31#define COOKIE_MAX 0x0000FFFFFFFFFFFFll
32#define DEFAULT_SECURITY_COOKIE 0x00002B992DDFA232ll
34#define DEFAULT_SECURITY_COOKIE 0xBB40E64E
93 TRACE(
"PeLdrpCompareDllName: %s and %wZ, Length = %d "
153 PCHAR ExportName, ForwarderName;
162 WARN(
"DllBase == NULL!\n");
167 ThunkData =
VaToPa(ThunkData);
179 if (!ProcessForwards)
183 ThunkData->u1.AddressOfData =
189 ImportData =
VaToPa((
PVOID)ThunkData->u1.AddressOfData);
192 NameTable =
VaToPa(
RVA(DllBase, ExportDirectory->AddressOfNames));
193 OrdinalTable =
VaToPa(
RVA(DllBase, ExportDirectory->AddressOfNameOrdinals));
203 ExportName =
VaToPa(
RVA(DllBase, NameTable[Hint]));
207 if ((Hint < ExportDirectory->NumberOfNames) &&
210 Ordinal = OrdinalTable[Hint];
222 High = ExportDirectory->NumberOfNames - 1;
231 ExportName =
VaToPa(
RVA(DllBase, NameTable[Middle]));
265 ERR(
"Did not find export '%s'!\n", (
PCHAR)ImportData->
Name);
270 Ordinal = OrdinalTable[Middle];
277 if (Ordinal >= ExportDirectory->NumberOfFunctions)
279 ERR(
"Ordinal number is invalid!\n");
297 CHAR ForwardDllName[256];
299 TRACE(
"PeLdrpBindImportName(): ForwarderName %s\n", ForwarderName);
302 RtlCopyMemory(ForwardDllName, ForwarderName,
sizeof(ForwardDllName));
325 ERR(
"PeLdrpLoadAndScanReferencedDll() failed to load forwarder dll.\n");
338 if (RefExportDirectory)
346 ImportName =
strrchr(ForwarderName,
'.') + 1;
355 ImportByName->
Hint = 0;
372 ThunkData->u1 = RefThunkData.
u1;
437 TRACE(
"PeLdrScanImportDescriptorTable() calling ourselves for %S\n",
438 VaToPa((*DataTableEntry)->BaseDllName.Buffer));
443 ERR(
"PeLdrScanImportDescriptorTable() failed\n");
465 TRACE(
"PeLdrpScanImportAddressTable(): DllBase 0x%X, "
466 "ImageBase 0x%X, ThunkData 0x%X\n", DllBase, ImageBase, ThunkData);
471 ERR(
"Error, DllBase == NULL!\n");
483 TRACE(
"PeLdrpScanImportAddressTable(): ExportDirectory 0x%X\n", ExportDirectory);
486 if (ExportDirectory ==
NULL)
488 ERR(
"DllBase=%p(%p)\n", DllBase,
VaToPa(DllBase));
541 if (NewCookie > COOKIE_MAX)
547 if ((NewCookie == 0) || (NewCookie == *
Cookie))
569 TRACE(
"PeLdrCheckForLoadedDll: DllName %s\n", DllName);
581 TRACE(
"PeLdrCheckForLoadedDll: DTE %p, EP %p, base %p name '%.*ws'\n",
590 *LoadedEntry = DataTableEntry;
592 TRACE(
"PeLdrCheckForLoadedDll: LoadedEntry %X\n", DataTableEntry);
597 ModuleEntry = ModuleEntry->
Flink;
612 ULONG ImportTableSize;
625 BaseName.
Length = ScanDTE->BaseDllName.Length;
626 TRACE(
"PeLdrScanImportDescriptorTable(): %wZ ImportTable = 0x%X\n",
627 &BaseName, ImportTable);
632 if (ImportTable ==
NULL)
636 for (;(ImportTable->
Name != 0) && (ImportTable->
FirstThunk != 0);ImportTable++)
640 TRACE(
"PeLdrScanImportDescriptorTable(): Looking at %s\n", ImportName);
652 &ScanDTE->InLoadOrderLinks,
656 ERR(
"PeLdrpLoadAndScanReferencedDll() failed\n");
667 &ScanDTE->InLoadOrderLinks);
671 ERR(
"PeLdrpScanImportAddressTable() failed: ImportName = '%s', DirectoryPath = '%s'\n",
672 ImportName, DirectoryPath);
694 TRACE(
"PeLdrAllocateDataTableEntry('%s', '%s', %p)\n",
700 if (DataTableEntry ==
NULL)
708 DataTableEntry->
DllBase = BaseVA;
725 BaseDllNameBuffer =
Buffer;
735 *
Buffer++ = *BaseDllName++;
785 TRACE(
"Inserting DTE %p, name='%.*S' DllBase=%p\n", DataTableEntry,
791 *NewEntry = DataTableEntry;
834 ULONG VirtualSize, SizeOfRawData, NumberOfSections;
884 if (PhysicalBase ==
NULL)
889 if (PhysicalBase ==
NULL)
898 VirtualBase =
PaToVa(PhysicalBase);
900 TRACE(
"Base PA: 0x%X, VA: 0x%X\n", PhysicalBase, VirtualBase);
931 for (
i = 0;
i < NumberOfSections;
i++)
937 if (VirtualSize == 0)
938 VirtualSize = SizeOfRawData;
948 if (SizeOfRawData > VirtualSize)
949 SizeOfRawData = VirtualSize;
953 if (SizeOfRawData != 0)
965 ERR(
"PeLdrLoadImage(): Error reading section from file!\n");
971 if (SizeOfRawData < VirtualSize)
973 TRACE(
"PeLdrLoadImage(): SORD %d < VS %d\n", SizeOfRawData, VirtualSize);
1002 *ImageBasePA = PhysicalBase;
1004 TRACE(
"PeLdrLoadImage() done, PA = %p\n", *ImageBasePA);
int strcmp(const char *String1, const char *String2)
ACPI_SIZE strlen(const char *String)
char * strchr(const char *String, int ch)
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
ULONG ArcGetRelativeTime(VOID)
#define DBG_DEFAULT_CHANNEL(ch)
ARC_STATUS ArcSeek(ULONG FileId, LARGE_INTEGER *Position, SEEKMODE SeekMode)
ARC_STATUS ArcOpen(CHAR *Path, OPENMODE OpenMode, ULONG *FileId)
ARC_STATUS ArcClose(_In_ ULONG FileId)
ARC_STATUS ArcRead(ULONG FileId, VOID *Buffer, ULONG N, ULONG *Count)
PVOID MmAllocateMemoryAtAddress(SIZE_T MemorySize, PVOID DesiredAddress, TYPE_OF_MEMORY MemoryType)
VOID MmFreeMemory(PVOID MemoryPointer)
PVOID MmAllocateMemoryWithType(SIZE_T MemorySize, TYPE_OF_MEMORY MemoryType)
FORCEINLINE VOID FrLdrHeapFree(PVOID MemoryPointer, ULONG Tag)
FORCEINLINE PVOID FrLdrHeapAlloc(SIZE_T MemorySize, ULONG Tag)
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
FORCEINLINE PVOID VaToPa(PVOID Va)
FORCEINLINE PVOID PaToVa(PVOID Pa)
#define IMAGE_DIRECTORY_ENTRY_EXPORT
struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY
#define RtlImageDirectoryEntryToData
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
IN PDCB IN POEM_STRING IN PUNICODE_STRING UnicodeName
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
LIST_ENTRY * ModuleListHead
#define LDRP_IMAGE_INTEGRITY_FORCED
#define LDRP_DRIVER_DEPENDENT_DLL
#define LDRP_ENTRY_PROCESSED
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
ULONG NTAPI LdrRelocateImageWithBias(_In_ PVOID BaseAddress, _In_ LONGLONG AdditionalBias, _In_opt_ PCSTR LoaderName, _In_ ULONG Success, _In_ ULONG Conflict, _In_ ULONG Invalid)
#define RTL_SIZEOF_THROUGH_FIELD(type, field)
_In_ ULONG _In_ ULONG _In_ ULONG Length
struct _IMAGE_IMPORT_DESCRIPTOR * PIMAGE_IMPORT_DESCRIPTOR
#define IMAGE_SNAP_BY_ORDINAL(Ordinal)
#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
#define IMAGE_FIRST_SECTION(NtHeader)
NTSTRSAFEAPI RtlStringCbCatA(_Inout_updates_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ NTSTRSAFE_PCSTR pszSrc)
NTSTRSAFEAPI RtlStringCbCopyA(_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ NTSTRSAFE_PCSTR pszSrc)
#define IMAGE_FILE_EXECUTABLE_IMAGE
#define IMAGE_DIRECTORY_ENTRY_IMPORT
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define IMAGE_ORDINAL(Ordinal)
BOOLEAN PeLdrScanImportDescriptorTable(IN OUT PLIST_ENTRY ModuleListHead, IN PCCH DirectoryPath, IN PLDR_DATA_TABLE_ENTRY ScanDTE)
static BOOLEAN PeLdrpScanImportAddressTable(IN OUT PLIST_ENTRY ModuleListHead, IN PVOID DllBase, IN PVOID ImageBase, IN PIMAGE_THUNK_DATA ThunkData, IN PCSTR DirectoryPath, IN PLIST_ENTRY Parent)
VOID PeLdrFreeDataTableEntry(_In_ PLDR_DATA_TABLE_ENTRY Entry)
BOOLEAN PeLdrCheckForLoadedDll(IN OUT PLIST_ENTRY ModuleListHead, IN PCH DllName, OUT PLDR_DATA_TABLE_ENTRY *LoadedEntry)
static BOOLEAN PeLdrpBindImportName(IN OUT PLIST_ENTRY ModuleListHead, IN PVOID DllBase, IN PVOID ImageBase, IN PIMAGE_THUNK_DATA ThunkData, IN PIMAGE_EXPORT_DIRECTORY ExportDirectory, IN ULONG ExportSize, IN BOOLEAN ProcessForwards, IN PCSTR DirectoryPath, IN PLIST_ENTRY Parent)
PELDR_IMPORTDLL_LOAD_CALLBACK PeLdrImportDllLoadCallback
#define DEFAULT_SECURITY_COOKIE
static BOOLEAN PeLdrpLoadAndScanReferencedDll(IN OUT PLIST_ENTRY ModuleListHead, IN PCCH DirectoryPath, IN PCH ImportName, IN PLIST_ENTRY Parent OPTIONAL, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry)
static BOOLEAN PeLdrpCompareDllName(IN PCH DllName, IN PUNICODE_STRING UnicodeName)
static PVOID PeLdrpFetchAddressOfSecurityCookie(PVOID BaseAddress, ULONG SizeOfImage)
BOOLEAN PeLdrAllocateDataTableEntry(IN OUT PLIST_ENTRY ModuleListHead, IN PCCH BaseDllName, IN PCCH FullDllName, IN PVOID BasePA, OUT PLDR_DATA_TABLE_ENTRY *NewEntry)
PVOID PeLdrInitSecurityCookie(PLDR_DATA_TABLE_ENTRY LdrEntry)
BOOLEAN PeLdrLoadImage(_In_ PCSTR FilePath, _In_ TYPE_OF_MEMORY MemoryType, _Out_ PVOID *ImageBasePA)
Loads the specified image from the file.
VOID(NTAPI * PELDR_IMPORTDLL_LOAD_CALLBACK)(_In_ PCSTR FileName)
_CRT_RESTORE_GCC_WARNINGS _CRT_DISABLE_GCC_WARNINGS _Check_return_ _CRTIMP _CONST_RETURN char *__cdecl strrchr(_In_z_ const char *_Str, _In_ int _Ch)
enum _TYPE_OF_MEMORY TYPE_OF_MEMORY
PULONG MinorVersion OPTIONAL
base of all file and directory entries
union _IMAGE_THUNK_DATA32::@2138 u1
UNICODE_STRING FullDllName
LIST_ENTRY InLoadOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Flink
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR _In_opt_ PLONGLONG _In_opt_ PWDF_REQUEST_SEND_OPTIONS _Out_opt_ PULONG_PTR BytesRead
static WLX_DISPATCH_VERSION_1_4 FunctionTable
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie