ignorepooltag.c File Reference

#include <ntoskrnl.h>
#include <initguid.h>
#include <debug.h>

Include dependency graph for ignorepooltag.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
	DEFINE_GUID (KseIgnoreFreePoolTagGuid, 0x8d0ed225, 0x0892, 0x4efc, 0x9e, 0x72, 0x50, 0x89, 0x12, 0x42, 0x74, 0x53)
static VOID NTAPI	ShimExFreePoolWithTag (_In_ PVOID P, _In_ ULONG Tag)
NTSTATUS NTAPI	KseIgnoreFreePoolTagInitialize (VOID)

Variables
KSE_SHIM	KseIgnoreFreePoolTagShim = { sizeof(KSE_SHIM), &KseIgnoreFreePoolTagGuid, L"IgnoreFreePoolTag", NULL, NULL, NULL, KseIgnoreFreePoolTagCollections }
static KSE_HOOK	KseIgnoreFreePoolTagHooksNT []
static KSE_HOOK_COLLECTION	KseIgnoreFreePoolTagCollections []

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 21 of file ignorepooltag.c.

Function Documentation

DEFINE_GUID()

DEFINE_GUID	(	KseIgnoreFreePoolTagGuid	,
		0x8d0ed225	,
		0x0892	,
		0x4efc	,
		0x9e	,
		0x72	,
		0x50	,
		0x89	,
		0x12	,
		0x42	,
		0x74	,
		0x53
	)

KseIgnoreFreePoolTagInitialize()

NTSTATUS NTAPI KseIgnoreFreePoolTagInitialize

(

VOID

)

Definition at line 59 of file ignorepooltag.c.

{
    NTSTATUS Status;
 
    Status = KseRegisterShim(&KseIgnoreFreePoolTagShim, NULL, 0);
    if (!NT_SUCCESS(Status))
        DPRINT1("KSE: Unable to register IgnoreFreePoolTag shim (0x%lx)\n", Status);
 
    return Status;
}

Referenced by KseInitialize().

ShimExFreePoolWithTag()

static VOID NTAPI ShimExFreePoolWithTag ( _In_ PVOID  P, _In_ ULONG  Tag  )

static

Definition at line 29 of file ignorepooltag.c.

{
    VOID (NTAPI *OriginalFunction)(PVOID, ULONG);
 
    OriginalFunction = KseIgnoreFreePoolTagShim.HookCollectionsArray->HookArray[0].OriginalFunction;
 
    /* Keep validating explicit frees of protected pool, like Windows does */
    if (!(Tag & PROTECTED_POOL))
        Tag = 0;
 
    OriginalFunction(P, Tag);
}

Variable Documentation

KseIgnoreFreePoolTagCollections

KSE_HOOK_COLLECTION KseIgnoreFreePoolTagCollections[]

static

Initial value:

= {
    { KseCollectionNtExport, NULL, KseIgnoreFreePoolTagHooksNT },
    { KseCollectionInvalid },
}

Definition at line 49 of file ignorepooltag.c.

KseIgnoreFreePoolTagHooksNT

KSE_HOOK KseIgnoreFreePoolTagHooksNT[]

static

Initial value:

= {
    { KseHookFunction, { "ExFreePoolWithTag" }, (PVOID)(ULONG_PTR)ShimExFreePoolWithTag },
    { KseHookInvalid }
}

Definition at line 44 of file ignorepooltag.c.

KseIgnoreFreePoolTagShim

KSE_SHIM KseIgnoreFreePoolTagShim = { sizeof(KSE_SHIM), &KseIgnoreFreePoolTagGuid, L"IgnoreFreePoolTag", NULL, NULL, NULL, KseIgnoreFreePoolTagCollections }

Definition at line 54 of file ignorepooltag.c.

Referenced by KseIgnoreFreePoolTagInitialize(), and ShimExFreePoolWithTag().