ReactOS 0.4.16-dev-838-g27bb510
umfuncs.h File Reference
#include <umtypes.h>
#include <dbgktypes.h>
Include dependency graph for umfuncs.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Typedefs

typedef VOID(NTAPIPLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)
 

Functions

__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus (_In_ ULONG Status)
 
NTSTATUS NTAPI DbgUiConnectToDbg (VOID)
 
NTSTATUS NTAPI DbgUiContinue (_In_ PCLIENT_ID ClientId, _In_ NTSTATUS ContinueStatus)
 
NTSTATUS NTAPI DbgUiDebugActiveProcess (_In_ HANDLE Process)
 
NTSTATUS NTAPI DbgUiStopDebugging (_In_ HANDLE Process)
 
NTSYSAPI NTSTATUS NTAPI DbgUiWaitStateChange (_In_ PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange, _In_ PLARGE_INTEGER TimeOut)
 
NTSTATUS NTAPI DbgUiConvertStateChangeStructure (_In_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange, _In_ PVOID DebugEvent)
 
VOID NTAPI DbgUiRemoteBreakin (VOID)
 
NTSTATUS NTAPI DbgUiIssueRemoteBreakin (_In_ HANDLE Process)
 
HANDLE NTAPI DbgUiGetThreadDebugObject (VOID)
 
NTSTATUS NTAPI LdrAddRefDll (_In_ ULONG Flags, _In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrDisableThreadCalloutsForDll (_In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrGetDllHandle (_In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *DllHandle)
 
NTSTATUS NTAPI LdrGetDllHandleEx (_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
 
NTSTATUS NTAPI LdrFindEntryForAddress (_In_ PVOID Address, _Out_ PLDR_DATA_TABLE_ENTRY *Module)
 
NTSTATUS NTAPI LdrGetProcedureAddress (_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
 
VOID NTAPI LdrInitializeThunk (ULONG Unknown1, ULONG Unknown2, ULONG Unknown3, ULONG Unknown4)
 
NTSTATUS NTAPI LdrLoadDll (_In_opt_ PWSTR SearchPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *BaseAddress)
 
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock (_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONG_PTR Delta)
 
NTSTATUS NTAPI LdrQueryImageFileExecutionOptions (_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
 
NTSTATUS NTAPI LdrQueryProcessModuleInformation (_Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
 
VOID NTAPI LdrSetDllManifestProber (_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
 
NTSTATUS NTAPI LdrShutdownProcess (VOID)
 
NTSTATUS NTAPI LdrShutdownThread (VOID)
 
NTSTATUS NTAPI LdrUnloadDll (_In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrVerifyImageMatchesChecksum (_In_ HANDLE FileHandle, _In_ PLDR_CALLBACK Callback, _In_ PVOID CallbackContext, _Out_ PUSHORT ImageCharacteristics)
 
NTSTATUS NTAPI LdrOpenImageFileOptionsKey (_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64, _Out_ PHANDLE NewKeyHandle)
 
NTSTATUS NTAPI LdrQueryImageFileKeyOption (_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
 

Typedef Documentation

◆ PLDR_CALLBACK

typedef VOID(NTAPI * PLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)

Definition at line 217 of file umfuncs.h.

Function Documentation

◆ DbgBreakPointWithStatus()

◆ DbgUiConnectToDbg()

NTSTATUS NTAPI DbgUiConnectToDbg ( VOID  )

Definition at line 25 of file dbgui.c.

26{
28
29 /* Don't connect twice */
30 if (NtCurrentTeb()->DbgSsReserved[1]) return STATUS_SUCCESS;
31
32 /* Setup the Attributes */
34
35 /* Create the object */
36 return ZwCreateDebugObject(&NtCurrentTeb()->DbgSsReserved[1],
40}
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
NTSYSAPI NTSTATUS NTAPI ZwCreateDebugObject(_Out_ PHANDLE DebugHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG Flags)
#define DEBUG_OBJECT_ALL_ACCESS
Definition: dbgktypes.h:34
#define DBGK_KILL_PROCESS_ON_EXIT
Definition: dbgktypes.h:49
#define NULL
Definition: types.h:112
#define NtCurrentTeb
#define InitializeObjectAttributes(p, n, a, r, s)
Definition: reg.c:106
#define STATUS_SUCCESS
Definition: shellext.h:65

Referenced by CreateProcessInternalW(), DebugActiveProcess(), and Main().

◆ DbgUiContinue()

NTSTATUS NTAPI DbgUiContinue ( _In_ PCLIENT_ID  ClientId,
_In_ NTSTATUS  ContinueStatus 
)

◆ DbgUiConvertStateChangeStructure()

NTSTATUS NTAPI DbgUiConvertStateChangeStructure ( _In_ PDBGUI_WAIT_STATE_CHANGE  WaitStateChange,
_In_ PVOID  DebugEvent 
)

◆ DbgUiDebugActiveProcess()

NTSTATUS NTAPI DbgUiDebugActiveProcess ( _In_ HANDLE  Process)

◆ DbgUiGetThreadDebugObject()

HANDLE NTAPI DbgUiGetThreadDebugObject ( VOID  )

Definition at line 333 of file dbgui.c.

334{
335 /* Just return the handle from the TEB */
336 return NtCurrentTeb()->DbgSsReserved[1];
337}

Referenced by CreateProcessInternalW(), and DebugSetProcessKillOnExit().

◆ DbgUiIssueRemoteBreakin()

NTSTATUS NTAPI DbgUiIssueRemoteBreakin ( _In_ HANDLE  Process)

◆ DbgUiRemoteBreakin()

VOID NTAPI DbgUiRemoteBreakin ( VOID  )

Definition at line 289 of file dbgui.c.

290{
291 /* Make sure a debugger is enabled; if so, breakpoint */
292 if (NtCurrentPeb()->BeingDebugged) DbgBreakPoint();
293
294 /* Exit the thread */
296}
#define NtCurrentPeb()
Definition: FLS.c:22
NTSYSAPI void WINAPI DbgBreakPoint(void)
NTSYSAPI VOID NTAPI RtlExitUserThread(_In_ NTSTATUS Status)

Referenced by DbgUiIssueRemoteBreakin().

◆ DbgUiStopDebugging()

NTSTATUS NTAPI DbgUiStopDebugging ( _In_ HANDLE  Process)

◆ DbgUiWaitStateChange()

NTSYSAPI NTSTATUS NTAPI DbgUiWaitStateChange ( _In_ PDBGUI_WAIT_STATE_CHANGE  DbgUiWaitStateCange,
_In_ PLARGE_INTEGER  TimeOut 
)

◆ LdrAddRefDll()

NTSTATUS NTAPI LdrAddRefDll ( _In_ ULONG  Flags,
_In_ PVOID  BaseAddress 
)

Definition at line 1205 of file ldrapi.c.

1208{
1209 PLDR_DATA_TABLE_ENTRY LdrEntry;
1213
1214 /* Check for invalid flags */
1215 if (Flags & ~(LDR_ADDREF_DLL_PIN))
1216 {
1217 /* Fail with invalid parameter status if so */
1219 goto quickie;
1220 }
1221
1222 /* Acquire the loader lock if not in init phase */
1223 if (!LdrpInLdrInit)
1224 {
1225 /* Acquire the lock */
1227 if (!NT_SUCCESS(Status)) goto quickie;
1228 Locked = TRUE;
1229 }
1230
1231 /* Get this module's data table entry */
1233 {
1234 if (!LdrEntry)
1235 {
1236 /* Shouldn't happen */
1238 goto quickie;
1239 }
1240
1241 /* If this is not a pinned module */
1242 if (LdrEntry->LoadCount != 0xFFFF)
1243 {
1244 /* Update its load count */
1246 {
1247 /* Pin it by setting load count to -1 */
1248 LdrEntry->LoadCount = 0xFFFF;
1250 }
1251 else
1252 {
1253 /* Increase its load count by one */
1254 LdrEntry->LoadCount++;
1256 }
1257
1258 /* Clear load in progress */
1260 }
1261 }
1262 else
1263 {
1264 /* There was an error getting this module's handle, return invalid param status */
1266 }
1267
1268quickie:
1269 /* Check for error case */
1270 if (!NT_SUCCESS(Status))
1271 {
1272 /* Print debug information */
1273 if ((ShowSnaps) || ((Status != STATUS_NO_SUCH_FILE) &&
1276 {
1277 DPRINT1("LDR: LdrAddRefDll(%p) 0x%08lx\n", BaseAddress, Status);
1278 }
1279 }
1280
1281 /* Release the lock if needed */
1283 return Status;
1284}
unsigned char BOOLEAN
LONG NTSTATUS
Definition: precomp.h:26
#define DPRINT1
Definition: precomp.h:8
#define TRUE
Definition: types.h:120
#define FALSE
Definition: types.h:117
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
Status
Definition: gdiplustypes.h:25
NTSTATUS NTAPI LdrUnlockLoaderLock(_In_ ULONG Flags, _In_opt_ ULONG_PTR Cookie)
Definition: ldrapi.c:101
NTSTATUS NTAPI LdrLockLoaderLock(_In_ ULONG Flags, _Out_opt_ PULONG Disposition, _Out_opt_ PULONG_PTR Cookie)
Definition: ldrapi.c:174
#define LDR_ADDREF_DLL_PIN
Definition: ldrtypes.h:75
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
Definition: ldrtypes.h:86
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
Definition: newmm.h:209
BOOLEAN LdrpInLdrInit
Definition: ldrinit.c:30
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
Definition: ldrutils.c:1600
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
Definition: ldrutils.c:434
BOOLEAN ShowSnaps
Definition: ldrinit.c:79
#define LDRP_UPDATE_PIN
Definition: ntdllp.h:17
#define LDRP_UPDATE_REFCOUNT
Definition: ntdllp.h:15
ULONG NTAPI LdrpClearLoadInProgress(VOID)
Definition: ldrutils.c:2649
#define STATUS_INTERNAL_ERROR
Definition: ntstatus.h:465
#define STATUS_DLL_NOT_FOUND
Definition: ntstatus.h:545
Definition: btrfs_drv.h:1876
USHORT LoadCount
Definition: ntddk_ex.h:208
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define STATUS_NO_SUCH_FILE
Definition: udferr_usr.h:137
#define STATUS_OBJECT_NAME_NOT_FOUND
Definition: udferr_usr.h:149
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
Definition: cmfuncs.h:14

Referenced by BasepGetModuleHandleExW(), and tp_object_initialize().

◆ LdrDisableThreadCalloutsForDll()

NTSTATUS NTAPI LdrDisableThreadCalloutsForDll ( _In_ PVOID  BaseAddress)

Definition at line 1154 of file ldrapi.c.

1156{
1157 PLDR_DATA_TABLE_ENTRY LdrEntry;
1159 BOOLEAN LockHeld;
1161 DPRINT("LdrDisableThreadCalloutsForDll (BaseAddress %p)\n", BaseAddress);
1162
1163 /* Don't do it during shutdown */
1165
1166 /* Check if we should grab the lock */
1167 LockHeld = FALSE;
1168 if (!LdrpInLdrInit)
1169 {
1170 /* Grab the lock */
1172 if (!NT_SUCCESS(Status)) return Status;
1173 LockHeld = TRUE;
1174 }
1175
1176 /* Make sure the DLL is valid and get its entry */
1179 {
1180 /* Get if it has a TLS slot */
1181 if (!LdrEntry->TlsIndex)
1182 {
1183 /* It doesn't, so you're allowed to call this */
1184 LdrEntry->Flags |= LDRP_DONT_CALL_FOR_THREADS;
1186 }
1187 }
1188
1189 /* Check if the lock was held */
1190 if (LockHeld)
1191 {
1192 /* Release it */
1194 }
1195
1196 /* Return the status */
1197 return Status;
1198}
#define LDRP_DONT_CALL_FOR_THREADS
Definition: ldrtypes.h:52
BOOLEAN LdrpShutdownInProgress
Definition: ldrinit.c:34
#define DPRINT
Definition: sndvol32.h:73
USHORT TlsIndex
Definition: ntddk_ex.h:209
ULONG Flags
Definition: ntddk_ex.h:207

◆ LdrFindEntryForAddress()

NTSTATUS NTAPI LdrFindEntryForAddress ( _In_ PVOID  Address,
_Out_ PLDR_DATA_TABLE_ENTRY Module 
)

Definition at line 425 of file ldrapi.c.

428{
429 PLIST_ENTRY ListHead, NextEntry;
430 PLDR_DATA_TABLE_ENTRY LdrEntry;
431 PIMAGE_NT_HEADERS NtHeader;
432 PPEB_LDR_DATA Ldr = NtCurrentPeb()->Ldr;
433 ULONG_PTR DllBase, DllEnd;
434
435 DPRINT("LdrFindEntryForAddress(Address %p)\n", Address);
436
437 /* Nothing to do */
438 if (!Ldr) return STATUS_NO_MORE_ENTRIES;
439
440 /* Get the current entry */
441 LdrEntry = Ldr->EntryInProgress;
442 if (LdrEntry)
443 {
444 /* Get the NT Headers */
445 NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
446 if (NtHeader)
447 {
448 /* Get the Image Base */
449 DllBase = (ULONG_PTR)LdrEntry->DllBase;
450 DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
451
452 /* Check if they match */
453 if (((ULONG_PTR)Address >= DllBase) &&
454 ((ULONG_PTR)Address < DllEnd))
455 {
456 /* Return it */
457 *Module = LdrEntry;
458 return STATUS_SUCCESS;
459 }
460 }
461 }
462
463 /* Loop the module list */
464 ListHead = &Ldr->InMemoryOrderModuleList;
465 NextEntry = ListHead->Flink;
466 while (NextEntry != ListHead)
467 {
468 /* Get the entry and NT Headers */
469 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
470 NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
471 if (NtHeader)
472 {
473 /* Get the Image Base */
474 DllBase = (ULONG_PTR)LdrEntry->DllBase;
475 DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
476
477 /* Check if they match */
478 if (((ULONG_PTR)Address >= DllBase) &&
479 ((ULONG_PTR)Address < DllEnd))
480 {
481 /* Return it */
482 *Module = LdrEntry;
483 return STATUS_SUCCESS;
484 }
485
486 /* Next Entry */
487 NextEntry = NextEntry->Flink;
488 }
489 }
490
491 /* Nothing found */
494 "LDR: %s() exiting 0x%08lx\n",
498}
#define RtlImageNtHeader
Definition: compat.h:806
@ DPFLTR_LDR_ID
Definition: dpfilter.h:113
#define __FUNCTION__
Definition: types.h:116
#define ULONG_PTR
Definition: config.h:101
#define DbgPrintEx(cmpid, lvl, fmt,...)
Definition: kdinit.c:24
if(dx< 0)
Definition: linetemp.h:194
#define DPFLTR_WARNING_LEVEL
Definition: kdtypes.h:31
#define STATUS_NO_MORE_ENTRIES
Definition: ntstatus.h:205
static WCHAR Address[46]
Definition: ping.c:68
IMAGE_OPTIONAL_HEADER32 OptionalHeader
Definition: ntddk_ex.h:184
PVOID DllBase
Definition: btrfs_drv.h:1880
Definition: typedefs.h:120
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
PVOID EntryInProgress
Definition: ldrtypes.h:127
LIST_ENTRY InMemoryOrderModuleList
Definition: btrfs_drv.h:1895
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260

Referenced by find_query_actctx(), and get_module_filename().

◆ LdrGetDllHandle()

NTSTATUS NTAPI LdrGetDllHandle ( _In_opt_ PWSTR  DllPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_ PVOID DllHandle 
)

Definition at line 770 of file ldrapi.c.

775{
776 /* Call the newer API */
778 DllPath,
779 DllCharacteristics,
780 DllName,
781 DllHandle);
782}
NTSTATUS NTAPI LdrGetDllHandleEx(_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
Definition: ldrapi.c:505
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT
Definition: ldrtypes.h:91
static const char const char * DllPath
Definition: image.c:34

Referenced by BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), FirstSoundSentry(), GetModuleHandleForUnicodeString(), SeiAddHooks(), SeiFindHookModuleInfoForImportDescriptor(), and SeiInit().

◆ LdrGetDllHandleEx()

NTSTATUS NTAPI LdrGetDllHandleEx ( _In_ ULONG  Flags,
_In_opt_ PWSTR  DllPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_opt_ PVOID DllHandle 
)

Definition at line 505 of file ldrapi.c.

511{
513 PLDR_DATA_TABLE_ENTRY LdrEntry;
514 UNICODE_STRING RedirectName, DynamicString, RawDllName;
515 PUNICODE_STRING pRedirectName, CompareName;
516 PWCHAR p1, p2, p3;
517 BOOLEAN Locked, RedirectedDll;
519 ULONG LoadFlag, Length;
520
521 /* Initialize the strings */
522 RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
523 RtlInitEmptyUnicodeString(&RawDllName, NULL, 0);
524 RedirectName = *DllName;
525 pRedirectName = &RedirectName;
526
527 /* Initialize state */
528 RedirectedDll = Locked = FALSE;
529 LdrEntry = NULL;
530 Cookie = 0;
531
532 /* Clear the handle */
533 if (DllHandle) *DllHandle = NULL;
534
535 /* Check for a valid flag combination */
537 (!DllHandle && !(Flags & LDR_GET_DLL_HANDLE_EX_PIN)))
538 {
539 DPRINT1("Flags are invalid or no DllHandle given\n");
541 goto Quickie;
542 }
543
544 /* If not initializing */
545 if (!LdrpInLdrInit)
546 {
547 /* Acquire the lock */
549 if (!NT_SUCCESS(Status)) goto Quickie;
550
551 /* Remember we own it */
552 Locked = TRUE;
553 }
554
556 pRedirectName, &LdrApiDefaultExtension, NULL, &DynamicString, &pRedirectName, &RedirectedDll);
557 if (!NT_SUCCESS(Status))
558 {
559 DPRINT1("LdrpApplyFileNameRedirection FAILED: (Status 0x%x)\n", Status);
560 goto Quickie;
561 }
562
563 /* Set default failure code */
565
566 /* Use the cache if we can */
568 {
569 /* Check if we were redirected */
570 if (RedirectedDll)
571 {
572 /* Check the flag */
574 {
575 goto DontCompare;
576 }
577
578 /* Use the right name */
580 }
581 else
582 {
583 /* Check the flag */
585 {
586 goto DontCompare;
587 }
588
589 /* Use the right name */
591 }
592
593 /* Check if the name matches */
594 if (RtlEqualUnicodeString(pRedirectName,
596 TRUE))
597 {
598 /* Skip the rest */
599 LdrEntry = LdrpGetModuleHandleCache;
600
601 /* Return success */
603 goto Quickie;
604 }
605 }
606
607DontCompare:
608 /* Find the name without the extension */
609 p1 = pRedirectName->Buffer;
610 p2 = NULL;
611 p3 = &p1[pRedirectName->Length / sizeof(WCHAR)];
612 while (p1 != p3)
613 {
614 if (*p1++ == L'.')
615 {
616 p2 = p1;
617 }
618 else if (*p1 == L'\\')
619 {
620 p2 = NULL;
621 }
622 }
623
624 /* Check if no extension was found or if we got a slash */
625 if (!(p2) || (*p2 == L'\\') || (*p2 == L'/'))
626 {
627 /* Check that we have space to add one */
628 Length = pRedirectName->Length +
631 {
632 /* No space to add the extension */
634 goto Quickie;
635 }
636
637 /* Setup the string */
638 RawDllName.MaximumLength = Length;
639 ASSERT(Length >= sizeof(UNICODE_NULL));
640 RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
641 0,
642 RawDllName.MaximumLength);
643 if (!RawDllName.Buffer)
644 {
646 goto Quickie;
647 }
648
649 /* Copy the string and add extension */
650 RtlCopyUnicodeString(&RawDllName, pRedirectName);
652 }
653 else
654 {
655 /* Check if there's something in the name */
656 Length = pRedirectName->Length;
657 if (Length)
658 {
659 /* Check and remove trailing period */
660 if (pRedirectName->Buffer[Length / sizeof(WCHAR) - sizeof(ANSI_NULL)] == '.')
661 {
662 /* Decrease the size */
663 pRedirectName->Length -= sizeof(WCHAR);
664 }
665 }
666
667 /* Setup the string */
668 RawDllName.MaximumLength = pRedirectName->Length + sizeof(WCHAR);
669 RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
670 0,
671 RawDllName.MaximumLength);
672 if (!RawDllName.Buffer)
673 {
675 goto Quickie;
676 }
677
678 /* Copy the string */
679 RtlCopyUnicodeString(&RawDllName, pRedirectName);
680 }
681
682 /* Display debug string */
683 if (ShowSnaps)
684 {
685 DPRINT1("LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
686 &RawDllName,
687 DllPath ? ((ULONG_PTR)DllPath == 1 ? L"" : DllPath) : L"");
688 }
689
690 /* Do the lookup */
692 &RawDllName,
693 ((ULONG_PTR)DllPath == 1) ? TRUE : FALSE,
694 RedirectedDll,
695 &LdrEntry))
696 {
697 /* Update cached entry */
698 LdrpGetModuleHandleCache = LdrEntry;
699
700 /* Return success */
702 }
703 else
704 {
705 /* Make sure to NULL this */
706 LdrEntry = NULL;
707 }
708Quickie:
709 /* The success path must have a valid loader entry */
710 ASSERT((LdrEntry != NULL) == NT_SUCCESS(Status));
711
712 /* Check if we got an entry and success */
713 DPRINT("Got LdrEntry->BaseDllName %wZ\n", LdrEntry ? &LdrEntry->BaseDllName : NULL);
714 if ((LdrEntry) && (NT_SUCCESS(Status)))
715 {
716 /* Check if the DLL is locked */
717 if ((LdrEntry->LoadCount != 0xFFFF) &&
719 {
720 /* Check what to do with the load count */
722 {
723 /* Pin it */
724 LdrEntry->LoadCount = 0xFFFF;
725 LoadFlag = LDRP_UPDATE_PIN;
726 }
727 else
728 {
729 /* Increase the load count */
730 LdrEntry->LoadCount++;
731 LoadFlag = LDRP_UPDATE_REFCOUNT;
732 }
733
734 /* Update the load count now */
735 LdrpUpdateLoadCount2(LdrEntry, LoadFlag);
737 }
738
739 /* Check if the caller is requesting the handle */
740 if (DllHandle) *DllHandle = LdrEntry->DllBase;
741 }
742
743 /* Free string if needed */
745
746 /* Free the raw DLL Name if needed */
747 if (RawDllName.Buffer)
748 {
749 /* Free the heap-allocated buffer */
750 RtlFreeHeap(RtlGetProcessHeap(), 0, RawDllName.Buffer);
751 RawDllName.Buffer = NULL;
752 }
753
754 /* Release lock */
755 if (Locked)
756 {
758 Cookie);
759 }
760
761 /* Return */
762 return Status;
763}
IN PUNICODE_STRING IN PUNICODE_STRING DynamicString
static BOOL CompareName(LPCWSTR pszName1, LPCWSTR pszName2)
Definition: find.c:60
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:616
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:634
#define STATUS_NO_MEMORY
Definition: d3dkmdt.h:51
UNICODE_STRING LdrApiDefaultExtension
Definition: ldrapi.c:22
#define LDRP_REDIRECTED
Definition: ldrtypes.h:62
#define LDR_GET_DLL_HANDLE_EX_PIN
Definition: ldrtypes.h:92
#define ASSERT(a)
Definition: mode.c:44
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define UNICODE_NULL
#define UNICODE_STRING_MAX_BYTES
#define ANSI_NULL
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
NTSYSAPI NTSTATUS NTAPI LdrpApplyFileNameRedirection(_In_ PUNICODE_STRING OriginalName, _In_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING StaticString, _Inout_opt_ PUNICODE_STRING DynamicString, _Inout_ PUNICODE_STRING *NewName, _Inout_ PBOOLEAN RedirectedDll)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
Definition: ldrutils.c:19
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
Definition: ldrutils.c:1958
#define STATUS_NAME_TOO_LONG
Definition: ntstatus.h:498
#define L(x)
Definition: ntvdm.h:50
UNICODE_STRING FullDllName
Definition: btrfs_drv.h:1882
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:149
USHORT MaximumLength
Definition: env_spec_w32.h:370
uint16_t * PWCHAR
Definition: typedefs.h:56
uint32_t ULONG
Definition: typedefs.h:59
__wchar_t WCHAR
Definition: xmlstorage.h:180

Referenced by LdrGetDllHandle(), and LoadLibraryExW().

◆ LdrGetProcedureAddress()

NTSTATUS NTAPI LdrGetProcedureAddress ( _In_ PVOID  BaseAddress,
_In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING  Name,
_In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG  Ordinal,
_Out_ PVOID ProcedureAddress 
)

Definition at line 789 of file ldrapi.c.

794{
795 /* Call the internal routine and tell it to execute DllInit */
796 return LdrpGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress, TRUE);
797}
NTSTATUS NTAPI LdrpGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress, _In_ BOOLEAN ExecuteInit)
Definition: ldrutils.c:2231

Referenced by BaseInitApphelp(), BasepReplaceProcessThreadTokens(), BaseSrvDelayLoadKernel32(), BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), CsrLoadServerDll(), FirstSoundSentry(), GetProcAddress(), InitApphelp(), LdrpInitializeProcess(), LoadOle32Export(), LsapAddAuthPackage(), SeiCreateShimModuleInfo(), and SeiResolveAPI().

◆ LdrInitializeThunk()

VOID NTAPI LdrInitializeThunk ( ULONG  Unknown1,
ULONG  Unknown2,
ULONG  Unknown3,
ULONG  Unknown4 
)

◆ LdrLoadDll()

NTSTATUS NTAPI LdrLoadDll ( _In_opt_ PWSTR  SearchPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_ PVOID BaseAddress 
)

Definition at line 312 of file ldrapi.c.

317{
320 BOOLEAN RedirectedDll = FALSE;
323 PUNICODE_STRING OldTldDll;
324 PTEB Teb = NtCurrentTeb();
325
326 /* Initialize the strings */
327 RtlInitEmptyUnicodeString(&StaticString, StringBuffer, sizeof(StringBuffer));
328 RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
329
331
332 /* Lock the loader lock */
334
335 /* Check if there's a TLD DLL being loaded */
336 OldTldDll = LdrpTopLevelDllBeingLoaded;
338 {
339
340 if (OldTldDll)
341 {
342 /* This is a recursive load, do something about it? */
344 {
345 /* Print out debug messages */
346 DPRINT1("[%p, %p] LDR: Recursive DLL Load\n",
349 DPRINT1("[%p, %p] Previous DLL being loaded \"%wZ\"\n",
352 OldTldDll);
353 DPRINT1("[%p, %p] DLL being requested \"%wZ\"\n",
356 DllName);
357
358 /* Was it initializing too? */
360 {
361 DPRINT1("[%p, %p] LDR: No DLL Initializer was running\n",
364 }
365 else
366 {
367 DPRINT1("[%p, %p] DLL whose initializer was currently running \"%wZ\"\n",
371 }
372 }
373 }
374
375 /* Set this one as the TLD DLL being loaded*/
377
378 /* Load the DLL */
379 Status = LdrpLoadDll(RedirectedDll,
381 DllCharacteristics,
382 DllName,
384 TRUE);
385 if (NT_SUCCESS(Status))
386 {
388 }
389 else if ((Status != STATUS_NO_SUCH_FILE) &&
393 {
396 "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
398 DllName,
399 Status);
400 }
401 }
403 {
404 /* Restore the old TLD DLL */
405 LdrpTopLevelDllBeingLoaded = OldTldDll;
406
407 /* Release the lock */
409 }
410 _SEH2_END;
411
412 /* Do we have a redirect string? */
415
416 /* Return */
417 return Status;
418}
IN PUNICODE_STRING StaticString
#define MAX_PATH
Definition: compat.h:34
WCHAR StringBuffer[156]
Definition: ldrinit.c:41
BOOLEAN LdrpBreakOnRecursiveDllLoads
Definition: ldrapi.c:21
BOOLEAN LdrpShowRecursiveLoads
Definition: ldrapi.c:21
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
Definition: ldrtypes.h:80
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
Definition: ldrutils.c:2414
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
Definition: ldrinit.c:43
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
Definition: ldrinit.c:40
#define STATUS_DLL_INIT_FAILED
Definition: ntstatus.h:558
#define _SEH2_FINALLY
Definition: pseh2_64.h:114
#define _SEH2_END
Definition: pseh2_64.h:155
#define _SEH2_TRY
Definition: pseh2_64.h:55
HANDLE UniqueThread
Definition: compat.h:826
HANDLE UniqueProcess
Definition: compat.h:825
Definition: compat.h:836
CLIENT_ID ClientId
Definition: compat.h:839
CLIENT_ID RealClientId
Definition: compat.h:861
#define SearchPath
Definition: winbase.h:3925

Referenced by AVrfpLoadAndInitializeProvider(), BaseInitApphelp(), BaseSrvDelayLoadKernel32(), CsrLoadServerDll(), InitApphelp(), LdrpInitializeProcess(), LoadLibraryExW(), LoadOle32Export(), LsapAddAuthPackage(), SeiInit(), and START_TEST().

◆ LdrOpenImageFileOptionsKey()

NTSTATUS NTAPI LdrOpenImageFileOptionsKey ( _In_ PUNICODE_STRING  SubKey,
_In_ BOOLEAN  Wow64,
_Out_ PHANDLE  NewKeyHandle 
)

Definition at line 110 of file ldrinit.c.

114{
115 PHANDLE RootKeyLocation;
117 UNICODE_STRING SubKeyString;
120 PWCHAR p1;
121
122 /* Check which root key to open */
123 if (Wow64)
124 RootKeyLocation = &Wow64ExecOptionsKey;
125 else
126 RootKeyLocation = &ImageExecOptionsKey;
127
128 /* Get the current key */
129 RootKey = *RootKeyLocation;
130
131 /* Setup the object attributes */
133 Wow64 ?
136 NULL,
137 NULL);
138
139 /* Open the root key */
141 if (NT_SUCCESS(Status))
142 {
143 /* Write the key handle */
144 if (InterlockedCompareExchangePointer(RootKeyLocation, RootKey, NULL) != NULL)
145 {
146 /* Someone already opened it, use it instead */
148 RootKey = *RootKeyLocation;
149 }
150
151 /* Extract the name */
152 SubKeyString = *SubKey;
153 p1 = (PWCHAR)((ULONG_PTR)SubKeyString.Buffer + SubKeyString.Length);
154 while (SubKeyString.Length)
155 {
156 if (p1[-1] == L'\\') break;
157 p1--;
158 SubKeyString.Length -= sizeof(*p1);
159 }
160 SubKeyString.Buffer = p1;
161 SubKeyString.Length = SubKey->Length - SubKeyString.Length;
162
163 /* Setup the object attributes */
165 &SubKeyString,
167 RootKey,
168 NULL);
169
170 /* Open the setting key */
171 Status = ZwOpenKey((PHANDLE)NewKeyHandle, GENERIC_READ, &ObjectAttributes);
172 }
173
174 /* Return to caller */
175 return Status;
176}
#define GENERIC_READ
Definition: compat.h:135
#define OBJ_CASE_INSENSITIVE
Definition: winternl.h:228
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
HANDLE ImageExecOptionsKey
Definition: ldrinit.c:22
HANDLE Wow64ExecOptionsKey
Definition: ldrinit.c:23
UNICODE_STRING ImageExecOptionsString
Definition: ldrinit.c:24
UNICODE_STRING Wow64OptionsString
Definition: ldrinit.c:25
#define KEY_ENUMERATE_SUB_KEYS
Definition: nt_native.h:1019
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3402
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:455
static PMEMKEY RootKey
Definition: registry.c:55

Referenced by CreateProcessInternalW(), LdrpInitializeExecutionOptions(), and LdrQueryImageFileExecutionOptionsEx().

◆ LdrProcessRelocationBlock()

PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock ( _In_ ULONG_PTR  Address,
_In_ ULONG  Count,
_In_ PUSHORT  TypeOffset,
_In_ LONG_PTR  Delta 
)

Definition at line 1570 of file ldrapi.c.

1575{
1577}
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlockLongLong(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONGLONG Delta)
int Count
Definition: noreturn.cpp:7
static ULONG Delta
Definition: xboxvideo.c:33

◆ LdrQueryImageFileExecutionOptions()

NTSTATUS NTAPI LdrQueryImageFileExecutionOptions ( _In_ PUNICODE_STRING  SubKey,
_In_ PCWSTR  ValueName,
_In_ ULONG  Type,
_Out_ PVOID  Buffer,
_In_ ULONG  BufferSize,
_Out_opt_ PULONG  ReturnedLength 
)

Definition at line 387 of file ldrinit.c.

394{
395 /* Call the newer function */
397 ValueName,
398 Type,
399 Buffer,
402 FALSE);
403}
Type
Definition: Type.h:7
_In_ ULONG _In_ BATTERY_QUERY_INFORMATION_LEVEL _In_ LONG _In_ ULONG _Out_ PULONG ReturnedLength
Definition: batclass.h:188
Definition: bufpool.h:45
NTSTATUS NTAPI LdrQueryImageFileExecutionOptionsEx(_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength, _In_ BOOLEAN Wow64)
Definition: ldrinit.c:348
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
Definition: wdfmemory.h:254
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
Definition: wdfregistry.h:243

Referenced by LdrpRunInitializeRoutines(), and SmpLoadSubSystemsForMuSession().

◆ LdrQueryImageFileKeyOption()

NTSTATUS NTAPI LdrQueryImageFileKeyOption ( _In_ HANDLE  KeyHandle,
_In_ PCWSTR  ValueName,
_In_ ULONG  Type,
_Out_ PVOID  Buffer,
_In_ ULONG  BufferSize,
_Out_opt_ PULONG  ReturnedLength 
)

Definition at line 183 of file ldrinit.c.

190{
191 ULONG KeyInfo[256];
192 UNICODE_STRING ValueNameString, IntegerString;
193 ULONG KeyInfoSize, ResultSize;
195 BOOLEAN FreeHeap = FALSE;
197
198 /* Build a string for the value name */
199 Status = RtlInitUnicodeStringEx(&ValueNameString, ValueName);
200 if (!NT_SUCCESS(Status)) return Status;
201
202 /* Query the value */
203 Status = ZwQueryValueKey(KeyHandle,
204 &ValueNameString,
206 KeyValueInformation,
207 sizeof(KeyInfo),
208 &ResultSize);
210 {
211 /* Our local buffer wasn't enough, allocate one */
212 KeyInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) +
213 KeyValueInformation->DataLength;
214 KeyValueInformation = RtlAllocateHeap(RtlGetProcessHeap(),
215 0,
216 KeyInfoSize);
217 if (KeyValueInformation != NULL)
218 {
219 /* Try again */
220 Status = ZwQueryValueKey(KeyHandle,
221 &ValueNameString,
223 KeyValueInformation,
224 KeyInfoSize,
225 &ResultSize);
226 FreeHeap = TRUE;
227 }
228 else
229 {
230 /* Give up this time */
232 }
233 }
234
235 /* Check for success */
236 if (NT_SUCCESS(Status))
237 {
238 /* Handle binary data */
239 if (KeyValueInformation->Type == REG_BINARY)
240 {
241 /* Check validity */
242 if ((Buffer) && (KeyValueInformation->DataLength <= BufferSize))
243 {
244 /* Copy into buffer */
246 &KeyValueInformation->Data,
247 KeyValueInformation->DataLength);
248 }
249 else
250 {
252 }
253
254 /* Copy the result length */
255 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
256 }
257 else if (KeyValueInformation->Type == REG_DWORD)
258 {
259 /* Check for valid type */
260 if (KeyValueInformation->Type != Type)
261 {
262 /* Error */
264 }
265 else
266 {
267 /* Check validity */
268 if ((Buffer) &&
269 (BufferSize == sizeof(ULONG)) &&
270 (KeyValueInformation->DataLength <= BufferSize))
271 {
272 /* Copy into buffer */
274 &KeyValueInformation->Data,
275 KeyValueInformation->DataLength);
276 }
277 else
278 {
280 }
281
282 /* Copy the result length */
283 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
284 }
285 }
286 else if (KeyValueInformation->Type != REG_SZ)
287 {
288 /* We got something weird */
290 }
291 else
292 {
293 /* String, check what you requested */
294 if (Type == REG_DWORD)
295 {
296 /* Validate */
297 if (BufferSize != sizeof(ULONG))
298 {
299 /* Invalid size */
300 BufferSize = 0;
302 }
303 else
304 {
305 /* OK, we know what you want... */
306 IntegerString.Buffer = (PWSTR)KeyValueInformation->Data;
307 IntegerString.Length = (USHORT)KeyValueInformation->DataLength -
308 sizeof(WCHAR);
309 IntegerString.MaximumLength = (USHORT)KeyValueInformation->DataLength;
310 Status = RtlUnicodeStringToInteger(&IntegerString, 0, (PULONG)Buffer);
311 }
312 }
313 else
314 {
315 /* Validate */
316 if (KeyValueInformation->DataLength > BufferSize)
317 {
318 /* Invalid */
320 }
321 else
322 {
323 /* Set the size */
324 BufferSize = KeyValueInformation->DataLength;
325 }
326
327 /* Copy the string */
328 RtlMoveMemory(Buffer, &KeyValueInformation->Data, BufferSize);
329 }
330
331 /* Copy the result length */
332 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
333 }
334 }
335
336 /* Check if buffer was in heap */
337 if (FreeHeap) RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation);
338
339 /* Return status */
340 return Status;
341}
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: d3dkmdt.h:46
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING, PCWSTR)
#define REG_SZ
Definition: layer.c:22
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4715
#define REG_BINARY
Definition: nt_native.h:1496
@ KeyValuePartialInformation
Definition: nt_native.h:1182
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
struct _KEY_VALUE_PARTIAL_INFORMATION KEY_VALUE_PARTIAL_INFORMATION
struct _KEY_VALUE_PARTIAL_INFORMATION * PKEY_VALUE_PARTIAL_INFORMATION
unsigned short USHORT
Definition: pedump.c:61
#define REG_DWORD
Definition: sdbapi.c:596
#define STATUS_BUFFER_OVERFLOW
Definition: shellext.h:66
uint16_t * PWSTR
Definition: typedefs.h:56
uint32_t * PULONG
Definition: typedefs.h:59
#define RtlMoveMemory(Destination, Source, Length)
Definition: typedefs.h:264
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133

Referenced by AVrfReadIFEO(), CreateProcessInternalW(), LdrpInitializeExecutionOptions(), LdrpInitializeProcess(), and LdrQueryImageFileExecutionOptionsEx().

◆ LdrQueryProcessModuleInformation()

NTSTATUS NTAPI LdrQueryProcessModuleInformation ( _Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES  ModuleInformation,
_In_ ULONG  Size,
_Out_opt_ PULONG  ReturnedSize 
)

Definition at line 1076 of file ldrapi.c.

1080{
1081 /* Call Ex version of the API */
1082 return LdrQueryProcessModuleInformationEx(0, 0, ModuleInformation, Size, ReturnedSize);
1083}
ULONG ReturnedSize
NTSTATUS NTAPI LdrQueryProcessModuleInformationEx(_In_opt_ ULONG ProcessId, _Reserved_ ULONG Reserved, _Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
Definition: ldrapi.c:947
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4533

Referenced by RtlQueryProcessDebugInformation(), and Test_ProcessModules().

◆ LdrSetDllManifestProber()

VOID NTAPI LdrSetDllManifestProber ( _In_ PLDR_MANIFEST_PROBER_ROUTINE  Routine)

Definition at line 73 of file ldrapi.c.

75{
77}
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
Definition: ldrpe.c:18

Referenced by DllMain().

◆ LdrShutdownProcess()

NTSTATUS NTAPI LdrShutdownProcess ( VOID  )

Definition at line 949 of file ldrinit.c.

950{
952 PLDR_DATA_TABLE_ENTRY LdrEntry;
953 PLIST_ENTRY NextEntry, ListHead;
954 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
955 PVOID EntryPoint;
956
957 DPRINT("LdrShutdownProcess() called for %wZ\n", &LdrpImageEntry->BaseDllName);
959
960 /* Tell the Shim Engine */
961 if (g_ShimsEnabled)
962 {
966 }
967
968 /* Tell the world */
969 if (ShowSnaps)
970 {
971 DPRINT1("\n");
972 }
973
974 /* Set the shutdown variables */
975 LdrpShutdownThreadId = NtCurrentTeb()->RealClientId.UniqueThread;
977
978 /* Enter the Loader Lock */
980
981 /* Cleanup trace logging data (Etw) */
982 if (SharedUserData->TraceLogging)
983 {
984 /* FIXME */
985 DPRINT1("We don't support Etw yet.\n");
986 }
987
988 /* Start at the end */
990 NextEntry = ListHead->Blink;
991 while (NextEntry != ListHead)
992 {
993 /* Get the current entry */
994 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
995 NextEntry = NextEntry->Blink;
996
997 /* Make sure it's not ourselves */
998 if (Peb->ImageBaseAddress != LdrEntry->DllBase)
999 {
1000 /* Get the entrypoint */
1001 EntryPoint = LdrEntry->EntryPoint;
1002
1003 /* Check if we are ready to call it */
1004 if (EntryPoint &&
1005 (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
1006 LdrEntry->Flags)
1007 {
1008 /* Set up the Act Ctx */
1009 ActCtx.Size = sizeof(ActCtx);
1010 ActCtx.Format = 1;
1012
1013 /* Activate the ActCtx */
1014 RtlActivateActivationContextUnsafeFast(&ActCtx,
1015 LdrEntry->EntryPointActivationContext);
1016
1017 _SEH2_TRY
1018 {
1019 /* Check if it has TLS */
1020 if (LdrEntry->TlsIndex)
1021 {
1022 /* Call TLS */
1024 }
1025
1026 /* Call the Entrypoint */
1027 DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
1028 &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
1029 LdrpCallInitRoutine(EntryPoint,
1030 LdrEntry->DllBase,
1032 (PVOID)1);
1033 }
1035 {
1036 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1037 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1038 }
1039 _SEH2_END;
1040
1041 /* Deactivate the ActCtx */
1042 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1043 }
1044 }
1045 }
1046
1047 /* Check for TLS */
1048 if (LdrpImageHasTls)
1049 {
1050 /* Set up the Act Ctx */
1051 ActCtx.Size = sizeof(ActCtx);
1052 ActCtx.Format = 1;
1054
1055 /* Activate the ActCtx */
1056 RtlActivateActivationContextUnsafeFast(&ActCtx,
1058
1059 _SEH2_TRY
1060 {
1061 /* Do TLS callbacks */
1063 }
1065 {
1066 /* Do nothing */
1067 }
1068 _SEH2_END;
1069
1070 /* Deactivate the ActCtx */
1071 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1072 }
1073
1074 /* FIXME: Do Heap detection and Etw final shutdown */
1075
1076 /* Release the lock */
1078 DPRINT("LdrpShutdownProcess() done\n");
1079
1080 return STATUS_SUCCESS;
1081}
#define VOID
Definition: acefi.h:82
#define DLL_PROCESS_DETACH
Definition: compat.h:130
PPEB Peb
Definition: dllmain.c:27
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:90
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
Definition: ldrinit.c:39
BOOLEAN LdrpShutdownInProgress
Definition: ldrinit.c:34
HANDLE LdrpShutdownThreadId
Definition: ldrinit.c:35
BOOLEAN LdrpImageHasTls
Definition: ldrinit.c:52
BOOLEAN ShowSnaps
Definition: ldrinit.c:79
RTL_CRITICAL_SECTION LdrpLoaderLock
Definition: ldrinit.c:68
_In_ PCWSTR _Out_ PVOID * ActCtx
Definition: ldrtypes.h:264
#define LDRP_PROCESS_ATTACH_CALLED
Definition: ldrtypes.h:53
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
Definition: ldrutils.c:447
PVOID g_pfnSE_ProcessDying
Definition: ldrutils.c:27
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
Definition: ldrutils.c:100
BOOLEAN g_ShimsEnabled
Definition: ldrutils.c:21
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:66
#define SharedUserData
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
Definition: process.c:439
VOID NTAPI SE_ProcessDying(VOID)
Definition: shimeng.c:1441
PACTIVATION_CONTEXT EntryPointActivationContext
Definition: ldrtypes.h:167
PVOID EntryPoint
Definition: ntddk_ex.h:203
struct _LIST_ENTRY * Blink
Definition: typedefs.h:122
LIST_ENTRY InInitializationOrderModuleList
Definition: ldrtypes.h:126
PPEB_LDR_DATA Ldr
Definition: btrfs_drv.h:1912
PVOID ImageBaseAddress
Definition: ntddk_ex.h:245
#define NTAPI
Definition: typedefs.h:36
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262

◆ LdrShutdownThread()

NTSTATUS NTAPI LdrShutdownThread ( VOID  )

Definition at line 1088 of file ldrinit.c.

1089{
1090 PPEB Peb = NtCurrentPeb();
1091 PTEB Teb = NtCurrentTeb();
1092 PLDR_DATA_TABLE_ENTRY LdrEntry;
1093 PLIST_ENTRY NextEntry, ListHead;
1094 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
1095 PVOID EntryPoint;
1096
1097 DPRINT("LdrShutdownThread() called for %wZ\n",
1099
1100 /* Cleanup trace logging data (Etw) */
1101 if (SharedUserData->TraceLogging)
1102 {
1103 /* FIXME */
1104 DPRINT1("We don't support Etw yet.\n");
1105 }
1106
1107 /* Get the Ldr Lock */
1109
1110 /* Start at the end */
1112 NextEntry = ListHead->Blink;
1113 while (NextEntry != ListHead)
1114 {
1115 /* Get the current entry */
1116 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
1117 NextEntry = NextEntry->Blink;
1118
1119 /* Make sure it's not ourselves */
1120 if (Peb->ImageBaseAddress != LdrEntry->DllBase)
1121 {
1122 /* Check if we should call */
1123 if (!(LdrEntry->Flags & LDRP_DONT_CALL_FOR_THREADS) &&
1124 (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
1125 (LdrEntry->Flags & LDRP_IMAGE_DLL))
1126 {
1127 /* Get the entrypoint */
1128 EntryPoint = LdrEntry->EntryPoint;
1129
1130 /* Check if we are ready to call it */
1131 if (EntryPoint)
1132 {
1133 /* Set up the Act Ctx */
1134 ActCtx.Size = sizeof(ActCtx);
1135 ActCtx.Format = 1;
1137
1138 /* Activate the ActCtx */
1139 RtlActivateActivationContextUnsafeFast(&ActCtx,
1140 LdrEntry->EntryPointActivationContext);
1141
1142 _SEH2_TRY
1143 {
1144 /* Check if it has TLS */
1145 if (LdrEntry->TlsIndex)
1146 {
1147 /* Make sure we're not shutting down */
1149 {
1150 /* Call TLS */
1152 }
1153 }
1154
1155 /* Make sure we're not shutting down */
1157 {
1158 /* Call the Entrypoint */
1159 DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
1160 &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
1161 LdrpCallInitRoutine(EntryPoint,
1162 LdrEntry->DllBase,
1164 NULL);
1165 }
1166 }
1168 {
1169 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_DETACH) for %wZ\n",
1170 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1171 }
1172 _SEH2_END;
1173
1174 /* Deactivate the ActCtx */
1175 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1176 }
1177 }
1178 }
1179 }
1180
1181 /* Check for TLS */
1182 if (LdrpImageHasTls)
1183 {
1184 /* Set up the Act Ctx */
1185 ActCtx.Size = sizeof(ActCtx);
1186 ActCtx.Format = 1;
1188
1189 /* Activate the ActCtx */
1190 RtlActivateActivationContextUnsafeFast(&ActCtx,
1192
1193 _SEH2_TRY
1194 {
1195 /* Do TLS callbacks */
1197 }
1199 {
1200 /* Do nothing */
1201 }
1202 _SEH2_END;
1203
1204 /* Deactivate the ActCtx */
1205 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1206 }
1207
1208 /* Free TLS */
1209 LdrpFreeTls();
1211
1212 /* Check for expansion slots */
1213 if (Teb->TlsExpansionSlots)
1214 {
1215 /* Free expansion slots */
1216 RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->TlsExpansionSlots);
1217 }
1218
1219 /* Check for FLS Data */
1220 if (Teb->FlsData)
1221 {
1222 /* Mimic BaseRundownFls */
1223 ULONG n, FlsHighIndex;
1224 PRTL_FLS_DATA pFlsData;
1225 PFLS_CALLBACK_FUNCTION lpCallback;
1226
1227 pFlsData = Teb->FlsData;
1228
1230 FlsHighIndex = NtCurrentPeb()->FlsHighIndex;
1231 RemoveEntryList(&pFlsData->ListEntry);
1233
1234 for (n = 1; n <= FlsHighIndex; ++n)
1235 {
1236 lpCallback = NtCurrentPeb()->FlsCallback[n];
1237 if (lpCallback && pFlsData->Data[n])
1238 {
1239 lpCallback(pFlsData->Data[n]);
1240 }
1241 }
1242
1243 RtlFreeHeap(RtlGetProcessHeap(), 0, pFlsData);
1244 Teb->FlsData = NULL;
1245 }
1246
1247 /* Check for Fiber data */
1248 if (Teb->HasFiberData)
1249 {
1250 /* Free Fiber data*/
1251 RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->NtTib.FiberData);
1252 Teb->NtTib.FiberData = NULL;
1253 }
1254
1255 /* Free the activation context stack */
1257 DPRINT("LdrShutdownThread() done\n");
1258
1259 return STATUS_SUCCESS;
1260}
#define DLL_THREAD_DETACH
Definition: compat.h:133
#define RemoveEntryList(Entry)
Definition: env_spec_w32.h:986
GLdouble n
Definition: glext.h:7729
NTSYSAPI void WINAPI RtlReleasePebLock(void)
Definition: libsupp.c:84
NTSYSAPI void WINAPI RtlAcquirePebLock(void)
Definition: libsupp.c:74
NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void)
Definition: actctx.c:5515
VOID NTAPI LdrpFreeTls(VOID)
Definition: ldrinit.c:1390
#define LDRP_IMAGE_DLL
Definition: ldrtypes.h:39
PVOID FiberData
Definition: compat.h:716
LIST_ENTRY ListEntry
Definition: rtltypes.h:1223
PVOID Data[RTL_FLS_MAXIMUM_AVAILABLE]
Definition: rtltypes.h:1224
PVOID * TlsExpansionSlots
Definition: compat.h:894
NT_TIB NtTib
Definition: ntddk_ex.h:332
VOID(WINAPI * PFLS_CALLBACK_FUNCTION)(PVOID)
Definition: winbase.h:1469

◆ LdrUnloadDll()

NTSTATUS NTAPI LdrUnloadDll ( _In_ PVOID  BaseAddress)

Definition at line 1291 of file ldrapi.c.

1293{
1295 PPEB Peb = NtCurrentPeb();
1296 PLDR_DATA_TABLE_ENTRY LdrEntry, CurrentEntry;
1297 PVOID EntryPoint;
1298 PLIST_ENTRY NextEntry;
1299 LIST_ENTRY UnloadList;
1300 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
1301 PVOID CorImageData;
1302 ULONG ComSectionSize;
1303
1304 /* Get the LDR Lock */
1306
1307 /* Increase the unload count */
1309
1310 /* Skip unload */
1311 if (LdrpShutdownInProgress) goto Quickie;
1312
1313 /* Make sure the DLL is valid and get its entry */
1315 {
1317 goto Quickie;
1318 }
1319
1320 /* Check the current Load Count */
1321 if (LdrEntry->LoadCount != 0xFFFF)
1322 {
1323 /* Decrease it */
1324 LdrEntry->LoadCount--;
1325
1326 /* If it's a dll */
1327 if (LdrEntry->Flags & LDRP_IMAGE_DLL)
1328 {
1329 /* Set up the Act Ctx */
1330 ActCtx.Size = sizeof(ActCtx);
1333
1334 /* Activate the ActCtx */
1335 RtlActivateActivationContextUnsafeFast(&ActCtx,
1336 LdrEntry->EntryPointActivationContext);
1337
1338 /* Update the load count */
1340
1341 /* Release the context */
1342 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1343 }
1344 }
1345 else
1346 {
1347 /* The DLL is locked */
1348 goto Quickie;
1349 }
1350
1351 /* Show debug message */
1352 if (ShowSnaps) DPRINT1("LDR: UNINIT LIST\n");
1353
1354 /* Check if this is our only unload and initialize the list if so */
1356
1357 /* Loop the modules to build the list */
1359 while (NextEntry != &Peb->Ldr->InInitializationOrderModuleList)
1360 {
1361 /* Get the entry */
1362 LdrEntry = CONTAINING_RECORD(NextEntry,
1364 InInitializationOrderLinks);
1365 NextEntry = NextEntry->Blink;
1366
1367 /* Remove flag */
1368 LdrEntry->Flags &= ~LDRP_UNLOAD_IN_PROGRESS;
1369
1370 /* If the load count is now 0 */
1371 if (!LdrEntry->LoadCount)
1372 {
1373 /* Show message */
1374 if (ShowSnaps)
1375 {
1376 DPRINT1("(%lu) [%ws] %ws (%lx) deinit %p\n",
1378 LdrEntry->BaseDllName.Buffer,
1379 LdrEntry->FullDllName.Buffer,
1380 (ULONG)LdrEntry->LoadCount,
1381 LdrEntry->EntryPoint);
1382 }
1383
1384 /* Call Shim Engine and notify */
1385 if (g_ShimsEnabled)
1386 {
1388 SE_DllUnloaded(LdrEntry);
1389 }
1390
1391 /* Unlink it */
1392 CurrentEntry = LdrEntry;
1394 RemoveEntryList(&CurrentEntry->InMemoryOrderLinks);
1395 RemoveEntryList(&CurrentEntry->HashLinks);
1396
1397 /* If there's more then one active unload */
1398 if (LdrpActiveUnloadCount > 1)
1399 {
1400 /* Flush the cached DLL handle and clear the list */
1402 CurrentEntry->InMemoryOrderLinks.Flink = NULL;
1403 }
1404
1405 /* Add the entry on the unload list */
1406 InsertTailList(&LdrpUnloadHead, &CurrentEntry->HashLinks);
1407 }
1408 }
1409
1410 /* Only call the entrypoints once */
1411 if (LdrpActiveUnloadCount > 1) goto Quickie;
1412
1413 /* Now loop the unload list and create our own */
1414 InitializeListHead(&UnloadList);
1415 CurrentEntry = NULL;
1416 NextEntry = LdrpUnloadHead.Flink;
1417 while (NextEntry != &LdrpUnloadHead)
1418 {
1419 /* Get the current entry */
1420 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
1421
1422 LdrpRecordUnloadEvent(LdrEntry);
1423
1424 /* Set the entry and clear it from the list */
1425 CurrentEntry = LdrEntry;
1427 CurrentEntry->InMemoryOrderLinks.Flink = NULL;
1428
1429 /* Move it from the global to the local list */
1430 RemoveEntryList(&CurrentEntry->HashLinks);
1431 InsertTailList(&UnloadList, &CurrentEntry->HashLinks);
1432
1433 /* Get the entrypoint */
1434 EntryPoint = LdrEntry->EntryPoint;
1435
1436 /* Check if we should call it */
1437 if ((EntryPoint) && (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED))
1438 {
1439 /* Show message */
1440 if (ShowSnaps)
1441 {
1442 DPRINT1("LDR: Calling deinit %p\n", EntryPoint);
1443 }
1444
1445 /* Set up the Act Ctx */
1446 ActCtx.Size = sizeof(ActCtx);
1449
1450 /* Activate the ActCtx */
1451 RtlActivateActivationContextUnsafeFast(&ActCtx,
1452 LdrEntry->EntryPointActivationContext);
1453
1454 /* Call the entrypoint */
1455 _SEH2_TRY
1456 {
1458 LdrEntry->DllBase,
1460 NULL);
1461 }
1463 {
1464 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1465 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1466 }
1467 _SEH2_END;
1468
1469 /* Release the context */
1470 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1471 }
1472
1473 /* Remove it from the list */
1474 RemoveEntryList(&CurrentEntry->InLoadOrderLinks);
1475 CurrentEntry = NULL;
1476 NextEntry = LdrpUnloadHead.Flink;
1477 }
1478
1479 /* Now loop our local list */
1480 NextEntry = UnloadList.Flink;
1481 while (NextEntry != &UnloadList)
1482 {
1483 /* Get the entry */
1484 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
1485 NextEntry = NextEntry->Flink;
1486 CurrentEntry = LdrEntry;
1487
1488 /* Notify Application Verifier */
1490 {
1491 AVrfDllUnloadNotification(LdrEntry);
1492 }
1493
1494 /* Show message */
1495 if (ShowSnaps)
1496 {
1497 DPRINT1("LDR: Unmapping [%ws]\n", LdrEntry->BaseDllName.Buffer);
1498 }
1499
1500#if (_WIN32_WINNT >= _WIN32_WINNT_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
1501 /* Send shutdown notification */
1503#endif
1504
1505 /* Check if this is a .NET executable */
1506 CorImageData = RtlImageDirectoryEntryToData(LdrEntry->DllBase,
1507 TRUE,
1509 &ComSectionSize);
1510 if (CorImageData)
1511 {
1512 /* FIXME */
1513 DPRINT1(".NET Images are not supported yet\n");
1514 }
1515
1516 /* Check if we should unmap*/
1517 if (!(CurrentEntry->Flags & LDR_COR_OWNS_UNMAP))
1518 {
1519 /* Unmap the DLL */
1521 CurrentEntry->DllBase);
1523 }
1524
1525 /* Unload the alternate resource module, if any */
1527
1528 /* Check if a Hotpatch is active */
1529 if (LdrEntry->PatchInformation)
1530 {
1531 /* FIXME */
1532 DPRINT1("We don't support Hotpatching yet\n");
1533 }
1534
1535 /* Deallocate the Entry */
1537
1538 /* If this is the cached entry, invalidate it */
1539 if (LdrpGetModuleHandleCache == CurrentEntry)
1540 {
1542 }
1543 }
1544
1545Quickie:
1546 /* Decrease unload count */
1549
1550 /* Return to caller */
1551 return Status;
1552}
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
Definition: section.c:3481
#define RtlImageDirectoryEntryToData
Definition: compat.h:809
#define InsertTailList(ListHead, Entry)
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
#define FLG_HEAP_ENABLE_TAIL_CHECK
Definition: pstypes.h:60
LIST_ENTRY LdrpUnloadHead
Definition: ldrapi.c:19
BOOLEAN NTAPI LdrUnloadAlternateResourceModule(_In_ PVOID BaseAddress)
Definition: ldrapi.c:1603
#define LDR_DLL_NOTIFICATION_REASON_UNLOADED
Definition: ldrtypes.h:204
#define LDR_COR_OWNS_UNMAP
Definition: ldrtypes.h:57
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
Definition: rtltypes.h:101
#define NtCurrentProcess()
Definition: nt_native.h:1657
#define LDRP_UPDATE_DEREFCOUNT
Definition: ntdllp.h:16
ULONG LdrpActiveUnloadCount
Definition: ldrinit.c:82
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
Definition: ldrutils.c:1577
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:328
VOID NTAPI LdrpSendDllNotifications(_In_ PLDR_DATA_TABLE_ENTRY DllEntry, _In_ ULONG NotificationReason)
Definition: ldrnotify.c:104
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: trace.c:28
PVOID g_pfnSE_DllUnloaded
Definition: ldrutils.c:24
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
Definition: ntdllp.h:59
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Definition: ntimage.h:489
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: shimeng.c:1465
LIST_ENTRY InLoadOrderLinks
Definition: ldrtypes.h:142
LIST_ENTRY InInitializationOrderLinks
Definition: ldrtypes.h:144
LIST_ENTRY InMemoryOrderLinks
Definition: btrfs_drv.h:1878
LIST_ENTRY HashLinks
Definition: ldrtypes.h:155
PVOID PatchInformation
Definition: ldrtypes.h:168
PVOID LoaderLock
Definition: ntddk_ex.h:295
ULONG NtGlobalFlag
Definition: ntddk_ex.h:270
void * PVOID
Definition: typedefs.h:50

Referenced by BasepReplaceProcessThreadTokens(), CsrLoadServerDll(), FreeLibrary(), FreeLibraryAndExitThread(), InitApphelp(), LdrpLoadDll(), LdrpUnloadShimEngine(), LsapAddAuthPackage(), PropertyLengthAsVariant(), RtlConvertPropertyToVariant(), RtlConvertVariantToProperty(), START_TEST(), tp_object_execute(), and tp_object_release().

◆ LdrVerifyImageMatchesChecksum()

NTSTATUS NTAPI LdrVerifyImageMatchesChecksum ( _In_ HANDLE  FileHandle,
_In_ PLDR_CALLBACK  Callback,
_In_ PVOID  CallbackContext,
_Out_ PUSHORT  ImageCharacteristics 
)

Definition at line 804 of file ldrapi.c.

809{
810 FILE_STANDARD_INFORMATION FileStandardInfo;
811 PIMAGE_IMPORT_DESCRIPTOR ImportData;
812 PIMAGE_SECTION_HEADER LastSection = NULL;
814 PIMAGE_NT_HEADERS NtHeader;
815 HANDLE SectionHandle;
817 PVOID ViewBase;
818 BOOLEAN Result, NoActualCheck;
820 PVOID ImportName;
821 ULONG Size;
822 DPRINT("LdrVerifyImageMatchesChecksum() called\n");
823
824 /* If the handle has the magic KnownDll flag, skip actual checksums */
825 NoActualCheck = ((ULONG_PTR)FileHandle & 1);
826
827 /* Create the section */
828 Status = NtCreateSection(&SectionHandle,
830 NULL,
831 NULL,
834 FileHandle);
835 if (!NT_SUCCESS(Status))
836 {
837 DPRINT1 ("NtCreateSection() failed (Status 0x%x)\n", Status);
838 return Status;
839 }
840
841 /* Map the section */
842 ViewSize = 0;
843 ViewBase = NULL;
844 Status = NtMapViewOfSection(SectionHandle,
846 &ViewBase,
847 0,
848 0,
849 NULL,
850 &ViewSize,
851 ViewShare,
852 0,
854 if (!NT_SUCCESS(Status))
855 {
856 DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
857 NtClose(SectionHandle);
858 return Status;
859 }
860
861 /* Get the file information */
864 &FileStandardInfo,
867 if (!NT_SUCCESS(Status))
868 {
869 DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
871 NtClose(SectionHandle);
872 return Status;
873 }
874
875 /* Protect with SEH */
877 {
878 /* Check if this is the KnownDll hack */
879 if (NoActualCheck)
880 {
881 /* Don't actually do it */
882 Result = TRUE;
883 }
884 else
885 {
886 /* Verify the checksum */
888 FileStandardInfo.EndOfFile.LowPart,
889 FileStandardInfo.EndOfFile.LowPart);
890 }
891
892 /* Check if a callback was supplied */
893 if ((Result) && (Callback))
894 {
895 /* Get the NT Header */
896 NtHeader = RtlImageNtHeader(ViewBase);
897
898 /* Check if caller requested this back */
899 if (ImageCharacteristics)
900 {
901 /* Return to caller */
902 *ImageCharacteristics = NtHeader->FileHeader.Characteristics;
903 }
904
905 /* Get the Import Directory Data */
906 ImportData = RtlImageDirectoryEntryToData(ViewBase,
907 FALSE,
909 &Size);
910
911 /* Make sure there is one */
912 if (ImportData)
913 {
914 /* Loop the imports */
915 while (ImportData->Name)
916 {
917 /* Get the name */
918 ImportName = RtlImageRvaToVa(NtHeader,
919 ViewBase,
920 ImportData->Name,
921 &LastSection);
922
923 /* Notify the callback */
924 Callback(CallbackContext, ImportName);
925 ImportData++;
926 }
927 }
928 }
929 }
931 {
932 /* Fail the request returning STATUS_IMAGE_CHECKSUM_MISMATCH */
933 Result = FALSE;
934 }
935 _SEH2_END;
936
937 /* Unmap file and close handle */
939 NtClose(SectionHandle);
940
941 /* Return status */
943}
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
Definition: section.c:3074
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
Definition: section.c:3255
#define RtlImageRvaToVa
Definition: compat.h:807
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
Definition: fltkernel.h:1231
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
Definition: mmfuncs.h:408
#define SEC_COMMIT
Definition: mmtypes.h:100
#define SECTION_MAP_EXECUTE
Definition: nt_native.h:1290
#define PAGE_EXECUTE
Definition: nt_native.h:1306
NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, OUT PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
@ ViewShare
Definition: nt_native.h:1278
#define STATUS_IMAGE_CHECKSUM_MISMATCH
Definition: ntstatus.h:677
#define IMAGE_DIRECTORY_ENTRY_IMPORT
Definition: pedump.c:260
#define FileStandardInformation
Definition: propsheet.cpp:61
IMAGE_FILE_HEADER FileHeader
Definition: ntddk_ex.h:183
ULONG_PTR SIZE_T
Definition: typedefs.h:80
ULONG LowPart
Definition: typedefs.h:106
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
Definition: wdfinterrupt.h:458
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR _In_ ULONGLONG _In_ ULONGLONG _In_opt_ PEVENT_FILTER_DESCRIPTOR _Inout_opt_ PVOID CallbackContext
Definition: wmitypes.h:60
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
Definition: wsk.h:409

Referenced by SmpInitializeKnownDllsInternal().