99#define DEFAULT_SECURITY_COOKIE 0x00002B992DDFA232ll
101#define DEFAULT_SECURITY_COOKIE 0xBB40E64E
153 SubKeyString = *SubKey;
155 while (SubKeyString.
Length)
157 if (p1[-1] ==
L'\\')
break;
159 SubKeyString.
Length -=
sizeof(*p1);
162 SubKeyString.
Length = SubKey->Length - SubKeyString.
Length;
194 ULONG KeyInfoSize, ResultSize;
218 if (KeyValueInformation !=
NULL)
247 &KeyValueInformation->
Data,
261 if (KeyValueInformation->
Type !=
Type)
275 &KeyValueInformation->
Data,
338 if (FreeHeap)
RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation);
432 (DirSize != 64 && ConfigDir->
Size != DirSize) ||
433 (ConfigDir->
Size < 0x48))
486 if (*
Cookie == 0xBB40) NewCookie &= 0xFFFF;
490 if ((NewCookie == 0) || (NewCookie == *
Cookie))
510 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
514 DPRINT(
"LdrpInitializeThread() called for %wZ (%p/%p)\n",
524 Status = RtlAllocateActivationContextStack(&
NtCurrentTeb()->ActivationContextStackPointer);
527 DPRINT1(
"Warning: Unable to allocate ActivationContextStack\n");
538 NextEntry = ListHead->
Flink;
539 while (NextEntry != ListHead)
564 RtlActivateActivationContextUnsafeFast(&
ActCtx,
584 DPRINT(
"%wZ - Calling entry point at %p for thread attaching, %p/%p\n",
596 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_ATTACH) for %wZ\n",
602 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
608 NextEntry = NextEntry->
Flink;
620 RtlActivateActivationContextUnsafeFast(&
ActCtx,
635 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
643 DPRINT(
"LdrpInitializeThread() done\n");
659 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
660 ULONG BreakOnDllLoad;
664 DPRINT(
"LdrpRunInitializeRoutines() called for %wZ (%p/%p)\n",
681 Count *
sizeof(*LdrRootEntry));
687 LdrRootEntry = LocalArray;
699 DPRINT1(
"[%p,%p] LDR: Real INIT LIST for Process %wZ\n",
707 NextEntry = ListHead->
Flink;
709 while (NextEntry != ListHead)
728 LdrRootEntry[
i] = LdrEntry;
733 DPRINT1(
"[%p,%p] LDR: %wZ init routine %p\n",
746 NextEntry = NextEntry->
Flink;
755 if (Kernel32ProcessInitPostImportFunction)
758 Status = Kernel32ProcessInitPostImportFunction();
761 DPRINT1(
"LDR: LdrpRunInitializeRoutines - Failed running kernel32 post-import function, Status=0x%08lx\n",
Status);
765 Kernel32ProcessInitPostImportFunction =
NULL;
781 LdrEntry = LdrRootEntry[
i];
815 DPRINT1(
" - About to call init routine at %p\n", EntryPoint);
835 RtlActivateActivationContextUnsafeFast(&
ActCtx,
850 DPRINT1(
"%wZ - Calling entry point at %p for DLL_PROCESS_ATTACH\n",
861 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_ATTACH) for %wZ\n",
867 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
878 DPRINT1(
"LDR: DLL_PROCESS_ATTACH for dll \"%wZ\" (InitRoutine: %p) failed\n",
889 NextEntry = NextEntry->
Flink;
890 while (NextEntry != ListHead)
899 NextEntry = NextEntry->
Flink;
911 RtlActivateActivationContextUnsafeFast(&
ActCtx,
926 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
934 if (LdrRootEntry != LocalArray)
941 DPRINT(
"LdrpRunInitializeRoutines() done\n");
955 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
986 DPRINT1(
"We don't support Etw yet.\n");
991 NextEntry = ListHead->
Blink;
992 while (NextEntry != ListHead)
996 NextEntry = NextEntry->
Blink;
1015 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1028 DPRINT(
"%wZ - Calling entry point at %p for thread detaching\n",
1037 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1043 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1057 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1072 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1079 DPRINT(
"LdrpShutdownProcess() done\n");
1095 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
1098 DPRINT(
"LdrShutdownThread() called for %wZ\n",
1105 DPRINT1(
"We don't support Etw yet.\n");
1113 NextEntry = ListHead->
Blink;
1114 while (NextEntry != ListHead)
1118 NextEntry = NextEntry->
Blink;
1140 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1160 DPRINT(
"%wZ - Calling entry point at %p for thread detaching\n",
1170 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_DETACH) for %wZ\n",
1176 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1191 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1206 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1228 pFlsData = Teb->FlsData;
1235 for (
n = 1;
n <= FlsHighIndex; ++
n)
1238 if (lpCallback && pFlsData->
Data[
n])
1240 lpCallback(pFlsData->
Data[
n]);
1245 Teb->FlsData =
NULL;
1249 if (Teb->HasFiberData)
1258 DPRINT(
"LdrShutdownThread() done\n");
1277 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1278 NextEntry = ListHead->
Flink;
1279 while (ListHead != NextEntry)
1283 NextEntry = NextEntry->
Flink;
1292 if (!TlsDirectory)
continue;
1300 DPRINT1(
"LDR: Tls Found in %wZ at %p\n",
1349 NextEntry = ListHead->
Flink;
1350 while (NextEntry != ListHead)
1354 NextEntry = NextEntry->
Flink;
1371 DPRINT1(
"LDR: TlsVector %p Index %lu = %p copied from %x to %p\n",
1400 if (!TlsVector)
return;
1404 NextEntry = ListHead->
Flink;
1405 while (NextEntry != ListHead)
1408 NextEntry = NextEntry->
Flink;
1431 ULONG ExecuteOptions, MinimumStackCommit = 0, GlobalFlag;
1453 sizeof(ExecuteOptions),
1472 if (
Peb->ImageUsesLargePages)
1480 L"DisableHeapLookaside",
1494 L"MinimumStackCommitInBytes",
1496 &MinimumStackCommit,
1497 sizeof(MinimumStackCommit),
1523 DPRINT1(
"AVRF: LdrpInitializeApplicationVerifierPackage failed with %08X\n",
Status);
1536 DPRINT1(
"AVRF: LdrpInitializeApplicationVerifierPackage failed with %08X\n",
Status);
1548 DPRINT(
"LdrpValidateImageForMp is unimplemented\n");
1595 } KnownCompatGuids[] = {
1603 ULONG Buffer[(
sizeof(COMPATIBILITY_CONTEXT_ELEMENT) * 10 +
sizeof(ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION)) /
sizeof(
ULONG)];
1604 ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION* ContextCompatInfo;
1615 DPRINT1(
"LdrpInitializeProcessCompat: Corrupt pShimData (0x%x, %u)\n", pShimData->
dwMagic, pShimData->
dwSize);
1622 DPRINT1(
"LdrpInitializeProcessCompat: ProcessCompatVersion set to ignore manifest\n");
1632 SizeRequired =
sizeof(
Buffer);
1636 CompatibilityInformationInActivationContext,
1643 DPRINT1(
"LdrpInitializeProcessCompat: Unable to query process actctx with status %x\n",
Status);
1647 ContextCompatInfo = (ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION*)
Buffer;
1649 if (ContextCompatInfo->ElementCount == 0)
1660 for (
n = 0;
n < ContextCompatInfo->ElementCount; ++
n)
1662 if (ContextCompatInfo->Elements[
n].Type == ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS &&
1667 DPRINT1(
"LdrpInitializeProcessCompat: Not applying automatic fix for winver 0x%x due to policy\n", KnownCompatGuids[
cur].
Version);
1672 if (pShimData ==
NULL)
1681 DPRINT1(
"LdrpInitializeProcessCompat: Unable to allocated %u bytes\n",
sizeof(*pShimData));
1685 pShimData->
dwSize =
sizeof(*pShimData);
1688 Peb->pShimData = pShimData;
1689 *pOldShimData = pShimData;
1694 DPRINT1(
"LdrpInitializeProcessCompat: Found guid for winver 0x%x in manifest from %wZ\n",
1716 RtlInitEmptyUnicodeString(&DotLocal, LocalBuffer,
sizeof(LocalBuffer));
1724 DPRINT1(
"LDR: Failed to allocate memory for .local check\n");
1731 DPRINT1(
"LDR: String too big for .local check\n");
1756 if (DotLocal.
Buffer != LocalBuffer)
1770 ULONG ComSectionSize;
1799 ULONG DebugProcessHeapOnly = 0;
1802 ULONG ExecuteOptions = 0;
1821 ImagePathName.
Buffer = ImagePath;
1836 IsDotNetImage =
TRUE;
1850 OldShimData =
Peb->pShimData;
1861 if (ProcessParameters)
1892 HeapParameters.
Length =
sizeof(HeapParameters);
1895#define VALID_CONFIG_FIELD(Name) (ConfigSize >= RTL_SIZEOF_THROUGH_FIELD(IMAGE_LOAD_CONFIG_DIRECTORY, Name))
1900 DPRINT1(
"WARN: Accepting different LOAD_CONFIG size!\n");
1902 DPRINT1(
"Applying LOAD_CONFIG\n");
1929#undef VALID_CONFIG_FIELD
1947 DPRINT1(
"LDR: PID: 0x%p started - '%wZ'\n",
2001 DPRINT1(
"We don't support user stack trace databases yet\n");
2031 DPRINT1(
"Failed to create process heap\n");
2038 DPRINT1(
"Failed to initialize locale table\n");
2048 HeapParameters.
Length =
sizeof(HeapParameters);
2052 DPRINT1(
"Failed to create loader private heap\n");
2061 L"DebugProcessHeapOnly",
2063 &DebugProcessHeapOnly,
2120 DPRINT1(
"LDR: %s - failed call to ZwQuerySymbolicLinkObject with status %x\n",
"",
Status);
2136 if (ProcessParameters)
2147 DPRINT1(
"No valid DllPath was given!\n");
2166 DPRINT1(
"LDR: LdrpInitializeProcess - unable to allocate current working directory buffer\n");
2179 DPRINT(
"Using dynamically allocd curdir\n");
2184 DPRINT(
"Using local system root\n");
2211 if (!ImageFileName.
Buffer[0])
2219 Current = ImageFileName.
Buffer;
2222 if (*Current++ ==
'\\')
2225 NtDllName = Current;
2272 DPRINT1(
"LDR: NEW PROCESS\n");
2314 DPRINT1(
"LDR: AVrfInitializeVerifier failed (ntstatus 0x%x)\n",
Status);
2323 DPRINT1(
"We don't support .NET applications yet\n");
2329 PVOID Kernel32BaseAddress;
2330 PVOID FunctionAddress;
2342 &BaseProcessInitPostImportName,
2349 DPRINT1(
"LDR: Unable to find post-import process init function, Status=0x%08lx\n",
Status);
2352 Kernel32ProcessInitPostImportFunction = FunctionAddress;
2355 &BaseQueryModuleDataName,
2362 DPRINT1(
"LDR: Unable to find BaseQueryModuleData, Status=0x%08lx\n",
Status);
2365 Kernel32BaseQueryModuleData = FunctionAddress;
2374 DPRINT1(
"LDR: Performing EXE relocation\n");
2390 DPRINT1(
"LdrRelocateImageWithBias() failed\n");
2397 DPRINT1(
"WARNING: Relocated EXE Context");
2409 NextEntry = ListHead->
Flink;
2410 while (ListHead != NextEntry)
2414 NextEntry = NextEntry->
Flink;
2421 if (!
NT_SUCCESS(ImportStatus))
return ImportStatus;
2432 DPRINT1(
"LDR: LdrpProcessInitialization failed to initialize TLS slots; status %x\n",
2466 sizeof(ExecuteOptions));
2469 DPRINT1(
"LDR: Could not set process execute flags 0x%x; status %x\n",
2477 if (((
Peb->OSCSDVersion >> 8) & 0xFF) != 0)
2479 WCHAR szCSDVersion[128];
2484 ((
Peb->OSCSDVersion >> 8) & 0xFF));
2518 DPRINT(
"Querying app compat hacks is missing!\n");
2530 DPRINT1(
"LDR: LdrpProcessInitialization failed running initialization routines; status %x\n",
2551 if (OptionsKey)
NtClose(OptionsKey);
2565 DPRINT1(
"LDR: Process initialization failure for %wZ; NTSTATUS = %08lx\n",
2587 DPRINT(
"LdrpInit() %p/%p\n",
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
WCHAR CurrentDirectory[1024]
_In_ ULONG _In_ BATTERY_QUERY_INFORMATION_LEVEL _In_ LONG _In_ ULONG _Out_ PULONG ReturnedLength
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
struct _PEB_LDR_DATA PEB_LDR_DATA
#define REACTOS_SHIMDATA_MAGIC
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define STATUS_INVALID_HANDLE
#define STATUS_NOT_IMPLEMENTED
#define STATUS_OBJECT_TYPE_MISMATCH
#define RtlInitializeBitMap
#define NT_SUCCESS(StatCode)
#define DLL_THREAD_DETACH
#define DLL_PROCESS_ATTACH
#define DLL_PROCESS_DETACH
#define RtlImageDirectoryEntryToData
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
#define DLL_THREAD_ATTACH
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define InsertHeadList(ListHead, Entry)
UNICODE_STRING * PUNICODE_STRING
#define RtlCompareMemory(s1, s2, l)
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
#define InitializeListHead(ListHead)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define REACTOS_COMPATVERSION_IGNOREMANIFEST
#define FLG_USER_STACK_TRACE_DB
#define FLG_SHOW_LDR_SNAPS
#define FLG_HEAP_PAGE_ALLOCS
#define TLS_EXPANSION_SLOTS
#define FLG_APPLICATION_VERIFIER
#define OBJ_CASE_INSENSITIVE
NTSYSAPI void WINAPI RtlReleasePebLock(void)
NTSYSAPI void WINAPI RtlAcquirePebLock(void)
NTSYSAPI void WINAPI DbgBreakPoint(void)
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING, PCWSTR)
NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void)
NTSYSAPI void WINAPI LdrShutdownProcess(void)
NTSYSAPI void WINAPI LdrShutdownThread(void)
NTSYSAPI NTSTATUS WINAPI RtlQueryInformationActivationContext(ULONG, HANDLE, PVOID, ULONG, PVOID, SIZE_T, SIZE_T *)
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedCompareExchangePointer
long __cdecl _InterlockedIncrement(_Interlocked_operand_ long volatile *_Addend)
long __cdecl _InterlockedCompareExchange(_Interlocked_operand_ long volatile *_Destination, long _Exchange, long _Comparand)
#define UInt32x32To64(a, b)
ULONG RtlpDisableHeapLookaside
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
VOID NTAPI LdrpInitializeDotLocalSupport(PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
BOOLEAN LdrpShutdownInProgress
WCHAR LdrpKnownDllPathBuffer[128]
VOID NTAPI LdrpInit(PCONTEXT Context, PVOID SystemArgument1, PVOID SystemArgument2)
UNICODE_STRING LdrpDefaultPath
NTSTATUS NTAPI LdrQueryImageFileExecutionOptionsEx(_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength, _In_ BOOLEAN Wow64)
ULONG RtlpShutdownProcessFlags
VOID NTAPI LdrpFreeTls(VOID)
static IN LPSTR IN PVOID IN PVOID Unk3
VOID NTAPI RtlpInitDeferredCriticalSection(VOID)
HANDLE LdrpShutdownThreadId
NTSTATUS NTAPI LdrpInitializeExecutionOptions(PUNICODE_STRING ImagePathName, PPEB Peb, PHANDLE OptionsKey)
RTL_CRITICAL_SECTION FastPebLock
LONG LdrpProcessInitialized
ULONG LdrpNumberOfTlsEntries
ULONG LdrpNumberOfProcessors
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
ULONG LdrpActiveUnloadCount
NTSTATUS NTAPI LdrQueryImageFileExecutionOptions(_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
PVOID NTAPI LdrpInitSecurityCookie(PLDR_DATA_TABLE_ENTRY LdrEntry)
BOOLEAN LdrpLoaderLockInit
const UNICODE_STRING LdrpDotLocal
HANDLE ImageExecOptionsKey
static IN LPSTR IN PVOID Unk2
LARGE_INTEGER RtlpTimeout
NTSTATUS LdrPerformRelocations(PIMAGE_NT_HEADERS NTHeaders, PVOID ImageBase)
HANDLE Wow64ExecOptionsKey
NTSTATUS NTAPI RtlpInitializeLocaleTable(VOID)
#define DEFAULT_SECURITY_COOKIE
NTSTATUS NTAPI LdrQueryImageFileKeyOption(_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
PTEB LdrpTopLevelDllBeingLoadedTeb
VOID NTAPI RtlInitializeHeapManager(VOID)
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64, _Out_ PHANDLE NewKeyHandle)
PVOID NTAPI LdrpFetchAddressOfSecurityCookie(PVOID BaseAddress, ULONG SizeOfImage)
ULONG LdrpFatalHardErrorCount
VOID NTAPI LdrpValidateImageForMp(IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry)
LIST_ENTRY LdrpHashTable[LDR_HASH_TABLE_ENTRIES]
UNICODE_STRING LdrpKnownDllPath
NTSTATUS NTAPI LdrpInitializeProcess(IN PCONTEXT Context, IN PVOID SystemArgument1)
RTL_BITMAP TlsExpansionBitMap
NTSTATUS NTAPI LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
BOOLEAN LdrpLdrDatabaseIsSetup
RTL_CRITICAL_SECTION_DEBUG LdrpLoaderLockDebug
VOID NTAPI RtlpInitializeVectoredExceptionHandling(VOID)
BOOLEAN NTAPI LdrpDisableProcessCompatGuidDetection(VOID)
HANDLE LdrpKnownDllObjectDirectory
RTL_CRITICAL_SECTION LdrpLoaderLock
VOID NTAPI LdrpInitFailure(NTSTATUS Status)
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
PLDR_DATA_TABLE_ENTRY LdrpNtDllDataTableEntry
VOID NTAPI LdrpInitializeProcessCompat(PVOID pProcessActctx, PVOID *pOldShimData)
NTSTATUS NTAPI LdrpInitializeTls(VOID)
VOID NTAPI LdrpEnsureLoaderLockIsHeld(VOID)
#define VALID_CONFIG_FIELD(Name)
UNICODE_STRING ImageExecOptionsString
UNICODE_STRING Kernel32String
BOOLEAN RtlpTimeoutDisable
UNICODE_STRING Wow64OptionsString
VOID NTAPI LdrpInitializeThread(IN PCONTEXT Context)
UNICODE_STRING NtDllString
NTSTATUS NTAPI RtlpInitializeActCtx(PVOID *pOldShimData)
NTSTATUS NTAPI LdrpAllocateTls(VOID)
static IN LPSTR IN PVOID IN PVOID IN PVOID Unk4
BOOLEAN LdrpDllValidation
BOOLEAN RtlpUse16ByteSLists
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(_In_opt_ PWSTR SearchPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *BaseAddress)
NTSTATUS NTAPI LdrGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
#define LDRP_ENTRY_PROCESSED
_In_ PCWSTR _Out_ PVOID * ActCtx
#define LDRP_DONT_CALL_FOR_THREADS
#define LDRP_PROCESS_ATTACH_CALLED
int _snwprintf(wchar_t *buffer, size_t count, const wchar_t *format,...)
#define InitializeObjectAttributes(p, n, a, r, s)
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
NTSYSAPI NTSTATUS NTAPI ZwRaiseHardError(_In_ NTSTATUS ErrorStatus, _In_ ULONG NumberOfParameters, _In_ ULONG UnicodeStringParameterMask, _In_ PULONG_PTR Parameters, _In_ ULONG ValidResponseOptions, _Out_ PULONG Response)
NTSYSAPI NTSTATUS NTAPI ZwDelayExecution(_In_ BOOLEAN Alertable, _In_ LARGE_INTEGER *Interval)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
#define MEM_EXECUTE_OPTION_DISABLE
#define MEM_EXECUTE_OPTION_PERMANENT
#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION
#define MEM_EXECUTE_OPTION_ENABLE
NTSYSAPI NTSTATUS NTAPI ZwOpenDirectoryObject(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI VOID NTAPI RtlInitNlsTables(_In_ PUSHORT AnsiTableBase, _In_ PUSHORT OemTableBase, _In_ PUSHORT CaseTableBase, _Out_ PNLSTABLEINFO NlsTable)
NTSYSAPI VOID NTAPI RtlResetRtlTranslations(_In_ PNLSTABLEINFO NlsTable)
NTSYSAPI NTSTATUS NTAPI RtlSetCurrentDirectory_U(_In_ PUNICODE_STRING name)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
ULONG NTAPI LdrRelocateImageWithBias(_In_ PVOID BaseAddress, _In_ LONGLONG AdditionalBias, _In_opt_ PCSTR LoaderName, _In_ ULONG Success, _In_ ULONG Conflict, _In_ ULONG Invalid)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
NTSYSAPI PRTL_USER_PROCESS_PARAMETERS NTAPI RtlNormalizeProcessParams(_In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
#define RTL_USER_PROCESS_PARAMETERS_LOCAL_DLL_PATH
#define RTL_USER_PROCESS_PARAMETERS_PRIVATE_DLL_PATH
#define RTL_QUERY_ACTIVATION_CONTEXT_FLAG_NO_ADDREF
#define RTL_USER_PROCESS_PARAMETERS_NORMALIZED
NTSYSAPI NTSTATUS NTAPI NtOpenKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
#define SYMBOLIC_LINK_QUERY
@ KeyValuePartialInformation
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define DIRECTORY_TRAVERSE
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSYSAPI PVOID NTAPI RtlCreateHeap(IN ULONG Flags, IN PVOID HeapBase OPTIONAL, IN ULONG ReserveSize OPTIONAL, IN ULONG CommitSize OPTIONAL, IN PVOID Lock OPTIONAL, IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL)
#define NtCurrentProcess()
NTSYSAPI NTSTATUS NTAPI NtQueryValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
struct _KEY_VALUE_PARTIAL_INFORMATION KEY_VALUE_PARTIAL_INFORMATION
#define KEY_ENUMERATE_SUB_KEYS
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
struct _KEY_VALUE_PARTIAL_INFORMATION * PKEY_VALUE_PARTIAL_INFORMATION
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define HEAP_CREATE_ALIGN_16
#define Int32x32To64(a, b)
#define Int64ShrlMod32(a, b)
#define UNICODE_STRING_MAX_BYTES
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage(IN HANDLE KeyHandle, IN PPEB Peb, IN BOOLEAN SystemWide, IN BOOLEAN ReadAdvancedOptions)
BOOLEAN NTAPI RtlDoesFileExists_UStr(IN PUNICODE_STRING FileName)
PVOID g_pfnSE_InstallAfterInit
VOID NTAPI LdrpLoadShimEngine(IN PWSTR ImageName, IN PUNICODE_STRING ProcessImage, IN PVOID pShimData)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
PVOID g_pfnSE_ProcessDying
NTSTATUS NTAPI AVrfInitializeVerifier(VOID)
#define LDR_HASH_TABLE_ENTRIES
VOID NTAPI RtlpInitializeThreadPooling(VOID)
VOID NTAPI LdrpInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS NTAPI LdrpSetProtection(PVOID ViewBase, BOOLEAN Restore)
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
PVOID NTAPI LdrpFetchAddressOfEntryPoint(PVOID ImageBase)
BOOLEAN RtlpPageHeapEnabled
PLDR_DATA_TABLE_ENTRY NTAPI LdrpAllocateDataTableEntry(IN PVOID BaseAddress)
ULONG NTAPI LdrpClearLoadInProgress(VOID)
VOID NTAPI RtlpInitializeKeyedEvent(VOID)
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
#define IMAGE_SUBSYSTEM_NATIVE
UNICODE_STRING NtSystemRoot
NTSTATUS NTAPI NtQueryPerformanceCounter(OUT PLARGE_INTEGER PerformanceCounter, OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL)
NTSTATUS NTAPI NtQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT PSIZE_T ReturnLength)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI NtTestAlert(VOID)
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_DLL_INIT_FAILED
#define STATUS_APP_INIT_FAILURE
#define STATUS_CONFLICTING_ADDRESSES
NTSTATUS NTAPI NtOpenSymbolicLinkObject(OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
#define IMAGE_DIRECTORY_ENTRY_TLS
static VOID LoadConfig(HWND hwndDlg, PPOWER_SCHEMES_PAGE_DATA pPageData, PPOWER_SCHEME pScheme)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
VOID NTAPI RtlSetUnhandledExceptionFilter(IN PRTLP_UNHANDLED_EXCEPTION_FILTER TopLevelExceptionFilter)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
#define _WIN32_WINNT_WIN10
#define _WIN32_WINNT_WINBLUE
#define _WIN32_WINNT_WIN8
#define _WIN32_WINNT_WIN7
#define _WIN32_WINNT_VISTA
#define STATUS_BUFFER_OVERFLOW
VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
VOID NTAPI SE_ProcessDying(VOID)
PULONG MinorVersion OPTIONAL
#define TLS_MINIMUM_AVAILABLE
ULONG StartAddressOfRawData
ULONG EndAddressOfRawData
IMAGE_TLS_DIRECTORY TlsDirectory
PACTIVATION_CONTEXT EntryPointActivationContext
UNICODE_STRING FullDllName
LIST_ENTRY InInitializationOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Blink
struct _LIST_ENTRY * Flink
LIST_ENTRY InInitializationOrderModuleList
LIST_ENTRY InMemoryOrderModuleList
LIST_ENTRY InLoadOrderModuleList
UNICODE_STRING CSDVersion
BOOLEAN ReadImageFileExecOptions
ULONG ImageProcessAffinityMask
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
LARGE_INTEGER CriticalSectionTimeout
ULONG TlsExpansionBitmapBits[32]
SIZE_T MinimumStackCommit
BOOLEAN InheritedAddressSpace
PRTL_BITMAP TlsExpansionBitmap
PVOID UnicodeCaseTableData
PVOID Data[RTL_FLS_MAXIMUM_AVAILABLE]
ULONG DeCommitFreeBlockThreshold
ULONG VirtualMemoryThreshold
ULONG DeCommitTotalFreeThreshold
ULONG MaximumAllocationSize
UNICODE_STRING CommandLine
UNICODE_STRING ImagePathName
DWORD dwRosProcessCompatVersion
PVOID ActivationContextStackPointer
PVOID * TlsExpansionSlots
PVOID ThreadLocalStoragePointer
static LARGE_INTEGER Counter
#define RTL_CONSTANT_STRING(s)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define RtlMoveMemory(Destination, Source, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_INVALID_PARAMETER
#define STATUS_INFO_LENGTH_MISMATCH
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
_Must_inspect_result_ _In_ WDFDEVICE _In_ LPCGUID _Out_ PINTERFACE _In_ USHORT _In_ USHORT Version
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_Must_inspect_result_ _In_ WDFOBJECT _In_ CONST GUID * Guid
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
VOID(WINAPI * PFLS_CALLBACK_FUNCTION)(PVOID)
#define FLS_MAXIMUM_AVAILABLE
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define NX_SUPPORT_POLICY_ALWAYSOFF
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
#define NX_SUPPORT_POLICY_ALWAYSON
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
#define PF_COMPARE_EXCHANGE128