ReactOS  0.4.15-dev-5496-g599ba9c
shimeng.c File Reference
#include "ntndk.h"
#include "shimlib.h"
#include <strsafe.h>
#include "apphelp.h"
#include "shimeng.h"
Include dependency graph for shimeng.c:

Go to the source code of this file.

Macros

#define WIN32_NO_STATUS
 
#define IN_APPHELP
 
#define APPHELP_NOSDBPAPI
 
#define ARRAY_Init(Array, TypeOfArray)   ARRAY_InitWorker((Array), sizeof(TypeOfArray))
 
#define ARRAY_Append(Array, TypeOfArray)   (TypeOfArray*)ARRAY_AppendWorker((Array), sizeof(TypeOfArray), 5)
 
#define ARRAY_At(Array, TypeOfArray, at)   (TypeOfArray*)ARRAY_AtWorker((Array), sizeof(TypeOfArray), at)
 
#define ARRAY_Size(Array)   (Array)->Size__
 
#define MAX_LAYER_LENGTH   256
 
#define SYSTEM32   L"\\system32"
 
#define WINSXS   L"\\winsxs"
 

Typedefs

typedef FARPROC(WINAPIGETPROCADDRESSPROC) (HINSTANCE, LPCSTR)
 

Functions

FARPROC WINAPI StubGetProcAddress (HINSTANCE hModule, LPCSTR lpProcName)
 
BOOL WINAPI SE_IsShimDll (PVOID BaseAddress)
 
static BOOL ARRAY_InitWorker (PARRAY Array, DWORD ItemSize)
 
static BOOL ARRAY_EnsureSize (PARRAY Array, DWORD ItemSize, DWORD GrowWith)
 
static PVOID ARRAY_AppendWorker (PARRAY Array, DWORD ItemSize, DWORD GrowWith)
 
static PVOID ARRAY_AtWorker (PARRAY Array, DWORD ItemSize, DWORD n)
 
VOID SeiInitDebugSupport (VOID)
 
BOOL WINAPIV SeiDbgPrint (SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format,...)
 
static BOOL SeiIsOrdinalName (LPCSTR lpProcName)
 
LPCSTR SeiPrintFunctionName (LPCSTR lpProcName, char szOrdProcFmt[10])
 
int SeiCompareFunctionName (LPCSTR lpProcName1, LPCSTR lpProcName2)
 
PVOID SeiGetModuleFromAddress (PVOID addr)
 
VOID NotifyShims (DWORD dwReason, PVOID Info)
 
VOID SeiCheckComPlusImage (PVOID BaseAddress)
 
PSHIMMODULE SeiGetShimModuleInfo (PVOID BaseAddress)
 
PSHIMMODULE SeiCreateShimModuleInfo (PCWSTR DllName, PVOID BaseAddress)
 
PSHIMINFO SeiAppendHookInfo (PSHIMMODULE pShimModuleInfo, PHOOKAPIEX pHookApi, DWORD dwHookCount, PCWSTR ShimName)
 
PHOOKMODULEINFO SeiFindHookModuleInfo (PUNICODE_STRING ModuleName, PVOID BaseAddress)
 
PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor (PBYTE DllBase, PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor)
 
static LPCWSTR SeiGetStringPtr (PDB pdb, TAGID tag, TAG type)
 
static DWORD SeiGetDWORD (PDB pdb, TAGID tag, TAG type)
 
static QWORD SeiGetQWORD (PDB pdb, TAGID tag, TAG type)
 
static VOID SeiAddShim (TAGREF trShimRef, PARRAY pShimRef)
 
static VOID SeiAddFlag (PDB pdb, TAGID tiFlagRef, PFLAGINFO pFlagInfo)
 
static VOID SeiSetLayerEnvVar (LPCWSTR wszLayer)
 
static VOID SeiBuildShimRefArray (HSDB hsdb, SDBQUERYRESULT *pQuery, PARRAY pShimRef, PFLAGINFO pFlagInfo)
 
VOID SeiAddHooks (PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
 
VOID SeiResolveAPI (PHOOKMODULEINFO HookModuleInfo)
 
VOID SeiResolveAPIs (VOID)
 
VOID SeiCombineHookInfo (VOID)
 
VOID SeiAddInternalHooks (DWORD dwNumHooks)
 
VOID SeiPatchNewImport (PIMAGE_THUNK_DATA FirstThunk, PHOOKAPIEX HookApi, PLDR_DATA_TABLE_ENTRY LdrEntry)
 
PINEXCLUDE SeiFindInExclude (PARRAY InExclude, PCUNICODE_STRING DllName)
 
BOOL SeiIsExcluded (PLDR_DATA_TABLE_ENTRY LdrEntry, PHOOKAPIEX HookApi)
 
VOID SeiAppendInExclude (PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
 
VOID SeiReadInExclude (PDB pdb, TAGID parent, PARRAY dest)
 
VOID SeiBuildGlobalInclExclList (HSDB hsdb)
 
VOID SeiBuildInclExclList (PDB pdb, TAGID ShimTag, PSHIMINFO pShimInfo)
 
VOID SeiHookImports (PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID PatchNewModules (PPEB Peb)
 
VOID SeiInitPaths (VOID)
 
VOID SeiSetEntryProcessed (PPEB Peb)
 
VOID SeiResetEntryProcessed (PPEB Peb)
 
VOID SeiInit (LPCWSTR ProcessImage, HSDB hsdb, SDBQUERYRESULT *pQuery, BOOLEAN ProcessInit)
 
BOOL SeiGetShimData (PUNICODE_STRING ProcessImage, PVOID pShimData, HSDB *pHsdb, SDBQUERYRESULT *pQuery)
 
VOID NTAPI SE_InstallBeforeInit (PUNICODE_STRING ProcessImage, PVOID pShimData)
 
VOID NTAPI SE_InstallAfterInit (PUNICODE_STRING ProcessImage, PVOID pShimData)
 
VOID NTAPI SE_ProcessDying (VOID)
 
VOID WINAPI SE_DllLoaded (PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID WINAPI SE_DllUnloaded (PLDR_DATA_TABLE_ENTRY LdrEntry)
 
BOOLEAN NTAPI LdrInitShimEngineDynamic (IN PVOID BaseAddress)
 
BOOL WINAPI SE_DynamicShim (LPCWSTR ProcessImage, HSDB hsdb, PVOID pQueryResult, LPCSTR Module, LPDWORD lpdwDynamicToken)
 

Variables

static const UNICODE_STRING Ntdll = RTL_CONSTANT_STRING(L"ntdll.dll")
 
static const UNICODE_STRING Kernel32 = RTL_CONSTANT_STRING(L"kernel32.dll")
 
static const UNICODE_STRING Verifier = RTL_CONSTANT_STRING(L"verifier.dll")
 
HMODULE g_hInstance
 
static UNICODE_STRING g_WindowsDirectory
 
static UNICODE_STRING g_System32Directory
 
static UNICODE_STRING g_SxsDirectory
 
static UNICODE_STRING g_LoadingShimDll
 
ULONG g_ShimEngDebugLevel = 0xffffffff
 
BOOL g_bComPlusImage = FALSE
 
BOOL g_bShimDuringInit = FALSE
 
BOOL g_bShimEngInitialized = FALSE
 
BOOL g_bInternalHooksUsed = FALSE
 
static ARRAY g_pShimInfo
 
static ARRAY g_pHookArray
 
static ARRAY g_InExclude
 
HOOKAPIEX g_IntHookEx []
 

Macro Definition Documentation

◆ APPHELP_NOSDBPAPI

#define APPHELP_NOSDBPAPI

Definition at line 14 of file shimeng.c.

◆ ARRAY_Append

#define ARRAY_Append (   Array,
  TypeOfArray 
)    (TypeOfArray*)ARRAY_AppendWorker((Array), sizeof(TypeOfArray), 5)

Definition at line 123 of file shimeng.c.

◆ ARRAY_At

#define ARRAY_At (   Array,
  TypeOfArray,
  at 
)    (TypeOfArray*)ARRAY_AtWorker((Array), sizeof(TypeOfArray), at)

Definition at line 124 of file shimeng.c.

◆ ARRAY_Init

#define ARRAY_Init (   Array,
  TypeOfArray 
)    ARRAY_InitWorker((Array), sizeof(TypeOfArray))

Definition at line 122 of file shimeng.c.

◆ ARRAY_Size

#define ARRAY_Size (   Array)    (Array)->Size__

Definition at line 125 of file shimeng.c.

◆ IN_APPHELP

#define IN_APPHELP

Definition at line 10 of file shimeng.c.

◆ MAX_LAYER_LENGTH

#define MAX_LAYER_LENGTH   256

Definition at line 471 of file shimeng.c.

◆ SYSTEM32

#define SYSTEM32   L"\\system32"

◆ WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 8 of file shimeng.c.

◆ WINSXS

#define WINSXS   L"\\winsxs"

Typedef Documentation

◆ GETPROCADDRESSPROC

typedef FARPROC(WINAPI* GETPROCADDRESSPROC) (HINSTANCE, LPCSTR)

Definition at line 41 of file shimeng.c.

Function Documentation

◆ ARRAY_AppendWorker()

static PVOID ARRAY_AppendWorker ( PARRAY  Array,
DWORD  ItemSize,
DWORD  GrowWith 
)
inlinestatic

Definition at line 95 of file shimeng.c.

96 {
97  PBYTE pData;
98 
99  if (!ARRAY_EnsureSize(Array, ItemSize, GrowWith))
100  return NULL;
101 
102  pData = Array->Data__;
103  pData += (Array->Size__ * ItemSize);
104  Array->Size__++;
105 
106  return pData;
107 }
DWORD Size__
Definition: shimeng.h:18
static BOOL ARRAY_EnsureSize(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
Definition: shimeng.c:64
PVOID Data__
Definition: shimeng.h:17
static UCHAR ItemSize[4]
Definition: parser.c:16
#define NULL
Definition: types.h:112
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
Definition: twain.h:1827
BYTE * PBYTE
Definition: pedump.c:66

◆ ARRAY_AtWorker()

static PVOID ARRAY_AtWorker ( PARRAY  Array,
DWORD  ItemSize,
DWORD  n 
)
inlinestatic

Definition at line 109 of file shimeng.c.

110 {
111  PBYTE pData;
112 
113  ASSERT(Array);
114  ASSERT(ItemSize == Array->ItemSize__);
115  ASSERT(n < Array->Size__);
116 
117  pData = Array->Data__;
118  return pData + (n * ItemSize);
119 }
GLdouble n
Definition: glext.h:7729
#define ASSERT(a)
Definition: mode.c:44
PVOID Data__
Definition: shimeng.h:17
static UCHAR ItemSize[4]
Definition: parser.c:16
DWORD ItemSize__
Definition: shimeng.h:20
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
Definition: twain.h:1827
BYTE * PBYTE
Definition: pedump.c:66

◆ ARRAY_EnsureSize()

static BOOL ARRAY_EnsureSize ( PARRAY  Array,
DWORD  ItemSize,
DWORD  GrowWith 
)
inlinestatic

Definition at line 64 of file shimeng.c.

65 {
66  PVOID pNewData;
67  DWORD Count;
68 
69  ASSERT(Array);
70  ASSERT(ItemSize == Array->ItemSize__);
71 
72  if (Array->MaxSize__ > Array->Size__)
73  return TRUE;
74 
75  Count = Array->Size__ + GrowWith;
76  pNewData = SeiAlloc(Count * ItemSize);
77 
78  if (!pNewData)
79  {
80  SHIMENG_FAIL("Failed to allocate %d bytes\n", Count * ItemSize);
81  return FALSE;
82  }
83  Array->MaxSize__ = Count;
84 
85  if (Array->Data__)
86  {
87  memcpy(pNewData, Array->Data__, Array->Size__ * ItemSize);
88  SeiFree(Array->Data__);
89  }
90  Array->Data__ = pNewData;
91 
92  return TRUE;
93 }
#define TRUE
Definition: types.h:120
DWORD Size__
Definition: shimeng.h:18
#define SeiFree(mem)
Definition: shimeng.h:103
#define FALSE
Definition: types.h:117
int Count
Definition: noreturn.cpp:7
#define ASSERT(a)
Definition: mode.c:44
unsigned long DWORD
Definition: ntddk_ex.h:95
#define memcpy(s1, s2, n)
Definition: mkisofs.h:878
PVOID Data__
Definition: shimeng.h:17
static UCHAR ItemSize[4]
Definition: parser.c:16
DWORD ItemSize__
Definition: shimeng.h:20
#define SeiAlloc(size)
Definition: shimeng.h:101
DWORD MaxSize__
Definition: shimeng.h:19

Referenced by ARRAY_AppendWorker().

◆ ARRAY_InitWorker()

static BOOL ARRAY_InitWorker ( PARRAY  Array,
DWORD  ItemSize 
)
inlinestatic

Definition at line 55 of file shimeng.c.

56 {
57  Array->Data__ = NULL;
58  Array->Size__ = Array->MaxSize__ = 0;
59  Array->ItemSize__ = ItemSize;
60 
61  return TRUE;
62 }
#define TRUE
Definition: types.h:120
DWORD Size__
Definition: shimeng.h:18
PVOID Data__
Definition: shimeng.h:17
static UCHAR ItemSize[4]
Definition: parser.c:16
DWORD ItemSize__
Definition: shimeng.h:20
#define NULL
Definition: types.h:112
DWORD MaxSize__
Definition: shimeng.h:19

◆ LdrInitShimEngineDynamic()

BOOLEAN NTAPI LdrInitShimEngineDynamic ( IN PVOID  BaseAddress)

Definition at line 1677 of file ldrapi.c.

1678 {
1679  ULONG_PTR Cookie;
1681  if (NT_SUCCESS(Status))
1682  {
1683  if (!g_pShimEngineModule)
1684  {
1687  }
1689  return TRUE;
1690  }
1691  return FALSE;
1692 }
NTSTATUS NTAPI LdrUnlockLoaderLock(IN ULONG Flags, IN ULONG Cookie OPTIONAL)
Definition: ldrapi.c:101
#define TRUE
Definition: types.h:120
VOID NTAPI LdrpGetShimEngineInterface(VOID)
LONG NTSTATUS
Definition: precomp.h:26
NTSTATUS NTAPI LdrLockLoaderLock(IN ULONG Flags, OUT PULONG Disposition OPTIONAL, OUT PULONG_PTR Cookie OPTIONAL)
Definition: ldrapi.c:173
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define FALSE
Definition: types.h:117
Status
Definition: gdiplustypes.h:24
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
Definition: cmfuncs.h:13
#define NULL
Definition: types.h:112
PVOID g_pShimEngineModule
Definition: ldrutils.c:22

Referenced by SE_DynamicShim().

◆ NotifyShims()

VOID NotifyShims ( DWORD  dwReason,
PVOID  Info 
)

Definition at line 255 of file shimeng.c.

256 {
257  DWORD n;
258 
259  for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
260  {
261  PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
262  if (!pShimModule->pNotifyShims)
263  continue;
264 
265  pShimModule->pNotifyShims(dwReason, Info);
266  }
267 }
static ARRAY g_pShimInfo
Definition: shimeng.c:37
GLdouble n
Definition: glext.h:7729
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
Definition: wdfchildlist.h:683
DWORD dwReason
Definition: misc.cpp:154
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SE_DllLoaded(), SE_DllUnloaded(), SE_InstallAfterInit(), SE_ProcessDying(), and SeiCreateShimModuleInfo().

◆ PatchNewModules()

VOID PatchNewModules ( PPEB  Peb)

Definition at line 1065 of file shimeng.c.

1066 {
1067  PLIST_ENTRY ListHead, ListEntry;
1068  PLDR_DATA_TABLE_ENTRY LdrEntry;
1069 
1070  ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1071  ListEntry = ListHead->Flink;
1072 
1073  while (ListHead != ListEntry)
1074  {
1075  LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
1076  SeiHookImports(LdrEntry);
1077 
1078  ListEntry = ListEntry->Flink;
1079  }
1080 }
VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: shimeng.c:958
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
Definition: btrfs_drv.h:1876
Definition: typedefs.h:119
#define NtCurrentPeb()
Definition: FLS.c:22

Referenced by SeiInit().

◆ SE_DllLoaded()

VOID WINAPI SE_DllLoaded ( PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 1447 of file shimeng.c.

1448 {
1449  PHOOKMODULEINFO HookModuleInfo;
1450  SHIMENG_INFO("%sINIT. loading DLL \"%wZ\"\n", g_bShimDuringInit ? "" : "AFTER ", &LdrEntry->BaseDllName);
1451 
1452  HookModuleInfo = SeiFindHookModuleInfo(&LdrEntry->BaseDllName, NULL);
1453  if (HookModuleInfo)
1454  {
1455  ASSERT(HookModuleInfo->BaseAddress == NULL);
1456  HookModuleInfo->BaseAddress = LdrEntry->DllBase;
1457  SeiResolveAPI(HookModuleInfo);
1458  }
1459 
1460  SeiHookImports(LdrEntry);
1461 
1462  NotifyShims(SHIM_REASON_DLL_LOAD, LdrEntry);
1463 }
VOID SeiResolveAPI(PHOOKMODULEINFO HookModuleInfo)
Definition: shimeng.c:665
PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
Definition: shimeng.c:352
PVOID BaseAddress
Definition: shimeng.h:71
PVOID DllBase
Definition: btrfs_drv.h:1880
VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: shimeng.c:958
#define ASSERT(a)
Definition: mode.c:44
BOOL g_bShimDuringInit
Definition: shimeng.c:34
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
VOID NotifyShims(DWORD dwReason, PVOID Info)
Definition: shimeng.c:255
#define NULL
Definition: types.h:112
#define SHIM_REASON_DLL_LOAD
Definition: shimlib.h:47

Referenced by LdrpGetShimEngineInterface(), and LdrpLoadDll().

◆ SE_DllUnloaded()

VOID WINAPI SE_DllUnloaded ( PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 1465 of file shimeng.c.

1466 {
1467  SHIMENG_INFO("(%p)\n", LdrEntry);
1468 
1469  /* Should we unhook here? */
1470 
1472 }
#define SHIM_REASON_DLL_UNLOAD
Definition: shimlib.h:48
VOID NotifyShims(DWORD dwReason, PVOID Info)
Definition: shimeng.c:255

Referenced by LdrpGetShimEngineInterface(), and LdrUnloadDll().

◆ SE_DynamicShim()

BOOL WINAPI SE_DynamicShim ( LPCWSTR  ProcessImage,
HSDB  hsdb,
PVOID  pQueryResult,
LPCSTR  Module,
LPDWORD  lpdwDynamicToken 
)

Definition at line 1487 of file shimeng.c.

1488 {
1490  {
1491  SHIMENG_MSG("ReactOS HACK(CORE-13283): ShimEng already initialized!\n");
1492  return TRUE;
1493  }
1494 
1496  SeiInit(ProcessImage, hsdb, pQueryResult, FALSE);
1498 
1500 
1501  return TRUE;
1502 }
#define TRUE
Definition: types.h:120
VOID SeiInit(LPCWSTR ProcessImage, HSDB hsdb, SDBQUERYRESULT *pQuery, BOOLEAN ProcessInit)
Definition: shimeng.c:1185
LPCWSTR LPCWSTR LPCWSTR DWORD PSDBQUERYRESULT_VISTA pQueryResult
Definition: env.c:37
BOOL g_bShimEngInitialized
Definition: shimeng.c:35
#define FALSE
Definition: types.h:117
BOOL g_bShimDuringInit
Definition: shimeng.c:34
HMODULE g_hInstance
Definition: MainWindow.cpp:18
BOOLEAN NTAPI LdrInitShimEngineDynamic(IN PVOID BaseAddress)
Definition: ldrapi.c:1677

◆ SE_InstallAfterInit()

VOID NTAPI SE_InstallAfterInit ( PUNICODE_STRING  ProcessImage,
PVOID  pShimData 
)

Definition at line 1436 of file shimeng.c.

1437 {
1439 }
#define SHIM_NOTIFY_ATTACH
Definition: shimlib.h:50
VOID NotifyShims(DWORD dwReason, PVOID Info)
Definition: shimeng.c:255
#define NULL
Definition: types.h:112

Referenced by LdrpGetShimEngineInterface(), and LdrpInitializeProcess().

◆ SE_InstallBeforeInit()

VOID NTAPI SE_InstallBeforeInit ( PUNICODE_STRING  ProcessImage,
PVOID  pShimData 
)

Definition at line 1417 of file shimeng.c.

1418 {
1419  HSDB hsdb = NULL;
1420  SDBQUERYRESULT QueryResult = { { 0 } };
1421  SHIMENG_INFO("(%wZ, %p)\n", ProcessImage, pShimData);
1422 
1423  if (!SeiGetShimData(ProcessImage, pShimData, &hsdb, &QueryResult))
1424  {
1425  SHIMENG_FAIL("Failed to get shim data\n");
1426  return;
1427  }
1428 
1430  SeiInit(ProcessImage->Buffer, hsdb, &QueryResult, TRUE);
1432 
1433  SdbReleaseDatabase(hsdb);
1434 }
#define TRUE
Definition: types.h:120
VOID SeiInit(LPCWSTR ProcessImage, HSDB hsdb, SDBQUERYRESULT *pQuery, BOOLEAN ProcessInit)
Definition: shimeng.c:1185
Definition: apphelp.h:30
#define FALSE
Definition: types.h:117
BOOL SeiGetShimData(PUNICODE_STRING ProcessImage, PVOID pShimData, HSDB *pHsdb, SDBQUERYRESULT *pQuery)
Definition: shimeng.c:1367
void WINAPI SdbReleaseDatabase(HSDB)
Definition: hsdb.c:417
BOOL g_bShimDuringInit
Definition: shimeng.c:34
#define NULL
Definition: types.h:112

Referenced by LdrpGetShimEngineInterface(), and LdrpLoadShimEngine().

◆ SE_IsShimDll()

BOOL WINAPI SE_IsShimDll ( PVOID  BaseAddress)

Definition at line 1474 of file shimeng.c.

1475 {
1476  SHIMENG_INFO("(%p)\n", BaseAddress);
1477 
1479 }
PSHIMMODULE SeiGetShimModuleInfo(PVOID BaseAddress)
Definition: shimeng.c:280
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define NULL
Definition: types.h:112

Referenced by SeiHookImports(), SeiResetEntryProcessed(), SeiSetEntryProcessed(), and StubGetProcAddress().

◆ SE_ProcessDying()

VOID NTAPI SE_ProcessDying ( VOID  )

Definition at line 1441 of file shimeng.c.

1442 {
1443  SHIMENG_MSG("()\n");
1445 }
#define SHIM_NOTIFY_DETACH
Definition: shimlib.h:51
VOID NotifyShims(DWORD dwReason, PVOID Info)
Definition: shimeng.c:255
#define NULL
Definition: types.h:112

Referenced by LdrpGetShimEngineInterface(), and LdrShutdownProcess().

◆ SeiAddFlag()

static VOID SeiAddFlag ( PDB  pdb,
TAGID  tiFlagRef,
PFLAGINFO  pFlagInfo 
)
static

Definition at line 439 of file shimeng.c.

440 {
442 
443  /* Resolve the FLAG_REF to the real FLAG node */
444  TAGID FlagTag = SeiGetDWORD(pdb, tiFlagRef, TAG_FLAG_TAGID);
445 
446  if (FlagTag == TAGID_NULL)
447  return;
448 
451  Flag.QuadPart = SeiGetQWORD(pdb, FlagTag, TAG_FLAG_PROCESSPARAM);
452  pFlagInfo->ProcessParameters_Flags |= Flag.LowPart;
453 }
static PDB pdb
Definition: db.cpp:172
ULONG ProcessParameters_Flags
Definition: shimeng.h:81
ULARGE_INTEGER AppCompatFlags
Definition: shimeng.h:79
#define TAG_FLAG_PROCESSPARAM
Definition: sdbtagid.h:124
ULONGLONG QuadPart
Definition: ms-dtyp.idl:185
#define TAG_FLAG_MASK_KERNEL
Definition: sdbtagid.h:114
Definition: xml2sdb.h:79
#define TAG_FLAG_TAGID
Definition: sdbtagid.h:94
ULARGE_INTEGER AppCompatFlagsUser
Definition: shimeng.h:80
static QWORD SeiGetQWORD(PDB pdb, TAGID tag, TAG type)
Definition: shimeng.c:419
#define TAGID_NULL
Definition: db.cpp:38
DWORD TAGID
#define TAG_FLAG_MASK_USER
Definition: sdbtagid.h:117
static DWORD SeiGetDWORD(PDB pdb, TAGID tag, TAG type)
Definition: shimeng.c:410

Referenced by SeiBuildShimRefArray().

◆ SeiAddHooks()

VOID SeiAddHooks ( PHOOKAPIEX  hooks,
DWORD  dwHookCount,
PSHIMINFO  pShim 
)

Definition at line 556 of file shimeng.c.

557 {
558  DWORD n, j;
559  UNICODE_STRING UnicodeModName;
560  WCHAR Buf[512];
561 
562  RtlInitEmptyUnicodeString(&UnicodeModName, Buf, sizeof(Buf));
563 
564  for (n = 0; n < dwHookCount; ++n)
565  {
567  PVOID DllHandle;
568  PHOOKAPIEX hook = hooks + n;
569  PHOOKAPIEX* pHookApi;
570  PHOOKMODULEINFO HookModuleInfo;
571 
572  RtlInitAnsiString(&AnsiString, hook->LibraryName);
573  if (!NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeModName, &AnsiString, FALSE)))
574  {
575  SHIMENG_FAIL("Unable to convert %s to Unicode\n", hook->LibraryName);
576  continue;
577  }
578 
579  if (NT_SUCCESS(LdrGetDllHandle(NULL, 0, &UnicodeModName, &DllHandle)))
580  {
581  HookModuleInfo = SeiFindHookModuleInfo(NULL, DllHandle);
582  }
583  else
584  {
585  HookModuleInfo = SeiFindHookModuleInfo(&UnicodeModName, NULL);
586  DllHandle = NULL;
587  }
588 
589  if (!HookModuleInfo)
590  {
591  HookModuleInfo = ARRAY_Append(&g_pHookArray, HOOKMODULEINFO);
592  if (!HookModuleInfo)
593  continue;
594 
595  HookModuleInfo->BaseAddress = DllHandle;
596  ARRAY_Init(&HookModuleInfo->HookApis, PHOOKAPIEX);
597  RtlCreateUnicodeString(&HookModuleInfo->Name, UnicodeModName.Buffer);
598  }
599 
600  hook->pShimInfo = pShim;
601 
602  for (j = 0; j < ARRAY_Size(&HookModuleInfo->HookApis); ++j)
603  {
604  PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, j);
605  int CmpResult = SeiCompareFunctionName(hook->FunctionName, HookApi->FunctionName);
606  if (CmpResult == 0)
607  {
608  while (HookApi->ApiLink)
609  {
610  HookApi = HookApi->ApiLink;
611  }
612  HookApi->ApiLink = hook;
613  hook = NULL;
614  break;
615  }
616  }
617  /* No place found yet, append it */
618  if (hook)
619  {
620  pHookApi = ARRAY_Append(&HookModuleInfo->HookApis, PHOOKAPIEX);
621  if (pHookApi)
622  *pHookApi = hook;
623  }
624  }
625 }
UNICODE_STRING Name
Definition: shimeng.h:70
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
Definition: ldrapi.c:805
ARRAY HookApis
Definition: shimeng.h:73
PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
Definition: shimeng.c:352
GLdouble n
Definition: glext.h:7729
#define ARRAY_Append(Array, TypeOfArray)
Definition: shimeng.c:123
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
PVOID BaseAddress
Definition: shimeng.h:71
#define FALSE
Definition: types.h:117
int SeiCompareFunctionName(LPCSTR lpProcName1, LPCSTR lpProcName2)
Definition: shimeng.c:228
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
Definition: glfuncs.h:250
Definition: msg.h:42
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
PCSTR FunctionName
Definition: shimeng.h:32
static ARRAY g_pHookArray
Definition: shimeng.c:38
PHOOKAPIEX ApiLink
Definition: shimeng.h:36
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
#define NULL
Definition: types.h:112
#define ARRAY_Init(Array, TypeOfArray)
Definition: shimeng.c:122
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SeiAddInternalHooks(), and SeiCombineHookInfo().

◆ SeiAddInternalHooks()

VOID SeiAddInternalHooks ( DWORD  dwNumHooks)

Definition at line 751 of file shimeng.c.

752 {
753  if (dwNumHooks == 0)
754  {
756  return;
757  }
758 
761 }
#define TRUE
Definition: types.h:120
#define ARRAYSIZE(array)
Definition: filtermapper.c:47
#define FALSE
Definition: types.h:117
VOID SeiAddHooks(PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
Definition: shimeng.c:556
#define NULL
Definition: types.h:112
BOOL g_bInternalHooksUsed
Definition: shimeng.c:36
HOOKAPIEX g_IntHookEx[]
Definition: shimeng.c:43

Referenced by SeiInit().

◆ SeiAddShim()

static VOID SeiAddShim ( TAGREF  trShimRef,
PARRAY  pShimRef 
)
static

Definition at line 428 of file shimeng.c.

429 {
430  TAGREF* Data;
431 
432  Data = ARRAY_Append(pShimRef, TAGREF);
433  if (!Data)
434  return;
435 
436  *Data = trShimRef;
437 }
DWORD TAGREF
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
Definition: wdfdevice.h:4527
#define ARRAY_Append(Array, TypeOfArray)
Definition: shimeng.c:123

Referenced by SeiBuildShimRefArray().

◆ SeiAppendHookInfo()

PSHIMINFO SeiAppendHookInfo ( PSHIMMODULE  pShimModuleInfo,
PHOOKAPIEX  pHookApi,
DWORD  dwHookCount,
PCWSTR  ShimName 
)

Definition at line 327 of file shimeng.c.

328 {
329  PSHIMINFO* pData, Data;
330 
331  pData = ARRAY_Append(&pShimModuleInfo->EnabledShims, PSHIMINFO);
332  if (!pData)
333  return NULL;
334 
335  *pData = SeiAlloc(sizeof(SHIMINFO));
336  Data = *pData;
337 
338  if (!Data)
339  return NULL;
340 
341  Data->ShimName = SdbpStrDup(ShimName);
342  if (!Data->ShimName)
343  return NULL;
344 
345  Data->pHookApi = pHookApi;
346  Data->dwHookCount = dwHookCount;
347  Data->pShimModule = pShimModuleInfo;
348  ARRAY_Init(&Data->InExclude, INEXCLUDE);
349  return Data;
350 }
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
Definition: wdfdevice.h:4527
#define ARRAY_Append(Array, TypeOfArray)
Definition: shimeng.c:123
PWSTR SdbpStrDup(LPCWSTR string)
Definition: sdbapi.c:162
ARRAY EnabledShims
Definition: shimeng.h:65
#define NULL
Definition: types.h:112
#define ARRAY_Init(Array, TypeOfArray)
Definition: shimeng.c:122
#define SeiAlloc(size)
Definition: shimeng.h:101
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
Definition: twain.h:1827

Referenced by SeiInit().

◆ SeiAppendInExclude()

VOID SeiAppendInExclude ( PARRAY  dest,
PCWSTR  ModuleName,
BOOL  IsInclude 
)

Definition at line 860 of file shimeng.c.

861 {
863  UNICODE_STRING ModuleNameU;
864  RtlInitUnicodeString(&ModuleNameU, ModuleName);
865 
866  InExclude = SeiFindInExclude(dest, &ModuleNameU);
867  if (InExclude)
868  {
869  InExclude->Include = IsInclude;
870  return;
871  }
872 
874  if (InExclude)
875  {
876  PCWSTR ModuleNameCopy = SdbpStrDup(ModuleName);
877  RtlInitUnicodeString(&InExclude->Module, ModuleNameCopy);
878  InExclude->Include = IsInclude;
879  }
880 }
const uint16_t * PCWSTR
Definition: typedefs.h:57
bool Include
Definition: xml2sdb.h:38
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
Definition: acpixf.h:1278
#define ARRAY_Append(Array, TypeOfArray)
Definition: shimeng.c:123
std::string Module
Definition: xml2sdb.h:37
PWSTR SdbpStrDup(LPCWSTR string)
Definition: sdbapi.c:162
PINEXCLUDE SeiFindInExclude(PARRAY InExclude, PCUNICODE_STRING DllName)
Definition: shimeng.c:797
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
static char * dest
Definition: rtl.c:135

Referenced by SeiBuildInclExclList(), and SeiReadInExclude().

◆ SeiBuildGlobalInclExclList()

VOID SeiBuildGlobalInclExclList ( HSDB  hsdb)

Definition at line 915 of file shimeng.c.

916 {
917  PDB pdb;
918  TAGREF tr = TAGREF_ROOT;
919  TAGID root, db, library;
920 
921  if (!SdbTagRefToTagID(hsdb, tr, &pdb, &root))
922  {
923  SHIMENG_WARN("Unable to resolve database root\n");
924  return;
925  }
927  if (db == TAGID_NULL)
928  {
929  SHIMENG_WARN("Unable to resolve database\n");
930  return;
931  }
933  if (library == TAGID_NULL)
934  {
935  SHIMENG_WARN("Unable to resolve library\n");
936  return;
937  }
938 
940 }
DWORD TAGREF
static PDB pdb
Definition: db.cpp:172
static ARRAY g_InExclude
Definition: shimeng.c:39
#define TAG_LIBRARY
Definition: sdbtagid.h:164
#define TAGREF_ROOT
Definition: sdbtypes.h:22
#define TAG_DATABASE
Definition: db.cpp:85
struct _root root
FT_Library library
Definition: cffdrivr.c:654
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAGID_NULL
Definition: db.cpp:38
VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest)
Definition: shimeng.c:889
DWORD TAGID
BOOL WINAPI SdbTagRefToTagID(HSDB hsdb, TAGREF trWhich, PDB *ppdb, TAGID *ptiWhich)
Definition: hsdb.c:638

Referenced by SeiInit().

◆ SeiBuildInclExclList()

VOID SeiBuildInclExclList ( PDB  pdb,
TAGID  ShimTag,
PSHIMINFO  pShimInfo 
)

Definition at line 942 of file shimeng.c.

943 {
944  DWORD n;
945 
946  /* First duplicate the global in/excludes */
947  for (n = 0; n < ARRAY_Size(&g_InExclude); ++n)
948  {
950  SeiAppendInExclude(&pShimInfo->InExclude, InEx->Module.Buffer, InEx->Include);
951  }
952 
953  /* Now read this shim's in/excludes (possibly overriding the global ones) */
954  SeiReadInExclude(pdb, ShimTag, &pShimInfo->InExclude);
955 }
VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
Definition: shimeng.c:860
static PDB pdb
Definition: db.cpp:172
static ARRAY g_InExclude
Definition: shimeng.c:39
GLdouble n
Definition: glext.h:7729
UNICODE_STRING Module
Definition: shimeng.h:44
unsigned long DWORD
Definition: ntddk_ex.h:95
BOOL Include
Definition: shimeng.h:45
#define ARRAY_Size(Array)
Definition: shimeng.c:125
ARRAY InExclude
Definition: shimeng.h:54
VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest)
Definition: shimeng.c:889
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SeiInit().

◆ SeiBuildShimRefArray()

static VOID SeiBuildShimRefArray ( HSDB  hsdb,
SDBQUERYRESULT pQuery,
PARRAY  pShimRef,
PFLAGINFO  pFlagInfo 
)
static

Definition at line 474 of file shimeng.c.

475 {
476  WCHAR wszLayerEnvVar[MAX_LAYER_LENGTH] = { 0 };
477  DWORD n;
478 
479  for (n = 0; n < pQuery->dwExeCount; ++n)
480  {
481  PDB pdb;
482  TAGID tag;
483  if (SdbTagRefToTagID(hsdb, pQuery->atrExes[n], &pdb, &tag))
484  {
488 
489  if (ExeName)
490  SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Exe(%S))\n", ExeName);
491 
492  while (ShimRef != TAGID_NULL)
493  {
494  TAGREF trShimRef;
495  if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
496  SeiAddShim(trShimRef, pShimRef);
497 
499  }
500 
501  while (FlagRef != TAGID_NULL)
502  {
503  SeiAddFlag(pdb, FlagRef, pFlagInfo);
504 
506  }
507  }
508  }
509 
510 
511  for (n = 0; n < pQuery->dwLayerCount; ++n)
512  {
513  PDB pdb;
514  TAGID tag;
515  if (SdbTagRefToTagID(hsdb, pQuery->atrLayers[n], &pdb, &tag))
516  {
517  LPCWSTR LayerName = SeiGetStringPtr(pdb, tag, TAG_NAME);
520 
521  if (LayerName)
522  {
523  HRESULT hr;
524  SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Layer(%S))\n", LayerName);
525  if (wszLayerEnvVar[0])
526  StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), L" ");
527  hr = StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), LayerName);
528  if (!SUCCEEDED(hr))
529  {
530  SHIMENG_FAIL("Unable to append %S\n", LayerName);
531  }
532  }
533 
534  while (ShimRef != TAGID_NULL)
535  {
536  TAGREF trShimRef;
537  if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
538  SeiAddShim(trShimRef, pShimRef);
539 
541  }
542 
543  while (FlagRef != TAGID_NULL)
544  {
545  SeiAddFlag(pdb, FlagRef, pFlagInfo);
546 
548  }
549  }
550  }
551  if (wszLayerEnvVar[0])
552  SeiSetLayerEnvVar(wszLayerEnvVar);
553 }
WCHAR * ExeName
DWORD TAGREF
#define TAG_NAME
Definition: vfat.h:553
static PDB pdb
Definition: db.cpp:172
HRESULT hr
Definition: shlfolder.c:183
const WCHAR * LPCWSTR
Definition: xmlstorage.h:185
BOOL WINAPIV SeiDbgPrint(SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format,...)
Definition: shimeng.c:160
TAGREF atrLayers[SDB_MAX_LAYERS]
Definition: apphelp.h:67
GLdouble n
Definition: glext.h:7729
#define ARRAYSIZE(array)
Definition: filtermapper.c:47
Definition: ecma_167.h:138
DWORD dwLayerCount
Definition: apphelp.h:71
STRSAFEAPI StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
Definition: strsafe.h:325
#define L(x)
Definition: ntvdm.h:50
if SUCCEEDED(hr)
TAGID WINAPI SdbFindNextTag(PDB pdb, TAGID parent, TAGID prev_child)
Definition: sdbread.c:231
__wchar_t WCHAR
Definition: xmlstorage.h:180
LONG HRESULT
Definition: typedefs.h:79
unsigned long DWORD
Definition: ntddk_ex.h:95
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAG_SHIM_REF
Definition: db.cpp:89
DWORD dwExeCount
Definition: apphelp.h:70
BOOL WINAPI SdbTagIDToTagRef(HSDB hsdb, PDB pdb, TAGID tiWhich, TAGREF *ptrWhich)
Definition: hsdb.c:669
TAGREF atrExes[SDB_MAX_EXES]
Definition: apphelp.h:65
#define TAGID_NULL
Definition: db.cpp:38
static LPCWSTR SeiGetStringPtr(PDB pdb, TAGID tag, TAG type)
Definition: shimeng.c:401
#define MAX_LAYER_LENGTH
Definition: shimeng.c:471
#define NULL
Definition: types.h:112
#define TAG_FLAG_REF
Definition: sdbtagid.h:183
static VOID SeiAddFlag(PDB pdb, TAGID tiFlagRef, PFLAGINFO pFlagInfo)
Definition: shimeng.c:439
static VOID SeiAddShim(TAGREF trShimRef, PARRAY pShimRef)
Definition: shimeng.c:428
DWORD TAGID
BOOL WINAPI SdbTagRefToTagID(HSDB hsdb, TAGREF trWhich, PDB *ppdb, TAGID *ptiWhich)
Definition: hsdb.c:638
static VOID SeiSetLayerEnvVar(LPCWSTR wszLayer)
Definition: shimeng.c:456
char * tag
Definition: main.c:59

Referenced by SeiInit().

◆ SeiCheckComPlusImage()

VOID SeiCheckComPlusImage ( PVOID  BaseAddress)

Definition at line 271 of file shimeng.c.

272 {
273  ULONG ComSectionSize;
275 
276  SHIMENG_INFO("COM+ executable %s\n", g_bComPlusImage ? "TRUE" : "FALSE");
277 }
#define TRUE
Definition: types.h:120
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Definition: ntimage.h:489
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define RtlImageDirectoryEntryToData
Definition: compat.h:809
BOOL g_bComPlusImage
Definition: shimeng.c:33
#define NULL
Definition: types.h:112
unsigned int ULONG
Definition: retypes.h:1

Referenced by SeiInit().

◆ SeiCombineHookInfo()

VOID SeiCombineHookInfo ( VOID  )

Definition at line 727 of file shimeng.c.

728 {
729  DWORD mod, n;
730 
731  /* Enumerate all Shim modules */
732  for (mod = 0; mod < ARRAY_Size(&g_pShimInfo); ++mod)
733  {
734  PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, mod);
735  DWORD dwShimCount = ARRAY_Size(&pShimModule->EnabledShims);
736 
737  /* Enumerate all Shims */
738  for (n = 0; n < dwShimCount; ++n)
739  {
740  PSHIMINFO pShim = *ARRAY_At(&pShimModule->EnabledShims, PSHIMINFO, n);
741 
742  PHOOKAPIEX hooks = pShim->pHookApi;
743  DWORD dwHookCount = pShim->dwHookCount;
744 
745  SeiAddHooks(hooks, dwHookCount, pShim);
746  }
747  }
748 }
static ARRAY g_pShimInfo
Definition: shimeng.c:37
GLdouble n
Definition: glext.h:7729
DWORD dwHookCount
Definition: shimeng.h:52
PHOOKAPIEX pHookApi
Definition: shimeng.h:51
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
ARRAY EnabledShims
Definition: shimeng.h:65
VOID SeiAddHooks(PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
Definition: shimeng.c:556
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124
static int mod
Definition: i386-dis.c:1289

Referenced by SeiInit().

◆ SeiCompareFunctionName()

int SeiCompareFunctionName ( LPCSTR  lpProcName1,
LPCSTR  lpProcName2 
)

Definition at line 228 of file shimeng.c.

229 {
230  BOOL Ord1 = SeiIsOrdinalName(lpProcName1);
231  BOOL Ord2 = SeiIsOrdinalName(lpProcName2);
232 
233  /* One is an ordinal, the other not */
234  if (Ord1 != Ord2)
235  return 1;
236 
237  /* Compare ordinals */
238  if (Ord1)
239  return (ULONG_PTR)lpProcName1 != (ULONG_PTR)lpProcName2;
240 
241  /* Compare names */
242  return strcmp(lpProcName1, lpProcName2);
243 }
static BOOL SeiIsOrdinalName(LPCSTR lpProcName)
Definition: shimeng.c:213
uint32_t ULONG_PTR
Definition: typedefs.h:65
unsigned int BOOL
Definition: ntddk_ex.h:94
int strcmp(const char *String1, const char *String2)
Definition: utclib.c:469
#define ULONG_PTR
Definition: config.h:101

Referenced by SeiAddHooks(), and StubGetProcAddress().

◆ SeiCreateShimModuleInfo()

PSHIMMODULE SeiCreateShimModuleInfo ( PCWSTR  DllName,
PVOID  BaseAddress 
)

Definition at line 294 of file shimeng.c.

295 {
296  static const ANSI_STRING GetHookAPIs = RTL_CONSTANT_STRING("GetHookAPIs");
297  static const ANSI_STRING NotifyShims = RTL_CONSTANT_STRING("NotifyShims");
299  PVOID pGetHookAPIs, pNotifyShims;
300 
303  {
304  SHIMENG_WARN("Failed to resolve entry points for %S\n", DllName);
305  return NULL;
306  }
307 
309  if (!pData)
310  return NULL;
311 
312  *pData = SeiAlloc(sizeof(SHIMMODULE));
313 
314  Data = *pData;
315 
316  RtlCreateUnicodeString(&Data->Name, DllName);
317  Data->BaseAddress = BaseAddress;
318 
319  Data->pGetHookAPIs = pGetHookAPIs;
320  Data->pNotifyShims = pNotifyShims;
321 
322  ARRAY_Init(&Data->EnabledShims, PSHIMINFO);
323 
324  return Data;
325 }
static ARRAY g_pShimInfo
Definition: shimeng.c:37
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
Definition: wdfdevice.h:4527
#define ARRAY_Append(Array, TypeOfArray)
Definition: shimeng.c:123
PHOOKAPI WINAPI GetHookAPIs(IN LPCSTR szCommandLine, IN LPCWSTR wszShimName, OUT PDWORD pdwHookCount)
Definition: main.c:15
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
Definition: ldrapi.c:823
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static tGETHOOKAPIS pGetHookAPIs
Definition: dispmode.c:26
NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
std::string Name
Definition: xml2sdb.h:101
VOID NotifyShims(DWORD dwReason, PVOID Info)
Definition: shimeng.c:255
#define NULL
Definition: types.h:112
#define ARRAY_Init(Array, TypeOfArray)
Definition: shimeng.c:122
#define SeiAlloc(size)
Definition: shimeng.h:101
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
Definition: twain.h:1827
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14

Referenced by SeiInit().

◆ SeiDbgPrint()

BOOL WINAPIV SeiDbgPrint ( SEI_LOG_LEVEL  Level,
PCSTR  Function,
PCSTR  Format,
  ... 
)

Outputs diagnostic info.

Parameters
[in]LevelThe level to log this message with, choose any of [SHIM_ERR, SHIM_WARN, SHIM_INFO].
[in]FunctionNameThe function this log should be attributed to.
[in]FormatThe format string.
...Variable arguments providing additional information.
Returns
Success: TRUE Failure: FALSE.

Definition at line 160 of file shimeng.c.

161 {
162  char Buffer[512];
163  char* Current = Buffer;
164  const char* LevelStr;
165  size_t Length = sizeof(Buffer);
166  va_list ArgList;
167  HRESULT hr;
168 
169  if (g_ShimEngDebugLevel == 0xffffffff)
171 
173  return FALSE;
174 
175  switch (Level)
176  {
177  case SEI_MSG:
178  LevelStr = "MSG ";
179  break;
180  case SEI_FAIL:
181  LevelStr = "FAIL";
182  break;
183  case SEI_WARN:
184  LevelStr = "WARN";
185  break;
186  case SEI_INFO:
187  LevelStr = "INFO";
188  break;
189  default:
190  LevelStr = "USER";
191  break;
192  }
193 
194  if (Function)
195  hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] [%s] ", LevelStr, Function);
196  else
197  hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] ", LevelStr);
198 
199  if (!SUCCEEDED(hr))
200  return FALSE;
201 
202  va_start(ArgList, Format);
203  hr = StringCchVPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, Format, ArgList);
204  va_end(ArgList);
205  if (!SUCCEEDED(hr))
206  return FALSE;
207 
208  DbgPrint("%s", Buffer);
209  return TRUE;
210 }
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:101
_In_ CDROM_SCAN_FOR_SPECIAL_INFO _In_ PCDROM_SCAN_FOR_SPECIAL_HANDLER Function
Definition: cdrom.h:1154
#define DbgPrint
Definition: hal.h:12
HRESULT hr
Definition: shlfolder.c:183
STRSAFEAPI StringCchVPrintfExA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPSTR *ppszDestEnd, size_t *pcchRemaining, STRSAFE_DWORD dwFlags, STRSAFE_LPCSTR pszFormat, va_list argList)
Definition: strsafe.h:650
IN BOOLEAN OUT PSTR Buffer
Definition: progress.h:34
#define TRUE
Definition: types.h:120
ULONG g_ShimEngDebugLevel
Definition: shimeng.c:32
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR Level
Definition: wmitypes.h:55
STRSAFEAPI StringCchPrintfExA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPSTR *ppszDestEnd, size_t *pcchRemaining, STRSAFE_DWORD dwFlags, STRSAFE_LPCSTR pszFormat,...)
Definition: strsafe.h:575
#define va_end(ap)
Definition: acmsvcex.h:90
#define FALSE
Definition: types.h:117
if SUCCEEDED(hr)
char * va_list
Definition: acmsvcex.h:78
Definition: bufpool.h:45
LONG HRESULT
Definition: typedefs.h:79
va_start(ap, x)
#define STRSAFE_NULL_ON_FAILURE
Definition: ntstrsafe.h:34
VOID SeiInitDebugSupport(VOID)
Definition: shimeng.c:128

Referenced by SeiBuildShimRefArray(), and SeiInit().

◆ SeiFindHookModuleInfo()

PHOOKMODULEINFO SeiFindHookModuleInfo ( PUNICODE_STRING  ModuleName,
PVOID  BaseAddress 
)

Definition at line 352 of file shimeng.c.

353 {
354  DWORD n;
355 
356  if (ModuleName == NULL && BaseAddress == NULL)
357  {
358  BaseAddress = NtCurrentPeb()->ImageBaseAddress;
359  }
360 
361  for (n = 0; n < ARRAY_Size(&g_pHookArray); ++n)
362  {
364 
365  if (BaseAddress && BaseAddress == pModuleInfo->BaseAddress)
366  return pModuleInfo;
367 
368  if (!BaseAddress && RtlEqualUnicodeString(ModuleName, &pModuleInfo->Name, TRUE))
369  return pModuleInfo;
370  }
371 
372  return NULL;
373 }
UNICODE_STRING Name
Definition: shimeng.h:70
#define TRUE
Definition: types.h:120
GLdouble n
Definition: glext.h:7729
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
Definition: acpixf.h:1278
PVOID BaseAddress
Definition: shimeng.h:71
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
static ARRAY g_pHookArray
Definition: shimeng.c:38
#define NtCurrentPeb()
Definition: FLS.c:22
#define NULL
Definition: types.h:112
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SE_DllLoaded(), SeiAddHooks(), SeiFindHookModuleInfoForImportDescriptor(), and StubGetProcAddress().

◆ SeiFindHookModuleInfoForImportDescriptor()

PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor ( PBYTE  DllBase,
PIMAGE_IMPORT_DESCRIPTOR  ImportDescriptor 
)

Definition at line 375 of file shimeng.c.

376 {
377  UNICODE_STRING DllName;
378  PVOID DllHandle;
380 
381  if (!RtlCreateUnicodeStringFromAsciiz(&DllName, (PCSZ)(DllBase + ImportDescriptor->Name)))
382  {
383  SHIMENG_FAIL("Unable to convert dll name to unicode\n");
384  return NULL;
385  }
386 
387  Success = LdrGetDllHandle(NULL, NULL, &DllName, &DllHandle);
388 
389  if (!NT_SUCCESS(Success))
390  {
391  SHIMENG_FAIL("Unable to get module handle for %wZ (%p)\n", &DllName, DllBase);
392  RtlFreeUnicodeString(&DllName);
393 
394  return NULL;
395  }
396  RtlFreeUnicodeString(&DllName);
397 
398  return SeiFindHookModuleInfo(NULL, DllHandle);
399 }
CONST char * PCSZ
Definition: umtypes.h:125
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
Definition: ldrapi.c:805
LONG NTSTATUS
Definition: precomp.h:26
PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
Definition: shimeng.c:352
NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz(_Out_ PUNICODE_STRING Destination, _In_ PCSZ Source)
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define NULL
Definition: types.h:112

Referenced by SeiHookImports().

◆ SeiFindInExclude()

PINEXCLUDE SeiFindInExclude ( PARRAY  InExclude,
PCUNICODE_STRING  DllName 
)

Definition at line 797 of file shimeng.c.

798 {
799  DWORD n;
800 
801  for (n = 0; n < ARRAY_Size(InExclude); ++n)
802  {
804 
805  if (RtlEqualUnicodeString(&InEx->Module, DllName, TRUE))
806  return InEx;
807  }
808 
809  return NULL;
810 }
#define TRUE
Definition: types.h:120
GLdouble n
Definition: glext.h:7729
UNICODE_STRING Module
Definition: shimeng.h:44
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
#define NULL
Definition: types.h:112
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SeiAppendInExclude(), and SeiIsExcluded().

◆ SeiGetDWORD()

static DWORD SeiGetDWORD ( PDB  pdb,
TAGID  tag,
TAG  type 
)
static

Definition at line 410 of file shimeng.c.

411 {
412  TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
413  if (tagEntry == TAGID_NULL)
414  return 0;
415 
416  return SdbReadDWORDTag(pdb, tagEntry, 0);
417 }
static PDB pdb
Definition: db.cpp:172
DWORD WINAPI SdbReadDWORDTag(PDB pdb, TAGID tagid, DWORD ret)
Definition: sdbread.c:305
Definition: ecma_167.h:138
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAGID_NULL
Definition: db.cpp:38
GLuint GLuint GLsizei GLenum type
Definition: gl.h:1545
DWORD TAGID

Referenced by SeiAddFlag(), and SeiInit().

◆ SeiGetModuleFromAddress()

PVOID SeiGetModuleFromAddress ( PVOID  addr)

Definition at line 246 of file shimeng.c.

247 {
248  PVOID hModule = NULL;
250  return hModule;
251 }
PVOID NTAPI RtlPcToFileHeader(IN PVOID PcValue, PVOID *BaseOfImage)
Definition: libsupp.c:659
GLenum const GLvoid * addr
Definition: glext.h:9621
#define NULL
Definition: types.h:112
HMODULE hModule
Definition: animate.c:44

Referenced by StubGetProcAddress().

◆ SeiGetQWORD()

static QWORD SeiGetQWORD ( PDB  pdb,
TAGID  tag,
TAG  type 
)
static

Definition at line 419 of file shimeng.c.

420 {
421  TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
422  if (tagEntry == TAGID_NULL)
423  return 0;
424 
425  return SdbReadQWORDTag(pdb, tagEntry, 0);
426 }
static PDB pdb
Definition: db.cpp:172
Definition: ecma_167.h:138
QWORD WINAPI SdbReadQWORDTag(PDB pdb, TAGID tagid, QWORD ret)
Definition: sdbread.c:321
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAGID_NULL
Definition: db.cpp:38
GLuint GLuint GLsizei GLenum type
Definition: gl.h:1545
DWORD TAGID

Referenced by SeiAddFlag().

◆ SeiGetShimData()

BOOL SeiGetShimData ( PUNICODE_STRING  ProcessImage,
PVOID  pShimData,
HSDB pHsdb,
SDBQUERYRESULT pQuery 
)

Definition at line 1367 of file shimeng.c.

1368 {
1369  static const UNICODE_STRING ForbiddenShimmingApps[] = {
1370  RTL_CONSTANT_STRING(L"ntsd.exe"),
1371  RTL_CONSTANT_STRING(L"windbg.exe"),
1372 #if WINVER >= 0x600
1373  RTL_CONSTANT_STRING(L"slsvc.exe"),
1374 #endif
1375  };
1376  static const UNICODE_STRING PathDividerFind = RTL_CONSTANT_STRING(L"\\/");
1377  UNICODE_STRING ProcessName;
1378  USHORT PathDivider;
1379  HSDB hsdb;
1380  DWORD n;
1381 
1382  if (!NT_SUCCESS(RtlFindCharInUnicodeString(RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END, ProcessImage, &PathDividerFind, &PathDivider)))
1383  PathDivider = 0;
1384 
1385  if (PathDivider)
1386  PathDivider += sizeof(WCHAR);
1387 
1388  ProcessName.Buffer = ProcessImage->Buffer + PathDivider / sizeof(WCHAR);
1389  ProcessName.Length = ProcessImage->Length - PathDivider;
1390  ProcessName.MaximumLength = ProcessImage->MaximumLength - PathDivider;
1391 
1392  for (n = 0; n < ARRAYSIZE(ForbiddenShimmingApps); ++n)
1393  {
1394  if (RtlEqualUnicodeString(&ProcessName, ForbiddenShimmingApps + n, TRUE))
1395  {
1396  SHIMENG_MSG("Not shimming %wZ\n", ForbiddenShimmingApps + n);
1397  return FALSE;
1398  }
1399  }
1400 
1401  /* We should probably load all db's here, but since we do not support that yet... */
1403  if (hsdb)
1404  {
1405  if (SdbUnpackAppCompatData(hsdb, ProcessImage->Buffer, pShimData, pQuery))
1406  {
1407  *pHsdb = hsdb;
1408  return TRUE;
1409  }
1410  SdbReleaseDatabase(hsdb);
1411  }
1412  return FALSE;
1413 }
#define RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END
Definition: rtl.h:25
USHORT MaximumLength
Definition: env_spec_w32.h:370
#define TRUE
Definition: types.h:120
HSDB WINAPI SdbInitDatabase(DWORD, LPCWSTR)
Definition: hsdb.c:369
GLdouble n
Definition: glext.h:7729
#define ARRAYSIZE(array)
Definition: filtermapper.c:47
Definition: apphelp.h:30
#define SDB_DATABASE_MAIN_SHIM
Definition: apphelp.h:24
NTSTATUS NTAPI RtlFindCharInUnicodeString(_In_ ULONG Flags, _In_ PCUNICODE_STRING SearchString, _In_ PCUNICODE_STRING MatchString, _Out_ PUSHORT Position)
#define L(x)
Definition: ntvdm.h:50
#define FALSE
Definition: types.h:117
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
unsigned long DWORD
Definition: ntddk_ex.h:95
#define HID_DOS_PATHS
Definition: apphelp.h:19
void WINAPI SdbReleaseDatabase(HSDB)
Definition: hsdb.c:417
unsigned short USHORT
Definition: pedump.c:61
#define NULL
Definition: types.h:112
BOOL WINAPI SdbUnpackAppCompatData(HSDB hsdb, LPCWSTR pszImageName, PVOID pData, PSDBQUERYRESULT pQueryResult)
Definition: hsdb.c:761
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14

Referenced by SE_InstallBeforeInit().

◆ SeiGetShimModuleInfo()

PSHIMMODULE SeiGetShimModuleInfo ( PVOID  BaseAddress)

Definition at line 280 of file shimeng.c.

281 {
282  DWORD n;
283 
284  for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
285  {
286  PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
287 
288  if (pShimModule->BaseAddress == BaseAddress)
289  return pShimModule;
290  }
291  return NULL;
292 }
static ARRAY g_pShimInfo
Definition: shimeng.c:37
GLdouble n
Definition: glext.h:7729
PVOID BaseAddress
Definition: shimeng.h:60
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
#define NULL
Definition: types.h:112
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SE_IsShimDll(), and SeiInit().

◆ SeiGetStringPtr()

static LPCWSTR SeiGetStringPtr ( PDB  pdb,
TAGID  tag,
TAG  type 
)
static

Definition at line 401 of file shimeng.c.

402 {
403  TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
404  if (tagEntry == TAGID_NULL)
405  return NULL;
406 
407  return SdbGetStringTagPtr(pdb, tagEntry);
408 }
static PDB pdb
Definition: db.cpp:172
LPWSTR WINAPI SdbGetStringTagPtr(PDB pdb, TAGID tagid)
Definition: sdbread.c:375
Definition: ecma_167.h:138
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAGID_NULL
Definition: db.cpp:38
#define NULL
Definition: types.h:112
GLuint GLuint GLsizei GLenum type
Definition: gl.h:1545
DWORD TAGID

Referenced by SeiBuildShimRefArray(), and SeiInit().

◆ SeiHookImports()

VOID SeiHookImports ( PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 958 of file shimeng.c.

959 {
960  ULONG Size;
961  PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
962  PBYTE DllBase = LdrEntry->DllBase;
963 
964  if (SE_IsShimDll(DllBase) ||
965  g_hInstance == LdrEntry->DllBase ||
967  {
968  SHIMENG_INFO("Skipping shim module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
969  return;
970  }
971 
972  if (LdrEntry->Flags & LDRP_COMPAT_DATABASE_PROCESSED)
973  {
974  SHIMENG_INFO("Skipping module 0x%p \"%wZ\" because it was already processed\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
975  return;
976  }
977 
978  ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size);
979  if (!ImportDescriptor)
980  {
981  SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
982  return;
983  }
984 
985  SHIMENG_INFO("Hooking module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
986 
987  for ( ;ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
988  {
989  PHOOKMODULEINFO HookModuleInfo;
990 
991  /* Do we have hooks for this module? */
992  HookModuleInfo = SeiFindHookModuleInfoForImportDescriptor(DllBase, ImportDescriptor);
993 
994  if (HookModuleInfo)
995  {
996  PIMAGE_THUNK_DATA OriginalThunk, FirstThunk;
997  DWORD n;
998 
999  for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
1000  {
1001  DWORD dwFound = 0;
1002  PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
1003 
1004  /* Check if this module should be excluded from being hooked (system32/winsxs, global or shim exclude) */
1005  if (SeiIsExcluded(LdrEntry, HookApi))
1006  {
1007  continue;
1008  }
1009 
1010  OriginalThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->OriginalFirstThunk);
1011  FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
1012 
1013  /* Walk all imports */
1014  for (;OriginalThunk->u1.AddressOfData && FirstThunk->u1.Function; OriginalThunk++, FirstThunk++)
1015  {
1016  if (!IMAGE_SNAP_BY_ORDINAL(OriginalThunk->u1.Function))
1017  {
1018  if (!SeiIsOrdinalName(HookApi->FunctionName))
1019  {
1020  PIMAGE_IMPORT_BY_NAME ImportName;
1021 
1022  ImportName = (PIMAGE_IMPORT_BY_NAME)(DllBase + OriginalThunk->u1.Function);
1023  if (!strcmp((PCSTR)ImportName->Name, HookApi->FunctionName))
1024  {
1025  SeiPatchNewImport(FirstThunk, HookApi, LdrEntry);
1026 
1027  /* Sadly, iat does not have to be sorted, and can even contain duplicate entries. */
1028  dwFound++;
1029  }
1030  }
1031  }
1032  else
1033  {
1034  if (SeiIsOrdinalName(HookApi->FunctionName))
1035  {
1036  if ((PCSTR)IMAGE_ORDINAL(OriginalThunk->u1.Function) == HookApi->FunctionName)
1037  {
1038  SeiPatchNewImport(FirstThunk, HookApi, LdrEntry);
1039  dwFound++;
1040  }
1041  }
1042  }
1043  }
1044 
1045  if (dwFound != 1)
1046  {
1047  char szOrdProcFmt[10];
1048  LPCSTR FuncName = SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt);
1049 
1050  /* One entry not found. */
1051  if (!dwFound)
1052  SHIMENG_INFO("Entry \"%s!%s\" not found for \"%wZ\"\n", HookApi->LibraryName, FuncName, &LdrEntry->BaseDllName);
1053  else
1054  SHIMENG_INFO("Entry \"%s!%s\" found %d times for \"%wZ\"\n", HookApi->LibraryName, FuncName, dwFound, &LdrEntry->BaseDllName);
1055  }
1056  }
1057  }
1058  }
1059 
1060  /* Mark this module as processed. */
1062 }
ARRAY HookApis
Definition: shimeng.h:73
#define TRUE
Definition: types.h:120
GLdouble n
Definition: glext.h:7729
IN PVOID IN PVOID IN USHORT IN USHORT Size
Definition: pci.h:361
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
BOOL SeiIsExcluded(PLDR_DATA_TABLE_ENTRY LdrEntry, PHOOKAPIEX HookApi)
Definition: shimeng.c:812
static BOOL SeiIsOrdinalName(LPCSTR lpProcName)
Definition: shimeng.c:213
PVOID DllBase
Definition: btrfs_drv.h:1880
#define LDRP_COMPAT_DATABASE_PROCESSED
Definition: ldrtypes.h:61
const char * LPCSTR
Definition: xmlstorage.h:183
union _IMAGE_THUNK_DATA32::@2092 u1
macro IMPORT Name endm macro EXPORT Name global &Name endm macro TEXTAREA section rx align endm macro DATAAREA section rw endm macro RODATAAREA section rw endm macro NESTED_ENTRY Name FuncName equ &Name PrologName equ &Name &_Prolog FuncEndName equ &Name &_end global &FuncName align func &FuncName & FuncName
Definition: kxarm.h:185
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
Definition: shimeng.c:218
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
PCSTR LibraryName
Definition: shimeng.h:31
#define RtlImageDirectoryEntryToData
Definition: compat.h:809
VOID SeiPatchNewImport(PIMAGE_THUNK_DATA FirstThunk, PHOOKAPIEX HookApi, PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: shimeng.c:764
PCSTR FunctionName
Definition: shimeng.h:32
static UNICODE_STRING g_LoadingShimDll
Definition: shimeng.c:31
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
Definition: ntimage.h:567
PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor(PBYTE DllBase, PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor)
Definition: shimeng.c:375
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
#define IMAGE_DIRECTORY_ENTRY_IMPORT
Definition: pedump.c:260
ULONG Flags
Definition: ntddk_ex.h:207
HMODULE g_hInstance
Definition: MainWindow.cpp:18
unsigned int ULONG
Definition: retypes.h:1
int strcmp(const char *String1, const char *String2)
Definition: utclib.c:469
const char * PCSTR
Definition: typedefs.h:52
#define IMAGE_ORDINAL(Ordinal)
Definition: pedump.c:337
BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
Definition: shimeng.c:1474
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
BYTE * PBYTE
Definition: pedump.c:66
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
Definition: ntimage.h:566

Referenced by PatchNewModules(), and SE_DllLoaded().

◆ SeiInit()

VOID SeiInit ( LPCWSTR  ProcessImage,
HSDB  hsdb,
SDBQUERYRESULT pQuery,
BOOLEAN  ProcessInit 
)

Definition at line 1185 of file shimeng.c.

1186 {
1187  DWORD n;
1188  ARRAY ShimRefArray;
1189  DWORD dwTotalHooks = 0;
1190  FLAGINFO ShimFlags;
1191 
1192  PPEB Peb = NtCurrentPeb();
1193 
1194  /* We should only be called once! */
1196 
1197  ARRAY_Init(&ShimRefArray, TAGREF);
1201  RtlZeroMemory(&ShimFlags, sizeof(ShimFlags));
1202 
1203  SeiInitPaths();
1204 
1206 
1207  if (ProcessInit)
1208  {
1209  /* Mark all modules loaded until now as 'LDRP_ENTRY_PROCESSED' so that their entrypoint is not called while we are loading shims */
1211  }
1212 
1213  /* TODO:
1214  if (pQuery->trApphelp)
1215  SeiDisplayAppHelp(?pQuery->trApphelp?);
1216  */
1217 
1218  SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(ExePath(%S))\n", ProcessImage);
1219  SeiBuildShimRefArray(hsdb, pQuery, &ShimRefArray, &ShimFlags);
1220  if (ShimFlags.AppCompatFlags.QuadPart)
1221  {
1222  SeiDbgPrint(SEI_MSG, NULL, "Using KERNEL apphack flags 0x%I64x\n", ShimFlags.AppCompatFlags.QuadPart);
1224  }
1225  if (ShimFlags.AppCompatFlagsUser.QuadPart)
1226  {
1227  SeiDbgPrint(SEI_MSG, NULL, "Using USER apphack flags 0x%I64x\n", ShimFlags.AppCompatFlagsUser.QuadPart);
1229  }
1230  if (ShimFlags.ProcessParameters_Flags)
1231  {
1232  SeiDbgPrint(SEI_MSG, NULL, "Using ProcessParameters flags 0x%x\n", ShimFlags.ProcessParameters_Flags);
1234  }
1235  SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Complete)\n");
1236 
1237  SHIMENG_INFO("Got %d shims\n", ARRAY_Size(&ShimRefArray));
1239 
1240  /* Walk all shims referenced (in layers + exes), and load their modules */
1241  for (n = 0; n < ARRAY_Size(&ShimRefArray); ++n)
1242  {
1243  PDB pdb;
1244  TAGID ShimRef;
1245 
1246  TAGREF tr = *ARRAY_At(&ShimRefArray, TAGREF, n);
1247 
1248  if (SdbTagRefToTagID(hsdb, tr, &pdb, &ShimRef))
1249  {
1250  LPCWSTR ShimName, DllName, CommandLine = NULL;
1251  TAGID ShimTag;
1252  WCHAR FullNameBuffer[MAX_PATH];
1253  UNICODE_STRING UnicodeDllName;
1255  PSHIMMODULE pShimModuleInfo = NULL;
1256  ANSI_STRING AnsiCommandLine = RTL_CONSTANT_STRING("");
1257  PSHIMINFO pShimInfo = NULL;
1258  PHOOKAPIEX pHookApi;
1259  DWORD dwHookCount;
1260 
1261  ShimName = SeiGetStringPtr(pdb, ShimRef, TAG_NAME);
1262  if (!ShimName)
1263  {
1264  SHIMENG_FAIL("Failed to retrieve the name for 0x%x\n", tr);
1265  continue;
1266  }
1267 
1268  CommandLine = SeiGetStringPtr(pdb, ShimRef, TAG_COMMAND_LINE);
1269  if (CommandLine && *CommandLine)
1270  {
1271  RtlInitUnicodeString(&UnicodeDllName, CommandLine);
1272  if (NT_SUCCESS(RtlUnicodeStringToAnsiString(&AnsiCommandLine, &UnicodeDllName, TRUE)))
1273  {
1274  SHIMENG_INFO("COMMAND LINE %s for %S", AnsiCommandLine.Buffer, ShimName);
1275  }
1276  else
1277  {
1278  AnsiCommandLine.Buffer = "";
1279  CommandLine = NULL;
1280  }
1281  }
1282 
1283  ShimTag = SeiGetDWORD(pdb, ShimRef, TAG_SHIM_TAGID);
1284  if (!ShimTag)
1285  {
1286  SHIMENG_FAIL("Failed to resolve %S to a shim\n", ShimName);
1287  continue;
1288  }
1289 
1290  if (!SUCCEEDED(SdbGetAppPatchDir(NULL, FullNameBuffer, ARRAYSIZE(FullNameBuffer))))
1291  {
1292  SHIMENG_WARN("Failed to get the AppPatch dir\n");
1293  continue;
1294  }
1295 
1296  DllName = SeiGetStringPtr(pdb, ShimTag, TAG_DLLFILE);
1297  if (DllName == NULL ||
1298  !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), L"\\")) ||
1299  !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), DllName)))
1300  {
1301  SHIMENG_WARN("Failed to build a full path for %S\n", ShimName);
1302  continue;
1303  }
1304 
1306  RtlInitUnicodeString(&UnicodeDllName, FullNameBuffer);
1307  if (NT_SUCCESS(LdrGetDllHandle(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1308  {
1309  /* This shim dll was already loaded, let's find it */
1310  pShimModuleInfo = SeiGetShimModuleInfo(BaseAddress);
1311  }
1312  else if (!NT_SUCCESS(LdrLoadDll(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1313  {
1314  SHIMENG_WARN("Failed to load %wZ for %S\n", &UnicodeDllName, ShimName);
1315  continue;
1316  }
1318  /* No shim module found (or we just loaded it) */
1319  if (!pShimModuleInfo)
1320  {
1321  pShimModuleInfo = SeiCreateShimModuleInfo(DllName, BaseAddress);
1322  if (!pShimModuleInfo)
1323  {
1324  SHIMENG_FAIL("Failed to allocate ShimInfo for %S\n", DllName);
1325  continue;
1326  }
1327  }
1328 
1329  SHIMENG_INFO("Shim DLL 0x%p \"%wZ\" loaded\n", BaseAddress, &UnicodeDllName);
1330  SHIMENG_INFO("Using SHIM \"%S!%S\"\n", DllName, ShimName);
1331 
1332  /* Ask this shim what hooks it needs (and pass along the commandline) */
1333  dwHookCount = 0;
1334  pHookApi = pShimModuleInfo->pGetHookAPIs(AnsiCommandLine.Buffer, ShimName, &dwHookCount);
1335  SHIMENG_INFO("GetHookAPIs returns %d hooks for DLL \"%wZ\" SHIM \"%S\"\n", dwHookCount, &UnicodeDllName, ShimName);
1336  if (dwHookCount && pHookApi)
1337  pShimInfo = SeiAppendHookInfo(pShimModuleInfo, pHookApi, dwHookCount, ShimName);
1338  else
1339  dwHookCount = 0;
1340 
1341  /* If this shim has hooks, create the include / exclude lists */
1342  if (pShimInfo)
1343  SeiBuildInclExclList(pdb, ShimTag, pShimInfo);
1344 
1345  if (CommandLine && *CommandLine)
1346  RtlFreeAnsiString(&AnsiCommandLine);
1347 
1348  dwTotalHooks += dwHookCount;
1349  }
1350  }
1351 
1352  SeiAddInternalHooks(dwTotalHooks);
1354  SeiResolveAPIs();
1356 
1357  if (ProcessInit)
1358  {
1359  /* Remove the 'LDRP_ENTRY_PROCESSED' flag from entries we modified, so that the loader can continue to process them */
1361  }
1363 }
VOID SeiResetEntryProcessed(PPEB Peb)
Definition: shimeng.c:1156
PSHIMMODULE SeiGetShimModuleInfo(PVOID BaseAddress)
Definition: shimeng.c:280
DWORD TAGREF
#define TAG_NAME
Definition: vfat.h:553
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
Definition: ldrapi.c:805
static ARRAY g_pShimInfo
Definition: shimeng.c:37
static PDB pdb
Definition: db.cpp:172
PPEB Peb
Definition: dllmain.c:27
static ARRAY g_InExclude
Definition: shimeng.c:39
const WCHAR * LPCWSTR
Definition: xmlstorage.h:185
#define TRUE
Definition: types.h:120
VOID PatchNewModules(PPEB Peb)
Definition: shimeng.c:1065
PSHIMINFO SeiAppendHookInfo(PSHIMMODULE pShimModuleInfo, PHOOKAPIEX pHookApi, DWORD dwHookCount, PCWSTR ShimName)
Definition: shimeng.c:327
ULARGE_INTEGER AppCompatFlagsUser
Definition: winternl.h:350
BOOL WINAPIV SeiDbgPrint(SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format,...)
Definition: shimeng.c:160
ULONG ProcessParameters_Flags
Definition: shimeng.h:81
HRESULT WINAPI SdbGetAppPatchDir(HSDB db, LPWSTR path, DWORD size)
Definition: hsdb.c:579
GLdouble n
Definition: glext.h:7729
static VOID SeiBuildShimRefArray(HSDB hsdb, SDBQUERYRESULT *pQuery, PARRAY pShimRef, PFLAGINFO pFlagInfo)
Definition: shimeng.c:474
#define ARRAYSIZE(array)
Definition: filtermapper.c:47
ULARGE_INTEGER AppCompatFlags
Definition: shimeng.h:79
PVOID ImageBaseAddress
Definition: ntddk_ex.h:245
#define TAG_COMMAND_LINE
Definition: db.cpp:102
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
Definition: btrfs_drv.h:1913
BOOL g_bShimEngInitialized
Definition: shimeng.c:35
STRSAFEAPI StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
Definition: strsafe.h:325
#define L(x)
Definition: ntvdm.h:50
#define TAG_DLLFILE
Definition: sdbtagid.h:137
VOID SeiInitPaths(VOID)
Definition: shimeng.c:1083
VOID SeiBuildInclExclList(PDB pdb, TAGID ShimTag, PSHIMINFO pShimInfo)
Definition: shimeng.c:942
ULONGLONG QuadPart
Definition: ms-dtyp.idl:185
if SUCCEEDED(hr)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
VOID SeiSetEntryProcessed(PPEB Peb)
Definition: shimeng.c:1105
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define TAG_SHIM_TAGID
Definition: sdbtagid.h:67
VOID SeiBuildGlobalInclExclList(HSDB hsdb)
Definition: shimeng.c:915
#define ASSERT(a)
Definition: mode.c:44
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define MAX_PATH
Definition: compat.h:34
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
VOID SeiAddInternalHooks(DWORD dwNumHooks)
Definition: shimeng.c:751
ULARGE_INTEGER AppCompatFlagsUser
Definition: shimeng.h:80
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
Definition: ldrapi.c:310
static ARRAY g_pHookArray
Definition: shimeng.c:38
static UNICODE_STRING g_LoadingShimDll
Definition: shimeng.c:31
static LPCWSTR SeiGetStringPtr(PDB pdb, TAGID tag, TAG type)
Definition: shimeng.c:401
#define NtCurrentPeb()
Definition: FLS.c:22
DWORD ItemSize__
Definition: shimeng.h:20
#define NULL
Definition: types.h:112
ULARGE_INTEGER AppCompatFlags
Definition: winternl.h:349
VOID SeiResolveAPIs(VOID)
Definition: shimeng.c:711
Definition: shimeng.h:15
#define ARRAY_Init(Array, TypeOfArray)
Definition: shimeng.c:122
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262
DWORD TAGID
VOID SeiCombineHookInfo(VOID)
Definition: shimeng.c:727
BOOL WINAPI SdbTagRefToTagID(HSDB hsdb, TAGREF trWhich, PDB *ppdb, TAGID *ptiWhich)
Definition: hsdb.c:638
static DWORD SeiGetDWORD(PDB pdb, TAGID tag, TAG type)
Definition: shimeng.c:410
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124
PSHIMMODULE SeiCreateShimModuleInfo(PCWSTR DllName, PVOID BaseAddress)
Definition: shimeng.c:294
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14
VOID SeiCheckComPlusImage(PVOID BaseAddress)
Definition: shimeng.c:271

Referenced by SE_DynamicShim(), and SE_InstallBeforeInit().

◆ SeiInitDebugSupport()

VOID SeiInitDebugSupport ( VOID  )

Definition at line 128 of file shimeng.c.

129 {
130  static const UNICODE_STRING DebugKey = RTL_CONSTANT_STRING(L"SHIMENG_DEBUG_LEVEL");
131  UNICODE_STRING DebugValue;
133  ULONG NewLevel = SEI_MSG; /* Show some basic info in the logs, unless configured different */
134  WCHAR Buffer[40];
135 
136  RtlInitEmptyUnicodeString(&DebugValue, Buffer, sizeof(Buffer));
137 
138  Status = RtlQueryEnvironmentVariable_U(NULL, &DebugKey, &DebugValue);
139 
140  if (NT_SUCCESS(Status))
141  {
142  if (!NT_SUCCESS(RtlUnicodeStringToInteger(&DebugValue, 10, &NewLevel)))
143  NewLevel = 0;
144  }
145  g_ShimEngDebugLevel = NewLevel;
146 }
LONG NTSTATUS
Definition: precomp.h:26
ULONG g_ShimEngDebugLevel
Definition: shimeng.c:32
#define L(x)
Definition: ntvdm.h:50
NTSYSAPI NTSTATUS NTAPI RtlQueryEnvironmentVariable_U(_In_opt_ PWSTR Environment, _In_ PCUNICODE_STRING Name, _Out_ PUNICODE_STRING Value)
Definition: bufpool.h:45
Status
Definition: gdiplustypes.h:24
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define NULL
Definition: types.h:112
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
unsigned int ULONG
Definition: retypes.h:1
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14

Referenced by SeiDbgPrint().

◆ SeiInitPaths()

VOID SeiInitPaths ( VOID  )

Definition at line 1083 of file shimeng.c.

1084 {
1085 #define SYSTEM32 L"\\system32"
1086 #define WINSXS L"\\winsxs"
1087 
1088  PWSTR WindowsDirectory = SdbpStrDup(SharedUserData->NtSystemRoot);
1089  RtlInitUnicodeString(&g_WindowsDirectory, WindowsDirectory);
1090 
1095 
1100 
1101 #undef SYSTEM32
1102 #undef WINSXS
1103 }
#define WINSXS
USHORT MaximumLength
Definition: env_spec_w32.h:370
uint16_t * PWSTR
Definition: typedefs.h:56
DWORD SdbpStrsize(PCWSTR string)
Definition: sdbapi.c:157
LPVOID SdbpAlloc(SIZE_T size)
Definition: sdbapi.c:55
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define SYSTEM32
static UNICODE_STRING g_SxsDirectory
Definition: shimeng.c:30
static UNICODE_STRING g_System32Directory
Definition: shimeng.c:29
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
Definition: string_lib.cpp:62
static UNICODE_STRING g_WindowsDirectory
Definition: shimeng.c:28
#define SharedUserData
PWSTR SdbpStrDup(LPCWSTR string)
Definition: sdbapi.c:162
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)

Referenced by SeiInit().

◆ SeiIsExcluded()

BOOL SeiIsExcluded ( PLDR_DATA_TABLE_ENTRY  LdrEntry,
PHOOKAPIEX  HookApi 
)

Definition at line 812 of file shimeng.c.

813 {
814  PSHIMINFO pShimInfo = HookApi->pShimInfo;
816  BOOL IsExcluded = FALSE;
817  char szOrdProcFmt[10];
818 
819  if (!pShimInfo)
820  {
821  /* Internal hook, do not exclude it */
822  return FALSE;
823  }
824 
825  /* By default, everything from System32 or WinSxs is excluded */
828  IsExcluded = TRUE;
829 
830  InExclude = SeiFindInExclude(&pShimInfo->InExclude, &LdrEntry->BaseDllName);
831  if (InExclude)
832  {
833  /* If it is on the 'exclude' list, bail out */
834  if (!InExclude->Include)
835  {
836  SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it on in the exclude list.\n",
837  &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt));
838 
839  return TRUE;
840  }
841  /* If it is on the 'include' list, override System32 / Winsxs check. */
842  if (IsExcluded)
843  {
844  SHIMENG_INFO("Module '%wZ' included for shim %S, API '%s!%s', because it is on the include list.\n",
845  &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt));
846 
847  }
848  IsExcluded = FALSE;
849  }
850 
851  if (IsExcluded)
852  {
853  SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it is in System32/WinSXS.\n",
854  &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt));
855  }
856 
857  return IsExcluded;
858 }
#define TRUE
Definition: types.h:120
bool Include
Definition: xml2sdb.h:38
#define FALSE
Definition: types.h:117
unsigned int BOOL
Definition: ntddk_ex.h:94
static UNICODE_STRING g_SxsDirectory
Definition: shimeng.c:30
static UNICODE_STRING g_System32Directory
Definition: shimeng.c:29
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
Definition: shimeng.c:218
PCWSTR ShimName
Definition: shimeng.h:50
PCSTR LibraryName
Definition: shimeng.h:31
PCSTR FunctionName
Definition: shimeng.h:32
PSHIMINFO pShimInfo
Definition: shimeng.h:35
UNICODE_STRING FullDllName
Definition: btrfs_drv.h:1882
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
ARRAY InExclude
Definition: shimeng.h:54
NTSYSAPI BOOLEAN NTAPI RtlPrefixUnicodeString(IN PUNICODE_STRING String1, IN PUNICODE_STRING String2, IN BOOLEAN CaseInSensitive)
PINEXCLUDE SeiFindInExclude(PARRAY InExclude, PCUNICODE_STRING DllName)
Definition: shimeng.c:797

Referenced by SeiHookImports().

◆ SeiIsOrdinalName()

static BOOL SeiIsOrdinalName ( LPCSTR  lpProcName)
static

Definition at line 213 of file shimeng.c.

214 {
215  return (ULONG_PTR)lpProcName <= MAXUSHORT;
216 }
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define MAXUSHORT
Definition: typedefs.h:83

Referenced by SeiCompareFunctionName(), SeiHookImports(), SeiPrintFunctionName(), and SeiResolveAPI().

◆ SeiPatchNewImport()

VOID SeiPatchNewImport ( PIMAGE_THUNK_DATA  FirstThunk,
PHOOKAPIEX  HookApi,
PLDR_DATA_TABLE_ENTRY  LdrEntry 
)

Definition at line 764 of file shimeng.c.

765 {
766  ULONG OldProtection = 0;
767  PVOID Ptr;
768  SIZE_T Size;
770  char szOrdProcFmt[10];
771 
772  SHIMENG_INFO("Hooking API \"%s!%s\" for DLL \"%wZ\"\n", HookApi->LibraryName, SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt), &LdrEntry->BaseDllName);
773 
774  Ptr = &FirstThunk->u1.Function;
775  Size = sizeof(FirstThunk->u1.Function);
777 
778  if (!NT_SUCCESS(Status))
779  {
780  SHIMENG_FAIL("Unable to unprotect 0x%p\n", &FirstThunk->u1.Function);
781  return;
782  }
783 
784  SHIMENG_INFO("changing 0x%p to 0x%p\n", FirstThunk->u1.Function, HookApi->ReplacementFunction);
785  FirstThunk->u1.Function = (ULONG_PTR)HookApi->ReplacementFunction;
786 
787  Size = sizeof(FirstThunk->u1.Function);
788  Status = NtProtectVirtualMemory(NtCurrentProcess(), &Ptr, &Size, OldProtection, &OldProtection);
789 
790  if (!NT_SUCCESS(Status))
791  {
792  SHIMENG_WARN("Unable to reprotect 0x%p\n", &FirstThunk->u1.Function);
793  }
794 }
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
Definition: virtual.c:3105
LONG NTSTATUS
Definition: precomp.h:26
IN PVOID IN PVOID IN USHORT IN USHORT Size
Definition: pci.h:361
#define NtCurrentProcess()
Definition: nt_native.h:1657
Status
Definition: gdiplustypes.h:24
union _IMAGE_THUNK_DATA32::@2092 u1
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
Definition: shimeng.c:218
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
PCSTR LibraryName
Definition: shimeng.h:31
PCSTR FunctionName
Definition: shimeng.h:32
ULONG_PTR SIZE_T
Definition: typedefs.h:80
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
PVOID ReplacementFunction
Definition: shimeng.h:33
unsigned int ULONG
Definition: retypes.h:1
#define ULONG_PTR
Definition: config.h:101
#define PAGE_EXECUTE_READWRITE
Definition: nt_native.h:1308

Referenced by SeiHookImports().

◆ SeiPrintFunctionName()

LPCSTR SeiPrintFunctionName ( LPCSTR  lpProcName,
char  szOrdProcFmt[10] 
)

Definition at line 218 of file shimeng.c.

219 {
220  if (SeiIsOrdinalName(lpProcName))
221  {
222  StringCchPrintfA(szOrdProcFmt, 10, "#%Iu", (ULONG_PTR)lpProcName);
223  return szOrdProcFmt;
224  }
225  return lpProcName;
226 }
static BOOL SeiIsOrdinalName(LPCSTR lpProcName)
Definition: shimeng.c:213
uint32_t ULONG_PTR
Definition: typedefs.h:65
STRSAFEAPI StringCchPrintfA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPCSTR pszFormat,...)
Definition: strsafe.h:520

Referenced by SeiHookImports(), SeiIsExcluded(), SeiPatchNewImport(), SeiResolveAPI(), and StubGetProcAddress().

◆ SeiReadInExclude()

VOID SeiReadInExclude ( PDB  pdb,
TAGID  parent,
PARRAY  dest 
)

Definition at line 889 of file shimeng.c.

890 {
891  TAGID InExcludeTag;
892 
893  InExcludeTag = SdbFindFirstTag(pdb, parent, TAG_INEXCLUD);
894 
895  while (InExcludeTag != TAGID_NULL)
896  {
898  TAGID ModuleTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_MODULE);
899  TAGID IncludeTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_INCLUDE);
900 
901  ModuleName = SdbGetStringTagPtr(pdb, ModuleTag);
902  if (ModuleName)
903  {
904  SeiAppendInExclude(dest, ModuleName, IncludeTag != TAGID_NULL);
905  }
906  else
907  {
908  SHIMENG_WARN("INEXCLUDE without Module: 0x%x\n", InExcludeTag);
909  }
910 
911  InExcludeTag = SdbFindNextTag(pdb, parent, InExcludeTag);
912  }
913 }
const uint16_t * PCWSTR
Definition: typedefs.h:57
VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
Definition: shimeng.c:860
#define TAG_INCLUDE
Definition: db.cpp:56
static PDB pdb
Definition: db.cpp:172
LPWSTR WINAPI SdbGetStringTagPtr(PDB pdb, TAGID tagid)
Definition: sdbread.c:375
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
Definition: acpixf.h:1278
#define TAG_INEXCLUD
Definition: db.cpp:86
#define TAG_MODULE
Definition: db.cpp:99
TAGID WINAPI SdbFindNextTag(PDB pdb, TAGID parent, TAGID prev_child)
Definition: sdbread.c:231
r parent
Definition: btrfs.c:3010
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
Definition: sdbread.c:208
#define TAGID_NULL
Definition: db.cpp:38
static char * dest
Definition: rtl.c:135
DWORD TAGID

Referenced by SeiBuildGlobalInclExclList(), and SeiBuildInclExclList().

◆ SeiResetEntryProcessed()

VOID SeiResetEntryProcessed ( PPEB  Peb)

Definition at line 1156 of file shimeng.c.

1157 {
1158  PLIST_ENTRY ListHead, Entry;
1159  PLDR_DATA_TABLE_ENTRY LdrEntry;
1160 
1161  ListHead = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1162  Entry = ListHead->Flink;
1163  while (Entry != ListHead)
1164  {
1165  LdrEntry = CONTAINING_RECORD(Entry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
1166  Entry = Entry->Flink;
1167 
1168  if (SE_IsShimDll(LdrEntry->DllBase) ||
1169  g_hInstance == LdrEntry->DllBase ||
1170  RtlEqualUnicodeString(&LdrEntry->BaseDllName, &Ntdll, TRUE) ||
1173  !(LdrEntry->Flags & LDRP_SHIMENG_SUPPRESSED_ENTRY))
1174  {
1175  SHIMENG_WARN("Don't mess with 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1176  }
1177  else
1178  {
1179  SHIMENG_WARN("Resetting 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1181  }
1182  }
1183 }
#define LDRP_ENTRY_PROCESSED
Definition: ldrtypes.h:44
struct _Entry Entry
Definition: kefuncs.h:629
#define TRUE
Definition: types.h:120
#define LDRP_SHIMENG_SUPPRESSED_ENTRY
Definition: ldrtypes.h:40
static const UNICODE_STRING Verifier
Definition: shimeng.c:25
PVOID DllBase
Definition: btrfs_drv.h:1880
static const UNICODE_STRING Ntdll
Definition: shimeng.c:23
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
static const UNICODE_STRING Kernel32
Definition: shimeng.c:24
Definition: btrfs_drv.h:1876
Definition: typedefs.h:119
#define NtCurrentPeb()
Definition: FLS.c:22
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
ULONG Flags
Definition: ntddk_ex.h:207
HMODULE g_hInstance
Definition: MainWindow.cpp:18
BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
Definition: shimeng.c:1474
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
base of all file and directory entries
Definition: entries.h:82

Referenced by SeiInit().

◆ SeiResolveAPI()

VOID SeiResolveAPI ( PHOOKMODULEINFO  HookModuleInfo)

Definition at line 665 of file shimeng.c.

666 {
667  DWORD n;
669 
670  ASSERT(HookModuleInfo->BaseAddress != NULL);
671 
672  for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
673  {
675  PVOID ProcAddress;
676  PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
677 
678  if (!SeiIsOrdinalName(HookApi->FunctionName))
679  {
681  Status = LdrGetProcedureAddress(HookModuleInfo->BaseAddress, &AnsiString, 0, &ProcAddress);
682  }
683  else
684  {
685  Status = LdrGetProcedureAddress(HookModuleInfo->BaseAddress, NULL, (ULONG_PTR)HookApi->FunctionName, &ProcAddress);
686  }
687 
688  if (!NT_SUCCESS(Status))
689  {
690  char szOrdProcFmt[10];
691  LPCSTR lpFunctionName = SeiPrintFunctionName(HookApi->FunctionName, szOrdProcFmt);
692  SHIMENG_FAIL("Unable to retrieve %s!%s\n", HookApi->LibraryName, lpFunctionName);
693  continue;
694  }
695 
696  HookApi->OriginalFunction = ProcAddress;
697  if (HookApi->ApiLink)
698  {
699  SHIMENG_MSG("TODO: Figure out how to handle conflicting In/Exports with ApiLink!\n");
700  }
701  while (HookApi->ApiLink)
702  {
703  HookApi->ApiLink->OriginalFunction = HookApi->OriginalFunction;
704  HookApi->OriginalFunction = HookApi->ApiLink->ReplacementFunction;
705  HookApi = HookApi->ApiLink;
706  }
707  }
708 }
ARRAY HookApis
Definition: shimeng.h:73
LONG NTSTATUS
Definition: precomp.h:26
GLdouble n
Definition: glext.h:7729
static BOOL SeiIsOrdinalName(LPCSTR lpProcName)
Definition: shimeng.c:213
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
uint32_t ULONG_PTR
Definition: typedefs.h:65
PVOID BaseAddress
Definition: shimeng.h:71
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
Definition: ldrapi.c:823
const char * LPCSTR
Definition: xmlstorage.h:183
Status
Definition: gdiplustypes.h:24
#define ASSERT(a)
Definition: mode.c:44
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
Definition: shimeng.c:218
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
unsigned long DWORD
Definition: ntddk_ex.h:95
PVOID OriginalFunction
Definition: shimeng.h:34
#define ARRAY_Size(Array)
Definition: shimeng.c:125
PCSTR LibraryName
Definition: shimeng.h:31
PCSTR FunctionName
Definition: shimeng.h:32
PHOOKAPIEX ApiLink
Definition: shimeng.h:36
#define NULL
Definition: types.h:112
PVOID ReplacementFunction
Definition: shimeng.h:33
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SE_DllLoaded(), and SeiResolveAPIs().

◆ SeiResolveAPIs()

VOID SeiResolveAPIs ( VOID  )

Definition at line 711 of file shimeng.c.

712 {
713  DWORD n;
714 
715  for (n = 0; n < ARRAY_Size(&g_pHookArray); ++n)
716  {
718 
719  /* Is this module loaded? */
720  if (pModuleInfo->BaseAddress)
721  {
722  SeiResolveAPI(pModuleInfo);
723  }
724  }
725 }
VOID SeiResolveAPI(PHOOKMODULEINFO HookModuleInfo)
Definition: shimeng.c:665
GLdouble n
Definition: glext.h:7729
PVOID BaseAddress
Definition: shimeng.h:71
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
static ARRAY g_pHookArray
Definition: shimeng.c:38
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124

Referenced by SeiInit().

◆ SeiSetEntryProcessed()

VOID SeiSetEntryProcessed ( PPEB  Peb)

Definition at line 1105 of file shimeng.c.

1106 {
1107  PLIST_ENTRY ListHead, Entry;
1108  PLDR_DATA_TABLE_ENTRY LdrEntry;
1109 
1110  ListHead = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1111  Entry = ListHead->Flink;
1112  while (Entry != ListHead)
1113  {
1114  LdrEntry = CONTAINING_RECORD(Entry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
1115  Entry = Entry->Flink;
1116 
1117  if (RtlEqualUnicodeString(&LdrEntry->BaseDllName, &Ntdll, TRUE) ||
1121  SE_IsShimDll(LdrEntry->DllBase) ||
1122  (LdrEntry->Flags & LDRP_ENTRY_PROCESSED))
1123  {
1124  SHIMENG_WARN("Don't mess with 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1125  }
1126  else
1127  {
1128  SHIMENG_WARN("Touching 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1130  }
1131  }
1132 
1133  ListHead = &NtCurrentPeb()->Ldr->InMemoryOrderModuleList;
1134  Entry = ListHead->Flink;
1135  SHIMENG_INFO("In memory:\n");
1136  while (Entry != ListHead)
1137  {
1138  LdrEntry = CONTAINING_RECORD(Entry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
1139  Entry = Entry->Flink;
1140 
1141  SHIMENG_INFO(" 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1142  }
1143 
1144  ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1145  Entry = ListHead->Flink;
1146  SHIMENG_INFO("In load:\n");
1147  while (Entry != ListHead)
1148  {
1149  LdrEntry = CONTAINING_RECORD(Entry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
1150  Entry = Entry->Flink;
1151 
1152  SHIMENG_INFO(" 0x%p '%wZ'\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
1153  }
1154 }
#define LDRP_ENTRY_PROCESSED
Definition: ldrtypes.h:44
struct _Entry Entry
Definition: kefuncs.h:629
#define TRUE
Definition: types.h:120
#define LDRP_SHIMENG_SUPPRESSED_ENTRY
Definition: ldrtypes.h:40
static const UNICODE_STRING Verifier
Definition: shimeng.c:25
PVOID DllBase
Definition: btrfs_drv.h:1880
static const UNICODE_STRING Ntdll
Definition: shimeng.c:23
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
static const UNICODE_STRING Kernel32
Definition: shimeng.c:24
Definition: btrfs_drv.h:1876
Definition: typedefs.h:119
static UNICODE_STRING g_LoadingShimDll
Definition: shimeng.c:31
#define NtCurrentPeb()
Definition: FLS.c:22
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
ULONG Flags
Definition: ntddk_ex.h:207
BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
Definition: shimeng.c:1474
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
base of all file and directory entries
Definition: entries.h:82

Referenced by SeiInit().

◆ SeiSetLayerEnvVar()

static VOID SeiSetLayerEnvVar ( LPCWSTR  wszLayer)
static

Definition at line 456 of file shimeng.c.

457 {
459  UNICODE_STRING VarName = RTL_CONSTANT_STRING(L"__COMPAT_LAYER");
461 
463 
465  if (NT_SUCCESS(Status))
466  SHIMENG_INFO("%wZ=%wZ\n", &VarName, &Value);
467  else
468  SHIMENG_FAIL("Failed to set %wZ: 0x%x\n", &VarName, Status);
469 }
LONG NTSTATUS
Definition: precomp.h:26
#define L(x)
Definition: ntvdm.h:50
static PCWSTR wszLayer
Definition: layerapi.c:36
NTSYSAPI NTSTATUS NTAPI RtlSetEnvironmentVariable(_In_z_ PWSTR *Environment, _In_ PUNICODE_STRING Name, _In_ PUNICODE_STRING Value)
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
Definition: wdfregistry.h:406
Status
Definition: gdiplustypes.h:24
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define NULL
Definition: types.h:112
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RTL_CONSTANT_STRING(s)
Definition: tunneltest.c:14

Referenced by SeiBuildShimRefArray().

◆ StubGetProcAddress()

FARPROC WINAPI StubGetProcAddress ( HINSTANCE  hModule,
LPCSTR  lpProcName 
)

Definition at line 628 of file shimeng.c.

629 {
630  PVOID Addr = _ReturnAddress();
631  PHOOKMODULEINFO HookModuleInfo;
632  FARPROC proc = ((GETPROCADDRESSPROC)g_IntHookEx[0].OriginalFunction)(hModule, lpProcName);
633  char szOrdProcFmt[10];
634 
635  Addr = SeiGetModuleFromAddress(Addr);
636  if (SE_IsShimDll(Addr))
637  {
638  SHIMENG_MSG("Not touching GetProcAddress for shim dll (%p!%s)", hModule, SeiPrintFunctionName(lpProcName, szOrdProcFmt));
639  return proc;
640  }
641 
642  SHIMENG_INFO("(GetProcAddress(%p!%s) => %p\n", hModule, SeiPrintFunctionName(lpProcName, szOrdProcFmt), proc);
643 
644  HookModuleInfo = SeiFindHookModuleInfo(NULL, hModule);
645 
646  if (HookModuleInfo)
647  {
648  DWORD n;
649  for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
650  {
651  PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
652  int CmpResult = SeiCompareFunctionName(lpProcName, HookApi->FunctionName);
653  if (CmpResult == 0)
654  {
655  SHIMENG_MSG("Redirecting %p to %p\n", proc, HookApi->ReplacementFunction);
656  proc = HookApi->ReplacementFunction;
657  break;
658  }
659  }
660  }
661 
662  return proc;
663 }
ARRAY HookApis
Definition: shimeng.h:73
PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
Definition: shimeng.c:352
GLdouble n
Definition: glext.h:7729
static HANDLE proc()
Definition: pdb.c:34
int SeiCompareFunctionName(LPCSTR lpProcName1, LPCSTR lpProcName2)
Definition: shimeng.c:228
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
Definition: shimeng.c:218
unsigned long DWORD
Definition: ntddk_ex.h:95
#define ARRAY_Size(Array)
Definition: shimeng.c:125
FARPROC(WINAPI * GETPROCADDRESSPROC)(HINSTANCE, LPCSTR)
Definition: shimeng.c:41
PCSTR FunctionName
Definition: shimeng.h:32
#define NULL
Definition: types.h:112
PVOID ReplacementFunction
Definition: shimeng.h:33
void * _ReturnAddress(void)
HOOKAPIEX g_IntHookEx[]
Definition: shimeng.c:43
PVOID SeiGetModuleFromAddress(PVOID addr)
Definition: shimeng.c:246
BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
Definition: shimeng.c:1474
#define ARRAY_At(Array, TypeOfArray, at)
Definition: shimeng.c:124
int(* FARPROC)()
Definition: compat.h:36
HMODULE hModule
Definition: animate.c:44

Variable Documentation

◆ g_bComPlusImage

BOOL g_bComPlusImage = FALSE

Definition at line 33 of file shimeng.c.

Referenced by SeiCheckComPlusImage().

◆ g_bInternalHooksUsed

BOOL g_bInternalHooksUsed = FALSE

Definition at line 36 of file shimeng.c.

Referenced by SeiAddInternalHooks().

◆ g_bShimDuringInit

BOOL g_bShimDuringInit = FALSE

Definition at line 34 of file shimeng.c.

Referenced by SE_DllLoaded(), SE_DynamicShim(), and SE_InstallBeforeInit().

◆ g_bShimEngInitialized

BOOL g_bShimEngInitialized = FALSE

Definition at line 35 of file shimeng.c.

Referenced by SE_DynamicShim(), and SeiInit().

◆ g_hInstance

HMODULE g_hInstance

Definition at line 18 of file MainWindow.cpp.

Referenced by SE_DynamicShim(), SeiHookImports(), and SeiResetEntryProcessed().

◆ g_InExclude

ARRAY g_InExclude
static

Definition at line 39 of file shimeng.c.

Referenced by SeiBuildGlobalInclExclList(), SeiBuildInclExclList(), and SeiInit().

◆ g_IntHookEx

HOOKAPIEX g_IntHookEx[]
Initial value:
=
{
{
"kernel32.dll",
"GetProcAddress",
NULL,
NULL,
},
}
FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName)
Definition: shimeng.c:628
#define NULL
Definition: types.h:112

Definition at line 43 of file shimeng.c.

Referenced by SeiAddInternalHooks(), and StubGetProcAddress().

◆ g_LoadingShimDll

UNICODE_STRING g_LoadingShimDll
static

Definition at line 31 of file shimeng.c.

Referenced by SeiHookImports(), SeiInit(), and SeiSetEntryProcessed().

◆ g_pHookArray

ARRAY g_pHookArray
static

Definition at line 38 of file shimeng.c.

Referenced by SeiAddHooks(), SeiFindHookModuleInfo(), SeiInit(), and SeiResolveAPIs().

◆ g_pShimInfo

ARRAY g_pShimInfo
static

◆ g_ShimEngDebugLevel

ULONG g_ShimEngDebugLevel = 0xffffffff

Definition at line 32 of file shimeng.c.

Referenced by SeiDbgPrint(), and SeiInitDebugSupport().

◆ g_SxsDirectory

UNICODE_STRING g_SxsDirectory
static

Definition at line 30 of file shimeng.c.

Referenced by SeiInitPaths(), and SeiIsExcluded().

◆ g_System32Directory

UNICODE_STRING g_System32Directory
static

Definition at line 29 of file shimeng.c.

Referenced by SeiInitPaths(), and SeiIsExcluded().

◆ g_WindowsDirectory

UNICODE_STRING g_WindowsDirectory
static

Definition at line 28 of file shimeng.c.

Referenced by SeiInitPaths().

◆ Kernel32

const UNICODE_STRING Kernel32 = RTL_CONSTANT_STRING(L"kernel32.dll")
static

Definition at line 24 of file shimeng.c.

Referenced by SeiResetEntryProcessed(), and SeiSetEntryProcessed().

◆ Ntdll

const UNICODE_STRING Ntdll = RTL_CONSTANT_STRING(L"ntdll.dll")
static

Definition at line 23 of file shimeng.c.

Referenced by SeiResetEntryProcessed(), and SeiSetEntryProcessed().

◆ Verifier

const UNICODE_STRING Verifier = RTL_CONSTANT_STRING(L"verifier.dll")
static

Definition at line 25 of file shimeng.c.

Referenced by SeiResetEntryProcessed(), and SeiSetEntryProcessed().