umfuncs.h File Reference

#include <umtypes.h>
#include <dbgktypes.h>

Include dependency graph for umfuncs.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Typedefs
typedef VOID(NTAPI *	PLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)

Functions
__analysis_noreturn NTSYSAPI VOID NTAPI	DbgBreakPointWithStatus (_In_ ULONG Status)
NTSTATUS NTAPI	DbgUiConnectToDbg (VOID)
NTSTATUS NTAPI	DbgUiContinue (_In_ PCLIENT_ID ClientId, _In_ NTSTATUS ContinueStatus)
NTSTATUS NTAPI	DbgUiDebugActiveProcess (_In_ HANDLE Process)
NTSTATUS NTAPI	DbgUiStopDebugging (_In_ HANDLE Process)
NTSYSAPI NTSTATUS NTAPI	DbgUiWaitStateChange (_In_ PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange, _In_ PLARGE_INTEGER TimeOut)
NTSTATUS NTAPI	DbgUiConvertStateChangeStructure (_In_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange, _In_ PVOID DebugEvent)
VOID NTAPI	DbgUiRemoteBreakin (VOID)
NTSTATUS NTAPI	DbgUiIssueRemoteBreakin (_In_ HANDLE Process)
HANDLE NTAPI	DbgUiGetThreadDebugObject (VOID)
NTSTATUS NTAPI	LdrAddRefDll (_In_ ULONG Flags, _In_ PVOID BaseAddress)
NTSTATUS NTAPI	LdrDisableThreadCalloutsForDll (_In_ PVOID BaseAddress)
NTSTATUS NTAPI	LdrGetDllHandle (_In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *DllHandle)
NTSTATUS NTAPI	LdrGetDllHandleEx (_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
NTSTATUS NTAPI	LdrFindEntryForAddress (_In_ PVOID Address, _Out_ PLDR_DATA_TABLE_ENTRY *Module)
NTSTATUS NTAPI	LdrGetProcedureAddress (_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
VOID NTAPI	LdrInitializeThunk (ULONG Unknown1, ULONG Unknown2, ULONG Unknown3, ULONG Unknown4)
NTSTATUS NTAPI	LdrLoadDll (_In_opt_ PWSTR SearchPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *BaseAddress)
PIMAGE_BASE_RELOCATION NTAPI	LdrProcessRelocationBlock (_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONG_PTR Delta)
NTSTATUS NTAPI	LdrQueryImageFileExecutionOptions (_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
NTSTATUS NTAPI	LdrQueryProcessModuleInformation (_Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
VOID NTAPI	LdrSetDllManifestProber (_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
NTSTATUS NTAPI	LdrShutdownProcess (VOID)
NTSTATUS NTAPI	LdrShutdownThread (VOID)
NTSTATUS NTAPI	LdrUnloadDll (_In_ PVOID BaseAddress)
NTSTATUS NTAPI	LdrVerifyImageMatchesChecksum (_In_ HANDLE FileHandle, _In_ PLDR_CALLBACK Callback, _In_ PVOID CallbackContext, _Out_ PUSHORT ImageCharacteristics)
NTSTATUS NTAPI	LdrOpenImageFileOptionsKey (_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64, _Out_ PHANDLE NewKeyHandle)
NTSTATUS NTAPI	LdrQueryImageFileKeyOption (_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)

Typedef Documentation

PLDR_CALLBACK

typedef VOID(NTAPI * PLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)

Definition at line 217 of file umfuncs.h.

Function Documentation

DbgBreakPointWithStatus()

__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus

(

_In_ ULONG

Status

)

Referenced by ExpDebuggerWorker(), ExpInitializeExecutive(), i8042KbdInterruptService(), KdbpCliInit(), KeUpdateSystemTime(), KiBugCheckDebugBreak(), KiInitializeSystem(), KiSystemStartup(), NtSystemDebugControl(), and vDbgPrintExWithPrefixInternal().

DbgUiConnectToDbg()

NTSTATUS NTAPI DbgUiConnectToDbg

(

VOID

)

Definition at line 25 of file dbgui.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
 
    /* Don't connect twice */
    if (NtCurrentTeb()->DbgSsReserved[1]) return STATUS_SUCCESS;
 
    /* Setup the Attributes */
    InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, 0);
 
    /* Create the object */
    return ZwCreateDebugObject(&NtCurrentTeb()->DbgSsReserved[1],
                               DEBUG_OBJECT_ALL_ACCESS,
                               &ObjectAttributes,
                               DBGK_KILL_PROCESS_ON_EXIT);
}

DbgUiContinue()

NTSTATUS NTAPI DbgUiContinue	(	_In_ PCLIENT_ID	ClientId,
		_In_ NTSTATUS	ContinueStatus
	)

DbgUiConvertStateChangeStructure()

NTSTATUS NTAPI DbgUiConvertStateChangeStructure	(	_In_ PDBGUI_WAIT_STATE_CHANGE	WaitStateChange,
		_In_ PVOID	DebugEvent
	)

DbgUiDebugActiveProcess()

NTSTATUS NTAPI DbgUiDebugActiveProcess

(

_In_ HANDLE

Process

)

DbgUiGetThreadDebugObject()

HANDLE NTAPI DbgUiGetThreadDebugObject

(

VOID

)

Definition at line 333 of file dbgui.c.

{
    /* Just return the handle from the TEB */
    return NtCurrentTeb()->DbgSsReserved[1];
}

DbgUiIssueRemoteBreakin()

NTSTATUS NTAPI DbgUiIssueRemoteBreakin

(

_In_ HANDLE

Process

)

DbgUiRemoteBreakin()

VOID NTAPI DbgUiRemoteBreakin

(

VOID

)

Definition at line 289 of file dbgui.c.

{
    /* Make sure a debugger is enabled; if so, breakpoint */
    if (NtCurrentPeb()->BeingDebugged) DbgBreakPoint();
 
    /* Exit the thread */
    RtlExitUserThread(STATUS_SUCCESS);
}

Referenced by DbgUiIssueRemoteBreakin().

DbgUiStopDebugging()

NTSTATUS NTAPI DbgUiStopDebugging

(

_In_ HANDLE

Process

)

DbgUiWaitStateChange()

NTSYSAPI NTSTATUS NTAPI DbgUiWaitStateChange	(	_In_ PDBGUI_WAIT_STATE_CHANGE	DbgUiWaitStateCange,
		_In_ PLARGE_INTEGER	TimeOut
	)

LdrAddRefDll()

NTSTATUS NTAPI LdrAddRefDll	(	_In_ ULONG	Flags,
		_In_ PVOID	BaseAddress
	)

Definition at line 1205 of file ldrapi.c.

{
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG_PTR Cookie;
    BOOLEAN Locked = FALSE;
 
    /* Check for invalid flags */
    if (Flags & ~(LDR_ADDREF_DLL_PIN))
    {
        /* Fail with invalid parameter status if so */
        Status = STATUS_INVALID_PARAMETER;
        goto quickie;
    }
 
    /* Acquire the loader lock if not in init phase */
    if (!LdrpInLdrInit)
    {
        /* Acquire the lock */
        Status = LdrLockLoaderLock(0, NULL, &Cookie);
        if (!NT_SUCCESS(Status)) goto quickie;
        Locked = TRUE;
    }
 
    /* Get this module's data table entry */
    if (LdrpCheckForLoadedDllHandle(BaseAddress, &LdrEntry))
    {
        if (!LdrEntry)
        {
            /* Shouldn't happen */
            Status = STATUS_INTERNAL_ERROR;
            goto quickie;
        }
 
        /* If this is not a pinned module */
        if (LdrEntry->LoadCount != 0xFFFF)
        {
            /* Update its load count */
            if (Flags & LDR_ADDREF_DLL_PIN)
            {
                /* Pin it by setting load count to -1 */
                LdrEntry->LoadCount = 0xFFFF;
                LdrpUpdateLoadCount2(LdrEntry, LDRP_UPDATE_PIN);
            }
            else
            {
                /* Increase its load count by one */
                LdrEntry->LoadCount++;
                LdrpUpdateLoadCount2(LdrEntry, LDRP_UPDATE_REFCOUNT);
            }
 
            /* Clear load in progress */
            LdrpClearLoadInProgress();
        }
    }
    else
    {
        /* There was an error getting this module's handle, return invalid param status */
        Status = STATUS_INVALID_PARAMETER;
    }
 
quickie:
    /* Check for error case */
    if (!NT_SUCCESS(Status))
    {
        /* Print debug information */
        if ((ShowSnaps) || ((Status != STATUS_NO_SUCH_FILE) &&
                            (Status != STATUS_DLL_NOT_FOUND) &&
                            (Status != STATUS_OBJECT_NAME_NOT_FOUND)))
        {
            DPRINT1("LDR: LdrAddRefDll(%p) 0x%08lx\n", BaseAddress, Status);
        }
    }
 
    /* Release the lock if needed */
    if (Locked) LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, Cookie);
    return Status;
}

Referenced by BasepGetModuleHandleExW(), GetModuleHandleExW(), and tp_object_initialize().

LdrDisableThreadCalloutsForDll()

NTSTATUS NTAPI LdrDisableThreadCalloutsForDll

(

_In_ PVOID

BaseAddress

)

Definition at line 1154 of file ldrapi.c.

{
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    NTSTATUS Status;
    BOOLEAN LockHeld;
    ULONG_PTR Cookie;
    DPRINT("LdrDisableThreadCalloutsForDll (BaseAddress %p)\n", BaseAddress);
 
    /* Don't do it during shutdown */
    if (LdrpShutdownInProgress) return STATUS_SUCCESS;
 
    /* Check if we should grab the lock */
    LockHeld = FALSE;
    if (!LdrpInLdrInit)
    {
        /* Grab the lock */
        Status = LdrLockLoaderLock(0, NULL, &Cookie);
        if (!NT_SUCCESS(Status)) return Status;
        LockHeld = TRUE;
    }
 
    /* Make sure the DLL is valid and get its entry */
    Status = STATUS_DLL_NOT_FOUND;
    if (LdrpCheckForLoadedDllHandle(BaseAddress, &LdrEntry))
    {
        /* Get if it has a TLS slot */
        if (!LdrEntry->TlsIndex)
        {
            /* It doesn't, so you're allowed to call this */
            LdrEntry->Flags |= LDRP_DONT_CALL_FOR_THREADS;
            Status = STATUS_SUCCESS;
        }
    }
 
    /* Check if the lock was held */
    if (LockHeld)
    {
        /* Release it */
        LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, Cookie);
    }
 
    /* Return the status */
    return Status;
}

LdrFindEntryForAddress()

NTSTATUS NTAPI LdrFindEntryForAddress	(	_In_ PVOID	Address,
		_Out_ PLDR_DATA_TABLE_ENTRY *	Module
	)

Definition at line 425 of file ldrapi.c.

{
    PLIST_ENTRY ListHead, NextEntry;
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    PIMAGE_NT_HEADERS NtHeader;
    PPEB_LDR_DATA Ldr = NtCurrentPeb()->Ldr;
    ULONG_PTR DllBase, DllEnd;
 
    DPRINT("LdrFindEntryForAddress(Address %p)\n", Address);
 
    /* Nothing to do */
    if (!Ldr) return STATUS_NO_MORE_ENTRIES;
 
    /* Get the current entry */
    LdrEntry = Ldr->EntryInProgress;
    if (LdrEntry)
    {
        /* Get the NT Headers */
        NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
        if (NtHeader)
        {
            /* Get the Image Base */
            DllBase = (ULONG_PTR)LdrEntry->DllBase;
            DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
 
            /* Check if they match */
            if (((ULONG_PTR)Address >= DllBase) &&
                ((ULONG_PTR)Address < DllEnd))
            {
                /* Return it */
                *Module = LdrEntry;
                return STATUS_SUCCESS;
            }
        }
    }
 
    /* Loop the module list */
    ListHead = &Ldr->InMemoryOrderModuleList;
    NextEntry = ListHead->Flink;
    while (NextEntry != ListHead)
    {
        /* Get the entry and NT Headers */
        LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
        NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
        if (NtHeader)
        {
            /* Get the Image Base */
            DllBase = (ULONG_PTR)LdrEntry->DllBase;
            DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
 
            /* Check if they match */
            if (((ULONG_PTR)Address >= DllBase) &&
                ((ULONG_PTR)Address < DllEnd))
            {
                /* Return it */
                *Module = LdrEntry;
                return STATUS_SUCCESS;
            }
 
            /* Next Entry */
            NextEntry = NextEntry->Flink;
        }
    }
 
    /* Nothing found */
    DbgPrintEx(DPFLTR_LDR_ID,
               DPFLTR_WARNING_LEVEL,
               "LDR: %s() exiting 0x%08lx\n",
               __FUNCTION__,
               STATUS_NO_MORE_ENTRIES);
    return STATUS_NO_MORE_ENTRIES;
}

Referenced by find_query_actctx(), and get_module_filename().

LdrGetDllHandle()

NTSTATUS NTAPI LdrGetDllHandle	(	_In_opt_ PWSTR	DllPath,
		_In_opt_ PULONG	DllCharacteristics,
		_In_ PUNICODE_STRING	DllName,
		_Out_ PVOID *	DllHandle
	)

Definition at line 770 of file ldrapi.c.

{
    /* Call the newer API */
    return LdrGetDllHandleEx(LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT,
                             DllPath,
                             DllCharacteristics,
                             DllName,
                             DllHandle);
}

Referenced by BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), FirstSoundSentry(), GetModuleHandleForUnicodeString(), SeiAddHooks(), SeiFindHookModuleInfoForImportDescriptor(), and SeiInit().

LdrGetDllHandleEx()

NTSTATUS NTAPI LdrGetDllHandleEx	(	_In_ ULONG	Flags,
		_In_opt_ PWSTR	DllPath,
		_In_opt_ PULONG	DllCharacteristics,
		_In_ PUNICODE_STRING	DllName,
		_Out_opt_ PVOID *	DllHandle
	)

Definition at line 505 of file ldrapi.c.

{
    NTSTATUS Status;
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    UNICODE_STRING RedirectName, DynamicString, RawDllName;
    PUNICODE_STRING pRedirectName, CompareName;
    PWCHAR p1, p2, p3;
    BOOLEAN Locked, RedirectedDll;
    ULONG_PTR Cookie;
    ULONG LoadFlag, Length;
 
    /* Initialize the strings */
    RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
    RtlInitEmptyUnicodeString(&RawDllName, NULL, 0);
    RedirectName = *DllName;
    pRedirectName = &RedirectName;
 
    /* Initialize state */
    RedirectedDll = Locked = FALSE;
    LdrEntry = NULL;
    Cookie = 0;
 
    /* Clear the handle */
    if (DllHandle) *DllHandle = NULL;
 
    /* Check for a valid flag combination */
    if ((Flags & ~(LDR_GET_DLL_HANDLE_EX_PIN | LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT)) ||
        (!DllHandle && !(Flags & LDR_GET_DLL_HANDLE_EX_PIN)))
    {
        DPRINT1("Flags are invalid or no DllHandle given\n");
        Status = STATUS_INVALID_PARAMETER;
        goto Quickie;
    }
 
    /* If not initializing */
    if (!LdrpInLdrInit)
    {
        /* Acquire the lock */
        Status = LdrLockLoaderLock(0, NULL, &Cookie);
        if (!NT_SUCCESS(Status)) goto Quickie;
 
        /* Remember we own it */
        Locked = TRUE;
    }
 
    Status = LdrpApplyFileNameRedirection(
        pRedirectName, &LdrApiDefaultExtension, NULL, &DynamicString, &pRedirectName, &RedirectedDll);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("LdrpApplyFileNameRedirection FAILED: (Status 0x%x)\n", Status);
        goto Quickie;
    }
 
    /* Set default failure code */
    Status = STATUS_DLL_NOT_FOUND;
 
    /* Use the cache if we can */
    if (LdrpGetModuleHandleCache)
    {
        /* Check if we were redirected */
        if (RedirectedDll)
        {
            /* Check the flag */
            if (!(LdrpGetModuleHandleCache->Flags & LDRP_REDIRECTED))
            {
                goto DontCompare;
            }
 
            /* Use the right name */
            CompareName = &LdrpGetModuleHandleCache->FullDllName;
        }
        else
        {
            /* Check the flag */
            if (LdrpGetModuleHandleCache->Flags & LDRP_REDIRECTED)
            {
                goto DontCompare;
            }
 
            /* Use the right name */
            CompareName = &LdrpGetModuleHandleCache->BaseDllName;
        }
 
        /* Check if the name matches */
        if (RtlEqualUnicodeString(pRedirectName,
                                  CompareName,
                                  TRUE))
        {
            /* Skip the rest */
            LdrEntry = LdrpGetModuleHandleCache;
 
            /* Return success */
            Status = STATUS_SUCCESS;
            goto Quickie;
        }
    }
 
DontCompare:
    /* Find the name without the extension */
    p1 = pRedirectName->Buffer;
    p2 = NULL;
    p3 = &p1[pRedirectName->Length / sizeof(WCHAR)];
    while (p1 != p3)
    {
        if (*p1++ == L'.')
        {
            p2 = p1;
        }
        else if (*p1 == L'\\')
        {
            p2 = NULL;
        }
    }
 
    /* Check if no extension was found or if we got a slash */
    if (!(p2) || (*p2 == L'\\') || (*p2 == L'/'))
    {
        /* Check that we have space to add one */
        Length = pRedirectName->Length +
                 LdrApiDefaultExtension.Length + sizeof(UNICODE_NULL);
        if (Length >= UNICODE_STRING_MAX_BYTES)
        {
            /* No space to add the extension */
            Status = STATUS_NAME_TOO_LONG;
            goto Quickie;
        }
 
        /* Setup the string */
        RawDllName.MaximumLength = Length;
        ASSERT(Length >= sizeof(UNICODE_NULL));
        RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
                                            0,
                                            RawDllName.MaximumLength);
        if (!RawDllName.Buffer)
        {
            Status = STATUS_NO_MEMORY;
            goto Quickie;
        }
 
        /* Copy the string and add extension */
        RtlCopyUnicodeString(&RawDllName, pRedirectName);
        RtlAppendUnicodeStringToString(&RawDllName, &LdrApiDefaultExtension);
    }
    else
    {
        /* Check if there's something in the name */
        Length = pRedirectName->Length;
        if (Length)
        {
            /* Check and remove trailing period */
            if (pRedirectName->Buffer[Length / sizeof(WCHAR) - sizeof(ANSI_NULL)] == '.')
            {
                /* Decrease the size */
                pRedirectName->Length -= sizeof(WCHAR);
            }
        }
 
        /* Setup the string */
        RawDllName.MaximumLength = pRedirectName->Length + sizeof(WCHAR);
        RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
                                            0,
                                            RawDllName.MaximumLength);
        if (!RawDllName.Buffer)
        {
            Status = STATUS_NO_MEMORY;
            goto Quickie;
        }
 
        /* Copy the string */
        RtlCopyUnicodeString(&RawDllName, pRedirectName);
    }
 
    /* Display debug string */
    if (ShowSnaps)
    {
        DPRINT1("LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
                &RawDllName,
                DllPath ? ((ULONG_PTR)DllPath == 1 ? L"" : DllPath) : L"");
    }
 
    /* Do the lookup */
    if (LdrpCheckForLoadedDll(DllPath,
                              &RawDllName,
                              ((ULONG_PTR)DllPath == 1) ? TRUE : FALSE,
                              RedirectedDll,
                              &LdrEntry))
    {
        /* Update cached entry */
        LdrpGetModuleHandleCache = LdrEntry;
 
        /* Return success */
        Status = STATUS_SUCCESS;
    }
    else
    {
        /* Make sure to NULL this */
        LdrEntry = NULL;
    }
Quickie:
    /* The success path must have a valid loader entry */
    ASSERT((LdrEntry != NULL) == NT_SUCCESS(Status));
 
    /* Check if we got an entry and success */
    DPRINT("Got LdrEntry->BaseDllName %wZ\n", LdrEntry ? &LdrEntry->BaseDllName : NULL);
    if ((LdrEntry) && (NT_SUCCESS(Status)))
    {
        /* Check if the DLL is locked */
        if ((LdrEntry->LoadCount != 0xFFFF) &&
            !(Flags & LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT))
        {
            /* Check what to do with the load count */
            if (Flags & LDR_GET_DLL_HANDLE_EX_PIN)
            {
                /* Pin it */
                LdrEntry->LoadCount = 0xFFFF;
                LoadFlag = LDRP_UPDATE_PIN;
            }
            else
            {
                /* Increase the load count */
                LdrEntry->LoadCount++;
                LoadFlag = LDRP_UPDATE_REFCOUNT;
            }
 
            /* Update the load count now */
            LdrpUpdateLoadCount2(LdrEntry, LoadFlag);
            LdrpClearLoadInProgress();
        }
 
        /* Check if the caller is requesting the handle */
        if (DllHandle) *DllHandle = LdrEntry->DllBase;
    }
 
    /* Free string if needed */
    if (DynamicString.Buffer) RtlFreeUnicodeString(&DynamicString);
 
    /* Free the raw DLL Name if needed */
    if (RawDllName.Buffer)
    {
        /* Free the heap-allocated buffer */
        RtlFreeHeap(RtlGetProcessHeap(), 0, RawDllName.Buffer);
        RawDllName.Buffer = NULL;
    }
 
    /* Release lock */
    if (Locked)
    {
        LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS,
                            Cookie);
    }
 
    /* Return */
    return Status;
}

Referenced by GetModuleHandleExW(), LdrGetDllHandle(), load_library(), and LoadLibraryExW().

LdrGetProcedureAddress()

NTSTATUS NTAPI LdrGetProcedureAddress	(	_In_ PVOID	BaseAddress,
		_In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING	Name,
		_In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG	Ordinal,
		_Out_ PVOID *	ProcedureAddress
	)

Definition at line 789 of file ldrapi.c.

{
    /* Call the internal routine and tell it to execute DllInit */
    return LdrpGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress, TRUE);
}

Referenced by BaseInitApphelp(), BasepReplaceProcessThreadTokens(), BaseSrvDelayLoadKernel32(), BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), CsrLoadServerDll(), FirstSoundSentry(), get_proc_address(), GetProcAddress(), InitApphelp(), LdrpInitializeProcess(), LoadOle32Export(), LsapAddAuthPackage(), SeiCreateShimModuleInfo(), and SeiResolveAPI().

LdrInitializeThunk()

VOID NTAPI LdrInitializeThunk	(	ULONG	Unknown1,
		ULONG	Unknown2,
		ULONG	Unknown3,
		ULONG	Unknown4
	)

LdrLoadDll()

NTSTATUS NTAPI LdrLoadDll	(	_In_opt_ PWSTR	SearchPath,
		_In_opt_ PULONG	DllCharacteristics,
		_In_ PUNICODE_STRING	DllName,
		_Out_ PVOID *	BaseAddress
	)

Definition at line 312 of file ldrapi.c.

{
    WCHAR StringBuffer[MAX_PATH];
    UNICODE_STRING StaticString, DynamicString;
    BOOLEAN RedirectedDll = FALSE;
    NTSTATUS Status;
    ULONG_PTR Cookie;
    PUNICODE_STRING OldTldDll;
    PTEB Teb = NtCurrentTeb();
 
    /* Initialize the strings */
    RtlInitEmptyUnicodeString(&StaticString, StringBuffer, sizeof(StringBuffer));
    RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
 
    Status = LdrpApplyFileNameRedirection(DllName, &LdrApiDefaultExtension, &StaticString, &DynamicString, &DllName, &RedirectedDll);
 
    /* Lock the loader lock */
    LdrLockLoaderLock(LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, NULL, &Cookie);
 
    /* Check if there's a TLD DLL being loaded */
    OldTldDll = LdrpTopLevelDllBeingLoaded;
    _SEH2_TRY
    {
 
        if (OldTldDll)
        {
            /* This is a recursive load, do something about it? */
            if ((ShowSnaps) || (LdrpShowRecursiveLoads) || (LdrpBreakOnRecursiveDllLoads))
            {
                /* Print out debug messages */
                DPRINT1("[%p, %p] LDR: Recursive DLL Load\n",
                        Teb->RealClientId.UniqueProcess,
                        Teb->RealClientId.UniqueThread);
                DPRINT1("[%p, %p]      Previous DLL being loaded \"%wZ\"\n",
                        Teb->RealClientId.UniqueProcess,
                        Teb->RealClientId.UniqueThread,
                        OldTldDll);
                DPRINT1("[%p, %p]      DLL being requested \"%wZ\"\n",
                        Teb->RealClientId.UniqueProcess,
                        Teb->RealClientId.UniqueThread,
                        DllName);
 
                /* Was it initializing too? */
                if (!LdrpCurrentDllInitializer)
                {
                    DPRINT1("[%p, %p] LDR: No DLL Initializer was running\n",
                            Teb->RealClientId.UniqueProcess,
                            Teb->RealClientId.UniqueThread);
                }
                else
                {
                    DPRINT1("[%p, %p]      DLL whose initializer was currently running \"%wZ\"\n",
                            Teb->ClientId.UniqueProcess,
                            Teb->ClientId.UniqueThread,
                            &LdrpCurrentDllInitializer->BaseDllName);
                }
            }
        }
 
        /* Set this one as the TLD DLL being loaded*/
        LdrpTopLevelDllBeingLoaded = DllName;
 
        /* Load the DLL */
        Status = LdrpLoadDll(RedirectedDll,
                             SearchPath,
                             DllCharacteristics,
                             DllName,
                             BaseAddress,
                             TRUE);
        if (NT_SUCCESS(Status))
        {
            Status = STATUS_SUCCESS;
        }
        else if ((Status != STATUS_NO_SUCH_FILE) &&
                 (Status != STATUS_DLL_NOT_FOUND) &&
                 (Status != STATUS_OBJECT_NAME_NOT_FOUND) &&
                 (Status != STATUS_DLL_INIT_FAILED))
        {
            DbgPrintEx(DPFLTR_LDR_ID,
                       DPFLTR_WARNING_LEVEL,
                       "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
                       __FUNCTION__,
                       DllName,
                       Status);
        }
    }
    _SEH2_FINALLY
    {
        /* Restore the old TLD DLL */
        LdrpTopLevelDllBeingLoaded = OldTldDll;
 
        /* Release the lock */
        LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, Cookie);
    }
    _SEH2_END;
 
    /* Do we have a redirect string? */
    if (DynamicString.Buffer)
        RtlFreeUnicodeString(&DynamicString);
 
    /* Return */
    return Status;
}

Referenced by AVrfpLoadAndInitializeProvider(), BaseInitApphelp(), BaseSrvDelayLoadKernel32(), CsrLoadServerDll(), InitApphelp(), LdrpInitializeProcess(), load_library(), LoadLibraryExW(), LoadOle32Export(), LsapAddAuthPackage(), SeiInit(), and START_TEST().

LdrOpenImageFileOptionsKey()

NTSTATUS NTAPI LdrOpenImageFileOptionsKey	(	_In_ PUNICODE_STRING	SubKey,
		_In_ BOOLEAN	Wow64,
		_Out_ PHANDLE	NewKeyHandle
	)

Definition at line 111 of file ldrinit.c.

{
    PHANDLE RootKeyLocation;
    HANDLE RootKey;
    UNICODE_STRING SubKeyString;
    OBJECT_ATTRIBUTES ObjectAttributes;
    NTSTATUS Status;
    PWCHAR p1;
 
    /* Check which root key to open */
    if (Wow64)
        RootKeyLocation = &Wow64ExecOptionsKey;
    else
        RootKeyLocation = &ImageExecOptionsKey;
 
    /* Get the current key */
    RootKey = *RootKeyLocation;
 
    /* Setup the object attributes */
    InitializeObjectAttributes(&ObjectAttributes,
                               Wow64 ?
                               &Wow64OptionsString : &ImageExecOptionsString,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    /* Open the root key */
    Status = ZwOpenKey(&RootKey, KEY_ENUMERATE_SUB_KEYS, &ObjectAttributes);
    if (NT_SUCCESS(Status))
    {
        /* Write the key handle */
        if (InterlockedCompareExchangePointer(RootKeyLocation, RootKey, NULL) != NULL)
        {
            /* Someone already opened it, use it instead */
            NtClose(RootKey);
            RootKey = *RootKeyLocation;
        }
 
        /* Extract the name */
        SubKeyString = *SubKey;
        p1 = (PWCHAR)((ULONG_PTR)SubKeyString.Buffer + SubKeyString.Length);
        while (SubKeyString.Length)
        {
            if (p1[-1] == L'\\') break;
            p1--;
            SubKeyString.Length -= sizeof(*p1);
        }
        SubKeyString.Buffer = p1;
        SubKeyString.Length = SubKey->Length - SubKeyString.Length;
 
        /* Setup the object attributes */
        InitializeObjectAttributes(&ObjectAttributes,
                                   &SubKeyString,
                                   OBJ_CASE_INSENSITIVE,
                                   RootKey,
                                   NULL);
 
        /* Open the setting key */
        Status = ZwOpenKey((PHANDLE)NewKeyHandle, GENERIC_READ, &ObjectAttributes);
    }
 
    /* Return to caller */
    return Status;
}

Referenced by CreateProcessInternalW(), LdrpInitializeExecutionOptions(), and LdrQueryImageFileExecutionOptionsEx().

LdrProcessRelocationBlock()

PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock	(	_In_ ULONG_PTR	Address,
		_In_ ULONG	Count,
		_In_ PUSHORT	TypeOffset,
		_In_ LONG_PTR	Delta
	)

Definition at line 1570 of file ldrapi.c.

{
    return LdrProcessRelocationBlockLongLong(Address, Count, TypeOffset, Delta);
}

LdrQueryImageFileExecutionOptions()

NTSTATUS NTAPI LdrQueryImageFileExecutionOptions	(	_In_ PUNICODE_STRING	SubKey,
		_In_ PCWSTR	ValueName,
		_In_ ULONG	Type,
		_Out_ PVOID	Buffer,
		_In_ ULONG	BufferSize,
		_Out_opt_ PULONG	ReturnedLength
	)

Definition at line 388 of file ldrinit.c.

{
    /* Call the newer function */
    return LdrQueryImageFileExecutionOptionsEx(SubKey,
                                               ValueName,
                                               Type,
                                               Buffer,
                                               BufferSize,
                                               ReturnedLength,
                                               FALSE);
}

Referenced by LdrpRunInitializeRoutines(), and SmpLoadSubSystemsForMuSession().

LdrQueryImageFileKeyOption()

NTSTATUS NTAPI LdrQueryImageFileKeyOption	(	_In_ HANDLE	KeyHandle,
		_In_ PCWSTR	ValueName,
		_In_ ULONG	Type,
		_Out_ PVOID	Buffer,
		_In_ ULONG	BufferSize,
		_Out_opt_ PULONG	ReturnedLength
	)

Definition at line 184 of file ldrinit.c.

{
    ULONG KeyInfo[256];
    UNICODE_STRING ValueNameString, IntegerString;
    ULONG KeyInfoSize, ResultSize;
    PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation = (PKEY_VALUE_PARTIAL_INFORMATION)&KeyInfo;
    BOOLEAN FreeHeap = FALSE;
    NTSTATUS Status;
 
    /* Build a string for the value name */
    Status = RtlInitUnicodeStringEx(&ValueNameString, ValueName);
    if (!NT_SUCCESS(Status)) return Status;
 
    /* Query the value */
    Status = ZwQueryValueKey(KeyHandle,
                             &ValueNameString,
                             KeyValuePartialInformation,
                             KeyValueInformation,
                             sizeof(KeyInfo),
                             &ResultSize);
    if (Status == STATUS_BUFFER_OVERFLOW)
    {
        /* Our local buffer wasn't enough, allocate one */
        KeyInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) +
                      KeyValueInformation->DataLength;
        KeyValueInformation = RtlAllocateHeap(RtlGetProcessHeap(),
                                              0,
                                              KeyInfoSize);
        if (KeyValueInformation != NULL)
        {
            /* Try again */
            Status = ZwQueryValueKey(KeyHandle,
                                     &ValueNameString,
                                     KeyValuePartialInformation,
                                     KeyValueInformation,
                                     KeyInfoSize,
                                     &ResultSize);
            FreeHeap = TRUE;
        }
        else
        {
            /* Give up this time */
            Status = STATUS_NO_MEMORY;
        }
    }
 
    /* Check for success */
    if (NT_SUCCESS(Status))
    {
        /* Handle binary data */
        if (KeyValueInformation->Type == REG_BINARY)
        {
            /* Check validity */
            if ((Buffer) && (KeyValueInformation->DataLength <= BufferSize))
            {
                /* Copy into buffer */
                RtlMoveMemory(Buffer,
                              &KeyValueInformation->Data,
                              KeyValueInformation->DataLength);
            }
            else
            {
                Status = STATUS_BUFFER_OVERFLOW;
            }
 
            /* Copy the result length */
            if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
        }
        else if (KeyValueInformation->Type == REG_DWORD)
        {
            /* Check for valid type */
            if (KeyValueInformation->Type != Type)
            {
                /* Error */
                Status = STATUS_OBJECT_TYPE_MISMATCH;
            }
            else
            {
                /* Check validity */
                if ((Buffer) &&
                    (BufferSize == sizeof(ULONG)) &&
                    (KeyValueInformation->DataLength <= BufferSize))
                {
                    /* Copy into buffer */
                    RtlMoveMemory(Buffer,
                                  &KeyValueInformation->Data,
                                  KeyValueInformation->DataLength);
                }
                else
                {
                    Status = STATUS_BUFFER_OVERFLOW;
                }
 
                /* Copy the result length */
                if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
            }
        }
        else if (KeyValueInformation->Type != REG_SZ)
        {
            /* We got something weird */
            Status = STATUS_OBJECT_TYPE_MISMATCH;
        }
        else
        {
            /*  String, check what you requested */
            if (Type == REG_DWORD)
            {
                /* Validate */
                if (BufferSize != sizeof(ULONG))
                {
                    /* Invalid size */
                    BufferSize = 0;
                    Status = STATUS_INFO_LENGTH_MISMATCH;
                }
                else
                {
                    /* OK, we know what you want... */
                    IntegerString.Buffer = (PWSTR)KeyValueInformation->Data;
                    IntegerString.Length = (USHORT)KeyValueInformation->DataLength -
                                           sizeof(WCHAR);
                    IntegerString.MaximumLength = (USHORT)KeyValueInformation->DataLength;
                    Status = RtlUnicodeStringToInteger(&IntegerString, 0, (PULONG)Buffer);
                }
            }
            else
            {
                /* Validate */
                if (KeyValueInformation->DataLength > BufferSize)
                {
                    /* Invalid */
                    Status = STATUS_BUFFER_OVERFLOW;
                }
                else
                {
                    /* Set the size */
                    BufferSize = KeyValueInformation->DataLength;
                }
 
                /* Copy the string */
                RtlMoveMemory(Buffer, &KeyValueInformation->Data, BufferSize);
            }
 
            /* Copy the result length */
            if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
        }
    }
 
    /* Check if buffer was in heap */
    if (FreeHeap) RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation);
 
    /* Return status */
    return Status;
}

Referenced by AVrfReadIFEO(), CreateProcessInternalW(), LdrpInitializeExecutionOptions(), LdrpInitializeProcess(), and LdrQueryImageFileExecutionOptionsEx().

LdrQueryProcessModuleInformation()

NTSTATUS NTAPI LdrQueryProcessModuleInformation	(	_Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES	ModuleInformation,
		_In_ ULONG	Size,
		_Out_opt_ PULONG	ReturnedSize
	)

Definition at line 1076 of file ldrapi.c.

{
    /* Call Ex version of the API */
    return LdrQueryProcessModuleInformationEx(0, 0, ModuleInformation, Size, ReturnedSize);
}

Referenced by RtlQueryProcessDebugInformation(), and Test_ProcessModules().

LdrSetDllManifestProber()

VOID NTAPI LdrSetDllManifestProber

(

_In_ PLDR_MANIFEST_PROBER_ROUTINE

Routine

)

Definition at line 73 of file ldrapi.c.

{
    LdrpManifestProberRoutine = Routine;
}

Referenced by DllMain().

LdrShutdownProcess()

NTSTATUS NTAPI LdrShutdownProcess

(

VOID

)

Definition at line 950 of file ldrinit.c.

{
    PPEB Peb = NtCurrentPeb();
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    PLIST_ENTRY NextEntry, ListHead;
    RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
    PVOID EntryPoint;
 
    DPRINT("LdrShutdownProcess() called for %wZ\n", &LdrpImageEntry->BaseDllName);
    if (LdrpShutdownInProgress) return STATUS_SUCCESS;
 
    /* Tell the Shim Engine */
    if (g_ShimsEnabled)
    {
        VOID(NTAPI *SE_ProcessDying)();
        SE_ProcessDying = RtlDecodeSystemPointer(g_pfnSE_ProcessDying);
        SE_ProcessDying();
    }
 
    /* Tell the world */
    if (ShowSnaps)
    {
        DPRINT1("\n");
    }
 
    /* Set the shutdown variables */
    LdrpShutdownThreadId = NtCurrentTeb()->RealClientId.UniqueThread;
    LdrpShutdownInProgress = TRUE;
 
    /* Enter the Loader Lock */
    RtlEnterCriticalSection(&LdrpLoaderLock);
 
    /* Cleanup trace logging data (Etw) */
    if (SharedUserData->TraceLogging)
    {
        /* FIXME */
        DPRINT1("We don't support Etw yet.\n");
    }
 
    /* Start at the end */
    ListHead = &Peb->Ldr->InInitializationOrderModuleList;
    NextEntry = ListHead->Blink;
    while (NextEntry != ListHead)
    {
        /* Get the current entry */
        LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
        NextEntry = NextEntry->Blink;
 
        /* Make sure it's not ourselves */
        if (Peb->ImageBaseAddress != LdrEntry->DllBase)
        {
            /* Get the entrypoint */
            EntryPoint = LdrEntry->EntryPoint;
 
            /* Check if we are ready to call it */
            if (EntryPoint &&
                (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
                LdrEntry->Flags)
            {
                /* Set up the Act Ctx */
                ActCtx.Size = sizeof(ActCtx);
                ActCtx.Format = 1;
                RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
                /* Activate the ActCtx */
                RtlActivateActivationContextUnsafeFast(&ActCtx,
                                                       LdrEntry->EntryPointActivationContext);
 
                _SEH2_TRY
                {
                    /* Check if it has TLS */
                    if (LdrEntry->TlsIndex)
                    {
                        /* Call TLS */
                        LdrpCallTlsInitializers(LdrEntry, DLL_PROCESS_DETACH);
                    }
 
                    /* Call the Entrypoint */
                    DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
                           &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
                    LdrpCallInitRoutine(EntryPoint,
                                        LdrEntry->DllBase,
                                        DLL_PROCESS_DETACH,
                                        (PVOID)1);
                }
                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                    DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
                            _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
                }
                _SEH2_END;
 
                /* Deactivate the ActCtx */
                RtlDeactivateActivationContextUnsafeFast(&ActCtx);
            }
        }
    }
 
    /* Check for TLS */
    if (LdrpImageHasTls)
    {
        /* Set up the Act Ctx */
        ActCtx.Size = sizeof(ActCtx);
        ActCtx.Format = 1;
        RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
        /* Activate the ActCtx */
        RtlActivateActivationContextUnsafeFast(&ActCtx,
                                               LdrpImageEntry->EntryPointActivationContext);
 
        _SEH2_TRY
        {
            /* Do TLS callbacks */
            LdrpCallTlsInitializers(LdrpImageEntry, DLL_PROCESS_DETACH);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Do nothing */
        }
        _SEH2_END;
 
        /* Deactivate the ActCtx */
        RtlDeactivateActivationContextUnsafeFast(&ActCtx);
    }
 
    /* FIXME: Do Heap detection and Etw final shutdown */
 
    /* Release the lock */
    RtlLeaveCriticalSection(&LdrpLoaderLock);
    DPRINT("LdrpShutdownProcess() done\n");
 
    return STATUS_SUCCESS;
}

LdrShutdownThread()

NTSTATUS NTAPI LdrShutdownThread

(

VOID

)

Definition at line 1089 of file ldrinit.c.

{
    PPEB Peb = NtCurrentPeb();
    PTEB Teb = NtCurrentTeb();
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    PLIST_ENTRY NextEntry, ListHead;
    RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
    PVOID EntryPoint;
 
    DPRINT("LdrShutdownThread() called for %wZ\n",
            &LdrpImageEntry->BaseDllName);
 
    /* Cleanup trace logging data (Etw) */
    if (SharedUserData->TraceLogging)
    {
        /* FIXME */
        DPRINT1("We don't support Etw yet.\n");
    }
 
    /* Get the Ldr Lock */
    RtlEnterCriticalSection(&LdrpLoaderLock);
 
    /* Start at the end */
    ListHead = &Peb->Ldr->InInitializationOrderModuleList;
    NextEntry = ListHead->Blink;
    while (NextEntry != ListHead)
    {
        /* Get the current entry */
        LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
        NextEntry = NextEntry->Blink;
 
        /* Make sure it's not ourselves */
        if (Peb->ImageBaseAddress != LdrEntry->DllBase)
        {
            /* Check if we should call */
            if (!(LdrEntry->Flags & LDRP_DONT_CALL_FOR_THREADS) &&
                (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
                (LdrEntry->Flags & LDRP_IMAGE_DLL))
            {
                /* Get the entrypoint */
                EntryPoint = LdrEntry->EntryPoint;
 
                /* Check if we are ready to call it */
                if (EntryPoint)
                {
                    /* Set up the Act Ctx */
                    ActCtx.Size = sizeof(ActCtx);
                    ActCtx.Format = 1;
                    RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
                    /* Activate the ActCtx */
                    RtlActivateActivationContextUnsafeFast(&ActCtx,
                                                           LdrEntry->EntryPointActivationContext);
 
                    _SEH2_TRY
                    {
                        /* Check if it has TLS */
                        if (LdrEntry->TlsIndex)
                        {
                            /* Make sure we're not shutting down */
                            if (!LdrpShutdownInProgress)
                            {
                                /* Call TLS */
                                LdrpCallTlsInitializers(LdrEntry, DLL_THREAD_DETACH);
                            }
                        }
 
                        /* Make sure we're not shutting down */
                        if (!LdrpShutdownInProgress)
                        {
                            /* Call the Entrypoint */
                            DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
                                   &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
                            LdrpCallInitRoutine(EntryPoint,
                                                LdrEntry->DllBase,
                                                DLL_THREAD_DETACH,
                                                NULL);
                        }
                    }
                    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                    {
                        DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_DETACH) for %wZ\n",
                                _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
                    }
                    _SEH2_END;
 
                    /* Deactivate the ActCtx */
                    RtlDeactivateActivationContextUnsafeFast(&ActCtx);
                }
            }
        }
    }
 
    /* Check for TLS */
    if (LdrpImageHasTls)
    {
        /* Set up the Act Ctx */
        ActCtx.Size = sizeof(ActCtx);
        ActCtx.Format = 1;
        RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
        /* Activate the ActCtx */
        RtlActivateActivationContextUnsafeFast(&ActCtx,
                                               LdrpImageEntry->EntryPointActivationContext);
 
        _SEH2_TRY
        {
            /* Do TLS callbacks */
            LdrpCallTlsInitializers(LdrpImageEntry, DLL_THREAD_DETACH);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Do nothing */
        }
        _SEH2_END;
 
        /* Deactivate the ActCtx */
        RtlDeactivateActivationContextUnsafeFast(&ActCtx);
    }
 
    /* Free TLS */
    LdrpFreeTls();
    RtlLeaveCriticalSection(&LdrpLoaderLock);
 
    /* Check for expansion slots */
    if (Teb->TlsExpansionSlots)
    {
        /* Free expansion slots */
        RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->TlsExpansionSlots);
    }
 
    /* Check for FLS Data */
    if (Teb->FlsData)
    {
        /* Mimic BaseRundownFls */
        ULONG n, FlsHighIndex;
        PRTL_FLS_DATA pFlsData;
        PFLS_CALLBACK_FUNCTION lpCallback;
 
        pFlsData = Teb->FlsData;
 
        RtlAcquirePebLock();
        FlsHighIndex = NtCurrentPeb()->FlsHighIndex;
        RemoveEntryList(&pFlsData->ListEntry);
        RtlReleasePebLock();
 
        for (n = 1; n <= FlsHighIndex; ++n)
        {
            lpCallback = NtCurrentPeb()->FlsCallback[n];
            if (lpCallback && pFlsData->Data[n])
            {
                lpCallback(pFlsData->Data[n]);
            }
        }
 
        RtlFreeHeap(RtlGetProcessHeap(), 0, pFlsData);
        Teb->FlsData = NULL;
    }
 
    /* Check for Fiber data */
    if (Teb->HasFiberData)
    {
        /* Free Fiber data*/
        RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->NtTib.FiberData);
        Teb->NtTib.FiberData = NULL;
    }
 
    /* Free the activation context stack */
    RtlFreeThreadActivationContextStack();
    DPRINT("LdrShutdownThread() done\n");
 
    return STATUS_SUCCESS;
}

LdrUnloadDll()

NTSTATUS NTAPI LdrUnloadDll

(

_In_ PVOID

BaseAddress

)

Definition at line 1291 of file ldrapi.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    PPEB Peb = NtCurrentPeb();
    PLDR_DATA_TABLE_ENTRY LdrEntry, CurrentEntry;
    PVOID EntryPoint;
    PLIST_ENTRY NextEntry;
    LIST_ENTRY UnloadList;
    RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
    PVOID CorImageData;
    ULONG ComSectionSize;
 
    /* Get the LDR Lock */
    if (!LdrpInLdrInit) RtlEnterCriticalSection(Peb->LoaderLock);
 
    /* Increase the unload count */
    LdrpActiveUnloadCount++;
 
    /* Skip unload */
    if (LdrpShutdownInProgress) goto Quickie;
 
    /* Make sure the DLL is valid and get its entry */
    if (!LdrpCheckForLoadedDllHandle(BaseAddress, &LdrEntry))
    {
        Status = STATUS_DLL_NOT_FOUND;
        goto Quickie;
    }
 
    /* Check the current Load Count */
    if (LdrEntry->LoadCount != 0xFFFF)
    {
        /* Decrease it */
        LdrEntry->LoadCount--;
 
        /* If it's a dll */
        if (LdrEntry->Flags & LDRP_IMAGE_DLL)
        {
            /* Set up the Act Ctx */
            ActCtx.Size = sizeof(ActCtx);
            ActCtx.Format = RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER;
            RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
            /* Activate the ActCtx */
            RtlActivateActivationContextUnsafeFast(&ActCtx,
                                                   LdrEntry->EntryPointActivationContext);
 
            /* Update the load count */
            LdrpUpdateLoadCount2(LdrEntry, LDRP_UPDATE_DEREFCOUNT);
 
            /* Release the context */
            RtlDeactivateActivationContextUnsafeFast(&ActCtx);
        }
    }
    else
    {
        /* The DLL is locked */
        goto Quickie;
    }
 
    /* Show debug message */
    if (ShowSnaps) DPRINT1("LDR: UNINIT LIST\n");
 
    /* Check if this is our only unload and initialize the list if so */
    if (LdrpActiveUnloadCount == 1) InitializeListHead(&LdrpUnloadHead);
 
    /* Loop the modules to build the list */
    NextEntry = Peb->Ldr->InInitializationOrderModuleList.Blink;
    while (NextEntry != &Peb->Ldr->InInitializationOrderModuleList)
    {
        /* Get the entry */
        LdrEntry = CONTAINING_RECORD(NextEntry,
                                     LDR_DATA_TABLE_ENTRY,
                                     InInitializationOrderLinks);
        NextEntry = NextEntry->Blink;
 
        /* Remove flag */
        LdrEntry->Flags &= ~LDRP_UNLOAD_IN_PROGRESS;
 
        /* If the load count is now 0 */
        if (!LdrEntry->LoadCount)
        {
            /* Show message */
            if (ShowSnaps)
            {
                DPRINT1("(%lu) [%ws] %ws (%lx) deinit %p\n",
                        LdrpActiveUnloadCount,
                        LdrEntry->BaseDllName.Buffer,
                        LdrEntry->FullDllName.Buffer,
                        (ULONG)LdrEntry->LoadCount,
                        LdrEntry->EntryPoint);
            }
 
            /* Call Shim Engine and notify */
            if (g_ShimsEnabled)
            {
                VOID (NTAPI* SE_DllUnloaded)(PVOID) = RtlDecodeSystemPointer(g_pfnSE_DllUnloaded);
                SE_DllUnloaded(LdrEntry);
            }
 
            /* Unlink it */
            CurrentEntry = LdrEntry;
            RemoveEntryList(&CurrentEntry->InInitializationOrderLinks);
            RemoveEntryList(&CurrentEntry->InMemoryOrderLinks);
            RemoveEntryList(&CurrentEntry->HashLinks);
 
            /* If there's more then one active unload */
            if (LdrpActiveUnloadCount > 1)
            {
                /* Flush the cached DLL handle and clear the list */
                LdrpLoadedDllHandleCache = NULL;
                CurrentEntry->InMemoryOrderLinks.Flink = NULL;
            }
 
            /* Add the entry on the unload list */
            InsertTailList(&LdrpUnloadHead, &CurrentEntry->HashLinks);
        }
    }
 
    /* Only call the entrypoints once */
    if (LdrpActiveUnloadCount > 1) goto Quickie;
 
    /* Now loop the unload list and create our own */
    InitializeListHead(&UnloadList);
    CurrentEntry = NULL;
    NextEntry = LdrpUnloadHead.Flink;
    while (NextEntry != &LdrpUnloadHead)
    {
        /* Get the current entry */
        LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
 
        LdrpRecordUnloadEvent(LdrEntry);
 
        /* Set the entry and clear it from the list */
        CurrentEntry = LdrEntry;
        LdrpLoadedDllHandleCache = NULL;
        CurrentEntry->InMemoryOrderLinks.Flink = NULL;
 
        /* Move it from the global to the local list */
        RemoveEntryList(&CurrentEntry->HashLinks);
        InsertTailList(&UnloadList, &CurrentEntry->HashLinks);
 
        /* Get the entrypoint */
        EntryPoint = LdrEntry->EntryPoint;
 
        /* Check if we should call it */
        if ((EntryPoint) && (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED))
        {
            /* Show message */
            if (ShowSnaps)
            {
                DPRINT1("LDR: Calling deinit %p\n", EntryPoint);
            }
 
            /* Set up the Act Ctx */
            ActCtx.Size = sizeof(ActCtx);
            ActCtx.Format = RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER;
            RtlZeroMemory(&ActCtx.Frame, sizeof(RTL_ACTIVATION_CONTEXT_STACK_FRAME));
 
            /* Activate the ActCtx */
            RtlActivateActivationContextUnsafeFast(&ActCtx,
                                                   LdrEntry->EntryPointActivationContext);
 
            /* Call the entrypoint */
            _SEH2_TRY
            {
                LdrpCallInitRoutine(LdrEntry->EntryPoint,
                                    LdrEntry->DllBase,
                                    DLL_PROCESS_DETACH,
                                    NULL);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
                        _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
            }
            _SEH2_END;
 
            /* Release the context */
            RtlDeactivateActivationContextUnsafeFast(&ActCtx);
        }
 
        /* Remove it from the list */
        RemoveEntryList(&CurrentEntry->InLoadOrderLinks);
        CurrentEntry = NULL;
        NextEntry = LdrpUnloadHead.Flink;
    }
 
    /* Now loop our local list */
    NextEntry = UnloadList.Flink;
    while (NextEntry != &UnloadList)
    {
        /* Get the entry */
        LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
        NextEntry = NextEntry->Flink;
        CurrentEntry = LdrEntry;
 
        /* Notify Application Verifier */
        if (Peb->NtGlobalFlag & FLG_HEAP_ENABLE_TAIL_CHECK)
        {
            AVrfDllUnloadNotification(LdrEntry);
        }
 
        /* Show message */
        if (ShowSnaps)
        {
            DPRINT1("LDR: Unmapping [%ws]\n", LdrEntry->BaseDllName.Buffer);
        }
 
#if (_WIN32_WINNT >= _WIN32_WINNT_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
        /* Send shutdown notification */
        LdrpSendDllNotifications(CurrentEntry, LDR_DLL_NOTIFICATION_REASON_UNLOADED);
#endif
 
        /* Check if this is a .NET executable */
        CorImageData = RtlImageDirectoryEntryToData(LdrEntry->DllBase,
                                                    TRUE,
                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR,
                                                    &ComSectionSize);
        if (CorImageData)
        {
            /* FIXME */
            DPRINT1(".NET Images are not supported yet\n");
        }
 
        /* Check if we should unmap*/
        if (!(CurrentEntry->Flags & LDR_COR_OWNS_UNMAP))
        {
            /* Unmap the DLL */
            Status = NtUnmapViewOfSection(NtCurrentProcess(),
                                          CurrentEntry->DllBase);
            ASSERT(NT_SUCCESS(Status));
        }
 
        /* Unload the alternate resource module, if any */
        LdrUnloadAlternateResourceModule(CurrentEntry->DllBase);
 
        /* Check if a Hotpatch is active */
        if (LdrEntry->PatchInformation)
        {
            /* FIXME */
            DPRINT1("We don't support Hotpatching yet\n");
        }
 
        /* Deallocate the Entry */
        LdrpFinalizeAndDeallocateDataTableEntry(CurrentEntry);
 
        /* If this is the cached entry, invalidate it */
        if (LdrpGetModuleHandleCache == CurrentEntry)
        {
            LdrpGetModuleHandleCache = NULL;
        }
    }
 
Quickie:
    /* Decrease unload count */
    LdrpActiveUnloadCount--;
    if (!LdrpInLdrInit) RtlLeaveCriticalSection(Peb->LoaderLock);
 
    /* Return to caller */
    return Status;
}

Referenced by BasepReplaceProcessThreadTokens(), CsrLoadServerDll(), FreeLibrary(), FreeLibraryAndExitThread(), InitApphelp(), LdrpLoadDll(), LdrpUnloadShimEngine(), LsapAddAuthPackage(), PropertyLengthAsVariant(), RtlConvertPropertyToVariant(), RtlConvertVariantToProperty(), START_TEST(), tp_object_execute(), and tp_object_release().

LdrVerifyImageMatchesChecksum()

NTSTATUS NTAPI LdrVerifyImageMatchesChecksum	(	_In_ HANDLE	FileHandle,
		_In_ PLDR_CALLBACK	Callback,
		_In_ PVOID	CallbackContext,
		_Out_ PUSHORT	ImageCharacteristics
	)

Definition at line 804 of file ldrapi.c.

{
    FILE_STANDARD_INFORMATION FileStandardInfo;
    PIMAGE_IMPORT_DESCRIPTOR ImportData;
    PIMAGE_SECTION_HEADER LastSection = NULL;
    IO_STATUS_BLOCK IoStatusBlock;
    PIMAGE_NT_HEADERS NtHeader;
    HANDLE SectionHandle;
    SIZE_T ViewSize;
    PVOID ViewBase;
    BOOLEAN Result, NoActualCheck;
    NTSTATUS Status;
    PVOID ImportName;
    ULONG Size;
    DPRINT("LdrVerifyImageMatchesChecksum() called\n");
 
    /* If the handle has the magic KnownDll flag, skip actual checksums */
    NoActualCheck = ((ULONG_PTR)FileHandle & 1);
 
    /* Create the section */
    Status = NtCreateSection(&SectionHandle,
                             SECTION_MAP_EXECUTE,
                             NULL,
                             NULL,
                             PAGE_EXECUTE,
                             SEC_COMMIT,
                             FileHandle);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1 ("NtCreateSection() failed (Status 0x%x)\n", Status);
        return Status;
    }
 
    /* Map the section */
    ViewSize = 0;
    ViewBase = NULL;
    Status = NtMapViewOfSection(SectionHandle,
                                NtCurrentProcess(),
                                &ViewBase,
                                0,
                                0,
                                NULL,
                                &ViewSize,
                                ViewShare,
                                0,
                                PAGE_EXECUTE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
        NtClose(SectionHandle);
        return Status;
    }
 
    /* Get the file information */
    Status = NtQueryInformationFile(FileHandle,
                                    &IoStatusBlock,
                                    &FileStandardInfo,
                                    sizeof(FILE_STANDARD_INFORMATION),
                                    FileStandardInformation);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
        NtUnmapViewOfSection(NtCurrentProcess(), ViewBase);
        NtClose(SectionHandle);
        return Status;
    }
 
    /* Protect with SEH */
    _SEH2_TRY
    {
        /* Check if this is the KnownDll hack */
        if (NoActualCheck)
        {
            /* Don't actually do it */
            Result = TRUE;
        }
        else
        {
            /* Verify the checksum */
            Result = LdrVerifyMappedImageMatchesChecksum(ViewBase,
                                                         FileStandardInfo.EndOfFile.LowPart,
                                                         FileStandardInfo.EndOfFile.LowPart);
        }
 
        /* Check if a callback was supplied */
        if ((Result) && (Callback))
        {
            /* Get the NT Header */
            NtHeader = RtlImageNtHeader(ViewBase);
 
            /* Check if caller requested this back */
            if (ImageCharacteristics)
            {
                /* Return to caller */
                *ImageCharacteristics = NtHeader->FileHeader.Characteristics;
            }
 
            /* Get the Import Directory Data */
            ImportData = RtlImageDirectoryEntryToData(ViewBase,
                                                      FALSE,
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT,
                                                      &Size);
 
            /* Make sure there is one */
            if (ImportData)
            {
                /* Loop the imports */
                while (ImportData->Name)
                {
                    /* Get the name */
                    ImportName = RtlImageRvaToVa(NtHeader,
                                                 ViewBase,
                                                 ImportData->Name,
                                                 &LastSection);
 
                    /* Notify the callback */
                    Callback(CallbackContext, ImportName);
                    ImportData++;
                }
            }
        }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        /* Fail the request returning STATUS_IMAGE_CHECKSUM_MISMATCH */
        Result = FALSE;
    }
    _SEH2_END;
 
    /* Unmap file and close handle */
    NtUnmapViewOfSection(NtCurrentProcess(), ViewBase);
    NtClose(SectionHandle);
 
    /* Return status */
    return Result ? Status : STATUS_IMAGE_CHECKSUM_MISMATCH;
}

Referenced by SmpInitializeKnownDllsInternal().