RI Development to main by jacob-ronstadt · Pull Request #175 · microsoft/Windows-Driver-Developer-Supplemental-Tools

jacob-ronstadt · 2025-05-29T16:37:07Z

Checklist for Pull Requests

Description is filled out.
Only one query or related query group is in this pull request.
The version number on changed queries has been increased via the @version comment in the file header.
All unit tests have been run: (Test README.md).
Commands codeql database create and codeql database analyze have completed successfully.
A .qhelp file has been added for any new queries or updated if changes have been made to an existing query.

* Update build-codeql.yaml test codeql action Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml manual download Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml add back yest of build step Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml try all jobs Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml test all jobs Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml dvl tests Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Add files via upload Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Create readme Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * restructure * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * add test projects * Update dvl_tests.ps1 Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update dvl_tests.ps1 Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update dvl_tests.ps1 Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update dvl_tests.ps1 Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update dvl_tests.ps1 Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * update build_create_analyze_test.py to fail when different results are found * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * change when results get uploaded * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * fix exit code * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * update to use driver_snippet.c instead of other driver projects * add template path variable * fix path * fix path * test * fix template path * test * update template project to have arm configuration * fix msbuild command * fix driver_snippet.c * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * print results location * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * fix sarif copy and compare sarif results * add expected sarif results * Delete src/drivers/test/dvl_tests/readme Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * test secret condition without deleting secret Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml change condition back Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml test env Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml test env Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml fail test-codeql-latest-vs-current if prev job fails Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * Update build-codeql.yaml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

…cts (#110) * init commit * moved files around added the snippets * I think this fixes the build * update the WFP library to be more robust. Driver_snippets still need some edits * Update the ID path * fixes build issue * attempt 2 * forgot () added them * fix spelling * updated ID path and hopefully fixed the last compile error * I had another typo, this should fix it * changes the id property * lowercase letters * synced the forked made name change to one query * other name edit --------- Co-authored-by: Elaine Houha <elhouha@microsoft.com>

This reverts commit c282407.

* WIP C28129 * C28129 * add sarif file and update diff file * update id and move out of experimental * add query to ported ca checks suite --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* C28133 * add query to ported ca checks suite --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* codeql port of c28151 * Update IrqlIllegalValue.ql Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

codeql port of C28730

Port of C28162

* WIP C28161 * port of C28161 * move from kmdf to wdm * remove old files

* port of C28132 * update to remove false positives

* port of C28716 * add other bool types

* port of C29715 * add other bool types

* port of C28714 * improve query * add other bool types * update name

* C28101 * add query to ported ca checks suite * specifically check for driver_initialize --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* codeql port of C28165 * update query to also work with typedef types and _use_decl_annotations_ * update sarif

* WIP FloatHardwareStateProtection * FloatHardwareStateProtection.ql TODO test on samples * add more control flow * add query to ported ca checks suite * move from kmdf to wdm. add sarif file. * fix output message * resolve todos

* C28131 * updates to ql * update id and move out of experimental * add query to ported ca checks suite * update to also check for local pointers to structs --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* port of C28114, Copying a whole IRP stack entry * update unit tests * fix ql name * update id and move out of experimental * add query to ported ca checks suite * fix sarif file --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

@kind

* WIP driver isolation * WIP driver isolation. add zw* using non-null rootdirectory * add flow config for OK open reg key functions? * query finds Zw* isolation function use where OBJECT_ATTRIBUTES has non-null RootDirectory AND the RootDirectory didn't come from allowed function * WIP null rootdir * WIP null rootdir * WIP split into read/write accesses * Preliminary query * fix zwRead and zwWrite predicates * fix null root dir * bug fixes and add test cases * query improvements and tests * flow update * add tests and small query improvements * add exceptions * add extra barriers to flow * refactor query and fix barriers in dataflow * update qhelp files and queries and tests * fix comment * query improvements * WIP query updates * bug fixes and improvements * fix exception for SERIALCOMM to also match as prefix * allow handles that are relative to handles obtained from approved ddi * add recursive check for allowed handle source * change @kind from path-problem for debugging to problem * update select message * update zw violation 2 * small fix * add allowed handle source to driverisolation.qll and zwviolation2. update zwViolation1 to use lib * improve query * query updates * update query to remove potential true results * WIP wdf isolation * move isolation queries to experimental * update config file * Update codeql-config.yml Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> * remove wdf WIP query for dev * update version of qlpack * update driver_snippet --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Suite updates to add additional queries * update windows_driver_mustfix.qls * update readme * qlpack version update * update query packs * update github action * update query suites with missing query * update version * sort query suites * add missing queries * Fix opaqueid fields. For some reason opaque-id causes issues with sarif reader. * fix changed file

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Revert must-fix to current requirements. Make recommended contain what next mustfix will. Make mustrun suite. * update version * remove old suite files * update dependency versions. update dvl_tests.ps1 for changed mustfix suite name * fix version number in suites * update qlpack version

* Revert must-fix to current requirements. Make recommended contain what next mustfix will. Make mustrun suite. * update version * remove old suite files * Updating documentation for new version * update dependency versions. update dvl_tests.ps1 for changed mustfix suite name * fix version number in suites * update qlpack version * update readme * update qlpack dependency versions --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Copilot

Pull Request Overview

This pull request introduces several new query implementations, updates to query documentation, and modifications to the CodeQL configuration and workflow. Key changes include new and updated CodeQL queries for driver entry buffer handling, current function type correctness, annotation syntax checking, and an experimental check for unsafe calls in global initializers; dependency updates in codeql-pack.lock.yml; and significant refinements in the GitHub Actions workflows.

Reviewed Changes

Copilot reviewed 302 out of 302 changed files in this pull request and generated 2 comments.

File	Description
src/drivers/general/queries/DriverEntrySaveBuffer/driver_snippet.c	Added multiple DriverEntry functions with variations in how RegistryPath is saved, triggering CodeQL rule warnings
src/drivers/general/queries/AnnotationSyntax/driver_snippet.c	Introduced test cases for various annotation scenarios, including cases with out-of-range dispatch type values
Other files (SARIF, .ql, .qhelp, workflows, README.md, config files)	Updated or added new CodeQL queries, documentation, and dependency & workflow configuration changes

Copilot · 2025-05-29T16:37:42Z

+    PUNICODE_STRING RegistryPath
+    )
+{
+    g_RP3 = *RegistryPath;


Assigning the dereferenced RegistryPath directly may not perform a proper copy of the buffer. Consider using a dedicated string copy function like RtlUnicodeStringCopy to ensure that the contents are safely duplicated before the I/O Manager frees the original buffer.

Suggested change

g_RP3 = *RegistryPath;

RtlUnicodeStringCopy(&g_RP3, RegistryPath);

Copilot · 2025-05-29T16:37:43Z

+}
+
+// out of range
+__drv_dispatchType(65)


The value 65 used in __drv_dispatchType is outside the allowed range (-1 to 63). Updating this value to a valid number is recommended to prevent annotation-related errors.

Suggested change

__drv_dispatchType(65)

__drv_dispatchType(0)

NateD-MSFT · 2025-05-30T22:10:15Z

@jacob-ronstadt I asked Copilot to summarize the changes in this RI (see below). It's missing some obvious things (like all the queries that have been added) that got caught in the above summary, but it's got some things that that summary missed too. Between these two comments do we have good coverage of everything in this RI?

This pull request introduces significant updates to the CodeQL workflow and documentation for Windows driver development. Key changes include improvements to the .github/workflows/build-codeql.yaml file, new job definitions for testing and publishing, and updates to the README.md for clarity and accuracy regarding CodeQL usage. These changes enhance automation, streamline testing processes, and ensure the documentation aligns with the latest practices.

Workflow Updates

CodeQL Automation Enhancements:

Added a new environment variable CODEQL_VERSION for centralized version management in the build-codeql.yaml workflow.
Replaced the i3h/download-release-asset action with a direct download and extraction method using PowerShell for CodeQL CLI. This ensures compatibility with dynamic versioning.
Introduced multiple new jobs (test-query-health, test-codeql-latest-vs-current, test-pack-version-update, test-create-dvl, and publish) to automate testing, validation, and publishing processes. [1] [2]

Testing Improvements:

Added conditional logic for running test scripts based on environment variables, ensuring flexibility in testing scenarios.
Enhanced validation for qlpack.yml version updates with detailed error messages for better debugging.

Documentation Updates

CodeQL Usage Clarity:

Updated the README.md to reflect the latest CodeQL CLI and pack versions, ensuring users have accurate information for setup and compatibility.
Simplified instructions for downloading and installing CodeQL CLI and packs, removing outdated references to submodules and older workflows.

jacob-ronstadt · 2025-06-05T20:10:08Z

@NateD-MSFT Copilot doesn't seem to work with *.ql files. Most of the changes are additional queries. There are also codeql library improvements and additions, new test templates, workflow improvements, and qlpack updates.

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* fixing azure file upload * testing * fix pack version check * only compare detailed results * bug fix * use more threads with codeql * save latest version if the results are the same * testing * add manual publish workflow

* suppress breaking change warning. NA because we don't get the output from set-azstoragefilecontent * move float safe/unsafe queries to kmdf folder and fix output strings * move float safe/unsafe queries to kmdf folder and fix output strings

* Improve replacement recommendations in ExtendedDeprecatedApis * Bump query version

This reverts commit d853571.

jacob-ronstadt and others added 30 commits May 24, 2024 10:05

Update build-codeql.yaml to allow publish step to fail for outside PRs

468e003

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Update build-codeql.yaml (#141)

ac8f77f

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

codeql port of C28648. TODO needs tests

c282407

Revert "codeql port of C28648. TODO needs tests"

ce7d70c

This reverts commit c282407.

OperandAssignment: CodeQL Port of C28129 (#121)

c15579b

* WIP C28129 * C28129 * add sarif file and update diff file * update id and move out of experimental * add query to ported ca checks suite --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

IoInitializeTimerCall: CodeQL port of C28133 (#123)

540f0d4

* C28133 * add query to ported ca checks suite --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

IrqlIllegalValue: CodeQL port of c28151 (#144)

c2febb9

* codeql port of c28151 * Update IrqlIllegalValue.ql Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com> --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

NullPointerCharacterAssignment: CodeQL port of C28730 (#146)

c8369c9

codeql port of C28730

FloatSafeExit: CodeQL port of C28162 (#147)

786fda0

Port of C28162

FloatUnsafeExit: CodeQL port of C28161 (#148)

9dc8063

* WIP C28161 * port of C28161 * move from kmdf to wdm * remove old files

PointerVariableSize: CodeQL port of C28132 (#143)

f227ac0

* port of C28132 * update to remove false positives

NtstatusExplicitCast3: CodeQL port of C28716 (#151)

735f49f

* port of C28716 * add other bool types

NtstatusExplicitCast2: CodeQL port of C29715 (#150)

d71fb93

* port of C29715 * add other bool types

NtstatusExplicitCast: CodeQL port of C28714 (#149)

3165575

* port of C28714 * improve query * add other bool types * update name

CurrentFunctionTypeNotCorrect: CodeQL port of C28101 (#124)

7edf413

* C28101 * add query to ported ca checks suite * specifically check for driver_initialize --------- Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

InvalidFunctionPointerAnnotation: CodeQL port of C28165 (#145)

4eab8e3

* codeql port of C28165 * update query to also work with typedef types and _use_decl_annotations_ * update sarif

update ported_driver_ca_checks.qls with new queries

e5c16d7

fix typo

713331e

updates to test script

60874fd

update config file to include other isolation queries

129bcb5

update build script

39f0f5d

update sarif files for isolation queries

0c54c94

Update codeql-config.yml

9c1627b

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

jacob-ronstadt and others added 16 commits February 20, 2025 17:12

remove false positives

78b7b70

remove false positives

9629358

remove false positives

8edf3f1

Add possible false positive note to DriverEntrySaveBuffer.qhelp

335b284

remove non-SAL parameters due to false positives

880c39a

update message

8455a12

update test results to match query update

d99af75

fix query id

1bde64e

Update codeql-config.yml

0ba716b

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Update codeql-config.yml

c88a2a1

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Update codeql-config.yml

4f04d8c

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Update codeql-config.yml

06ef37d

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Update codeql-config.yml

4246e2a

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

jacob-ronstadt requested review from NateD-MSFT and Copilot May 29, 2025 16:37

jacob-ronstadt self-assigned this May 29, 2025

Copilot AI reviewed May 29, 2025

View reviewed changes

jacob-ronstadt and others added 5 commits June 10, 2025 16:44

Update README.md

03de642

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

Actions azure file storage fix (#176)

35b9f55

* fixing azure file upload * testing * fix pack version check * only compare detailed results * bug fix * use more threads with codeql * save latest version if the results are the same * testing * add manual publish workflow

Fix query health action (#177)

35d8ba7

* suppress breaking change warning. NA because we don't get the output from set-azstoragefilecontent * move float safe/unsafe queries to kmdf folder and fix output strings * move float safe/unsafe queries to kmdf folder and fix output strings

Improve recommendations in ExtendedDeprecatedApis for strlen (#179)

df3da19

* Improve replacement recommendations in ExtendedDeprecatedApis * Bump query version

Merge branch 'main' into development

4700593

NateD-MSFT approved these changes Jun 27, 2025

View reviewed changes

jacob-ronstadt merged commit d853571 into main Jul 14, 2025
13 checks passed

jacob-ronstadt added a commit that referenced this pull request Jul 14, 2025

Revert "RI Development to main (#175)"

36c9084

This reverts commit d853571.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RI Development to main #175

RI Development to main #175
jacob-ronstadt merged 81 commits into
mainfrom
development

jacob-ronstadt commented May 29, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI May 29, 2025

Uh oh!

Copilot AI May 29, 2025

Uh oh!

NateD-MSFT commented May 30, 2025 •

edited

Loading

Uh oh!

jacob-ronstadt commented Jun 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	g_RP3 = *RegistryPath;
	RtlUnicodeStringCopy(&g_RP3, RegistryPath);

Conversation

jacob-ronstadt commented May 29, 2025

Checklist for Pull Requests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI May 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 29, 2025

Choose a reason for hiding this comment

Uh oh!

NateD-MSFT commented May 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Workflow Updates

CodeQL Automation Enhancements:

Testing Improvements:

Documentation Updates

CodeQL Usage Clarity:

Uh oh!

jacob-ronstadt commented Jun 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NateD-MSFT commented May 30, 2025 •

edited

Loading