95 RtlInitEmptyUnicodeString(StringIn,
NULL, 0);
129 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
138 LdrEntry->EntryPointActivationContext);
175 BoundEntry = FirstEntry;
186 RedirectedDll =
FALSE;
187 RedirectedImportName = ImportNameUnic;
195 &RedirectedImportName,
206 DPRINT1(
"LDR: %Z got redirected to %wZ\n", &ImportNameAnsi, RedirectedImportName);
209 RedirectedDll =
TRUE;
215 RedirectedImportName,
220 if (
Entry->LoadCount != 0xFFFF)
232 Entry->LoadCount = 0xFFFF;
239 DPRINT1(
"LDR: Flags %lu %wZ (%lx)\n",
Flags, RedirectedImportName,
Entry->LoadCount);
246 else if (RedirectedDll)
248 DPRINT1(
"LDR: LdrpCheckForLoadedDll failed for redirected dll %wZ\n", RedirectedImportName);
254 DPRINT1(
"LDR: RtlDosApplyFileIsolationRedirection_Ustr failed with status %x for dll %wZ\n",
Status, ImportNameUnic);
269 RedirectedDll =
FALSE;
270 RedirectedImportName = ImportNameUnic;
278 &RedirectedImportName,
287 DPRINT1(
"LDR: %Z got redirected to %wZ\n", &ImportNameAnsi, RedirectedImportName);
290 RedirectedDll =
TRUE;
296 RedirectedImportName,
301 if (
Entry->LoadCount != 0xFFFF)
313 Entry->LoadCount = 0xFFFF;
320 DPRINT1(
"LDR: Flags %lu %wZ (%lx)\n",
Flags, RedirectedImportName,
Entry->LoadCount);
327 else if (RedirectedDll)
329 DPRINT1(
"LDR: LdrpCheckForLoadedDll failed with status %x for redirected dll %wZ\n",
Status, RedirectedImportName);
335 DPRINT1(
"LDR: RtlDosApplyFileIsolationRedirection_Ustr failed with status %x for dll %wZ\n",
Status, ImportNameUnic);
340 NewImportForwarder++;
375 RedirectedDll =
FALSE;
376 RedirectedImportName = ImportNameUnic;
384 &RedirectedImportName,
393 DPRINT1(
"LDR: %Z got redirected to %wZ\n", &ImportNameAnsi, RedirectedImportName);
397 RedirectedDll =
TRUE;
403 RedirectedImportName,
408 if (
Entry->LoadCount != 0xFFFF)
420 Entry->LoadCount = 0xFFFF;
427 DPRINT1(
"LDR: Flags %lu %wZ (%lx)\n",
Flags, RedirectedImportName,
Entry->LoadCount);
434 else if (RedirectedDll)
436 DPRINT1(
"LDR: LdrpCheckForLoadedDll failed for redirected dll %wZ\n", RedirectedImportName);
443 DPRINT1(
"LDR: RtlDosApplyFileIsolationRedirection_Ustr failed for dll %wZ\n", ImportNameUnic);
467 RtlInitEmptyUnicodeString(&UpdateString,
Buffer,
sizeof(
Buffer));
499 DPRINT1(
"LDR: Tls Callbacks Found. Imagebase %p Tls %p CallBacks %p\n",
500 LdrEntry->DllBase, TlsDirectory, Array);
512 DPRINT1(
"LDR: Calling Tls Callback Imagebase %p Function %p\n",
527 DPRINT1(
"LDR: Exception 0x%x during Tls Callback(%u) for %wZ\n",
592 DPRINT1(
"LDR: LdrpCreateDllSection - NtOpenFile failed; status = %x\n",
604 *SectionHandle =
NULL;
629 *SectionHandle =
NULL;
649 if (!DllCharacteristics ||
670 DPRINT1(
"LDR: Loading of (%wZ) blocked by Winsafer\n",
676 *SectionHandle =
NULL;
684 *SectionHandle =
NULL;
704 PWCHAR NameBuffer, p1, p2 = 0;
723 DPRINT1(
"LDR: LdrResolveDllName - Unable to find ");
804 if (EntryPoint) EntryPoint += (
ULONG_PTR)ImageBase;
808 return (
PVOID)EntryPoint;
827 if (SectionHandle) *SectionHandle = 0;
844 if (!SectionHandle || !
FullDllName || !BaseDllName)
858 ACTIVATION_CONTEXT_SECTION_DLL_REDIRECTION,
929 *SectionHandle = Section;
955 ULONG NewProtection, OldProtection,
i;
1044 PVOID ArbitraryUserPointer;
1056 ULONG RelocDataSize = 0;
1062 DPRINT1(
"LDR: LdrpMapDll: Image Name %ws, Search Path %ws\n",
1074 if (TempChar ==
'\\' || TempChar ==
'/' )
1092 "LDR: %s - call to LdrpCheckForKnownDll(\"%ws\", ...) failed with status %x\n",
1115 DPRINT1(
"LDR: Loading (%s) %wZ\n",
1116 Static ?
"STATIC" :
"DYNAMIC",
1162 HardErrorParameters[0] = (
ULONG_PTR)&HardErrorDllName;
1163 HardErrorParameters[1] = (
ULONG_PTR)&HardErrorDllPath;
1169 HardErrorParameters,
1247 DPRINT1(
"LDR: LdrpMapDll: Full Name %wZ, Base Name %wZ\n",
1278 HardErrorParameters,
1326 *DataTableEntry = LdrEntry;
1338 DPRINT(
"LDR: LdrpMapDll Relocating Image Name %ws (%p-%p -> %p)\n", DllName, (
PVOID)ImageBase, (
PVOID)ImageEnd, ViewBase);
1342 NextEntry = ListHead->
Flink;
1343 while (NextEntry != ListHead)
1349 NextEntry = NextEntry->
Flink;
1353 CandidateEnd = CandidateBase + CandidateEntry->
SizeOfImage;
1359 if ((ImageBase >= CandidateBase && ImageBase <= CandidateEnd) ||
1360 (ImageEnd >= CandidateBase && ImageEnd <= CandidateEnd) ||
1361 (CandidateBase >= ImageBase && CandidateBase <= ImageEnd))
1364 OverlapDllFound =
TRUE;
1371 if (!OverlapDllFound)
1377 DPRINT(
"Overlapping DLL: %wZ\n", &OverlapDll);
1392 if (!RelocData && !RelocDataSize)
1404 RelocatableDll =
FALSE;
1412 RelocatableDll =
FALSE;
1417 if (KnownDll && !RelocatableDll)
1420 HardErrorParameters[0] = (
ULONG_PTR)&IllegalDll;
1421 HardErrorParameters[1] = (
ULONG_PTR)&OverlapDll;
1423 DPRINT1(
"Illegal DLL relocation! %wZ overlaps %wZ\n", &OverlapDll, &IllegalDll);
1429 HardErrorParameters,
1493 DPRINT1(
"LDR: Fixups %successfully re-applied @ %p\n",
1525 DPRINT1(
"LDR: Fixups won't be re-applied to non-Dll @ %p\n", ViewBase);
1604 if ((
Entry->EntryPointActivationContext) &&
1637 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1638 Next = ListHead->
Flink;
1639 while (Next != ListHead)
1653 *LdrEntry = Current;
1682 "LDR: %s - Expanding full name of %wZ\n",
1711 *ExpandedName = PathName;
1726 FullPathName->Length,
1727 FullPathName->Buffer,
1743 *ExpandedName = FullPathName;
1759 "LDR: %s - Expanded to %wZ\n",
1767 "LDR: %s - Failed to expand %wZ; 0x%08x\n",
1806 "LDR: %s - Looking for %ws in %ws\n",
1865 p = *ActualSearchPath;
1866 if (!(
p) || (
p ==
';'))
1875 "LDR: %s - Looking for %ws\n",
1955 "LDR: %s - Returning %wZ\n",
1963 "LDR: %s - Unable to locate %ws in %ws: 0x%08x\n",
2003 if (!(DllName->Buffer) || !(DllName->Buffer[0]))
return FALSE;
2010 if (
Flag && !RedirectedDll)
2019 ListEntry = ListHead->
Flink;
2020 while (ListEntry != ListHead)
2029 *LdrEntry = CurEntry;
2034 ListEntry = ListEntry->
Flink;
2051 wc = DllName->Buffer;
2055 if ((*wc ==
L'\\') || (*wc ==
L'/'))
2076 DPRINT1(
"LDR: LdrpCheckForLoadedDll - Unable To Locate %wZ: 0x%08x\n",
2099 DPRINT(
"Warning, activation context missing\n");
2104 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
2105 ListEntry = ListHead->
Flink;
2106 while (ListEntry != ListHead)
2112 ListEntry = ListEntry->
Flink;
2123 *LdrEntry = CurEntry;
2175 Status = ZwMapViewOfSection(SectionHandle,
2202 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
2203 ListEntry = ListHead->
Flink;
2204 while (ListEntry != ListHead)
2210 ListEntry = ListEntry->
Flink;
2231 *LdrEntry = CurEntry;
2259 UCHAR ImportBuffer[64];
2288 if (
Length >
sizeof(ImportBuffer))
2302 ImportName->
Hint = 0;
2309 ImageBase = ImportName;
2324 DPRINT1(
"No ordinal and no name\n");
2354 DPRINT1(
"Image %wZ has no exports, but were trying to get procedure %Z. BaseAddress asked 0x%p, got entry BA 0x%p\n",
2380 InInitializationOrderLinks);
2448 RtlInitEmptyUnicodeString(&RawDllName, NameBuffer,
sizeof(NameBuffer));
2452 p = DllName->Buffer + DllName->Length /
sizeof(
WCHAR) - 1;
2453 GotExtension =
FALSE;
2454 while (
p >= DllName->Buffer)
2459 GotExtension =
TRUE;
2462 else if (
c ==
L'\\')
2478 "LDR: %s - Dll name missing extension; with extension " 2479 "added the name is too long\n" 2480 " DllName: (@ %p) \"%wZ\"\n" 2481 " DllName->Length: %u\n",
2502 DPRINT1(
"LDR: LdrLoadDll, loading %wZ from %ws\n",
2529 if ((DllCharacteristics) &&
2565 DbgPrint(
"LDR: Unloading %wZ due to error %x walking " 2566 "import descriptors\n",
2603 DbgPrint(
"LDR: Unloading %wZ because either its init " 2604 "routine or one of its static imports failed; " 2605 "status = 0x%08lx\n",
2667 ULONG ModulesCount = 0;
2670 ListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
2672 while (
Entry != ListHead)
2677 InInitializationOrderLinks);
2695 return ModulesCount;
2741 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
2742 Next = ListHead->
Flink;
2743 while (Next != ListHead)
2757 DPRINT1(
"WARNING: Exception 0x%x during LdrpRunShimEngineInitRoutine(%u)\n",
PVOID NTAPI RtlEncodeSystemPointer(IN PVOID Pointer)
#define LDRP_LOAD_IN_PROGRESS
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN InvalidName
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
#define LDRP_ENTRY_PROCESSED
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
NTSYSAPI NTSTATUS NTAPI ZwRaiseHardError(_In_ NTSTATUS ErrorStatus, _In_ ULONG NumberOfParameters, _In_ ULONG UnicodeStringParameterMask, _In_ PULONG_PTR Parameters, _In_ ULONG ValidResponseOptions, _Out_ PULONG Response)
ULONG LdrpFatalHardErrorCount
VOID NTAPI LdrpGetShimEngineInterface()
BOOLEAN NTAPI LdrpResolveDllName(PWSTR DllPath, PWSTR DllName, PUNICODE_STRING FullDllName, PUNICODE_STRING BaseDllName)
NTSYSAPI NTSTATUS NTAPI ZwFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ ULONG NumberOfBytesToFlush)
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
_In_ ULONG _In_ ULONG _In_ ULONG Length
LIST_ENTRY InInitializationOrderModuleList
#define IMAGE_FILE_SYSTEM
WORD NumberOfModuleForwarderRefs
_In_ CDROM_SCAN_FOR_SPECIAL_INFO _In_ PCDROM_SCAN_FOR_SPECIAL_HANDLER Function
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING, PCWSTR)
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
#define OBJ_CASE_INSENSITIVE
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
BOOLEAN LdrpLdrDatabaseIsSetup
IN BOOLEAN OUT PSTR Buffer
LIST_ENTRY InLoadOrderModuleList
#define STATUS_INVALID_PARAMETER
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpCodeAuthzCheckDllAllowed(IN PUNICODE_STRING FullName, IN HANDLE DllHandle)
NTSTATUS NTAPI LdrpCreateDllSection(IN PUNICODE_STRING FullName, IN HANDLE DllHandle, IN PULONG DllCharacteristics OPTIONAL, OUT PHANDLE SectionHandle)
#define IMAGE_ORDINAL_FLAG
UNICODE_STRING LdrpDefaultPath
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
LIST_ENTRY InMemoryOrderModuleList
VOID WINAPI SE_DllLoaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
#define LDR_GET_HASH_ENTRY(x)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
struct _IMAGE_BOUND_FORWARDER_REF * PIMAGE_BOUND_FORWARDER_REF
VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
VOID NTAPI LdrpInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI LdrpRunShimEngineInitRoutine(IN ULONG Reason)
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define INVALID_HANDLE_VALUE
struct _IMAGE_IMPORT_DESCRIPTOR * PIMAGE_IMPORT_DESCRIPTOR
IN PVOID IN PVOID IN USHORT IN USHORT Size
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define DLL_PROCESS_ATTACH
NTSTATUS NTAPI LdrpResolveFullName(IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING PathName, IN PUNICODE_STRING FullPathName, IN PUNICODE_STRING *ExpandedName)
PVOID g_pfnSE_ProcessDying
ULONG NTAPI RtlGetFullPathName_Ustr(_In_ PUNICODE_STRING FileName, _In_ ULONG Size, _Out_z_bytecap_(Size) PWSTR Buffer, _Out_opt_ PCWSTR *ShortName, _Out_opt_ PBOOLEAN InvalidName, _Out_ RTL_PATH_TYPE *PathType)
#define STATUS_SXS_KEY_NOT_FOUND
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
#define InsertTailList(ListHead, Entry)
PVOID g_pfnSE_InstallBeforeInit
#define UNICODE_STRING_MAX_BYTES
PVOID ArbitraryUserPointer
NTSTATUS NTAPI LdrpMapDll(IN PWSTR SearchPath OPTIONAL, IN PWSTR DllPath2, IN PWSTR DllName OPTIONAL, IN PULONG DllCharacteristics, IN BOOLEAN Static, IN BOOLEAN Redirect, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
#define RtlMoveMemory(Destination, Source, Length)
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
NTSTATUS NTAPI LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN OUT PATH_TYPE_AND_UNKNOWN * PathType
VOID NTAPI LdrpLoadShimEngine(IN PWSTR ImageName, IN PUNICODE_STRING ProcessImage, IN PVOID pShimData)
#define IMAGE_DIRECTORY_ENTRY_TLS
NTSYSAPI ULONG NTAPI RtlDosSearchPath_U(_In_ PCWSTR Path, _In_ PCWSTR FileName, _In_ PCWSTR Extension, _In_ ULONG BufferSize, _Out_ PWSTR Buffer, _Out_ PWSTR *PartName)
VOID(NTAPI * PIMAGE_TLS_CALLBACK)(PVOID DllHandle, ULONG Reason, PVOID Reserved)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
#define IMAGE_FIRST_SECTION(NtHeader)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define STATUS_SXS_SECTION_NOT_FOUND
LIST_ENTRY LdrpHashTable[LDR_HASH_TABLE_ENTRIES]
#define STATUS_ILLEGAL_DLL_RELOCATION
VOID NTAPI SE_InstallBeforeInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
#define EXCEPTION_EXECUTE_HANDLER
NTSTATUS NTAPI NtOpenSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
#define LDRP_IMAGE_NOT_AT_BASE
BOOLEAN(NTAPI * PDLL_INIT_ROUTINE)(_In_ PVOID DllHandle, _In_ ULONG Reason, _In_opt_ PCONTEXT Context)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
#define LDRP_UPDATE_DEREFCOUNT
NTSTATUS NTAPI RtlImageNtHeaderEx(_In_ ULONG Flags, _In_ PVOID Base, _In_ ULONG64 Size, _Out_ PIMAGE_NT_HEADERS *OutHeaders)
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
VOID NTAPI LdrpUpdateLoadCount3(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags, OUT PUNICODE_STRING UpdateString)
#define STATUS_NAME_TOO_LONG
#define IMAGE_SCN_MEM_NOT_CACHED
#define DLL_PROCESS_DETACH
union _IMAGE_THUNK_DATA32::@2123 u1
#define SECTION_MAP_WRITE
#define NtCurrentProcess()
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
VOID NTAPI SE_ProcessDying(VOID)
struct _LIST_ENTRY * Flink
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
PLDR_DATA_TABLE_ENTRY NTAPI LdrpAllocateDataTableEntry(IN PVOID BaseAddress)
PVOID g_pShimEngineModule
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
_Must_inspect_result_ _In_ ULONG Flags
#define UNICODE_STRING_MAX_CHARS
#define STATUS_INVALID_IMAGE_FORMAT
#define _SEH2_YIELD(STMT_)
#define NT_SUCCESS(StatCode)
#define ALIGN_DOWN(size, type)
HANDLE LdrpKnownDllObjectDirectory
VOID NTAPI LdrpEnsureLoaderLockIsHeld(VOID)
#define IMAGE_FILE_EXECUTABLE_IMAGE
NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionString(ULONG, const GUID *, ULONG, const UNICODE_STRING *, PVOID)
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
string StringOut(const string &String, bool forcePrint=true)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
ULONG NTAPI LdrpClearLoadInProgress(VOID)
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
_In_ PCWSTR _Out_ PVOID * ActCtx
NTSTATUS NTAPI LdrpSearchPath(IN PWCHAR *SearchPath, IN PWCHAR DllName, IN PUNICODE_STRING PathName, IN PUNICODE_STRING FullPathName, IN PUNICODE_STRING *ExpandedName)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
VOID NTAPI LdrpUnloadShimEngine()
#define IMAGE_SCN_MEM_WRITE
static const char * ImageName
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH
#define FILE_SHARE_DELETE
#define LDRP_UNLOAD_IN_PROGRESS
#define RtlImageDirectoryEntryToData
NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG Flags, IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING Extension, IN OUT PUNICODE_STRING StaticString, IN OUT PUNICODE_STRING DynamicString, IN OUT PUNICODE_STRING *NewName, IN PULONG NewFlags, IN PSIZE_T FileNameSize, IN PSIZE_T RequiredLength)
#define FILE_NON_DIRECTORY_FILE
ULONG LdrpNumberOfProcessors
NTSYSAPI void WINAPI RtlReleaseActivationContext(HANDLE)
#define IMAGE_DIRECTORY_ENTRY_EXPORT
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
UNICODE_STRING LdrpKnownDllPath
LIST_ENTRY InLoadOrderLinks
NTSTATUS NTAPI LdrpCheckForKnownDll(PWSTR DllName, PUNICODE_STRING FullDllName, PUNICODE_STRING BaseDllName, HANDLE *SectionHandle)
#define IMAGE_LOADER_FLAGS_COMPLUS
#define STATUS_IMAGE_NOT_AT_BASE
NTSTATUS NTAPI LdrUnloadDll(IN PVOID BaseAddress)
#define STATUS_OBJECT_NAME_NOT_FOUND
NTSYSAPI ULONG NTAPI LdrRelocateImageWithBias(_In_ PVOID NewAddress, _In_ LONGLONG AdditionalBias, _In_ PCCH LoaderName, _In_ ULONG Success, _In_ ULONG Conflict, _In_ ULONG Invalid)
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define DPFLTR_ERROR_LEVEL
#define STATUS_DLL_NOT_FOUND
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
LIST_ENTRY InMemoryOrderLinks
static const char const char * DllPath
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
BOOLEAN NTAPI RtlDoesFileExists_UstrEx(IN PCUNICODE_STRING FileName, IN BOOLEAN SucceedIfBusy)
PVOID LdrpGetShimEngineFunction(PCSZ FunctionName)
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
#define FIELD_OFFSET(t, f)
static OUT PIO_STATUS_BLOCK IoStatusBlock
VOID NTAPI LdrpFreeUnicodeString(IN PUNICODE_STRING StringIn)
NTSTATUS NTAPI LdrpAllocateUnicodeString(IN OUT PUNICODE_STRING StringOut, IN ULONG Length)
#define IMAGE_DIRECTORY_ENTRY_BASERELOC
NTSYSAPI NTSTATUS NTAPI ZwAreMappedFilesTheSame(_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
#define STATUS_PROCEDURE_NOT_FOUND
UNICODE_STRING * PUNICODE_STRING
#define LDRP_UPDATE_REFCOUNT
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char * FunctionName
struct _IMAGE_BOUND_IMPORT_DESCRIPTOR * PIMAGE_BOUND_IMPORT_DESCRIPTOR
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
#define IMAGE_DIRECTORY_ENTRY_IMPORT
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
#define FILE_SYNCHRONOUS_IO_NONALERT
NTSTATUS NTAPI LdrpSnapThunk(IN PVOID ExportBase, IN PVOID ImportBase, IN PIMAGE_THUNK_DATA OriginalThunk, IN OUT PIMAGE_THUNK_DATA Thunk, IN PIMAGE_EXPORT_DIRECTORY ExportEntry, IN ULONG ExportSize, IN BOOLEAN Static, IN LPSTR DllName)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSTATUS NTAPI LdrpSetProtection(PVOID ViewBase, BOOLEAN Restore)
RTL_CRITICAL_SECTION LdrpLoaderLock
#define SECTION_MAP_EXECUTE
#define IMAGE_FILE_RELOCS_STRIPPED
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
NTSYSAPI PVOID WINAPI RtlReAllocateHeap(HANDLE, ULONG, PVOID, SIZE_T)
#define InitializeObjectAttributes(p, n, a, r, s)
PIMAGE_NT_HEADERS WINAPI ImageNtHeader(_In_ PVOID)
#define RtlCopyMemory(Destination, Source, Length)
#define _SEH2_EXCEPT(...)
PVOID NTAPI LdrpFetchAddressOfEntryPoint(IN PVOID ImageBase)
#define _SEH2_GetExceptionCode()
UNICODE_STRING LdrApiDefaultExtension
#define STATUS_OBJECT_PATH_SYNTAX_BAD
#define STATUS_CONFLICTING_ADDRESSES
VOID NTAPI LdrpValidateImageForMp(IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry)
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
NTSYSAPI NTSTATUS NTAPI ZwProtectVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID *BaseAddress, _In_ SIZE_T *NumberOfBytesToProtect, _In_ ULONG NewAccessProtection, _Out_ PULONG OldAccessProtection)
PVOID g_pfnSE_DllUnloaded
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
LIST_ENTRY InInitializationOrderLinks
base of all file and directory entries
PVOID g_pfnSE_InstallAfterInit
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToNtPathName_U(_In_opt_z_ PCWSTR DosPathName, _Out_ PUNICODE_STRING NtPathName, _Out_opt_ PCWSTR *NtFileNamePart, _Out_opt_ PRTL_RELATIVE_NAME_U DirectoryInfo)
#define RtlCompareMemory(s1, s2, l)
#define IMAGE_SCN_MEM_EXECUTE
NTSYSAPI RTL_PATH_TYPE NTAPI RtlDetermineDosPathNameType_U(_In_ PCWSTR Path)
PULONG MinorVersion OPTIONAL