38 ULONG ForwarderChain,
i, Rva, OldProtect, IatSize, ExportSize;
40 DPRINT(
"LdrpSnapIAT(%wZ %wZ %p %u)\n", &ExportLdrEntry->BaseDllName, &ImportLdrEntry->BaseDllName, IatEntry, EntriesValid);
52 DbgPrint(
"LDR: %wZ doesn't contain an EXPORT table\n",
53 &ExportLdrEntry->BaseDllName);
109 DbgPrint(
"LDR: Unable to unprotect IAT for %wZ (Image Base %p)\n",
110 &ImportLdrEntry->BaseDllName,
111 ImportLdrEntry->DllBase);
116 ImportSize = IatSize;
128 DbgPrint(
"LDR: Unable to unprotect IAT for %wZ (Status %x)\n",
129 &ImportLdrEntry->BaseDllName,
138 ImportName = (
LPSTR)((
ULONG_PTR)ImportLdrEntry->DllBase + IatEntry->Name);
141 ForwarderChain = IatEntry->ForwarderChain;
144 while (ForwarderChain != -1)
149 IatEntry->OriginalFirstThunk +
155 IatEntry->FirstThunk +
165 ImportLdrEntry->DllBase,
185 else if (IatEntry->FirstThunk)
190 IatEntry->FirstThunk);
196 if ((IatEntry->Characteristics < NtHeader->OptionalHeader.SizeOfHeaders) ||
197 (IatEntry->Characteristics >= NtHeader->OptionalHeader.SizeOfImage))
200 OriginalThunk = FirstThunk;
207 IatEntry->OriginalFirstThunk);
215 while (OriginalThunk->u1.AddressOfData)
221 ImportLdrEntry->DllBase,
264 LPSTR ImportName =
NULL, BoundImportName, ForwarderName;
275 BoundEntry = *BoundEntryPtr;
283 DPRINT1(
"LDR: %wZ bound to %s\n", &LdrEntry->BaseDllName, BoundImportName);
296 DPRINT1(
"LDR: %wZ failed to load import module %s; status = %x\n",
297 &LdrEntry->BaseDllName,
319 DPRINT1(
"LDR: %wZ has stale binding to %s\n",
320 &LdrEntry->BaseDllName,
332 DPRINT1(
"LDR: %wZ has correct binding to %s\n",
333 &LdrEntry->BaseDllName,
353 DPRINT1(
"LDR: %wZ bound to %s via forwarder(s) from %wZ\n",
354 &LdrEntry->BaseDllName,
383 DPRINT1(
"LDR: %wZ has stale binding to %s\n",
384 &LdrEntry->BaseDllName,
396 DPRINT1(
"LDR: %wZ has correct binding to %s\n",
397 &LdrEntry->BaseDllName,
423 while (ImportEntry->
Name)
429 if (!
_stricmp(ImportName, BoundImportName))
break;
436 if (!ImportEntry->
Name)
441 DPRINT1(
"LDR: LdrpWalkImportTable - failing with" 442 "STATUS_OBJECT_NAME_INVALID due to no import descriptor name\n");
453 DPRINT1(
"LDR: Stale Bind %s from %wZ\n",
455 &LdrEntry->BaseDllName);
470 DPRINT1(
"LDR: %wZ failed to load import module %s; status = %x\n",
471 &LdrEntry->BaseDllName,
486 *BoundEntryPtr = FirstEntry;
500 while (BoundEntry->OffsetModuleName)
528 ImportName = (
LPSTR)((
ULONG_PTR)LdrEntry->DllBase + (*ImportEntry)->Name);
532 (*ImportEntry)->FirstThunk);
540 DPRINT1(
"LDR: %s used by %wZ\n",
542 &LdrEntry->BaseDllName);
555 DbgPrint(
"LDR: LdrpWalkImportTable - LdrpLoadImportModule failed " 556 "on import %s with status %x\n",
568 DPRINT1(
"LDR: Snapping imports for %wZ from %s\n",
569 &LdrEntry->BaseDllName,
589 DbgPrint(
"LDR: LdrpWalkImportTable - LdrpSnapIAT #2 failed with " 613 while ((ImportEntry->Name) && (ImportEntry->FirstThunk))
638 End = NumberOfNames - 1;
642 Next = (
Start + End) >> 1;
648 if (!CmpResult)
break;
655 else if (CmpResult > 0)
662 if (End <
Start)
return -1;
665 return OrdinalTable[Next];
673 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
678 ULONG BoundSize, IatSize;
680 DPRINT(
"LdrpWalkImportDescriptor - BEGIN (%wZ %p '%S')\n", &LdrEntry->BaseDllName, LdrEntry,
DllPath);
691 Status2 =
LdrpManifestProberRoutine(LdrEntry->DllBase, LdrEntry->FullDllName.Buffer, &LdrEntry->EntryPointActivationContext);
704 "LDR: LdrpWalkImportDescriptor() failed to probe %wZ for its " 705 "manifest, ntstatus = 0x%08lx\n",
706 &LdrEntry->FullDllName, Status2);
714 if (!LdrEntry->EntryPointActivationContext)
723 "LDR: RtlGetActiveActivationContext() failed; ntstatus = " 732 LdrEntry->EntryPointActivationContext);
751 if ((BoundEntry) || (ImportEntry))
776 DPRINT1(
"We don't support Per-DLL Heap Tagging yet!\n");
800 DPRINT(
"LdrpWalkImportDescriptor - END (%wZ %p)\n", &LdrEntry->BaseDllName, LdrEntry);
824 DPRINT(
"LdrpLoadImportModule('%S' '%s' %p %p)\n",
DllPath, ImportName, DataTableEntry, Existing);
826 RedirectedDll =
FALSE;
827 RtlInitEmptyUnicodeString(&RedirectedImpDescName,
NULL, 0);
837 GotExtension =
FALSE;
838 while (
p >= ImpDescName->
Buffer)
862 "LDR: %s - Dll name missing extension; with extension " 863 "added the name is too long\n" 864 " ImpDescName: (@ %p) \"%wZ\"\n" 865 " ImpDescName->Length: %u\n",
883 &RedirectedImpDescName,
893 RedirectedDll =
TRUE;
898 DPRINT1(
"LDR: RtlDosApplyFileIsolationRedirection_Ustr failed with status %x for dll %wZ\n",
Status, ImpDescName);
928 DPRINT1(
"LDR: LdrpMapDll failed with status %x for dll %wZ\n",
Status, ImpDescName);
939 &(*DataTableEntry)->InInitializationOrderLinks);
961 ULONG OriginalOrdinal = 0;
973 PULONG AddressOfFunctions;
977 PVOID ForwarderHandle;
978 ULONG ForwardOrdinal;
985 Ordinal = (
USHORT)(OriginalOrdinal - ExportDirectory->Base);
992 ((
ULONG_PTR)OriginalThunk->u1.AddressOfData & 0xffffffff));
999 (
ULONG_PTR)ExportDirectory->AddressOfNames);
1001 (
ULONG_PTR)ExportDirectory->AddressOfNameOrdinals);
1004 Hint = AddressOfData->
Hint;
1007 if (((
ULONG)Hint < ExportDirectory->NumberOfNames) &&
1011 Ordinal = OrdinalTable[Hint];
1017 ExportDirectory->NumberOfNames,
1025 if ((
ULONG)Ordinal >= ExportDirectory->NumberOfFunctions)
1045 DPRINT1(
"Failed to snap ordinal %Z!0x%x for %wZ\n", &TempString, OriginalOrdinal, &SnapTarget);
1047 DPRINT1(
"Failed to snap %Z!%s for %wZ\n", &TempString, ImportName, &SnapTarget);
1053 HardErrorParameters[1] = (
ULONG_PTR)&HardErrorDllName;
1060 HardErrorParameters[0] = OriginalOrdinal;
1071 HardErrorParameters[0] = (
ULONG_PTR)&HardErrorEntryPointName;
1080 HardErrorParameters,
1103 DPRINT(
"Non-fatal: Failed to snap ordinal 0x%x\n", OriginalOrdinal);
1105 DPRINT(
"Non-fatal: Failed to snap %s\n", ImportName);
1109 Thunk->u1.Function = (
ULONG_PTR)0xffbadd11;
1118 AddressOfFunctions = (
PULONG)
1120 (
ULONG_PTR)ExportDirectory->AddressOfFunctions);
1123 Thunk->u1.Function = (
ULONG_PTR)ExportBase + AddressOfFunctions[Ordinal];
1126 if ((Thunk->u1.Function > (
ULONG_PTR)ExportDirectory) &&
1127 (Thunk->u1.Function < ((
ULONG_PTR)ExportDirectory + ExportSize)))
1130 ImportName = (
LPSTR)Thunk->u1.Function;
1132 DotPosition =
strchr(ImportName,
'.');
1137 ForwarderName.
Buffer = ImportName;
1138 ForwarderName.
Length = (
USHORT)(DotPosition - ImportName);
1159 &RedirectedImportName,
1167 DPRINT1(
"LDR: %Z got redirected to %wZ\n", &ForwarderName, RedirectedImportName);
1174 RedirectedImportName = &TempUString;
1181 RedirectedImportName,
1193 ImportName + ForwarderName.
Length +
sizeof(
CHAR));
1196 if ((ForwarderName.
Length > 1) && (*ForwarderName.
Buffer ==
'#'))
1212 ForwardName = &ForwarderName;
1220 (
PVOID*)&Thunk->u1.Function,
1228 if (!AddressOfFunctions[Ordinal])
goto FailurePath;
NTSTATUS NTAPI LdrpLoadImportModule(IN PWSTR DllPath OPTIONAL, IN LPSTR ImportName, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry, OUT PBOOLEAN Existing)
ULONG LdrpFatalHardErrorCount
NTSYSAPI NTSTATUS NTAPI RtlCharToInteger(PCSZ String, ULONG Base, PULONG Value)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
WCHAR StaticUnicodeBuffer[261]
LIST_ENTRY InInitializationOrderModuleList
WORD NumberOfModuleForwarderRefs
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
struct _IMAGE_BOUND_FORWARDER_REF * PIMAGE_BOUND_FORWARDER_REF
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define STATUS_SXS_KEY_NOT_FOUND
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
#define InsertTailList(ListHead, Entry)
VOID NTAPI AVrfPageHeapDllNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
#define DPFLTR_WARNING_LEVEL
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA
UNICODE_STRING StaticUnicodeString
LDR_MANIFEST_PROBER_ROUTINE * PLDR_MANIFEST_PROBER_ROUTINE
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
VOID NTAPI AVrfDllLoadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
#define IMAGE_FIRST_SECTION(NtHeader)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS NTAPI LdrpSnapIAT(IN PLDR_DATA_TABLE_ENTRY ExportLdrEntry, IN PLDR_DATA_TABLE_ENTRY ImportLdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR IatEntry, IN BOOLEAN EntriesValid)
NTSTATUS NTAPI NtFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ SIZE_T FlushSize)
#define LDRP_IMAGE_NOT_AT_BASE
#define FLG_APPLICATION_VERIFIER
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
NTSTATUS NTAPI LdrpHandleOneOldFormatImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR *ImportEntry)
#define STATUS_NAME_TOO_LONG
#define NtCurrentProcess()
union _IMAGE_THUNK_DATA32::@2092 u1
NTSTATUS NTAPI LdrpHandleNewFormatImportDescriptors(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR BoundEntry)
#define STATUS_INVALID_IMAGE_FORMAT
#define NT_SUCCESS(StatCode)
#define EXCEPTION_EXECUTE_HANDLER
#define FLG_HEAP_PAGE_ALLOCS
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
PPEB NTAPI RtlGetCurrentPeb(VOID)
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
_In_ PCWSTR _Out_ PVOID * ActCtx
NTSTATUS NTAPI LdrpHandleOldFormatImportDescriptors(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_IMPORT_DESCRIPTOR ImportEntry)
#define STATUS_RESOURCE_DATA_NOT_FOUND
#define RtlImageDirectoryEntryToData
NTSTATUS NTAPI LdrpMapDll(IN PWSTR SearchPath OPTIONAL, IN PWSTR DllPath2, IN PWSTR DllName OPTIONAL, IN PULONG DllCharacteristics, IN BOOLEAN Static, IN BOOLEAN Redirect, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry)
NTSYSAPI NTSTATUS WINAPI RtlGetActiveActivationContext(HANDLE *)
NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG Flags, IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING Extension, IN OUT PUNICODE_STRING StaticString, IN OUT PUNICODE_STRING DynamicString, IN OUT PUNICODE_STRING *NewName, IN PULONG NewFlags, IN PSIZE_T FileNameSize, IN PSIZE_T RequiredLength)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
#define IMAGE_DIRECTORY_ENTRY_IAT
#define IMAGE_DIRECTORY_ENTRY_EXPORT
NTSTATUS NTAPI LdrpHandleOneNewFormatImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR *BoundEntryPtr, IN PIMAGE_BOUND_IMPORT_DESCRIPTOR FirstEntry)
NTSTATUS NTAPI LdrpSnapThunk(IN PVOID ExportBase, IN PVOID ImportBase, IN PIMAGE_THUNK_DATA OriginalThunk, IN OUT PIMAGE_THUNK_DATA Thunk, IN PIMAGE_EXPORT_DIRECTORY ExportDirectory, IN ULONG ExportSize, IN BOOLEAN Static, IN LPSTR DllName)
#define STATUS_ORDINAL_NOT_FOUND
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define STATUS_RESOURCE_LANG_NOT_FOUND
#define DPFLTR_ERROR_LEVEL
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
static const char const char * DllPath
#define STATUS_RESOURCE_NAME_NOT_FOUND
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define STATUS_NO_SUCH_FILE
#define FLG_HEAP_ENABLE_TAG_BY_DLL
UNICODE_STRING BaseDllName
#define STATUS_OBJECT_NAME_INVALID
char * strchr(const char *String, int ch)
struct _IMAGE_BOUND_IMPORT_DESCRIPTOR * PIMAGE_BOUND_IMPORT_DESCRIPTOR
#define STATUS_ENTRYPOINT_NOT_FOUND
#define IMAGE_DIRECTORY_ENTRY_IMPORT
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
int strcmp(const char *String1, const char *String2)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
#define _SEH2_EXCEPT(...)
#define _SEH2_GetExceptionCode()
#define IMAGE_ORDINAL(Ordinal)
UNICODE_STRING LdrApiDefaultExtension
LIST_ENTRY InInitializationOrderLinks
IN PUNICODE_STRING StaticString
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
USHORT NTAPI LdrpNameToOrdinal(IN LPSTR ImportName, IN ULONG NumberOfNames, IN PVOID ExportBase, IN PULONG NameTable, IN PUSHORT OrdinalTable)
#define STATUS_RESOURCE_TYPE_NOT_FOUND
PULONG MinorVersion OPTIONAL