├── assets
├── ida_line.png
├── ida_writeup.png
├── windbg_poolhit.png
├── windbg_poolused.png
└── windbg_stacktrace.png
├── leak
├── leak
│ ├── leak.vcxproj.filters
│ ├── leak.cpp
│ ├── ntdll.h
│ └── leak.vcxproj
└── leak.sln
├── README.md
└── .gitignore
/assets/ida_line.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SamuelTulach/GetDeviceInterfacesMemoryLeak/HEAD/assets/ida_line.png
--------------------------------------------------------------------------------
/assets/ida_writeup.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SamuelTulach/GetDeviceInterfacesMemoryLeak/HEAD/assets/ida_writeup.png
--------------------------------------------------------------------------------
/assets/windbg_poolhit.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SamuelTulach/GetDeviceInterfacesMemoryLeak/HEAD/assets/windbg_poolhit.png
--------------------------------------------------------------------------------
/assets/windbg_poolused.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SamuelTulach/GetDeviceInterfacesMemoryLeak/HEAD/assets/windbg_poolused.png
--------------------------------------------------------------------------------
/assets/windbg_stacktrace.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SamuelTulach/GetDeviceInterfacesMemoryLeak/HEAD/assets/windbg_stacktrace.png
--------------------------------------------------------------------------------
/leak/leak/leak.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 |
10 |
11 | Source
12 |
13 |
14 |
15 |
16 | Source
17 |
18 |
19 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Memory leak in IopGetDeviceInterfaces
2 | After few days of debugging my kernel-mode driver to figure out why hooking EFI runtime services function causes leak in paged memory, I noticed weird thing... It happens even without the driver loaded!
3 |
4 | To figure out where it comes from, I started by looking which pool tag is being used. Quick look in WinDbg showed me that it's pool tag "Pp" that is constantly gaining size.
5 |
6 | 
7 |
8 | Now there was nothing easier then to set breakpoint to the pool allocation.
9 |
10 | 
11 |
12 | After the breakpoint was hit, I could see exactly where it was coming from.
13 |
14 | 
15 |
16 | Relocated image in IDA and found exactly the line.
17 |
18 | 
19 |
20 | There we go.
21 |
22 | 
23 |
24 | Running Windows 10 x64 Pro 2004 (19041.264). Would be nice if you fixed this Microsoft. It's just small leak but it's annoying.
--------------------------------------------------------------------------------
/leak/leak/leak.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 | #include
5 | #include "ntdll.h"
6 |
7 | bool running = true;
8 |
9 | DWORD WINAPI SpamThread(PVOID number)
10 | {
11 | printf("Thread %i started\n", (int)number);
12 |
13 | while (running)
14 | {
15 | GUID dummyGuid = { 0 };
16 | UNICODE_STRING variableName = RTL_CONSTANT_STRING(L"dummyVariable");
17 |
18 | char buffer[8];
19 |
20 | ntdll::NtSetSystemEnvironmentValueEx(&variableName, &dummyGuid, buffer, sizeof(buffer), ATTRIBUTES);
21 | }
22 |
23 | return 0;
24 | }
25 |
26 | int main()
27 | {
28 | printf("Setting SE_SYSTEM_ENVIRONMENT_PRIVILEGE privilegie...\n");
29 | bool enabled = false;
30 | const NTSTATUS status = ntdll::RtlAdjustPrivilege(22L, true, false, reinterpret_cast(&enabled));
31 | if (!NT_SUCCESS(status))
32 | {
33 | printf("Failed to set SE_SYSTEM_ENVIRONMENT_PRIVILEGE privilegie!\n");
34 | return -1;
35 | }
36 |
37 | printf("Starting threads...\n");
38 | for (int i = 0; i < 8; i++)
39 | {
40 | CreateThread(nullptr, NULL, SpamThread, (PVOID)i, NULL, nullptr);
41 | }
42 |
43 | getchar();
44 | running = false;
45 |
46 | return 0;
47 | }
48 |
--------------------------------------------------------------------------------
/leak/leak/ntdll.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | #define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), (PWSTR)s }
4 |
5 | #define EFI_VARIABLE_NON_VOLATILE 0x00000001
6 | #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x00000002
7 | #define EFI_VARIABLE_RUNTIME_ACCESS 0x00000004
8 | #define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x00000008
9 | #define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x00000010
10 | #define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x00000020
11 | #define EFI_VARIABLE_APPEND_WRITE 0x00000040
12 | #define ATTRIBUTES (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)
13 |
14 | namespace ntdll
15 | {
16 | extern "C"
17 | {
18 | NTSYSAPI
19 | NTSTATUS
20 | NTAPI
21 | RtlAdjustPrivilege(
22 | _In_ ULONG Privilege,
23 | _In_ BOOLEAN Enable,
24 | _In_ BOOLEAN Client,
25 | _Out_ PBOOLEAN WasEnabled
26 | );
27 |
28 | NTSYSCALLAPI
29 | NTSTATUS
30 | NTAPI
31 | NtSetSystemEnvironmentValueEx(
32 | _In_ PUNICODE_STRING VariableName,
33 | _In_ LPGUID VendorGuid,
34 | _In_reads_bytes_opt_(ValueLength) PVOID Value,
35 | _In_ ULONG ValueLength,
36 | _In_ ULONG Attributes
37 | );
38 | }
39 | }
--------------------------------------------------------------------------------
/leak/leak.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.30413.136
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "leak", "leak\leak.vcxproj", "{63C98C52-ADD4-40FF-95BE-DCFBC469670A}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Debug|x64.ActiveCfg = Debug|x64
17 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Debug|x64.Build.0 = Debug|x64
18 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Debug|x86.ActiveCfg = Debug|Win32
19 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Debug|x86.Build.0 = Debug|Win32
20 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Release|x64.ActiveCfg = Release|x64
21 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Release|x64.Build.0 = Release|x64
22 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Release|x86.ActiveCfg = Release|Win32
23 | {63C98C52-ADD4-40FF-95BE-DCFBC469670A}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {210ADECF-1767-4B70-956A-F2D8508F3829}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/leak/leak/leak.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | Win32Proj
24 | {63c98c52-add4-40ff-95be-dcfbc469670a}
25 | leak
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 | false
35 |
36 |
37 | Application
38 | false
39 | v142
40 | true
41 | Unicode
42 |
43 |
44 | Application
45 | true
46 | v142
47 | Unicode
48 |
49 |
50 | Application
51 | false
52 | v142
53 | true
54 | Unicode
55 | false
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 | true
77 |
78 |
79 | false
80 |
81 |
82 | true
83 |
84 |
85 | false
86 |
87 |
88 |
89 | Level3
90 | true
91 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
92 | true
93 |
94 |
95 | Console
96 | true
97 |
98 |
99 |
100 |
101 | Level3
102 | true
103 | true
104 | true
105 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
106 | true
107 |
108 |
109 | Console
110 | true
111 | true
112 | true
113 |
114 |
115 |
116 |
117 | Level3
118 | true
119 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
120 | true
121 |
122 |
123 | Console
124 | true
125 |
126 |
127 |
128 |
129 | Level3
130 | true
131 | true
132 | true
133 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
134 | true
135 |
136 |
137 | Console
138 | true
139 | true
140 | true
141 | ntdll.lib;%(AdditionalDependencies)
142 |
143 |
144 |
145 |
146 |
147 |
148 |
149 |
150 |
151 |
152 |
153 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.rsuser
8 | *.suo
9 | *.user
10 | *.userosscache
11 | *.sln.docstates
12 |
13 | # User-specific files (MonoDevelop/Xamarin Studio)
14 | *.userprefs
15 |
16 | # Mono auto generated files
17 | mono_crash.*
18 |
19 | # Build results
20 | [Dd]ebug/
21 | [Dd]ebugPublic/
22 | [Rr]elease/
23 | [Rr]eleases/
24 | x64/
25 | x86/
26 | [Ww][Ii][Nn]32/
27 | [Aa][Rr][Mm]/
28 | [Aa][Rr][Mm]64/
29 | bld/
30 | [Bb]in/
31 | [Oo]bj/
32 | [Ll]og/
33 | [Ll]ogs/
34 |
35 | # Visual Studio 2015/2017 cache/options directory
36 | .vs/
37 | # Uncomment if you have tasks that create the project's static files in wwwroot
38 | #wwwroot/
39 |
40 | # Visual Studio 2017 auto generated files
41 | Generated\ Files/
42 |
43 | # MSTest test Results
44 | [Tt]est[Rr]esult*/
45 | [Bb]uild[Ll]og.*
46 |
47 | # NUnit
48 | *.VisualState.xml
49 | TestResult.xml
50 | nunit-*.xml
51 |
52 | # Build Results of an ATL Project
53 | [Dd]ebugPS/
54 | [Rr]eleasePS/
55 | dlldata.c
56 |
57 | # Benchmark Results
58 | BenchmarkDotNet.Artifacts/
59 |
60 | # .NET Core
61 | project.lock.json
62 | project.fragment.lock.json
63 | artifacts/
64 |
65 | # ASP.NET Scaffolding
66 | ScaffoldingReadMe.txt
67 |
68 | # StyleCop
69 | StyleCopReport.xml
70 |
71 | # Files built by Visual Studio
72 | *_i.c
73 | *_p.c
74 | *_h.h
75 | *.ilk
76 | *.meta
77 | *.obj
78 | *.iobj
79 | *.pch
80 | *.pdb
81 | *.ipdb
82 | *.pgc
83 | *.pgd
84 | *.rsp
85 | *.sbr
86 | *.tlb
87 | *.tli
88 | *.tlh
89 | *.tmp
90 | *.tmp_proj
91 | *_wpftmp.csproj
92 | *.log
93 | *.vspscc
94 | *.vssscc
95 | .builds
96 | *.pidb
97 | *.svclog
98 | *.scc
99 |
100 | # Chutzpah Test files
101 | _Chutzpah*
102 |
103 | # Visual C++ cache files
104 | ipch/
105 | *.aps
106 | *.ncb
107 | *.opendb
108 | *.opensdf
109 | *.sdf
110 | *.cachefile
111 | *.VC.db
112 | *.VC.VC.opendb
113 |
114 | # Visual Studio profiler
115 | *.psess
116 | *.vsp
117 | *.vspx
118 | *.sap
119 |
120 | # Visual Studio Trace Files
121 | *.e2e
122 |
123 | # TFS 2012 Local Workspace
124 | $tf/
125 |
126 | # Guidance Automation Toolkit
127 | *.gpState
128 |
129 | # ReSharper is a .NET coding add-in
130 | _ReSharper*/
131 | *.[Rr]e[Ss]harper
132 | *.DotSettings.user
133 |
134 | # TeamCity is a build add-in
135 | _TeamCity*
136 |
137 | # DotCover is a Code Coverage Tool
138 | *.dotCover
139 |
140 | # AxoCover is a Code Coverage Tool
141 | .axoCover/*
142 | !.axoCover/settings.json
143 |
144 | # Coverlet is a free, cross platform Code Coverage Tool
145 | coverage*.json
146 | coverage*.xml
147 | coverage*.info
148 |
149 | # Visual Studio code coverage results
150 | *.coverage
151 | *.coveragexml
152 |
153 | # NCrunch
154 | _NCrunch_*
155 | .*crunch*.local.xml
156 | nCrunchTemp_*
157 |
158 | # MightyMoose
159 | *.mm.*
160 | AutoTest.Net/
161 |
162 | # Web workbench (sass)
163 | .sass-cache/
164 |
165 | # Installshield output folder
166 | [Ee]xpress/
167 |
168 | # DocProject is a documentation generator add-in
169 | DocProject/buildhelp/
170 | DocProject/Help/*.HxT
171 | DocProject/Help/*.HxC
172 | DocProject/Help/*.hhc
173 | DocProject/Help/*.hhk
174 | DocProject/Help/*.hhp
175 | DocProject/Help/Html2
176 | DocProject/Help/html
177 |
178 | # Click-Once directory
179 | publish/
180 |
181 | # Publish Web Output
182 | *.[Pp]ublish.xml
183 | *.azurePubxml
184 | # Note: Comment the next line if you want to checkin your web deploy settings,
185 | # but database connection strings (with potential passwords) will be unencrypted
186 | *.pubxml
187 | *.publishproj
188 |
189 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
190 | # checkin your Azure Web App publish settings, but sensitive information contained
191 | # in these scripts will be unencrypted
192 | PublishScripts/
193 |
194 | # NuGet Packages
195 | *.nupkg
196 | # NuGet Symbol Packages
197 | *.snupkg
198 | # The packages folder can be ignored because of Package Restore
199 | **/[Pp]ackages/*
200 | # except build/, which is used as an MSBuild target.
201 | !**/[Pp]ackages/build/
202 | # Uncomment if necessary however generally it will be regenerated when needed
203 | #!**/[Pp]ackages/repositories.config
204 | # NuGet v3's project.json files produces more ignorable files
205 | *.nuget.props
206 | *.nuget.targets
207 |
208 | # Microsoft Azure Build Output
209 | csx/
210 | *.build.csdef
211 |
212 | # Microsoft Azure Emulator
213 | ecf/
214 | rcf/
215 |
216 | # Windows Store app package directories and files
217 | AppPackages/
218 | BundleArtifacts/
219 | Package.StoreAssociation.xml
220 | _pkginfo.txt
221 | *.appx
222 | *.appxbundle
223 | *.appxupload
224 |
225 | # Visual Studio cache files
226 | # files ending in .cache can be ignored
227 | *.[Cc]ache
228 | # but keep track of directories ending in .cache
229 | !?*.[Cc]ache/
230 |
231 | # Others
232 | ClientBin/
233 | ~$*
234 | *~
235 | *.dbmdl
236 | *.dbproj.schemaview
237 | *.jfm
238 | *.pfx
239 | *.publishsettings
240 | orleans.codegen.cs
241 |
242 | # Including strong name files can present a security risk
243 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
244 | #*.snk
245 |
246 | # Since there are multiple workflows, uncomment next line to ignore bower_components
247 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
248 | #bower_components/
249 |
250 | # RIA/Silverlight projects
251 | Generated_Code/
252 |
253 | # Backup & report files from converting an old project file
254 | # to a newer Visual Studio version. Backup files are not needed,
255 | # because we have git ;-)
256 | _UpgradeReport_Files/
257 | Backup*/
258 | UpgradeLog*.XML
259 | UpgradeLog*.htm
260 | ServiceFabricBackup/
261 | *.rptproj.bak
262 |
263 | # SQL Server files
264 | *.mdf
265 | *.ldf
266 | *.ndf
267 |
268 | # Business Intelligence projects
269 | *.rdl.data
270 | *.bim.layout
271 | *.bim_*.settings
272 | *.rptproj.rsuser
273 | *- [Bb]ackup.rdl
274 | *- [Bb]ackup ([0-9]).rdl
275 | *- [Bb]ackup ([0-9][0-9]).rdl
276 |
277 | # Microsoft Fakes
278 | FakesAssemblies/
279 |
280 | # GhostDoc plugin setting file
281 | *.GhostDoc.xml
282 |
283 | # Node.js Tools for Visual Studio
284 | .ntvs_analysis.dat
285 | node_modules/
286 |
287 | # Visual Studio 6 build log
288 | *.plg
289 |
290 | # Visual Studio 6 workspace options file
291 | *.opt
292 |
293 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
294 | *.vbw
295 |
296 | # Visual Studio LightSwitch build output
297 | **/*.HTMLClient/GeneratedArtifacts
298 | **/*.DesktopClient/GeneratedArtifacts
299 | **/*.DesktopClient/ModelManifest.xml
300 | **/*.Server/GeneratedArtifacts
301 | **/*.Server/ModelManifest.xml
302 | _Pvt_Extensions
303 |
304 | # Paket dependency manager
305 | .paket/paket.exe
306 | paket-files/
307 |
308 | # FAKE - F# Make
309 | .fake/
310 |
311 | # CodeRush personal settings
312 | .cr/personal
313 |
314 | # Python Tools for Visual Studio (PTVS)
315 | __pycache__/
316 | *.pyc
317 |
318 | # Cake - Uncomment if you are using it
319 | # tools/**
320 | # !tools/packages.config
321 |
322 | # Tabs Studio
323 | *.tss
324 |
325 | # Telerik's JustMock configuration file
326 | *.jmconfig
327 |
328 | # BizTalk build output
329 | *.btp.cs
330 | *.btm.cs
331 | *.odx.cs
332 | *.xsd.cs
333 |
334 | # OpenCover UI analysis results
335 | OpenCover/
336 |
337 | # Azure Stream Analytics local run output
338 | ASALocalRun/
339 |
340 | # MSBuild Binary and Structured Log
341 | *.binlog
342 |
343 | # NVidia Nsight GPU debugger configuration file
344 | *.nvuser
345 |
346 | # MFractors (Xamarin productivity tool) working folder
347 | .mfractor/
348 |
349 | # Local History for Visual Studio
350 | .localhistory/
351 |
352 | # BeatPulse healthcheck temp database
353 | healthchecksdb
354 |
355 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
356 | MigrationBackup/
357 |
358 | # Ionide (cross platform F# VS Code tools) working folder
359 | .ionide/
360 |
361 | # Fody - auto-generated XML schema
362 | FodyWeavers.xsd
363 |
--------------------------------------------------------------------------------