16#define MODULE_INVOLVED_IN_ARM3
41#define DEFAULT_SECURITY_COOKIE 0x00002B992DDFA232ll
43#define DEFAULT_SECURITY_COOKIE 0xBB40E64E
72 return DebugDirectory;
92 PMMPTE PointerPte, LastPte;
148 DPRINT1(
"MmMapViewOfSection failed with status 0x%x\n",
Status);
158 DPRINT1(
"MiReserveSystemPtes failed\n");
164 LastPte = PointerPte + PteCount;
168 *ImageBase = DriverBase;
169 DPRINT1(
"Loading: %wZ at %p with %lx pages\n",
FileName, DriverBase, PteCount);
176 while (PointerPte < LastPte)
236 if (!ExportDirectory)
return NULL;
252 Ret =
strcmp(ExportName, (
PCHAR)DllBase + NameTable[Mid]);
274 Ordinal = OrdinalTable[Mid];
299 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");
313 ImportName.
Length = LdrEntry->BaseDllName.Length;
314 ImportName.
MaximumLength = LdrEntry->BaseDllName.MaximumLength;
315 ImportName.
Buffer = LdrEntry->BaseDllName.Buffer;
345 DPRINT(
"Calling DllInit(%wZ)\n", &RegPath);
346 Status = DllInit(&RegPath);
372 ASSERT(LdrEntry->LoadCount == 0);
373 LdrEntry->LoadCount = 1;
387 PVOID CurrentImports;
393 (ImportList->Count == 0))
403 SingleEntry.
Count = 1;
407 ImportList = &SingleEntry;
411 for (
i = 0; (
i < ImportList->Count) && (ImportList->Entry[
i]);
i++)
414 LdrEntry = ImportList->Entry[
i];
495 if (!ExportDirectory)
return NULL;
511 Ret =
strcmp(ExportName->Buffer, (
PCHAR)DllBase + NameTable[Mid]);
533 Ordinal = OrdinalTable[Mid];
598#ifdef _WORKING_LINKER_
609 for (NextEntry = LoaderBlock->LoadOrderListHead.
Flink;
610 NextEntry != &LoaderBlock->LoadOrderListHead;
611 NextEntry = NextEntry->
Flink)
617#ifdef _WORKING_LINKER_
623 if (!ImageThunk)
continue;
627 for (
i = 0;
i < ImportSize;
i++, ImageThunk++)
630 if ((*ImageThunk >= (
ULONG_PTR)OldBase) && (*ImageThunk <= OldBaseTop))
633 DPRINT(
"[Mm0]: Updating IAT at: %p. Old Entry: %p. New Entry: %p.\n",
634 ImageThunk, *ImageThunk, *ImageThunk +
Delta);
635 *ImageThunk +=
Delta;
644 if (!ImportDescriptor)
continue;
648 while ((ImportDescriptor->
Name) &&
657 if ((*ImageThunk >= (
ULONG_PTR)OldBase) && (*ImageThunk <= OldBaseTop))
660 DPRINT(
"[Mm0]: Updating IAT at: %p. Old Entry: %p. New Entry: %p.\n",
661 ImageThunk, *ImageThunk, *ImageThunk +
Delta);
662 *ImageThunk +=
Delta;
696 PCHAR MissingForwarder;
703 ULONG ForwardExportSize;
712 if ((IsOrdinal) && !(SnapForwarder))
716 ExportDirectory->Base);
722 if (!SnapForwarder)
Name->u1.AddressOfData += (
ULONG_PTR)ImageBase;
731 DPRINT(
"Import name: %s\n", NameImport->
Name);
733 ExportDirectory->AddressOfNames);
735 ExportDirectory->AddressOfNameOrdinals);
738 Hint = NameImport->
Hint;
739 if ((Hint < ExportDirectory->NumberOfNames) &&
743 Ordinal = OrdinalTable[Hint];
748 High = ExportDirectory->NumberOfNames - 1;
776 DPRINT1(
"Warning: Driver failed to load, %s not found\n", NameImport->
Name);
781 Ordinal = OrdinalTable[Mid];
786 if (Ordinal >= ExportDirectory->NumberOfFunctions)
794 MissingForwarder = NameBuffer;
798 ExportDirectory->AddressOfFunctions);
842 ForwardExportDirectory =
847 if (!ForwardExportDirectory)
break;
853 sizeof(*ForwardName) +
856 if (!ForwardName)
break;
862 ForwardName->
Hint = 0;
872 ForwardExportDirectory,
884 NextEntry = NextEntry->
Flink;
995 PCHAR MissingApiBuffer = *MissingApi, ImportName;
997 ULONG ImportSize, ImportCount = 0, LoadedImportsSize, ExportSize;
999 ULONG GdiLink, NormalLink,
i;
1004 PVOID ImportBase, DllBase;
1010 DPRINT(
"%s - ImageBase: %p. ImageFileDirectory: %wZ\n",
1027 for (CurrentImport = ImportDescriptor;
1039 LoadedImportsSize = ImportCount *
sizeof(
PVOID) +
sizeof(
SIZE_T);
1047 LoadedImports->
Count = ImportCount;
1053 LoadedImports =
NULL;
1057 ImportCount = GdiLink = NormalLink = 0;
1065 !(
_strnicmp(ImportName,
"win32k",
sizeof(
"win32k") - 1));
1068 NormalLink = NormalLink |
1069 ((
_strnicmp(ImportName,
"win32k",
sizeof(
"win32k") - 1)) &&
1070 (
_strnicmp(ImportName,
"dxapi",
sizeof(
"dxapi") - 1)) &&
1071 (
_strnicmp(ImportName,
"coverage",
sizeof(
"coverage") - 1)) &&
1072 (
_strnicmp(ImportName,
"irt",
sizeof(
"irt") - 1)));
1075 if ((GdiLink) && (NormalLink))
1083 if (!(
_strnicmp(ImportName,
"ntdll",
sizeof(
"ntdll") - 1)) ||
1084 !(
_strnicmp(ImportName,
"winsrv",
sizeof(
"winsrv") - 1)) ||
1085 !(
_strnicmp(ImportName,
"advapi32",
sizeof(
"advapi32") - 1)) ||
1086 !(
_strnicmp(ImportName,
"kernel32",
sizeof(
"kernel32") - 1)) ||
1087 !(
_strnicmp(ImportName,
"user32",
sizeof(
"user32") - 1)) ||
1088 !(
_strnicmp(ImportName,
"gdi32",
sizeof(
"gdi32") - 1)))
1096 if (!(
_strnicmp(ImportName,
"ntoskrnl",
sizeof(
"ntoskrnl") - 1)) ||
1097 !(
_strnicmp(ImportName,
"win32k",
sizeof(
"win32k") - 1)) ||
1098 !(
_strnicmp(ImportName,
"hal",
sizeof(
"hal") - 1)))
1101 ReferenceNeeded =
FALSE;
1106 ReferenceNeeded =
TRUE;
1119 if (NamePrefix)
DPRINT1(
"Name Prefix not yet supported!\n");
1139 ImportBase = LdrEntry->
DllBase;
1142 if (!(
Loaded) && (ReferenceNeeded))
1157 NextEntry = NextEntry->
Flink;
1165 ImageFileDirectory->Length +
1230 *MissingDriver = DllName.
Buffer;
1231 *(
PULONG)MissingDriver |= 1;
1234 DPRINT1(
"Failed to load dependency: %wZ\n", &DllName);
1251 ASSERT(DllBase == DllEntry->DllBase);
1268 if ((ReferenceNeeded) && (LoadedImports))
1274 LoadedImports->
Entry[ImportCount] = LdrEntry;
1288 if (!ExportDirectory)
1291 DPRINT1(
"Warning: Driver failed to load, %S not found\n", *MissingDriver);
1324 *MissingApi = MissingApiBuffer;
1337 for (
i = 0;
i < LoadedImports->
Count;
i++)
1339 if (LoadedImports->
Entry[
i])
1355 else if (ImportCount == 1)
1361 else if (ImportCount != LoadedImports->
Count)
1364 LoadedImportsSize = ImportCount *
sizeof(
PVOID) +
sizeof(
SIZE_T);
1371 NewImports->
Count = 0;
1374 for (
i = 0;
i < LoadedImports->
Count;
i++)
1377 if (LoadedImports->
Entry[
i])
1381 NewImports->
Count++;
1387 LoadedImports = NewImports;
1392 *LoadImports = LoadedImports;
1442 ULONG_PTR DllBase, InitStart, InitEnd, ImageEnd, InitCode;
1477 NextEntry = NextEntry->
Flink;
1486 NextEntry = NextEntry->
Flink;
1494 while (SectionCount > 0)
1505 InitSection = Section;
1525 if (SectionCount == 1)
1528 LastSection = Section;
1542 LastSection = Section;
1550 while (SectionCount > 1);
1563 if (SectionCount != 1)
1576 if (InitStart < InitEnd)
1579 if ((InitCode >= InitStart) && (InitCode < InitEnd))
1583 *StartVa = (
PVOID)InitStart;
1584 *EndVa = (
PVOID)InitEnd;
1590 DPRINT(
"Freeing init code: %p-%p ('%wZ' @%p : '%s')\n",
1607 NextEntry = NextEntry->
Flink;
1632 DllBase = LdrEntry->DllBase;
1633 PageCount = LdrEntry->SizeOfImage >>
PAGE_SHIFT;
1640 if (!NtHeader)
return;
1644 DiscardSection =
NULL;
1652 DiscardSection = Section;
1662 if (!DiscardSection)
return;
1671 if (!PageCount)
return;
1689 PVOID DllBase, NewImageAddress;
1691 PMMPTE PointerPte, StartPte, LastPte;
1697 for (NextEntry = LoaderBlock->LoadOrderListHead.
Flink;
1698 NextEntry != &LoaderBlock->LoadOrderListHead;
1699 NextEntry = NextEntry->
Flink)
1708 DPRINT(
"[Mm0]: Driver at: %p ending at: %p for module: %wZ\n",
1716 LastPte = StartPte + PteCount;
1720 while (PointerPte < LastPte)
1733 if (
i <= 4)
continue;
1736 if (!NtHeader)
continue;
1750 ValidRelocs =
FALSE;
1770 PointerPte = StartPte;
1771 while (PointerPte < LastPte)
1788 ERROR_FATAL(
"[Mm0]: Couldn't allocate driver section!\n");
1793 LastPte = PointerPte + PteCount;
1797 DPRINT(
"[Mm0]: Copying from: %p to: %p\n", DllBase, NewImageAddress);
1802 while (PointerPte < LastPte)
1820 PointerPte -= PteCount;
1847 LdrEntry->
DllBase = NewImageAddress;
1877 ULONG LoadedImportsSize, ImportSize;
1884 KernelEntry = HalEntry = LastEntry =
NULL;
1899 KernelEntry = LdrEntry;
1904 HalEntry = LdrEntry;
1911 if ((LdrEntry == HalEntry) || (LdrEntry == KernelEntry))
1932 NextEntry = NextEntry->
Flink;
1951#ifdef _WORKING_LOADER_
1964 if (!ImportDescriptor)
1969 NextEntry = NextEntry->
Flink;
1975#ifdef _WORKING_LOADER_
1979 for (
i = 0, DllBase = 0, DllEnd = 0;
i < ImportSize;
i++, ImageThunk++)
1981 DllBase = DllEnd =
i = 0;
1982 while ((ImportDescriptor->
Name) &&
1995 if ((*ImageThunk >= DllBase) && (*ImageThunk < DllEnd))
2019 if ((*ImageThunk >= DllBase) && (*ImageThunk < DllEnd))
2023 EntryArray[
j] = LdrEntry2;
2028 NextEntry2 = NextEntry2->
Flink;
2033 if ((*ImageThunk < DllBase) || (*ImageThunk >= DllEnd))
2039 ERROR_FATAL(
"Broken IAT entry for %p at %p (%lx)\n",
2040 LdrEntry, ImageThunk, *ImageThunk);
2046#ifndef _WORKING_LOADER_
2056 for (
i = 0, ImportSize = 0;
i < Modules;
i++)
2059 if ((EntryArray[
i]) &&
2060 (EntryArray[
i] != HalEntry) &&
2061 (EntryArray[
i] != KernelEntry))
2064 LastEntry = EntryArray[
i];
2075 else if (ImportSize == 1)
2084 LoadedImportsSize = ImportSize *
sizeof(
PVOID) +
sizeof(
SIZE_T);
2091 LoadedImports->
Count = ImportSize;
2094 for (
i = 0,
j = 0;
i < Modules;
i++)
2097 if ((EntryArray[
i]) &&
2098 (EntryArray[
i] != HalEntry) &&
2099 (EntryArray[
i] != KernelEntry))
2103 LoadedImports->
Entry[
j] = EntryArray[
i];
2115 NextEntry = NextEntry->
Flink;
2148 Sections > 0; --Sections, ++SectionHeader)
2162 else if (*(
PULONG)SectionHeader->
Name ==
'LOOP')
2165 if (*(
PULONG)&SectionHeader->
Name[4] ==
'EDOC')
2171 else if (*(
PUSHORT)&SectionHeader->
Name[4] ==
'MI')
2178 else if ((*(
PULONG)SectionHeader->
Name ==
'YSIM') &&
2179 (*(
PULONG)&SectionHeader->
Name[4] ==
'ETPS'))
2203 ListHead = &LoaderBlock->LoadOrderListHead;
2204 NextEntry = ListHead->
Flink;
2214 while (NextEntry != ListHead)
2225 NextEntry = NextEntry->
Flink;
2234 if (!NewEntry)
return FALSE;
2237 *NewEntry = *LdrEntry;
2268 NextEntry = NextEntry->
Flink;
2377 NextEntry = NextEntry->
Flink;
2385 DPRINT1(
"Large pages not supported!\n");
2400 for (PointerPte = FirstPte; PointerPte <= LastPte; PointerPte++)
2408 DPRINT1(
"CORE-16449: FirstPte=%p, LastPte=%p, Protection=%lx\n", FirstPte, LastPte, Protection);
2409 DPRINT1(
"CORE-16449: PointerPte=%p, TempPte=%lx\n", PointerPte,
TempPte.u.Long);
2410 DPRINT1(
"CORE-16449: Please issue the 'mod' and 'bt' (KDBG) or 'lm' and 'kp' (WinDbg) commands. Then report this in Jira.\n");
2417#if _MI_HAS_NO_EXECUTE
2436 PVOID SectionBase, SectionEnd;
2439 PMMPTE FirstPte, LastPte;
2456 if (NtHeaders ==
NULL)
2458 DPRINT1(
"Failed to get NT headers for image @ %p\n", ImageBase);
2466 DPRINT1(
"Skipping NT 4 driver @ %p\n", ImageBase);
2480 if (LastPte >= FirstPte)
2489 Section = &SectionHeaders[
i];
2497 if (FirstPte == LastPte)
2513 SectionEnd =
Add2Ptr(SectionBase, SectionSize - 1);
2518 if (LastPte < FirstPte)
2535 DPRINT1(
"ImageBase 0x%p ImageSize 0x%lx Section %u VA 0x%lx Raw 0x%lx virt 0x%lx\n",
2550#ifdef ENABLE_MISETPAGINGOFDRIVER
2560#ifndef ENABLE_MISETPAGINGOFDRIVER
2562 DPRINT1(
"WARNING: MiSetPagingOfDriver() called, but paging is broken! ignoring!\n");
2575 while (PointerPte <= LastPte)
2578 if (PointerPte->u.Hard.Valid == 1)
2616 ImageBase = (
ULONG_PTR)LdrEntry->DllBase;
2618 if (!NtHeaders)
return;
2716 Status = ZwCreateSection(&SectionHandle,
2725 DPRINT1(
"ZwCreateSection failed with status 0x%x\n",
Status);
2733 Status = ZwMapViewOfSection(SectionHandle,
2746 DPRINT1(
"ZwMapViewOfSection failed with status 0x%x\n",
Status);
2753 Status = ZwQueryInformationFile(ImageHandle,
2756 sizeof(FileStandardInfo),
2826 (ConfigDir->
Size != DirSize))
2870 if ((NewCookie == 0) || (NewCookie == *
Cookie))
2903 PWCHAR MissingDriverName, PrefixedBuffer =
NULL;
2942 BaseLength *=
sizeof(
WCHAR);
2993 if (!PrefixedBuffer)
3000 PrefixName.
Buffer = PrefixedBuffer;
3010 BaseName.
Length += NamePrefix->Length;
3015 if (LoadedName) BaseName = *LoadedName;
3021 DPRINT1(
"MM:SYSLDR Loading %wZ (%wZ) %s\n",
3022 &PrefixName, &BaseName,
Flags ?
"in session space" :
"");
3051 NextEntry = NextEntry->
Flink;
3069 *ModuleObject = LdrEntry;
3070 *ImageBaseAddress = LdrEntry->
DllBase;
3115 DPRINT1(
"ZwOpenFile failed for '%wZ' with status 0x%x\n",
3150 Status = ZwCreateSection(&SectionHandle,
3159 DPRINT1(
"ZwCreateSection failed with status 0x%x\n",
Status);
3222 DPRINT1(
"MiLoadImageSection failed with status 0x%x\n",
Status);
3235 DPRINT1(
"LdrRelocateImageWithBias failed with status 0x%x\n",
Status);
3271 LdrEntry->
DllBase = ModuleLoadBase;
3318 MissingDriverName =
NULL;
3330 if (*(
ULONG_PTR*)&MissingDriverName & 1)
3332 NeedToFreeString =
TRUE;
3336 DPRINT1(
"MiResolveImageReferences failed with status 0x%x\n",
Status);
3337 DPRINT1(
" Missing driver '%ls', missing API '%s'\n",
3338 MissingDriverName, MissingApiName);
3340 if (NeedToFreeString)
3365 LdrEntry->
Flags &= ~LDRP_LOAD_IN_PROGRESS;
3391#ifdef __ROS_ROSSYM__
3407 UnicodeTemp = PrefixName;
3408 UnicodeTemp.
Buffer += 11;
3438 *ModuleObject = LdrEntry;
3439 *ImageBaseAddress = LdrEntry->
DllBase;
3485 FoundEntry = LdrEntry;
3490 NextEntry = NextEntry->
Flink;
3512 if (!LdrEntry)
return NULL;
3604 if (ProcAddress)
break;
3605 if (Modules == 2)
break;
3609 NextEntry = NextEntry->
Flink;
NTSTATUS NTAPI MmUnmapViewOfSection(IN PEPROCESS Process, IN PVOID BaseAddress)
#define ALIGN_DOWN_BY(size, align)
#define ALIGN_UP_BY(size, align)
int strcmp(const char *String1, const char *String2)
ACPI_SIZE strlen(const char *String)
int strncmp(const char *String1, const char *String2, ACPI_SIZE Count)
char * strchr(const char *String, int ch)
HARDWARE_PTE_ARMV6 TempPte
#define OBJ_NAME_PATH_SEPARATOR
struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY
_In_ CDROM_SCAN_FOR_SPECIAL_INFO _In_ PCDROM_SCAN_FOR_SPECIAL_HANDLER Function
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
#define IMAGE_DIRECTORY_ENTRY_EXPORT
#define IMAGE_DIRECTORY_ENTRY_DEBUG
#define RtlImageDirectoryEntryToData
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
#define _strnicmp(_String1, _String2, _MaxCount)
VOID NTAPI KeFlushQueuedDpcs(VOID)
#define UNIMPLEMENTED_DBGBREAK(...)
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define PsGetCurrentThread()
#define MAXIMUM_FILENAME_LENGTH
NTSTATUS ExInitializeResourceLite(PULONG res)
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeReleaseSpinLock(sl, irql)
#define KeGetCurrentIrql()
#define ExAcquireResourceExclusiveLite(res, wait)
#define InitializeListHead(ListHead)
#define ExAcquireResourceSharedLite(res, wait)
#define KeInitializeSpinLock(sl)
#define BooleanFlagOn(F, SF)
struct _FileName FileName
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
union Alignment_ Alignment
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint GLint GLint j
KIRQL FASTCALL KeAcquireSpinLockRaiseToSynch(PKSPIN_LOCK SpinLock)
LARGE_INTEGER NTAPI KeQueryPerformanceCounter(IN PLARGE_INTEGER PerformanceFreq)
#define EXCEPTION_EXECUTE_HANDLER
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define FLG_SHOW_LDR_SNAPS
#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
#define IMAGE_ADDRESSING_MODE_32BIT
#define InterlockedExchangeAdd
__INTRIN_INLINE unsigned long __readcr4(void)
#define Add2Ptr(PTR, INC)
static BOOLEAN LoadSymbols
BOOLEAN KdDebuggerNotPresent
BOOLEAN KdDebuggerEnabled
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
BOOLEAN MiLargePageAllDrivers
LIST_ENTRY MiLargePageDriverList
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
#define LDRP_DRIVER_DEPENDENT_DLL
#define LDRP_DEBUG_SYMBOLS_LOADED
#define LDRP_ENTRY_PROCESSED
#define LDRP_ENTRY_NATIVE
#define LDRP_SYSTEM_MAPPED
#define LDRP_LOAD_IN_PROGRESS
struct _LOAD_IMPORTS * PLOAD_IMPORTS
FORCEINLINE BOOLEAN MI_IS_PHYSICAL_ADDRESS(IN PVOID Address)
#define IMAGE_SCN_PROTECTION_MASK
FORCEINLINE VOID MiLockWorkingSet(IN PETHREAD Thread, IN PMMSUPPORT WorkingSet)
#define MI_IS_SESSION_IMAGE_ADDRESS(Address)
#define MI_IS_SESSION_ADDRESS(Address)
#define MI_GET_NEXT_COLOR()
PFN_NUMBER NTAPI MiRemoveAnyPage(IN ULONG Color)
FORCEINLINE VOID MI_MAKE_HARDWARE_PTE_KERNEL(IN PMMPTE NewPte, IN PMMPTE MappingPte, IN ULONG_PTR ProtectionMask, IN PFN_NUMBER PageFrameNumber)
ULONG MmTotalFreeSystemPtes[MaximumPtePoolTypes]
#define MM_SYSLDR_NO_IMPORTS
FORCEINLINE VOID MiUnlockWorkingSet(IN PETHREAD Thread, IN PMMSUPPORT WorkingSet)
PMMPTE NTAPI MiReserveSystemPtes(IN ULONG NumberOfPtes, IN MMSYSTEM_PTE_POOL_TYPE SystemPtePoolType)
FORCEINLINE VOID MI_UPDATE_VALID_PTE(IN PMMPTE PointerPte, IN MMPTE TempPte)
FORCEINLINE VOID MI_WRITE_VALID_PTE(IN PMMPTE PointerPte, IN MMPTE TempPte)
VOID NTAPI MiInitializePfn(IN PFN_NUMBER PageFrameIndex, IN PMMPTE PointerPte, IN BOOLEAN Modified)
PFN_COUNT NTAPI MiDeleteSystemPageableVm(IN PMMPTE PointerPte, IN PFN_NUMBER PageCount, IN ULONG Flags, OUT PPFN_NUMBER ValidPages)
#define MM_SYSLDR_BOOT_LOADED
#define MM_SYSLDR_SINGLE_ENTRY
#define MiAddressToPte(x)
#define ExFreePoolWithTag(_P, _T)
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
NTSYSAPI ULONG NTAPI LdrRelocateImageWithBias(_In_ PVOID NewAddress, _In_ LONGLONG AdditionalBias, _In_ PCCH LoaderName, _In_ ULONG Success, _In_ ULONG Conflict, _In_ ULONG Invalid)
VOID NTAPI DbgUnLoadImageSymbols(_In_ PSTRING Name, _In_ PVOID Base, _In_ ULONG_PTR ProcessId)
VOID NTAPI DbgLoadImageSymbols(_In_ PSTRING Name, _In_ PVOID Base, _In_ ULONG_PTR ProcessId)
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define SECTION_MAP_EXECUTE
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI VOID NTAPI RtlInitString(PSTRING DestinationString, PCSZ SourceString)
#define SECTION_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define NtCurrentProcess()
#define FILE_SHARE_DELETE
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
NTSYSAPI BOOLEAN NTAPI RtlPrefixUnicodeString(IN PUNICODE_STRING String1, IN PUNICODE_STRING String2, IN BOOLEAN CaseInSensitive)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
#define DBG_UNREFERENCED_LOCAL_VARIABLE(L)
#define IMAGE_SCN_MEM_WRITE
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
#define IMAGE_SCN_MEM_EXECUTE
#define IMAGE_FIRST_SECTION(NtHeader)
#define IMAGE_SCN_MEM_DISCARDABLE
#define IMAGE_SCN_MEM_READ
#define IMAGE_NT_OPTIONAL_HDR_MAGIC
ULONG ExpInitializationPhase
VOID FASTCALL ExReleaseResourceLite(IN PERESOURCE Resource)
#define MmSystemRangeStart
#define MiPteToAddress(_Pte)
VOID NTAPI KeFlushCurrentTb(VOID)
FORCEINLINE PMMPFN MiGetPfnEntry(IN PFN_NUMBER Pfn)
struct _MM_IMAGE_SECTION_OBJECT * PMM_IMAGE_SECTION_OBJECT
UCHAR MmDisablePagingExecutive
_Out_ PKAPC_STATE ApcState
static const WCHAR ServicesKeyName[]
VOID NTAPI KeFlushEntireTb(IN BOOLEAN Invalid, IN BOOLEAN AllProcessors)
LONG NTAPI KeReleaseMutant(IN PKMUTANT Mutant, IN KPRIORITY Increment, IN BOOLEAN Abandon, IN BOOLEAN Wait)
MMSUPPORT MmSystemCacheWs
HANDLE NTAPI PsGetCurrentProcessId(VOID)
#define STATUS_DRIVER_ENTRYPOINT_NOT_FOUND
#define STATUS_IMAGE_CHECKSUM_MISMATCH
#define STATUS_IMAGE_MP_UP_MISMATCH
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH
#define STATUS_IMAGE_ALREADY_LOADED
#define STATUS_ALREADY_COMMITTED
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_PROCEDURE_NOT_FOUND
#define STATUS_DRIVER_ORDINAL_NOT_FOUND
#define STATUS_NOT_IMPLEMENTED
#define STATUS_CONFLICTING_ADDRESSES
NTSTRSAFEVAPI RtlStringCbPrintfA(_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ _Printf_format_string_ NTSTRSAFE_PCSTR pszFormat,...)
NTSTRSAFEAPI RtlStringCbCopyA(_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ NTSTRSAFE_PCSTR pszSrc)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define IMAGE_DIRECTORY_ENTRY_IMPORT
#define IMAGE_DIRECTORY_ENTRY_IAT
#define IMAGE_DIRECTORY_ENTRY_BASERELOC
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define IMAGE_FILE_RELOCS_STRIPPED
#define IMAGE_FILE_UP_SYSTEM_ONLY
#define IMAGE_ORDINAL(Ordinal)
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
#define FileStandardInformation
BOOLEAN PsImageNotifyEnabled
FORCEINLINE VOID PspRunLoadImageNotifyRoutines(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo)
#define _SEH2_EXCEPT(...)
PEPROCESS PsInitialSystemProcess
_Check_return_ _CRTIMP int __cdecl _wcsnicmp(_In_reads_or_z_(_MaxCount) const wchar_t *_Str1, _In_reads_or_z_(_MaxCount) const wchar_t *_Str2, _In_ size_t _MaxCount)
#define ERROR_DBGBREAK(...)
NTSTATUS NTAPI MmMapViewOfSection(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
POBJECT_TYPE MmSectionObjectType
PULONG MinorVersion OPTIONAL
DWORD AddressOfNameOrdinals
ULONG ImageAddressingMode
union _IMAGE_THUNK_DATA32::@2107 u1
UNICODE_STRING FullDllName
LIST_ENTRY InLoadOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Flink
PLDR_DATA_TABLE_ENTRY Entry[1]
static LARGE_INTEGER Counter
ULONG_PTR ExPoolCodeStart
NTSTATUS NTAPI MiBuildImportsForBootDrivers(VOID)
NTSTATUS NTAPI MiSnapThunk(IN PVOID DllBase, IN PVOID ImageBase, IN PIMAGE_THUNK_DATA Name, IN PIMAGE_THUNK_DATA Address, IN PIMAGE_EXPORT_DIRECTORY ExportDirectory, IN ULONG ExportSize, IN BOOLEAN SnapForwarder, OUT PCHAR *MissingApi)
VOID NTAPI MiLocateKernelSections(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS NTAPI MiDereferenceImports(IN PLOAD_IMPORTS ImportList)
BOOLEAN NTAPI MiInitializeLoadedModuleList(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
VOID NTAPI MmMakeKernelResourceSectionWritable(VOID)
NTSTATUS NTAPI MmLoadSystemImage(IN PUNICODE_STRING FileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedName OPTIONAL, IN ULONG Flags, OUT PVOID *ModuleObject, OUT PVOID *ImageBaseAddress)
KSPIN_LOCK PsLoadedModuleSpinLock
LIST_ENTRY PsLoadedModuleList
BOOLEAN NTAPI MmVerifyImageIsOkForMpUse(IN PVOID BaseAddress)
VOID NTAPI MiSetPagingOfDriver(IN PMMPTE PointerPte, IN PMMPTE LastPte)
LIST_ENTRY MmLoadedUserImageList
NTSTATUS NTAPI MiResolveImageReferences(IN PVOID ImageBase, IN PUNICODE_STRING ImageFileDirectory, IN PUNICODE_STRING NamePrefix OPTIONAL, OUT PCHAR *MissingApi, OUT PWCHAR *MissingDriver, OUT PLOAD_IMPORTS *LoadImports)
BOOLEAN MmEnforceWriteProtection
ERESOURCE PsLoadedModuleResource
VOID NTAPI MmFreeDriverInitialization(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
PVOID NTAPI LdrpInitSecurityCookie(PLDR_DATA_TABLE_ENTRY LdrEntry)
PVOID NTAPI MiFindExportedRoutineByName(IN PVOID DllBase, IN PANSI_STRING ExportName)
VOID NTAPI MiReloadBootLoadedDrivers(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
VOID NTAPI MiWriteProtectSystemImage(_In_ PVOID ImageBase)
VOID NTAPI MiEnablePagingOfDriver(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
#define DEFAULT_SECURITY_COOKIE
ULONG_PTR MmPoolCodeStart
VOID NTAPI MiFindInitializationCode(OUT PVOID *StartVa, OUT PVOID *EndVa)
PVOID MmLastUnloadedDrivers
PVOID NTAPI LdrpFetchAddressOfSecurityCookie(PVOID BaseAddress, ULONG SizeOfImage)
NTSTATUS NTAPI MmUnloadSystemImage(IN PVOID ImageHandle)
BOOLEAN NTAPI MmChangeKernelResourceSectionProtection(IN ULONG_PTR ProtectionMask)
VOID NTAPI MiFreeInitializationCode(IN PVOID InitStart, IN PVOID InitEnd)
NTSTATUS NTAPI MmCallDllInitialize(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN PLIST_ENTRY ListHead)
VOID NTAPI MiProcessLoaderEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN BOOLEAN Insert)
PVOID NTAPI MmGetSystemRoutineAddress(IN PUNICODE_STRING SystemRoutineName)
PFN_NUMBER MmTotalSystemDriverPages
PMMPTE MiKernelResourceEndPte
PVOID NTAPI MiCacheImageSymbols(IN PVOID BaseAddress)
PVOID NTAPI MmPageEntireDriver(IN PVOID AddressWithinSection)
NTSTATUS NTAPI MiLoadImageSection(_Inout_ PSECTION *SectionPtr, _Out_ PVOID *ImageBase, _In_ PUNICODE_STRING FileName, _In_ BOOLEAN SessionLoad, _In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI MiUpdateThunks(IN PLOADER_PARAMETER_BLOCK LoaderBlock, IN PVOID OldBase, IN PVOID NewBase, IN ULONG Size)
BOOLEAN NTAPI MiCallDllUnloadAndUnloadDll(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI MiSetSystemCodeProtection(_In_ PMMPTE FirstPte, _In_ PMMPTE LastPte, _In_ ULONG Protection)
NTSTATUS NTAPI MmCheckSystemImage(IN HANDLE ImageHandle, IN BOOLEAN PurgeSection)
VOID NTAPI MmResetDriverPaging(IN PVOID AddressWithinSection)
PVOID NTAPI MiLocateExportName(IN PVOID DllBase, IN PCHAR ExportName)
PMMPTE MiKernelResourceStartPte
PLDR_DATA_TABLE_ENTRY NTAPI MiLookupDataTableEntry(IN PVOID Address)
VOID NTAPI MiClearImports(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
LOGICAL NTAPI MiUseLargeDriverPage(IN ULONG NumberOfPtes, IN OUT PVOID *ImageBaseAddress, IN PUNICODE_STRING BaseImageName, IN BOOLEAN BootDriver)
ULONG_PTR PsNtosImageBase
#define TAG_MODULE_OBJECT
#define RTL_CONSTANT_STRING(s)
#define FIELD_OFFSET(t, f)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_INVALID_PARAMETER
#define STATUS_INSUFFICIENT_RESOURCES
#define STATUS_OBJECT_NAME_NOT_FOUND
#define ALIGN_UP_POINTER_BY(ptr, align)
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDMATRANSACTION _In_ PFN_WDF_PROGRAM_DMA _In_ WDF_DMA_DIRECTION _In_ PMDL _In_ PVOID VirtualAddress
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
NTSTATUS(NTAPI * PMM_DLL_UNLOAD)(VOID)
NTSTATUS(NTAPI * PMM_DLL_INITIALIZE)(_In_ PUNICODE_STRING RegistryPath)
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
#define ROUND_TO_PAGES(Size)
#define ObDereferenceObject
#define PsGetCurrentProcess