8 #define WIN32_NO_STATUS 14 #define APPHELP_NOSDBPAPI 79 SHIMENG_FAIL(
"Failed to allocate %d bytes\n",
Count *
ItemSize);
121 #define ARRAY_Init(Array, TypeOfArray) ARRAY_InitWorker((Array), sizeof(TypeOfArray)) 122 #define ARRAY_Append(Array, TypeOfArray) (TypeOfArray*)ARRAY_AppendWorker((Array), sizeof(TypeOfArray), 5) 123 #define ARRAY_At(Array, TypeOfArray, at) (TypeOfArray*)ARRAY_AtWorker((Array), sizeof(TypeOfArray), at) 124 #define ARRAY_Size(Array) (Array)->Size__ 135 RtlInitEmptyUnicodeString(&DebugValue,
Buffer,
sizeof(
Buffer));
163 const char* LevelStr;
241 return strcmp(lpProcName1, lpProcName2);
261 if (!pShimModule->pNotifyShims)
272 ULONG ComSectionSize;
275 SHIMENG_INFO(
"COM+ executable %s\n",
g_bComPlusImage ?
"TRUE" :
"FALSE");
303 SHIMENG_WARN(
"Failed to resolve entry points for %S\n", DllName);
319 Data->pNotifyShims = pNotifyShims;
344 Data->pHookApi = pHookApi;
345 Data->dwHookCount = dwHookCount;
346 Data->pShimModule = pShimModuleInfo;
382 SHIMENG_FAIL(
"Unable to convert dll name to unicode\n");
390 SHIMENG_FAIL(
"Unable to get module handle for %wZ (%p)\n", &DllName, DllBase);
465 SHIMENG_INFO(
"%wZ=%wZ\n", &VarName, &
Value);
467 SHIMENG_FAIL(
"Failed to set %wZ: 0x%x\n", &VarName,
Status);
470 #define MAX_LAYER_LENGTH 256 524 if (wszLayerEnvVar[0])
529 SHIMENG_FAIL(
"Unable to append %S\n", LayerName);
550 if (wszLayerEnvVar[0])
561 RtlInitEmptyUnicodeString(&UnicodeModName, Buf,
sizeof(Buf));
563 for (
n = 0;
n < dwHookCount; ++
n)
574 SHIMENG_FAIL(
"Unable to convert %s to Unicode\n",
hook->LibraryName);
599 hook->pShimInfo = pShim;
632 char szOrdProcFmt[10];
689 char szOrdProcFmt[10];
691 SHIMENG_FAIL(
"Unable to retrieve %s!%s\n", HookApi->
LibraryName, lpFunctionName);
698 SHIMENG_MSG(
"TODO: Figure out how to handle conflicting In/Exports with ApiLink!\n");
737 for (
n = 0;
n < dwShimCount; ++
n)
765 ULONG OldProtection = 0;
769 char szOrdProcFmt[10];
779 SHIMENG_FAIL(
"Unable to unprotect 0x%p\n", &FirstThunk->
u1.
Function);
791 SHIMENG_WARN(
"Unable to reprotect 0x%p\n", &FirstThunk->
u1.
Function);
816 char szOrdProcFmt[10];
835 SHIMENG_INFO(
"Module '%wZ' excluded for shim %S, API '%s!%s', because it on in the exclude list.\n",
843 SHIMENG_INFO(
"Module '%wZ' included for shim %S, API '%s!%s', because it is on the include list.\n",
852 SHIMENG_INFO(
"Module '%wZ' excluded for shim %S, API '%s!%s', because it is in System32/WinSXS.\n",
901 SHIMENG_WARN(
"INEXCLUDE without Module: 0x%x\n", InExcludeTag);
916 SHIMENG_WARN(
"Unable to resolve database root\n");
922 SHIMENG_WARN(
"Unable to resolve database\n");
928 SHIMENG_WARN(
"Unable to resolve library\n");
961 SHIMENG_INFO(
"Skipping shim module 0x%p \"%wZ\"\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
967 SHIMENG_INFO(
"Skipping module 0x%p \"%wZ\" because it was already processed\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
972 if (!ImportDescriptor)
974 SHIMENG_INFO(
"Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
978 SHIMENG_INFO(
"Hooking module 0x%p \"%wZ\"\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
1040 char szOrdProcFmt[10];
1063 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1064 ListEntry = ListHead->
Flink;
1066 while (ListHead != ListEntry)
1071 ListEntry = ListEntry->
Flink;
1078 #define SYSTEM32 L"\\system32" 1079 #define WINSXS L"\\winsxs" 1103 ListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1105 while (
Entry != ListHead)
1117 SHIMENG_WARN(
"Don't mess with 0x%p '%wZ'\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
1126 ListHead = &
NtCurrentPeb()->Ldr->InMemoryOrderModuleList;
1128 SHIMENG_INFO(
"In memory:\n");
1129 while (
Entry != ListHead)
1137 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1139 SHIMENG_INFO(
"In load:\n");
1140 while (
Entry != ListHead)
1154 ListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1156 while (
Entry != ListHead)
1168 SHIMENG_WARN(
"Don't mess with 0x%p '%wZ'\n", LdrEntry->
DllBase, &LdrEntry->
BaseDllName);
1182 DWORD dwTotalHooks = 0;
1227 SHIMENG_INFO(
"Got %d shims\n",
ARRAY_Size(&ShimRefArray));
1254 SHIMENG_FAIL(
"Failed to retrieve the name for 0x%x\n", tr);
1259 if (CommandLine && *CommandLine)
1264 SHIMENG_INFO(
"COMMAND LINE %s for %S", AnsiCommandLine.
Buffer, ShimName);
1268 AnsiCommandLine.
Buffer =
"";
1276 SHIMENG_FAIL(
"Failed to resolve %S to a shim\n", ShimName);
1282 SHIMENG_WARN(
"Failed to get the AppPatch dir\n");
1287 if (DllName ==
NULL ||
1291 SHIMENG_WARN(
"Failed to build a full path for %S\n", ShimName);
1304 SHIMENG_WARN(
"Failed to load %wZ for %S\n", &UnicodeDllName, ShimName);
1309 if (!pShimModuleInfo)
1312 if (!pShimModuleInfo)
1314 SHIMENG_FAIL(
"Failed to allocate ShimInfo for %S\n", DllName);
1319 SHIMENG_INFO(
"Shim DLL 0x%p \"%wZ\" loaded\n",
BaseAddress, &UnicodeDllName);
1320 SHIMENG_INFO(
"Using SHIM \"%S!%S\"\n", DllName, ShimName);
1324 pHookApi = pShimModuleInfo->pGetHookAPIs(AnsiCommandLine.
Buffer, ShimName, &dwHookCount);
1325 SHIMENG_INFO(
"GetHookAPIs returns %d hooks for DLL \"%wZ\" SHIM \"%S\"\n", dwHookCount, &UnicodeDllName, ShimName);
1326 if (dwHookCount && pHookApi)
1327 pShimInfo =
SeiAppendHookInfo(pShimModuleInfo, pHookApi, dwHookCount, ShimName);
1335 if (CommandLine && *CommandLine)
1338 dwTotalHooks += dwHookCount;
1372 PathDivider +=
sizeof(
WCHAR);
1375 ProcessName.
Length = ProcessImage->
Length - PathDivider;
1382 SHIMENG_MSG(
"Not shimming %wZ\n", ForbiddenShimmingApps +
n);
1407 SHIMENG_INFO(
"(%wZ, %p)\n", ProcessImage, pShimData);
1409 if (!
SeiGetShimData(ProcessImage, pShimData, &hsdb, &QueryResult))
1411 SHIMENG_FAIL(
"Failed to get shim data\n");
1416 SeiInit(ProcessImage, hsdb, &QueryResult);
1429 SHIMENG_MSG(
"()\n");
1453 SHIMENG_INFO(
"(%p)\n", LdrEntry);
#define RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END
VOID SeiResetEntryProcessed(PPEB Peb)
PSHIMMODULE SeiGetShimModuleInfo(PVOID BaseAddress)
#define LDRP_ENTRY_PROCESSED
VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT *pQuery)
static BOOL ARRAY_InitWorker(PARRAY Array, DWORD ItemSize)
VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
_In_ ULONG _In_ ULONG _In_ ULONG Length
_In_ CDROM_SCAN_FOR_SPECIAL_INFO _In_ PCDROM_SCAN_FOR_SPECIAL_HANDLER Function
STRSAFEAPI StringCchVPrintfExA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPSTR *ppszDestEnd, size_t *pcchRemaining, STRSAFE_DWORD dwFlags, STRSAFE_LPCSTR pszFormat, va_list argList)
IN BOOLEAN OUT PSTR Buffer
VOID SeiResolveAPI(PHOOKMODULEINFO HookModuleInfo)
VOID PatchNewModules(PPEB Peb)
PSHIMINFO SeiAppendHookInfo(PSHIMMODULE pShimModuleInfo, PHOOKAPIEX pHookApi, DWORD dwHookCount, PCWSTR ShimName)
ULARGE_INTEGER AppCompatFlagsUser
BOOL WINAPIV SeiDbgPrint(SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format,...)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG _In_opt_ PVOID Data
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
DWORD WINAPI SdbReadDWORDTag(PDB pdb, TAGID tagid, DWORD ret)
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
HSDB WINAPI SdbInitDatabase(DWORD, LPCWSTR)
ULONG ProcessParameters_Flags
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
VOID WINAPI SE_DllLoaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
#define LDRP_SHIMENG_SUPPRESSED_ENTRY
PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
HRESULT WINAPI SdbGetAppPatchDir(HSDB db, LPWSTR path, DWORD size)
VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
LPWSTR WINAPI SdbGetStringTagPtr(PDB pdb, TAGID tagid)
static VOID SeiBuildShimRefArray(HSDB hsdb, SDBQUERYRESULT *pQuery, PARRAY pShimRef, PFLAGINFO pFlagInfo)
ULONG g_ShimEngDebugLevel
ULARGE_INTEGER AppCompatFlags
IN PVOID IN PVOID IN USHORT IN USHORT Size
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR Level
BOOL SeiIsExcluded(PLDR_DATA_TABLE_ENTRY LdrEntry, PHOOKAPIEX HookApi)
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
#define TAG_FLAG_PROCESSPARAM
#define ARRAY_Append(Array, TypeOfArray)
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
PVOID NTAPI RtlPcToFileHeader(IN PVOID PcValue, PVOID *BaseOfImage)
DWORD SdbpStrsize(PCWSTR string)
STRSAFEAPI StringCchPrintfExA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPSTR *ppszDestEnd, size_t *pcchRemaining, STRSAFE_DWORD dwFlags, STRSAFE_LPCSTR pszFormat,...)
LPVOID SdbpAlloc(SIZE_T size)
static BOOL SeiIsOrdinalName(LPCSTR lpProcName)
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
STRSAFEAPI StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
static const UNICODE_STRING Verifier
PHOOKAPI WINAPI GetHookAPIs(IN LPCSTR szCommandLine, IN LPCWSTR wszShimName, OUT PDWORD pdwHookCount)
#define SDB_DATABASE_MAIN_SHIM
NTSTATUS NTAPI RtlFindCharInUnicodeString(_In_ ULONG Flags, _In_ PCUNICODE_STRING SearchString, _In_ PCUNICODE_STRING MatchString, _Out_ PUSHORT Position)
_Must_inspect_result_ _In_ WDFCHILDLIST _In_ PWDF_CHILD_LIST_ITERATOR _Out_ WDFDEVICE _Inout_opt_ PWDF_CHILD_RETRIEVE_INFO Info
static const UNICODE_STRING Ntdll
VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
VOID SeiBuildInclExclList(PDB pdb, TAGID ShimTag, PSHIMINFO pShimInfo)
static BOOL ARRAY_EnsureSize(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
#define LDRP_COMPAT_DATABASE_PROCESSED
int SeiCompareFunctionName(LPCSTR lpProcName1, LPCSTR lpProcName2)
#define TAG_FLAG_MASK_KERNEL
QWORD WINAPI SdbReadQWORDTag(PDB pdb, TAGID tagid, QWORD ret)
VOID NTAPI SE_InstallBeforeInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
STRSAFEAPI StringCchPrintfA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPCSTR pszFormat,...)
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
NTSYSAPI NTSTATUS NTAPI RtlQueryEnvironmentVariable_U(_In_opt_ PWSTR Environment, _In_ PCUNICODE_STRING Name, _Out_ PUNICODE_STRING Value)
NTSYSAPI NTSTATUS NTAPI RtlSetEnvironmentVariable(_In_z_ PWSTR *Environment, _In_ PUNICODE_STRING Name, _In_ PUNICODE_STRING Value)
NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz(_Out_ PUNICODE_STRING Destination, _In_ PCSZ Source)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
VOID SeiSetEntryProcessed(PPEB Peb)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
#define SHIM_NOTIFY_ATTACH
union _IMAGE_THUNK_DATA32::@2123 u1
static UNICODE_STRING g_SxsDirectory
#define NtCurrentProcess()
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
static UNICODE_STRING g_System32Directory
TAGID WINAPI SdbFindNextTag(PDB pdb, TAGID parent, TAGID prev_child)
VOID NTAPI SE_ProcessDying(VOID)
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
struct _LIST_ENTRY * Flink
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
macro IMPORT Name endm macro EXPORT Name global &Name endm macro TEXTAREA section rx align endm macro DATAAREA section rw endm macro RODATAAREA section rw endm macro NESTED_ENTRY Name FuncName equ &Name PrologName equ &Name &_Prolog FuncEndName equ &Name &_end global &FuncName align func &FuncName & FuncName
VOID SeiBuildGlobalInclExclList(HSDB hsdb)
LPCSTR SeiPrintFunctionName(LPCSTR lpProcName, char szOrdProcFmt[10])
#define NT_SUCCESS(StatCode)
BOOL SeiGetShimData(PUNICODE_STRING ProcessImage, PVOID pShimData, HSDB *pHsdb, SDBQUERYRESULT *pQuery)
static const UNICODE_STRING Kernel32
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
static tGETHOOKAPIS pGetHookAPIs
TAGID WINAPI SdbFindFirstTag(PDB pdb, TAGID parent, TAG tag)
static UNICODE_STRING g_WindowsDirectory
#define ARRAY_Size(Array)
NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
VOID SeiAddInternalHooks(DWORD dwNumHooks)
GLenum const GLvoid * addr
ULARGE_INTEGER AppCompatFlagsUser
#define RtlImageDirectoryEntryToData
void WINAPI SdbReleaseDatabase(HSDB)
#define memcpy(s1, s2, n)
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
BOOL WINAPI SdbTagIDToTagRef(HSDB hsdb, PDB pdb, TAGID tiWhich, TAGREF *ptrWhich)
#define SHIM_NOTIFY_DETACH
PWSTR SdbpStrDup(LPCWSTR string)
VOID SeiPatchNewImport(PIMAGE_THUNK_DATA FirstThunk, PHOOKAPIEX HookApi, PLDR_DATA_TABLE_ENTRY LdrEntry)
static PVOID ARRAY_AtWorker(PARRAY Array, DWORD ItemSize, DWORD n)
static QWORD SeiGetQWORD(PDB pdb, TAGID tag, TAG type)
FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName)
FARPROC(WINAPI * GETPROCADDRESSPROC)(HINSTANCE, LPCSTR)
static ARRAY g_pHookArray
enum _SEI_LOG_LEVEL SEI_LOG_LEVEL
static UNICODE_STRING g_LoadingShimDll
static LPCWSTR SeiGetStringPtr(PDB pdb, TAGID tag, TAG type)
#define SHIM_REASON_DLL_UNLOAD
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor(PBYTE DllBase, PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor)
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
VOID SeiAddHooks(PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
VOID NotifyShims(DWORD dwReason, PVOID Info)
NTSYSAPI BOOLEAN NTAPI RtlPrefixUnicodeString(IN PUNICODE_STRING String1, IN PUNICODE_STRING String2, IN BOOLEAN CaseInSensitive)
PVOID ReplacementFunction
ULARGE_INTEGER AppCompatFlags
static PVOID ARRAY_AppendWorker(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
PINEXCLUDE SeiFindInExclude(PARRAY InExclude, PCUNICODE_STRING DllName)
#define IMAGE_DIRECTORY_ENTRY_IMPORT
VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest)
VOID SeiResolveAPIs(VOID)
void * _ReturnAddress(void)
#define STRSAFE_NULL_ON_FAILURE
#define ARRAY_Init(Array, TypeOfArray)
BOOL g_bInternalHooksUsed
#define SHIM_REASON_DLL_LOAD
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
int strcmp(const char *String1, const char *String2)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
static VOID SeiAddFlag(PDB pdb, TAGID tiFlagRef, PFLAGINFO pFlagInfo)
static VOID SeiAddShim(TAGREF trShimRef, PARRAY pShimRef)
#define PAGE_EXECUTE_READWRITE
GLuint GLuint GLsizei GLenum type
#define IMAGE_ORDINAL(Ordinal)
#define TAG_FLAG_MASK_USER
VOID SeiCombineHookInfo(VOID)
VOID SeiInitDebugSupport(VOID)
TW_UINT32 TW_UINT16 TW_UINT16 TW_MEMREF pData
BOOL WINAPI SdbUnpackAppCompatData(HSDB hsdb, LPCWSTR pszImageName, PVOID pData, PSDBQUERYRESULT pQueryResult)
PVOID SeiGetModuleFromAddress(PVOID addr)
BOOL WINAPI SdbTagRefToTagID(HSDB hsdb, TAGREF trWhich, PDB *ppdb, TAGID *ptiWhich)
BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
static DWORD SeiGetDWORD(PDB pdb, TAGID tag, TAG type)
#define ARRAY_At(Array, TypeOfArray, at)
base of all file and directory entries
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
static VOID SeiSetLayerEnvVar(LPCWSTR wszLayer)
PSHIMMODULE SeiCreateShimModuleInfo(PCWSTR DllName, PVOID BaseAddress)
#define RTL_CONSTANT_STRING(s)
VOID SeiCheckComPlusImage(PVOID BaseAddress)