mirror of
https://github.com/gnif/LookingGlass.git
synced 2026-08-22 07:01:30 +00:00
Explorer file copies were invisible to the Helper because the service launched its child with a duplicate of the LocalSystem token and changed only TokenSessionId. The child therefore remained a System-integrity process. Windows filtered Explorer's file clipboard formats across that integrity boundary. Basic text and bitmap formats continued to work. Keep only the SCM service privileged. Obtain the active session user's primary token with WTSQueryUserToken. For elevated accounts, prefer the linked limited token. Validate its session and security properties. Build the user environment and launch the interactive Helper on WinSta0\Default. Gate Helper activation until the service has rechecked the active session and registered the clipboard authority. Use random lifetime, stop, and activation objects owned by the service. Give the target logon SID synchronization access only. Recheck the active console session and service state before activation. Make the lifetime mutex terminate the Helper if the service exits unexpectedly. Restart it when the active session, IDD host, or authority changes. Replace the old process-handle mapping transfer with a device-bound authority protocol on the LGIdd device interface. The service verifies the exact driver host instance, duplicates only section map rights into that process, and registers the session, mapping identifier, and handle. Bind authority lifetime to its WDF file object, revoke it synchronously on cleanup, and poll the driver host identity while the child is active. Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF device group. Restrict the shared section to SYSTEM and the target logon SID. Apply a medium mandatory label that prevents low-integrity readers and writers. Map it with read/write rights instead of all access. Give each clipboard mapping a second random authority identifier. Store it only inside the logon-SID-protected mapping and send it in the mandatory HELLO. LGIdd matches it against the service-injected mapping. This authenticates the user Helper without the unsupported UMDF call to GetNamedPipeClientSessionId. Have the Helper verify that its pipe server is in session zero. Extend the pipe endpoint with bounded authentication reads, cancellable overlapped I/O, periodic authorization checks, and explicit disconnects. Serialize authority changes with clipboard attach and detach. Prevent stale cleanup from tearing down a replacement mapping. Disconnect the user pipe immediately when its owning authority is revoked. Run clipboard, OLE, display, configuration, and file access in the user's interactive process. Retain its process token for worker-thread file operations instead of querying and impersonating the desktop user from a System process. Store Helper logs in LocalAppData and grant only the registry rights needed by interactive configuration and UMDF. Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and enumerate the OLE object's advertised file formats. Validate returned storage and fall back to Shell item paths when direct retrieval fails. Validate clipboard sequence changes and defer retries during contention without publishing incomplete clipboard state. Complete the 1 MiB transfer work with full-sized Windows copy buffers. Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit. Validate the user-writable mapping with CClipboardRing before attaching. The pipe, mapping, and authority protocols change together. LGIdd.dll, the INF, and LGIddHelper.exe must be rebuilt and installed as one matching set.
179 lines
4.7 KiB
C++
179 lines
4.7 KiB
C++
/**
|
|
* Looking Glass
|
|
* Copyright © 2017-2026 The Looking Glass Authors
|
|
* https://looking-glass.io
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the Free
|
|
* Software Foundation; either version 2 of the License, or (at your option)
|
|
* any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc., 59
|
|
* Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "Atomic.h"
|
|
#include "CSRWLock.h"
|
|
|
|
#include <Windows.h>
|
|
|
|
#include <stddef.h>
|
|
#include <string>
|
|
|
|
class IPipeEndpointHandler
|
|
{
|
|
public:
|
|
virtual ~IPipeEndpointHandler() = default;
|
|
|
|
virtual void OnPipeConnected() {}
|
|
virtual void OnPipeDisconnected() {}
|
|
virtual bool ShouldReconnect() { return true; }
|
|
virtual bool PipeServerIsAuthorized(_In_ HANDLE pipe)
|
|
{
|
|
(void) pipe;
|
|
return true;
|
|
}
|
|
virtual bool PipeClientHelloRequired() const { return false; }
|
|
virtual bool BuildPipeClientHello(
|
|
_Out_writes_bytes_(size) void * message,
|
|
_In_ size_t size)
|
|
{
|
|
(void) message;
|
|
(void) size;
|
|
return true;
|
|
}
|
|
virtual bool PipeClientAuthenticationRequired() const { return false; }
|
|
virtual bool AuthenticatePipeClient(
|
|
_In_ HANDLE pipe,
|
|
_In_reads_bytes_(size) const void * message,
|
|
_In_ size_t size)
|
|
{
|
|
(void) pipe;
|
|
(void) message;
|
|
(void) size;
|
|
return true;
|
|
}
|
|
virtual bool PipeClientStillAuthorized(_In_ HANDLE pipe)
|
|
{
|
|
(void) pipe;
|
|
return true;
|
|
}
|
|
virtual bool OnPipeMessage(
|
|
_In_reads_bytes_(size) const void * message,
|
|
_In_ size_t size) = 0;
|
|
};
|
|
|
|
class CPipeEndpoint
|
|
{
|
|
public:
|
|
enum class Mode
|
|
{
|
|
Server,
|
|
Client,
|
|
};
|
|
|
|
CPipeEndpoint() = default;
|
|
~CPipeEndpoint();
|
|
|
|
CPipeEndpoint(const CPipeEndpoint &) = delete;
|
|
CPipeEndpoint & operator=(const CPipeEndpoint &) = delete;
|
|
|
|
bool Start(
|
|
_In_z_ const wchar_t * pipeName,
|
|
_In_ Mode mode,
|
|
_In_ size_t messageSize,
|
|
_In_opt_ const SECURITY_ATTRIBUTES * serverSecurity = nullptr,
|
|
_In_ DWORD serverOpenMode = 0,
|
|
_In_ DWORD serverPipeMode = 0);
|
|
void Stop();
|
|
void DisconnectClient();
|
|
|
|
bool Send(
|
|
_In_reads_bytes_(size) const void * message,
|
|
_In_ size_t size);
|
|
|
|
bool IsRunning() const { return Atomic::Load(m_running); }
|
|
bool IsConnected() const { return Atomic::Load(m_connected); }
|
|
|
|
HANDLE NativeHandle();
|
|
|
|
void SetHandler(_In_opt_ IPipeEndpointHandler * handler)
|
|
{
|
|
m_handler = handler;
|
|
}
|
|
|
|
private:
|
|
enum class PipeIoResult
|
|
{
|
|
Success,
|
|
Disconnected,
|
|
Stopped,
|
|
TimedOut,
|
|
Error,
|
|
};
|
|
|
|
static const DWORD CLIENT_RETRY_INITIAL_MS;
|
|
static const DWORD CLIENT_RETRY_MAX_MS;
|
|
static const DWORD SERVER_RETRY_MS;
|
|
static const DWORD AUTHENTICATION_TIMEOUT_MS;
|
|
static const DWORD AUTHORIZATION_POLL_MS;
|
|
static const DWORD WRITE_TIMEOUT_MS;
|
|
static const DWORD WAIT_FIRST_OBJECT_VALUE;
|
|
|
|
static bool IsDisconnectedError(_In_ DWORD error);
|
|
PipeIoResult WaitForOverlapped(
|
|
_In_ HANDLE pipe,
|
|
_In_ HANDLE ioEvent,
|
|
_Inout_ OVERLAPPED * overlapped,
|
|
_Out_ DWORD * transferred,
|
|
_In_ DWORD timeoutMs = INFINITE);
|
|
PipeIoResult ReadMessage(
|
|
_In_ HANDLE pipe,
|
|
_In_ HANDLE ioEvent,
|
|
_Out_writes_bytes_(messageSize) void * message,
|
|
_In_ DWORD messageSize,
|
|
_Out_ DWORD * bytesRead,
|
|
_In_ DWORD timeoutMs = INFINITE);
|
|
PipeIoResult WriteMessage(
|
|
_In_ HANDLE pipe,
|
|
_In_reads_bytes_(messageSize) const void * message,
|
|
_In_ DWORD messageSize);
|
|
|
|
static DWORD WINAPI ThreadProc(_In_ void * context);
|
|
|
|
void Thread();
|
|
void RunServer();
|
|
void RunClient();
|
|
bool ReadMessages(_In_ HANDLE pipe);
|
|
HANDLE CreateServerPipe();
|
|
bool WaitForRetry(_In_ DWORD delayMs);
|
|
void PublishPipe(_In_ HANDLE pipe);
|
|
void ClosePipe(_In_ HANDLE pipe);
|
|
|
|
std::wstring m_pipeName;
|
|
size_t m_messageSize = 0;
|
|
Mode m_mode = Mode::Client;
|
|
IPipeEndpointHandler * m_handler = nullptr;
|
|
SECURITY_ATTRIBUTES m_serverSecurity = {};
|
|
bool m_hasServerSecurity = false;
|
|
DWORD m_serverOpenMode = 0;
|
|
DWORD m_serverPipeMode = 0;
|
|
|
|
std::atomic<bool> m_running { false };
|
|
std::atomic<bool> m_connected { false };
|
|
|
|
CSRWLock m_pipeLock;
|
|
HANDLE m_pipe = INVALID_HANDLE_VALUE;
|
|
HANDLE m_thread = nullptr;
|
|
HANDLE m_stopEvent = nullptr;
|
|
HANDLE m_writeEvent = nullptr;
|
|
};
|