = FALSE;
    FsPreSetInfo(Data, &blockSetInfo);
    if (blockSetInfo) {
        Data->IoStatus.Status = STATUS_ACCESS_DENIED;
        Data->IoStatus.Information = 0;
        return FLT_PREOP_COMPLETE;
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

FLT_POSTOP_CALLBACK_STATUS
CorePostDirControl(
    _Inout_  PFLT_CALLBACK_DATA Data,
    _In_     PCFLT_RELATED_OBJECTS FltObjects,
    _In_opt_ PVOID CompletionContext,
    _In_     FLT_POST_OPERATION_FLAGS Flags
)
{
    UNREFERENCED_PARAMETER(FltObjects);
    UNREFERENCED_PARAMETER(CompletionContext);

    FsPostDirControl(Data, Flags);

    return FLT_POSTOP_FINISHED_PROCESSING;
}

NTSTATUS
DriverEntry(
    _In_ PDRIVER_OBJECT  DriverObject,
    _In_ PUNICODE_STRING RegistryPath
)
{
    NTSTATUS status;

    UNREFERENCED_PARAMETER(RegistryPath);

    /* Borrowed pointer from the I/O manager; cached for later helpers. */
    g_DriverObject = DriverObject;
    InterlockedExchange(&g_Initialized, 0);
    InterlockedExchange(&g_CoreInitState, 0);
    CoreSetStartupPhase(CoreStartupPhasePreEntry);

    /* Phase 1: mandatory filter registration transfers ownership to core. */
    status = FltRegisterFilter(
        DriverObject,
        &g_FilterRegistration,
        &g_FilterHandle
    );
    if (!NT_SUCCESS(status)) {
        return status;
    }
    CoreMarkInitialized(CORE_STATE_FILTER_REGISTERED);
    CoreSetStartupPhase(CoreStartupPhaseFilterRegistered);

    /* Phase 2a: mandatory comm bootstrap depends on the filter handle. */
    status = CommInitialize(g_FilterHandle);
    if (!NT_SUCCESS(status)) {
        CoreCleanupFromState(FALSE);
        return status;
    }
    CoreMarkInitialized(CORE_STATE_COMM_INITIALIZED);
    CoreSetStartupPhase(CoreStartupPhaseCommInitialized);

    /* Phase 2b: auth is mandatory before the filter begins dispatching. */
    status = AuthModuleInitialize();
    if (!NT_SUCCESS(status)) {
        CoreCleanupFromState(FALSE);
        return status;
    }
    CoreMarkInitialized(CORE_STATE_AUTH_INITIALIZED);
    CoreSetStartupPhase(CoreStartupPhaseAuthInitialized);

    /* Phase 3: once this succeeds, callback routing is active. */
    status = FltStartFiltering(g_FilterHandle);
    if (!NT_SUCCESS(status)) {
        CoreCleanupFromState(FALSE);
        return status;
    }
    CoreMarkInitialized(CORE_STATE_FILTERING_ACTIVE);
    CoreSetStartupPhase(CoreStartupPhaseFilteringActive);

    /*
     * Phase 4: optional/best-effort modules. Failures are logged only so the
     * minifilter can keep servicing mandatory comm + auth + routing duties.
     */
    status = FsModuleInitialize();
    if (NT_SUCCESS(status)) {
        CoreMarkInitialized(CORE_STATE_FS_INITIALIZED);
    }
    else {
        CoreLogOptionalInitFailure("FsModuleInitialize", status);
    }

    status = MemModuleInitialize();
    if (NT_SUCCESS(status)) {
        CoreMarkInitialized(CORE_STATE_MEM_INITIALIZED);
    }
    else {
        CoreLogOptionalInitFailure("MemModuleInitialize", status);
    }

    status = ProcModuleInitialize();
    if (NT_SUCCESS(status)) {
        CoreMarkInitialized(CORE_STATE_PROC_INITIALIZED);
    }
    else {
        CoreLogOptionalInitFailure("ProcModuleInitialize", status);
    }

    status = RegModuleInitialize();
    if (NT_SUCCESS(status)) {
        CoreMarkInitialized(CORE_STATE_REG_INITIALIZED);
    }
    else {
        CoreLogOptionalInitFailure("RegModuleInitialize", status);
    }

    status = StealthInitialize(DriverObject);
    if (NT_SUCCESS(status)) {
        CoreMarkInitialized(CORE_STATE_STEALTH_INITIALIZED);
    }
    else {
        CoreLogOptionalInitFailure("StealthInitialize", status);
    }

    /* Phase 5: publish that the full startup sequence ran to completion. */
    CoreSetStartupPhase(CoreStartupPhaseOptionalInitializationComplete);
    InterlockedExchange(&g_Initialized, 1);

    return STATUS_SUCCESS;
}