38 ULONG ForwarderChain,
i, Rva, OldProtect, IatSize, ExportSize;
40 DPRINT(
"LdrpSnapIAT(%wZ %wZ %p %u)\n", &ExportLdrEntry->BaseDllName, &ImportLdrEntry->BaseDllName, IatEntry, EntriesValid);
52 DbgPrint(
"LDR: %wZ doesn't contain an EXPORT table\n",
53 &ExportLdrEntry->BaseDllName);
109 DbgPrint(
"LDR: Unable to unprotect IAT for %wZ (Image Base %p)\n",
110 &ImportLdrEntry->BaseDllName,
111 ImportLdrEntry->DllBase);
116 ImportSize = IatSize;
128 DbgPrint(
"LDR: Unable to unprotect IAT for %wZ (Status %x)\n",
129 &ImportLdrEntry->BaseDllName,
138 ImportName = (
LPSTR)((
ULONG_PTR)ImportLdrEntry->DllBase + IatEntry->Name);
141 ForwarderChain = IatEntry->ForwarderChain;
144 while (ForwarderChain != -1)
149 IatEntry->OriginalFirstThunk +
155 IatEntry->FirstThunk +
165 ImportLdrEntry->DllBase,
185 else if (IatEntry->FirstThunk)
190 IatEntry->FirstThunk);
196 if ((IatEntry->Characteristics < NtHeader->OptionalHeader.SizeOfHeaders) ||
197 (IatEntry->Characteristics >= NtHeader->OptionalHeader.SizeOfImage))
200 OriginalThunk = FirstThunk;
207 IatEntry->OriginalFirstThunk);
215 while (OriginalThunk->u1.AddressOfData)
221 ImportLdrEntry->DllBase,
264 LPSTR ImportName =
NULL, BoundImportName, ForwarderName;
275 BoundEntry = *BoundEntryPtr;
283 DPRINT1(
"LDR: %wZ bound to %s\n", &LdrEntry->BaseDllName, BoundImportName);
296 DPRINT1(
"LDR: %wZ failed to load import module %s; status = %x\n",
297 &LdrEntry->BaseDllName,
319 DPRINT1(
"LDR: %wZ has stale binding to %s\n",
320 &LdrEntry->BaseDllName,
332 DPRINT1(
"LDR: %wZ has correct binding to %s\n",
333 &LdrEntry->BaseDllName,
353 DPRINT1(
"LDR: %wZ bound to %s via forwarder(s) from %wZ\n",
354 &LdrEntry->BaseDllName,
383 DPRINT1(
"LDR: %wZ has stale binding to %s\n",
384 &LdrEntry->BaseDllName,
396 DPRINT1(
"LDR: %wZ has correct binding to %s\n",
397 &LdrEntry->BaseDllName,
423 while (ImportEntry->
Name)
429 if (!
_stricmp(ImportName, BoundImportName))
break;
436 if (!ImportEntry->
Name)
441 DPRINT1(
"LDR: LdrpWalkImportTable - failing with"
442 "STATUS_OBJECT_NAME_INVALID due to no import descriptor name\n");
453 DPRINT1(
"LDR: Stale Bind %s from %wZ\n",
455 &LdrEntry->BaseDllName);
470 DPRINT1(
"LDR: %wZ failed to load import module %s; status = %x\n",
471 &LdrEntry->BaseDllName,
486 *BoundEntryPtr = FirstEntry;
500 while (BoundEntry->OffsetModuleName)
528 ImportName = (
LPSTR)((
ULONG_PTR)LdrEntry->DllBase + (*ImportEntry)->Name);
532 (*ImportEntry)->FirstThunk);
540 DPRINT1(
"LDR: %s used by %wZ\n",
542 &LdrEntry->BaseDllName);
555 DbgPrint(
"LDR: LdrpWalkImportTable - LdrpLoadImportModule failed "
556 "on import %s with status %x\n",
568 DPRINT1(
"LDR: Snapping imports for %wZ from %s\n",
569 &LdrEntry->BaseDllName,
589 DbgPrint(
"LDR: LdrpWalkImportTable - LdrpSnapIAT #2 failed with "
613 while ((ImportEntry->Name) && (ImportEntry->FirstThunk))
638 End = NumberOfNames - 1;
642 Next = (
Start + End) >> 1;
648 if (!CmpResult)
break;
655 else if (CmpResult > 0)
662 if (End <
Start)
return -1;
665 return OrdinalTable[Next];
673 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
678 ULONG BoundSize, IatSize;
680 DPRINT(
"LdrpWalkImportDescriptor - BEGIN (%wZ %p '%S')\n", &LdrEntry->BaseDllName, LdrEntry,
DllPath);
691 Status2 =
LdrpManifestProberRoutine(LdrEntry->DllBase, LdrEntry->FullDllName.Buffer, &LdrEntry->EntryPointActivationContext);
704 "LDR: LdrpWalkImportDescriptor() failed to probe %wZ for its "
705 "manifest, ntstatus = 0x%08lx\n",
706 &LdrEntry->FullDllName, Status2);
714 if (!LdrEntry->EntryPointActivationContext)
723 "LDR: RtlGetActiveActivationContext() failed; ntstatus = "
732 LdrEntry->EntryPointActivationContext);
751 if ((BoundEntry) || (ImportEntry))
776 DPRINT1(
"We don't support Per-DLL Heap Tagging yet!\n");
800 DPRINT(
"LdrpWalkImportDescriptor - END (%wZ %p)\n", &LdrEntry->BaseDllName, LdrEntry);
824 DPRINT(
"LdrpLoadImportModule('%S' '%s' %p %p)\n",
DllPath, ImportName, DataTableEntry, Existing);
826 RedirectedDll =
FALSE;
827 RtlInitEmptyUnicodeString(&RedirectedImpDescName,
NULL, 0);
837 GotExtension =
FALSE;
838 while (
p >= ImpDescName->
Buffer)
862 "LDR: %s - Dll name missing extension; with extension "
863 "added the name is too long\n"
864 " ImpDescName: (@ %p) \"%wZ\"\n"
865 " ImpDescName->Length: %u\n",
883 &RedirectedImpDescName,
893 RedirectedDll =
TRUE;
898 DPRINT1(
"LDR: RtlDosApplyFileIsolationRedirection_Ustr failed with status %x for dll %wZ\n",
Status, ImpDescName);
928 DPRINT1(
"LDR: LdrpMapDll failed with status %x for dll %wZ\n",
Status, ImpDescName);
939 &(*DataTableEntry)->InInitializationOrderLinks);
961 ULONG OriginalOrdinal = 0;
973 PULONG AddressOfFunctions;
977 PVOID ForwarderHandle;
978 ULONG ForwardOrdinal;
985 Ordinal = (
USHORT)(OriginalOrdinal - ExportDirectory->Base);
992 ((
ULONG_PTR)OriginalThunk->u1.AddressOfData & 0xffffffff));
999 (
ULONG_PTR)ExportDirectory->AddressOfNames);
1001 (
ULONG_PTR)ExportDirectory->AddressOfNameOrdinals);
1004 Hint = AddressOfData->
Hint;
1007 if (((
ULONG)Hint < ExportDirectory->NumberOfNames) &&
1011 Ordinal = OrdinalTable[Hint];
1017 ExportDirectory->NumberOfNames,
1025 if ((
ULONG)Ordinal >= ExportDirectory->NumberOfFunctions)
1045 DPRINT1(
"Failed to snap ordinal %Z!0x%x for %wZ\n", &TempString, OriginalOrdinal, &SnapTarget);
1047 DPRINT1(
"Failed to snap %Z!%s for %wZ\n", &TempString, ImportName, &SnapTarget);
1053 HardErrorParameters[1] = (
ULONG_PTR)&HardErrorDllName;
1060 HardErrorParameters[0] = OriginalOrdinal;
1071 HardErrorParameters[0] = (
ULONG_PTR)&HardErrorEntryPointName;
1080 HardErrorParameters,
1103 DPRINT(
"Non-fatal: Failed to snap ordinal 0x%x\n", OriginalOrdinal);
1105 DPRINT(
"Non-fatal: Failed to snap %s\n", ImportName);
1109 Thunk->u1.Function = (
ULONG_PTR)0xffbadd11;
1118 AddressOfFunctions = (
PULONG)
1120 (
ULONG_PTR)ExportDirectory->AddressOfFunctions);
1123 Thunk->u1.Function = (
ULONG_PTR)ExportBase + AddressOfFunctions[Ordinal];
1126 if ((Thunk->u1.Function > (
ULONG_PTR)ExportDirectory) &&
1127 (Thunk->u1.Function < ((
ULONG_PTR)ExportDirectory + ExportSize)))
1130 ImportName = (
LPSTR)Thunk->u1.Function;
1132 DotPosition =
strchr(ImportName,
'.');
1137 ForwarderName.
Buffer = ImportName;
1138 ForwarderName.
Length = (
USHORT)(DotPosition - ImportName);
1159 &RedirectedImportName,
1167 DPRINT1(
"LDR: %Z got redirected to %wZ\n", &ForwarderName, RedirectedImportName);
1174 RedirectedImportName = &TempUString;
1181 RedirectedImportName,
1193 ImportName + ForwarderName.
Length +
sizeof(
CHAR));
1196 if ((ForwarderName.
Length > 1) && (*ForwarderName.
Buffer ==
'#'))
1212 ForwardName = &ForwarderName;
1220 (
PVOID*)&Thunk->u1.Function,
1228 if (!AddressOfFunctions[Ordinal])
goto FailurePath;
IN PUNICODE_STRING StaticString
int strcmp(const char *String1, const char *String2)
char * strchr(const char *String, int ch)
#define DPFLTR_ERROR_LEVEL
#define NT_SUCCESS(StatCode)
NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG Flags, IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING Extension, IN OUT PUNICODE_STRING StaticString, IN OUT PUNICODE_STRING DynamicString, IN OUT PUNICODE_STRING *NewName, IN PULONG NewFlags, IN PSIZE_T FileNameSize, IN PSIZE_T RequiredLength)
#define IMAGE_DIRECTORY_ENTRY_EXPORT
#define RtlImageDirectoryEntryToData
#define InsertTailList(ListHead, Entry)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
#define EXCEPTION_EXECUTE_HANDLER
#define FLG_HEAP_PAGE_ALLOCS
#define FLG_APPLICATION_VERIFIER
#define FLG_HEAP_ENABLE_TAG_BY_DLL
NTSYSAPI PEB *WINAPI RtlGetCurrentPeb(void)
NTSYSAPI NTSTATUS WINAPI RtlGetActiveActivationContext(HANDLE *)
NTSTATUS NTAPI LdrpHandleOneNewFormatImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR *BoundEntryPtr, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR FirstEntry)
NTSTATUS NTAPI LdrpHandleOldFormatImportDescriptors(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR ImportEntry)
NTSTATUS NTAPI LdrpSnapIAT(IN PLDR_DATA_TABLE_ENTRY ExportLdrEntry, IN PLDR_DATA_TABLE_ENTRY ImportLdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR IatEntry, IN BOOLEAN EntriesValid)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS NTAPI LdrpHandleOneOldFormatImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR *ImportEntry)
USHORT NTAPI LdrpNameToOrdinal(IN LPSTR ImportName, IN ULONG NumberOfNames, IN PVOID ExportBase, IN PULONG NameTable, IN PUSHORT OrdinalTable)
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
NTSTATUS NTAPI LdrpLoadImportModule(IN PWSTR DllPath OPTIONAL, IN LPSTR ImportName, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry, OUT PBOOLEAN Existing)
NTSTATUS NTAPI LdrpSnapThunk(IN PVOID ExportBase, IN PVOID ImportBase, IN PIMAGE_THUNK_DATA OriginalThunk, IN OUT PIMAGE_THUNK_DATA Thunk, IN PIMAGE_EXPORT_DIRECTORY ExportDirectory, IN ULONG ExportSize, IN BOOLEAN Static, IN LPSTR DllName)
NTSTATUS NTAPI LdrpHandleNewFormatImportDescriptors(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR BoundEntry)
_In_ PCWSTR _Out_ PVOID * ActCtx
#define LDRP_IMAGE_NOT_AT_BASE
LDR_MANIFEST_PROBER_ROUTINE * PLDR_MANIFEST_PROBER_ROUTINE
static const char const char * DllPath
#define DPFLTR_WARNING_LEVEL
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define NtCurrentProcess()
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
NTSYSAPI NTSTATUS NTAPI RtlCharToInteger(PCSZ String, ULONG Base, PULONG Value)
NTSTATUS NTAPI LdrpMapDll(IN PWSTR SearchPath OPTIONAL, IN PWSTR DllPath2, IN PWSTR DllName OPTIONAL, IN PULONG DllCharacteristics, IN BOOLEAN Static, IN BOOLEAN Redirect, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry)
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
UNICODE_STRING LdrApiDefaultExtension
ULONG LdrpFatalHardErrorCount
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
VOID NTAPI AVrfDllLoadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI AVrfPageHeapDllNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
#define IMAGE_FIRST_SECTION(NtHeader)
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
NTSTATUS NTAPI NtFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ SIZE_T FlushSize)
#define STATUS_RESOURCE_LANG_NOT_FOUND
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_ORDINAL_NOT_FOUND
#define STATUS_RESOURCE_NAME_NOT_FOUND
#define STATUS_ENTRYPOINT_NOT_FOUND
#define STATUS_RESOURCE_TYPE_NOT_FOUND
#define STATUS_RESOURCE_DATA_NOT_FOUND
#define STATUS_SXS_KEY_NOT_FOUND
#define STATUS_NAME_TOO_LONG
#define IMAGE_DIRECTORY_ENTRY_IMPORT
#define IMAGE_DIRECTORY_ENTRY_IAT
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define IMAGE_ORDINAL(Ordinal)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
PULONG MinorVersion OPTIONAL
WORD NumberOfModuleForwarderRefs
union _IMAGE_THUNK_DATA32::@2113 u1
LIST_ENTRY InInitializationOrderLinks
UNICODE_STRING BaseDllName
LIST_ENTRY InInitializationOrderModuleList
WCHAR StaticUnicodeBuffer[261]
UNICODE_STRING StaticUnicodeString
#define RtlZeroMemory(Destination, Length)
#define STATUS_NO_SUCH_FILE
#define STATUS_OBJECT_NAME_INVALID
struct _IMAGE_BOUND_FORWARDER_REF * PIMAGE_BOUND_FORWARDER_REF
struct _IMAGE_BOUND_IMPORT_DESCRIPTOR * PIMAGE_BOUND_IMPORT_DESCRIPTOR