100 #define DEFAULT_SECURITY_COOKIE 0x00002B992DDFA232ll 102 #define DEFAULT_SECURITY_COOKIE 0xBB40E64E 153 SubKeyString = *SubKey;
155 while (SubKeyString.
Length)
157 if (p1[-1] ==
L'\\')
break;
159 SubKeyString.
Length -=
sizeof(*p1);
162 SubKeyString.
Length = SubKey->Length - SubKeyString.
Length;
193 ULONG KeyInfoSize, ResultSize;
217 if (KeyValueInformation !=
NULL)
246 &KeyValueInformation->
Data,
260 if (KeyValueInformation->
Type !=
Type)
274 &KeyValueInformation->
Data,
337 if (FreeHeap)
RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation);
429 (DirSize != 64 && ConfigDir->
Size != DirSize) ||
430 (ConfigDir->
Size < 0x48))
483 if (*
Cookie == 0xBB40) NewCookie &= 0xFFFF;
487 if ((NewCookie == 0) || (NewCookie == *
Cookie))
507 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
511 DPRINT(
"LdrpInitializeThread() called for %wZ (%p/%p)\n",
521 DPRINT1(
"Warning: Unable to allocate ActivationContextStack\n");
532 NextEntry = ListHead->
Flink;
533 while (NextEntry != ListHead)
578 DPRINT(
"%wZ - Calling entry point at %p for thread attaching, %p/%p\n",
590 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_ATTACH) for %wZ\n",
602 NextEntry = NextEntry->
Flink;
632 DPRINT(
"LdrpInitializeThread() done\n");
648 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
649 ULONG BreakOnDllLoad;
653 DPRINT(
"LdrpRunInitializeRoutines() called for %wZ (%p/%p)\n",
670 Count *
sizeof(*LdrRootEntry));
676 LdrRootEntry = LocalArray;
688 DPRINT1(
"[%p,%p] LDR: Real INIT LIST for Process %wZ\n",
696 NextEntry = ListHead->
Flink;
698 while (NextEntry != ListHead)
717 LdrRootEntry[
i] = LdrEntry;
722 DPRINT1(
"[%p,%p] LDR: %wZ init routine %p\n",
735 NextEntry = NextEntry->
Flink;
744 if (Kernel32ProcessInitPostImportFunction)
747 Status = Kernel32ProcessInitPostImportFunction();
750 DPRINT1(
"LDR: LdrpRunInitializeRoutines - Failed running kernel32 post-import function, Status=0x%08lx\n",
Status);
754 Kernel32ProcessInitPostImportFunction =
NULL;
770 LdrEntry = LdrRootEntry[
i];
804 DPRINT1(
" - About to call init routine at %p\n", EntryPoint);
839 DPRINT1(
"%wZ - Calling entry point at %p for DLL_PROCESS_ATTACH\n",
850 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_ATTACH) for %wZ\n",
867 DPRINT1(
"LDR: DLL_PROCESS_ATTACH for dll \"%wZ\" (InitRoutine: %p) failed\n",
878 NextEntry = NextEntry->
Flink;
879 while (NextEntry != ListHead)
888 NextEntry = NextEntry->
Flink;
923 if (LdrRootEntry != LocalArray)
930 DPRINT(
"LdrpRunInitializeRoutines() done\n");
944 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
975 DPRINT1(
"We don't support Etw yet.\n");
980 NextEntry = ListHead->
Blink;
981 while (NextEntry != ListHead)
985 NextEntry = NextEntry->
Blink;
1017 DPRINT(
"%wZ - Calling entry point at %p for thread detaching\n",
1026 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1068 DPRINT(
"LdrpShutdownProcess() done\n");
1084 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
1087 DPRINT(
"LdrShutdownThread() called for %wZ\n",
1094 DPRINT1(
"We don't support Etw yet.\n");
1102 NextEntry = ListHead->
Blink;
1103 while (NextEntry != ListHead)
1107 NextEntry = NextEntry->
Blink;
1149 DPRINT(
"%wZ - Calling entry point at %p for thread detaching\n",
1159 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_DETACH) for %wZ\n",
1217 pFlsData = Teb->FlsData;
1224 for (
n = 1;
n <= FlsHighIndex; ++
n)
1227 if (lpCallback && pFlsData->
Data[
n])
1229 lpCallback(pFlsData->
Data[
n]);
1234 Teb->FlsData =
NULL;
1238 if (Teb->HasFiberData)
1247 DPRINT(
"LdrShutdownThread() done\n");
1266 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1267 NextEntry = ListHead->
Flink;
1268 while (ListHead != NextEntry)
1272 NextEntry = NextEntry->
Flink;
1281 if (!TlsDirectory)
continue;
1289 DPRINT1(
"LDR: Tls Found in %wZ at %p\n",
1338 NextEntry = ListHead->
Flink;
1339 while (NextEntry != ListHead)
1343 NextEntry = NextEntry->
Flink;
1360 DPRINT1(
"LDR: TlsVector %p Index %lu = %p copied from %x to %p\n",
1389 if (!TlsVector)
return;
1393 NextEntry = ListHead->
Flink;
1394 while (NextEntry != ListHead)
1397 NextEntry = NextEntry->
Flink;
1420 ULONG ExecuteOptions, MinimumStackCommit = 0, GlobalFlag;
1442 sizeof(ExecuteOptions),
1461 if (
Peb->ImageUsesLargePages)
1469 L"DisableHeapLookaside",
1483 L"MinimumStackCommitInBytes",
1485 &MinimumStackCommit,
1486 sizeof(MinimumStackCommit),
1512 DPRINT1(
"AVRF: LdrpInitializeApplicationVerifierPackage failed with %08X\n",
Status);
1525 DPRINT1(
"AVRF: LdrpInitializeApplicationVerifierPackage failed with %08X\n",
Status);
1582 } KnownCompatGuids[] = {
1590 ULONG Buffer[(
sizeof(COMPATIBILITY_CONTEXT_ELEMENT) * 10 +
sizeof(ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION)) /
sizeof(
ULONG)];
1591 ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION* ContextCompatInfo;
1602 DPRINT1(
"LdrpInitializeProcessCompat: Corrupt pShimData (0x%x, %u)\n", pShimData->
dwMagic, pShimData->
dwSize);
1609 DPRINT1(
"LdrpInitializeProcessCompat: ProcessCompatVersion set to ignore manifest\n");
1619 SizeRequired =
sizeof(
Buffer);
1623 CompatibilityInformationInActivationContext,
1630 DPRINT1(
"LdrpInitializeProcessCompat: Unable to query process actctx with status %x\n",
Status);
1634 ContextCompatInfo = (ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION*)
Buffer;
1636 if (ContextCompatInfo->ElementCount == 0)
1647 for (
n = 0;
n < ContextCompatInfo->ElementCount; ++
n)
1649 if (ContextCompatInfo->Elements[
n].Type == ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS &&
1654 DPRINT1(
"LdrpInitializeProcessCompat: Not applying automatic fix for winver 0x%x due to policy\n", KnownCompatGuids[
cur].
Version);
1659 if (pShimData ==
NULL)
1668 DPRINT1(
"LdrpInitializeProcessCompat: Unable to allocated %u bytes\n",
sizeof(*pShimData));
1672 pShimData->
dwSize =
sizeof(*pShimData);
1675 Peb->pShimData = pShimData;
1676 *pOldShimData = pShimData;
1681 DPRINT1(
"LdrpInitializeProcessCompat: Found guid for winver 0x%x in manifest from %wZ\n",
1703 RtlInitEmptyUnicodeString(&DotLocal, LocalBuffer,
sizeof(LocalBuffer));
1711 DPRINT1(
"LDR: Failed to allocate memory for .local check\n");
1718 DPRINT1(
"LDR: String too big for .local check\n");
1743 if (DotLocal.
Buffer != LocalBuffer)
1757 ULONG ComSectionSize;
1786 ULONG DebugProcessHeapOnly = 0;
1789 ULONG ExecuteOptions = 0;
1808 ImagePathName.
Buffer = ImagePath;
1823 IsDotNetImage =
TRUE;
1837 OldShimData =
Peb->pShimData;
1848 if (ProcessParameters)
1879 HeapParameters.
Length =
sizeof(HeapParameters);
1882 #define VALID_CONFIG_FIELD(Name) (ConfigSize >= (FIELD_OFFSET(IMAGE_LOAD_CONFIG_DIRECTORY, Name) + sizeof(LoadConfig->Name))) 1887 DPRINT1(
"WARN: Accepting different LOAD_CONFIG size!\n");
1889 DPRINT1(
"Applying LOAD_CONFIG\n");
1915 #undef VALID_CONFIG_FIELD 1933 DPRINT1(
"LDR: PID: 0x%p started - '%wZ'\n",
1990 DPRINT1(
"We don't support user stack trace databases yet\n");
2021 DPRINT1(
"Failed to create process heap\n");
2031 HeapParameters.
Length =
sizeof(HeapParameters);
2035 DPRINT1(
"Failed to create loader private heap\n");
2044 L"DebugProcessHeapOnly",
2046 &DebugProcessHeapOnly,
2103 DPRINT1(
"LDR: %s - failed call to ZwQuerySymbolicLinkObject with status %x\n",
"",
Status);
2119 if (ProcessParameters)
2130 DPRINT1(
"No valid DllPath was given!\n");
2149 DPRINT1(
"LDR: LdrpInitializeProcess - unable to allocate current working directory buffer\n");
2162 DPRINT(
"Using dynamically allocd curdir\n");
2167 DPRINT(
"Using local system root\n");
2194 if (!ImageFileName.
Buffer[0])
2202 Current = ImageFileName.
Buffer;
2205 if (*Current++ ==
'\\')
2208 NtDllName = Current;
2255 DPRINT1(
"LDR: NEW PROCESS\n");
2297 DPRINT1(
"LDR: AVrfInitializeVerifier failed (ntstatus 0x%x)\n",
Status);
2306 DPRINT1(
"We don't support .NET applications yet\n");
2312 PVOID Kernel32BaseAddress;
2313 PVOID FunctionAddress;
2325 &BaseProcessInitPostImportName,
2335 Kernel32ProcessInitPostImportFunction = FunctionAddress;
2338 &BaseQueryModuleDataName,
2348 Kernel32BaseQueryModuleData = FunctionAddress;
2357 DPRINT1(
"LDR: Performing EXE relocation\n");
2373 DPRINT1(
"LdrRelocateImageWithBias() failed\n");
2380 DPRINT1(
"WARNING: Relocated EXE Context");
2392 NextEntry = ListHead->
Flink;
2393 while (ListHead != NextEntry)
2397 NextEntry = NextEntry->
Flink;
2404 if (!
NT_SUCCESS(ImportStatus))
return ImportStatus;
2410 DPRINT1(
"LDR: LdrpProcessInitialization failed to initialize TLS slots; status %x\n",
2444 sizeof(ExecuteOptions));
2447 DPRINT1(
"LDR: Could not set process execute flags 0x%x; status %x\n",
2455 if (((
Peb->OSCSDVersion >> 8) & 0xFF) != 0)
2457 WCHAR szCSDVersion[128];
2462 ((
Peb->OSCSDVersion >> 8) & 0xFF));
2496 DPRINT(
"Querying app compat hacks is missing!\n");
2508 DPRINT1(
"LDR: LdrpProcessInitialization failed running initialization routines; status %x\n",
2529 if (OptionsKey)
NtClose(OptionsKey);
2543 DPRINT1(
"LDR: Process initialization failure for %wZ; NTSTATUS = %08lx\n",
2565 DPRINT(
"LdrpInit() %p/%p\n",
#define _WIN32_WINNT_WIN7
PRTL_BITMAP TlsExpansionBitmap
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
UNICODE_STRING ImageExecOptionsString
#define PF_COMPARE_EXCHANGE128
#define LDRP_ENTRY_PROCESSED
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
ULONG RtlpShutdownProcessFlags
NTSYSAPI NTSTATUS NTAPI ZwRaiseHardError(_In_ NTSTATUS ErrorStatus, _In_ ULONG NumberOfParameters, _In_ ULONG UnicodeStringParameterMask, _In_ PULONG_PTR Parameters, _In_ ULONG ValidResponseOptions, _Out_ PULONG Response)
BOOLEAN LdrpDllValidation
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
NTSYSAPI VOID NTAPI RtlResetRtlTranslations(_In_ PNLSTABLEINFO NlsTable)
IMAGE_TLS_DIRECTORY TlsDirectory
VOID NTAPI LdrpInitializeProcessCompat(PVOID pProcessActctx, PVOID *pOldShimData)
#define HEAP_CREATE_ALIGN_16
BOOLEAN LdrpShutdownInProgress
long __cdecl _InterlockedCompareExchange(_Interlocked_operand_ long volatile *_Destination, long _Exchange, long _Comparand)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
UNICODE_STRING Kernel32String
_In_ ULONG _In_ ULONG _In_ ULONG Length
LIST_ENTRY InInitializationOrderModuleList
UNICODE_STRING LdrpKnownDllPath
#define STATUS_INFO_LENGTH_MISMATCH
LARGE_INTEGER RtlpTimeout
UNICODE_STRING NtSystemRoot
RTL_BITMAP TlsExpansionBitMap
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING, PCWSTR)
#define LDRP_DONT_CALL_FOR_THREADS
NTSTATUS NTAPI LdrShutdownProcess(VOID)
#define OBJ_CASE_INSENSITIVE
ULONG ImageProcessAffinityMask
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
PVOID g_pfnSE_ProcessDying
#define STATUS_APP_INIT_FAILURE
static IN LPSTR IN PVOID Unk2
#define _WIN32_WINNT_WIN10
WCHAR CurrentDirectory[1024]
IN BOOLEAN OUT PSTR Buffer
LIST_ENTRY InLoadOrderModuleList
#define STATUS_INVALID_PARAMETER
#define DLL_THREAD_ATTACH
#define TLS_EXPANSION_SLOTS
struct _LIST_ENTRY * Blink
FORCEINLINE VOID InsertHeadList(_Inout_ PLIST_ENTRY ListHead, _Inout_ __drv_aliasesMem PLIST_ENTRY Entry)
VOID(WINAPI * PFLS_CALLBACK_FUNCTION)(PVOID)
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
PLDR_DATA_TABLE_ENTRY LdrpNtDllDataTableEntry
NTSYSAPI void WINAPI RtlInitializeBitMap(PRTL_BITMAP, PULONG, ULONG)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
LIST_ENTRY InMemoryOrderModuleList
NTSYSAPI VOID NTAPI RtlSetBit(_In_ PRTL_BITMAP BitMapHeader, _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber)
NTSYSAPI NTSTATUS NTAPI ZwDelayExecution(_In_ BOOLEAN Alertable, _In_ LARGE_INTEGER *Interval)
VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
NTSTATUS NTAPI NtQueryPerformanceCounter(OUT PLARGE_INTEGER PerformanceCounter, OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL)
NTSYSAPI NTSTATUS NTAPI ZwOpenDirectoryObject(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSTATUS NTAPI NtQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT PSIZE_T ReturnLength)
IN PVOID IN PVOID IN USHORT IN USHORT Size
VOID NTAPI RtlReleasePebLock(VOID)
#define REACTOS_COMPATVERSION_IGNOREMANIFEST
#define DLL_PROCESS_ATTACH
void actctx_init(PVOID *pOldShimData)
#define _WIN32_WINNT_WINBLUE
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
HANDLE LdrpKnownDllObjectDirectory
static IN LPSTR IN PVOID IN PVOID IN PVOID Unk4
ULONG DeCommitFreeBlockThreshold
#define InsertTailList(ListHead, Entry)
NTSYSAPI NTSTATUS WINAPI RtlQueryInformationActivationContext(ULONG, HANDLE, PVOID, ULONG, PVOID, SIZE_T, SIZE_T *)
#define UNICODE_STRING_MAX_BYTES
NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void)
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(IN PUNICODE_STRING SubKey, IN BOOLEAN Wow64, OUT PHANDLE NewKeyHandle)
BOOLEAN RtlpPageHeapEnabled
#define DLL_THREAD_DETACH
#define STATUS_INVALID_HANDLE
#define RtlMoveMemory(Destination, Source, Length)
#define NX_SUPPORT_POLICY_ALWAYSON
#define DEFAULT_SECURITY_COOKIE
NTSYSAPI PRTL_USER_PROCESS_PARAMETERS NTAPI RtlNormalizeProcessParams(_In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
VOID NTAPI LdrpInitializeDotLocalSupport(PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
FORCEINLINE VOID YieldProcessor(VOID)
PVOID ThreadLocalStoragePointer
#define IMAGE_DIRECTORY_ENTRY_TLS
return STATUS_NOT_IMPLEMENTED
long __cdecl _InterlockedIncrement(_Interlocked_operand_ long volatile *_Addend)
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
#define _WIN32_WINNT_VISTA
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
#define NX_SUPPORT_POLICY_ALWAYSOFF
VOID NTAPI DbgBreakPoint(VOID)
NTSTATUS NTAPI LdrpInitializeTls(VOID)
BOOLEAN LdrpLoaderLockInit
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
RTL_CRITICAL_SECTION_DEBUG LdrpLoaderLockDebug
VOID NTAPI RtlpInitDeferedCriticalSection(VOID)
LIST_ENTRY LdrpHashTable[LDR_HASH_TABLE_ENTRIES]
#define InterlockedCompareExchangePointer
#define RTL_USER_PROCESS_PARAMETERS_PRIVATE_DLL_PATH
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
WCHAR LdrpKnownDllPathBuffer[128]
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
PVOID NTAPI LdrpFetchAddressOfEntryPoint(PVOID ImageBase)
int _snwprintf(wchar_t *buffer, size_t count, const wchar_t *format,...)
#define IMAGE_SUBSYSTEM_NATIVE
#define FLG_APPLICATION_VERIFIER
NTSTATUS NTAPI LdrQueryImageFileExecutionOptionsEx(IN PUNICODE_STRING SubKey, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL, IN BOOLEAN Wow64)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
BOOLEAN NTAPI LdrpDisableProcessCompatGuidDetection(VOID)
BOOLEAN ReadImageFileExecOptions
NTSTATUS NTAPI LdrpInitializeProcess(IN PCONTEXT Context, IN PVOID SystemArgument1)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage(IN HANDLE KeyHandle, IN PPEB Peb, IN BOOLEAN SystemWide, IN BOOLEAN ReadAdvancedOptions)
#define DLL_PROCESS_DETACH
ULONG TlsExpansionBitmapBits[32]
#define NtCurrentProcess()
#define REACTOS_SHIMDATA_MAGIC
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
#define MEM_EXECUTE_OPTION_ENABLE
#define DIRECTORY_TRAVERSE
#define _WIN32_WINNT_WIN8
VOID NTAPI LdrpInitFailure(NTSTATUS Status)
RTL_CRITICAL_SECTION LdrpLoaderLock
ULONG LdrpNumberOfTlsEntries
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
VOID NTAPI SE_ProcessDying(VOID)
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
struct _LIST_ENTRY * Flink
NTSYSAPI VOID NTAPI RtlInitNlsTables(_In_ PUSHORT AnsiTableBase, _In_ PUSHORT OemTableBase, _In_ PUSHORT CaseTableBase, _Out_ PNLSTABLEINFO NlsTable)
NTSYSAPI NTSTATUS NTAPI NtQueryValueKey(IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, IN PVOID KeyValueInformation, IN ULONG Length, IN PULONG ResultLength)
LONG LdrpProcessInitialized
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
VOID NTAPI LdrpFreeTls(VOID)
UNICODE_STRING NtDllString
#define STATUS_OBJECT_TYPE_MISMATCH
ULONG VirtualMemoryThreshold
BOOLEAN RtlpTimeoutDisable
PVOID NTAPI LdrpFetchAddressOfSecurityCookie(PVOID BaseAddress, ULONG SizeOfImage)
#define STATUS_INVALID_IMAGE_FORMAT
VOID NTAPI LdrpLoadShimEngine(IN PWSTR ImageName, IN PUNICODE_STRING ProcessImage, IN PVOID pShimData)
NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
static NTSTATUS(WINAPI *Kernel32ProcessInitPostImportFunction)(VOID)
#define NT_SUCCESS(StatCode)
VOID NTAPI LdrpInit(PCONTEXT Context, PVOID SystemArgument1, PVOID SystemArgument2)
_Must_inspect_result_ _In_ WDFOBJECT _In_ CONST GUID * Guid
struct _KEY_VALUE_PARTIAL_INFORMATION * PKEY_VALUE_PARTIAL_INFORMATION
#define EXCEPTION_EXECUTE_HANDLER
PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define FLG_HEAP_PAGE_ALLOCS
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
static VOID LoadConfig(HWND hwndDlg, PPOWER_SCHEMES_PAGE_DATA pPageData, PPOWER_SCHEME pScheme)
LARGE_INTEGER CriticalSectionTimeout
IN PVOID IN PVOID IN USHORT Version
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
PTEB LdrpTopLevelDllBeingLoadedTeb
_In_ PCWSTR _Out_ PVOID * ActCtx
SIZE_T MinimumStackCommit
VOID NTAPI LdrpEnsureLoaderLockIsHeld(VOID)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
BOOLEAN LdrpLdrDatabaseIsSetup
PVOID g_pfnSE_InstallAfterInit
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
ULONG NTAPI LdrpClearLoadInProgress(VOID)
UNICODE_STRING ImagePathName
PVOID Data[RTL_FLS_MAXIMUM_AVAILABLE]
ULONG MaximumAllocationSize
#define RtlImageDirectoryEntryToData
_In_ ULONG _In_ BATTERY_QUERY_INFORMATION_LEVEL _In_ LONG _In_ ULONG _Out_ PULONG ReturnedLength
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
NTSYSAPI PVOID NTAPI RtlCreateHeap(IN ULONG Flags, IN PVOID HeapBase OPTIONAL, IN ULONG ReserveSize OPTIONAL, IN ULONG CommitSize OPTIONAL, IN PVOID Lock OPTIONAL, IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL)
UNICODE_STRING Wow64OptionsString
#define MEM_EXECUTE_OPTION_DISABLE
UNICODE_STRING CommandLine
PVOID UnicodeCaseTableData
VOID NTAPI LdrpValidateImageForMp(IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry)
NTSTATUS NTAPI LdrQueryImageFileExecutionOptions(IN PUNICODE_STRING SubKey, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
#define VALID_CONFIG_FIELD(Name)
#define LDR_HASH_TABLE_ENTRIES
VOID NTAPI LdrpInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
ULONG LdrpNumberOfProcessors
HANDLE LdrpShutdownThreadId
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2
NTSTATUS NTAPI AVrfInitializeVerifier(VOID)
VOID NTAPI RtlInitializeHeapManager(VOID)
#define Int64ShrlMod32(a, b)
LIST_ENTRY LdrpDllNotificationList
static IN LPSTR IN PVOID IN PVOID Unk3
#define STATUS_DLL_INIT_FAILED
#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
VOID NTAPI LdrpInitializeThread(IN PCONTEXT Context)
ULONG LdrpFatalHardErrorCount
VOID NTAPI RtlpInitializeVectoredExceptionHandling(VOID)
#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION
NTSYSAPI ULONG NTAPI LdrRelocateImageWithBias(_In_ PVOID NewAddress, _In_ LONGLONG AdditionalBias, _In_ PCCH LoaderName, _In_ ULONG Success, _In_ ULONG Conflict, _In_ ULONG Invalid)
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
#define STATUS_BUFFER_OVERFLOW
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI LdrpSetProtection(PVOID ViewBase, BOOLEAN Restore)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define FLS_MAXIMUM_AVAILABLE
UNICODE_STRING LdrpDefaultPath
BOOLEAN NTAPI RtlDoesFileExists_UStr(IN PUNICODE_STRING FileName)
RTL_CRITICAL_SECTION FastPebLock
#define FLG_SHOW_LDR_SNAPS
PLDR_DATA_TABLE_ENTRY NTAPI LdrpAllocateDataTableEntry(IN PVOID BaseAddress)
struct _KEY_VALUE_PARTIAL_INFORMATION KEY_VALUE_PARTIAL_INFORMATION
#define InitializeListHead(ListHead)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
HANDLE ImageExecOptionsKey
HANDLE Wow64ExecOptionsKey
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
NTSTATUS NTAPI LdrpInitializeExecutionOptions(PUNICODE_STRING ImagePathName, PPEB Peb, PHANDLE OptionsKey)
BOOLEAN RtlpUse16ByteSLists
PACTIVATION_CONTEXT EntryPointActivationContext
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
UNICODE_STRING * PUNICODE_STRING
VOID NTAPI RtlAcquirePebLock(VOID)
#define DPH_FLAG_DLL_NOTIFY
ULONG EndAddressOfRawData
NTSTATUS NTAPI LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
#define MEM_EXECUTE_OPTION_PERMANENT
NTSTATUS NTAPI NtTestAlert(VOID)
static LARGE_INTEGER Counter
static BOOL(WINAPI *Kernel32BaseQueryModuleData)(IN LPSTR ModuleName
NTSYSAPI NTSTATUS NTAPI RtlSetCurrentDirectory_U(_In_ PUNICODE_STRING name)
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
NTSYSAPI NTSTATUS NTAPI NtOpenKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
DWORD dwRosProcessCompatVersion
NTSTATUS NTAPI LdrpAllocateTls(VOID)
NTSTATUS NTAPI RtlAllocateActivationContextStack(IN PACTIVATION_CONTEXT_STACK *Stack)
NTSTATUS LdrPerformRelocations(PIMAGE_NT_HEADERS NTHeaders, PVOID ImageBase)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
#define SYMBOLIC_LINK_QUERY
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
struct _PEB_LDR_DATA PEB_LDR_DATA
#define RtlZeroMemory(Destination, Length)
PVOID NTAPI LdrpInitSecurityCookie(PLDR_DATA_TABLE_ENTRY LdrEntry)
#define InitializeObjectAttributes(p, n, a, r, s)
NTSTATUS NTAPI NtOpenSymbolicLinkObject(OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
const UNICODE_STRING LdrpDotLocal
#define RtlCopyMemory(Destination, Source, Length)
UNICODE_STRING CSDVersion
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
PVOID * TlsExpansionSlots
#define FLG_USER_STACK_TRACE_DB
#define _SEH2_EXCEPT(...)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
#define RTL_USER_PROCESS_PARAMETERS_NORMALIZED
PVOID ActivationContextStackPointer
#define _SEH2_GetExceptionCode()
BOOLEAN InheritedAddressSpace
#define RTL_USER_PROCESS_PARAMETERS_LOCAL_DLL_PATH
NTSTATUS NTAPI LdrShutdownThread(VOID)
#define STATUS_CONFLICTING_ADDRESSES
ULONG StartAddressOfRawData
ULONG RtlpDisableHeapLookaside
#define LDRP_PROCESS_ATTACH_CALLED
#define UInt32x32To64(a, b)
ULONG DeCommitTotalFreeThreshold
ULONG LdrpActiveUnloadCount
VOID NTAPI RtlSetUnhandledExceptionFilter(IN PRTLP_UNHANDLED_EXCEPTION_FILTER TopLevelExceptionFilter)
LIST_ENTRY InInitializationOrderLinks
#define Int32x32To64(a, b)
#define RtlCompareMemory(s1, s2, l)
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
#define TLS_MINIMUM_AVAILABLE
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
#define RTL_QUERY_ACTIVATION_CONTEXT_FLAG_NO_ADDREF
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
#define KEY_ENUMERATE_SUB_KEYS
#define RTL_CONSTANT_STRING(s)
PULONG MinorVersion OPTIONAL