#include <rtl.h>
#include <debug.h>

Include dependency graph for trace.c:

Macros
#define	NDEBUG

Functions
PRTL_UNLOAD_EVENT_TRACE NTAPI	RtlGetUnloadEventTrace (VOID)

VOID NTAPI	LdrpRecordUnloadEvent (_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)

BOOLEAN NTAPI	RtlTraceDatabaseAdd (IN PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID Trace, OUT OPTIONAL PRTL_TRACE_BLOCK TraceBlock)

PRTL_TRACE_DATABASE NTAPI	RtlTraceDatabaseCreate (IN ULONG Buckets, IN OPTIONAL SIZE_T MaximumSize, IN ULONG Flags, IN ULONG Tag, IN OPTIONAL RTL_TRACE_HASH_FUNCTION HashFunction)

BOOLEAN NTAPI	RtlTraceDatabaseDestroy (IN PRTL_TRACE_DATABASE Database)

BOOLEAN NTAPI	RtlTraceDatabaseEnumerate (IN PRTL_TRACE_DATABASE Database, IN PRTL_TRACE_ENUMERATE TraceEnumerate, IN OUT PRTL_TRACE_BLOCK *TraceBlock)

BOOLEAN NTAPI	RtlTraceDatabaseFind (IN PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID Trace, OUT OPTIONAL PRTL_TRACE_BLOCK TraceBlock)

BOOLEAN NTAPI	RtlTraceDatabaseLock (IN PRTL_TRACE_DATABASE Database)

BOOLEAN NTAPI	RtlTraceDatabaseUnlock (IN PRTL_TRACE_DATABASE Database)

BOOLEAN NTAPI	RtlTraceDatabaseValidate (IN PRTL_TRACE_DATABASE Database)

Variables
static RTL_UNLOAD_EVENT_TRACE	RtlpUnloadEventTrace [RTL_UNLOAD_EVENT_TRACE_NUMBER]

static UINT	RtlpUnloadEventTraceIndex = 0

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 10 of file trace.c.

Function Documentation

◆ LdrpRecordUnloadEvent()

VOID NTAPI LdrpRecordUnloadEvent ( _In_ PLDR_DATA_TABLE_ENTRY LdrEntry )

Definition at line 28 of file trace.c.

{
    PIMAGE_NT_HEADERS NtHeaders;
    UINT Sequence = RtlpUnloadEventTraceIndex++;
    UINT Index = Sequence % RTL_UNLOAD_EVENT_TRACE_NUMBER;
    USHORT StringLen;
 
    DPRINT("LdrpRecordUnloadEvent(%wZ, %p - %p)\n", &LdrEntry->BaseDllName, LdrEntry->DllBase,
        (ULONG_PTR)LdrEntry->DllBase + LdrEntry->SizeOfImage);
 
    RtlpUnloadEventTrace[Index].BaseAddress = LdrEntry->DllBase;
    RtlpUnloadEventTrace[Index].SizeOfImage = LdrEntry->SizeOfImage;
    RtlpUnloadEventTrace[Index].Sequence = Sequence;
 
    NtHeaders = RtlImageNtHeader(LdrEntry->DllBase);
 
    if (NtHeaders)
    {
        RtlpUnloadEventTrace[Index].TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp;
        RtlpUnloadEventTrace[Index].CheckSum = NtHeaders->OptionalHeader.CheckSum;
    }
    else
    {
        RtlpUnloadEventTrace[Index].TimeDateStamp = 0;
        RtlpUnloadEventTrace[Index].CheckSum = 0;
    }
 
    StringLen = min(LdrEntry->BaseDllName.Length / sizeof(WCHAR), RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName));
    RtlCopyMemory(RtlpUnloadEventTrace[Index].ImageName, LdrEntry->BaseDllName.Buffer, StringLen * sizeof(WCHAR));
    if (StringLen < RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName))
        RtlpUnloadEventTrace[Index].ImageName[StringLen] = 0;
}

Referenced by LdrUnloadDll().

◆ RtlGetUnloadEventTrace()

PRTL_UNLOAD_EVENT_TRACE NTAPI RtlGetUnloadEventTrace ( VOID )

Definition at line 20 of file trace.c.

{
    /* Just return a pointer to an array, according to MSDN */
    return RtlpUnloadEventTrace;
}

Referenced by Test_Dump().

◆ RtlTraceDatabaseAdd()

BOOLEAN NTAPI RtlTraceDatabaseAdd	(	IN PRTL_TRACE_DATABASE	Database,
		IN ULONG	Count,
		IN PVOID *	Trace,
		OUT OPTIONAL PRTL_TRACE_BLOCK *	TraceBlock
	)

Definition at line 63 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseCreate()

PRTL_TRACE_DATABASE NTAPI RtlTraceDatabaseCreate	(	IN ULONG	Buckets,
		IN OPTIONAL SIZE_T	MaximumSize,
		IN ULONG	Flags,
		IN ULONG	Tag,
		IN OPTIONAL RTL_TRACE_HASH_FUNCTION	HashFunction
	)

Definition at line 74 of file trace.c.

{
    UNIMPLEMENTED;
    return NULL;
}

◆ RtlTraceDatabaseDestroy()

BOOLEAN NTAPI RtlTraceDatabaseDestroy ( IN PRTL_TRACE_DATABASE Database )

Definition at line 86 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseEnumerate()

BOOLEAN NTAPI RtlTraceDatabaseEnumerate	(	IN PRTL_TRACE_DATABASE	Database,
		IN PRTL_TRACE_ENUMERATE	TraceEnumerate,
		IN OUT PRTL_TRACE_BLOCK *	TraceBlock
	)

Definition at line 94 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseFind()

BOOLEAN NTAPI RtlTraceDatabaseFind	(	IN PRTL_TRACE_DATABASE	Database,
		IN ULONG	Count,
		IN PVOID *	Trace,
		OUT OPTIONAL PRTL_TRACE_BLOCK *	TraceBlock
	)

Definition at line 105 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseLock()

BOOLEAN NTAPI RtlTraceDatabaseLock ( IN PRTL_TRACE_DATABASE Database )

Definition at line 116 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseUnlock()

BOOLEAN NTAPI RtlTraceDatabaseUnlock ( IN PRTL_TRACE_DATABASE Database )

Definition at line 124 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

◆ RtlTraceDatabaseValidate()

BOOLEAN NTAPI RtlTraceDatabaseValidate ( IN PRTL_TRACE_DATABASE Database )

Definition at line 132 of file trace.c.

{
    UNIMPLEMENTED;
    return FALSE;
}

Variable Documentation

◆ RtlpUnloadEventTrace

RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER]

static

Definition at line 13 of file trace.c.

Referenced by LdrpRecordUnloadEvent(), and RtlGetUnloadEventTrace().

◆ RtlpUnloadEventTraceIndex

UINT RtlpUnloadEventTraceIndex = 0