ReactOS 0.4.15-dev-8408-g466a198
umfuncs.h File Reference
#include <umtypes.h>
#include <dbgktypes.h>
Include dependency graph for umfuncs.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Typedefs

typedef VOID(NTAPIPLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)
 

Functions

__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus (_In_ ULONG Status)
 
NTSTATUS NTAPI DbgUiConnectToDbg (VOID)
 
NTSTATUS NTAPI DbgUiContinue (_In_ PCLIENT_ID ClientId, _In_ NTSTATUS ContinueStatus)
 
NTSTATUS NTAPI DbgUiDebugActiveProcess (_In_ HANDLE Process)
 
NTSTATUS NTAPI DbgUiStopDebugging (_In_ HANDLE Process)
 
NTSYSAPI NTSTATUS NTAPI DbgUiWaitStateChange (_In_ PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange, _In_ PLARGE_INTEGER TimeOut)
 
NTSTATUS NTAPI DbgUiConvertStateChangeStructure (_In_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange, _In_ PVOID DebugEvent)
 
VOID NTAPI DbgUiRemoteBreakin (VOID)
 
NTSTATUS NTAPI DbgUiIssueRemoteBreakin (_In_ HANDLE Process)
 
HANDLE NTAPI DbgUiGetThreadDebugObject (VOID)
 
NTSTATUS NTAPI LdrAddRefDll (_In_ ULONG Flags, _In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrDisableThreadCalloutsForDll (_In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrGetDllHandle (_In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *DllHandle)
 
NTSTATUS NTAPI LdrGetDllHandleEx (_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
 
NTSTATUS NTAPI LdrFindEntryForAddress (_In_ PVOID Address, _Out_ PLDR_DATA_TABLE_ENTRY *Module)
 
NTSTATUS NTAPI LdrGetProcedureAddress (_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
 
VOID NTAPI LdrInitializeThunk (ULONG Unknown1, ULONG Unknown2, ULONG Unknown3, ULONG Unknown4)
 
NTSTATUS NTAPI LdrLoadDll (_In_opt_ PWSTR SearchPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *BaseAddress)
 
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock (_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONG_PTR Delta)
 
NTSTATUS NTAPI LdrQueryImageFileExecutionOptions (_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
 
NTSTATUS NTAPI LdrQueryProcessModuleInformation (_Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
 
VOID NTAPI LdrSetDllManifestProber (_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
 
NTSTATUS NTAPI LdrShutdownProcess (VOID)
 
NTSTATUS NTAPI LdrShutdownThread (VOID)
 
NTSTATUS NTAPI LdrUnloadDll (_In_ PVOID BaseAddress)
 
NTSTATUS NTAPI LdrVerifyImageMatchesChecksum (_In_ HANDLE FileHandle, _In_ PLDR_CALLBACK Callback, _In_ PVOID CallbackContext, _Out_ PUSHORT ImageCharacteristics)
 
NTSTATUS NTAPI LdrOpenImageFileOptionsKey (_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64, _Out_ PHANDLE NewKeyHandle)
 
NTSTATUS NTAPI LdrQueryImageFileKeyOption (_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
 

Typedef Documentation

◆ PLDR_CALLBACK

typedef VOID(NTAPI * PLDR_CALLBACK) (PVOID CallbackContext, PCHAR Name)

Definition at line 217 of file umfuncs.h.

Function Documentation

◆ DbgBreakPointWithStatus()

◆ DbgUiConnectToDbg()

NTSTATUS NTAPI DbgUiConnectToDbg ( VOID  )

Definition at line 25 of file dbgui.c.

26{
28
29 /* Don't connect twice */
30 if (NtCurrentTeb()->DbgSsReserved[1]) return STATUS_SUCCESS;
31
32 /* Setup the Attributes */
34
35 /* Create the object */
36 return ZwCreateDebugObject(&NtCurrentTeb()->DbgSsReserved[1],
40}
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
Definition: conport.c:36
NTSYSAPI NTSTATUS NTAPI ZwCreateDebugObject(_Out_ PHANDLE DebugHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG Flags)
#define DEBUG_OBJECT_ALL_ACCESS
Definition: dbgktypes.h:34
#define DBGK_KILL_PROCESS_ON_EXIT
Definition: dbgktypes.h:49
#define NULL
Definition: types.h:112
#define NtCurrentTeb
#define InitializeObjectAttributes(p, n, a, r, s)
Definition: reg.c:106
#define STATUS_SUCCESS
Definition: shellext.h:65

Referenced by CreateProcessInternalW(), DebugActiveProcess(), and Main().

◆ DbgUiContinue()

NTSTATUS NTAPI DbgUiContinue ( _In_ PCLIENT_ID  ClientId,
_In_ NTSTATUS  ContinueStatus 
)

◆ DbgUiConvertStateChangeStructure()

NTSTATUS NTAPI DbgUiConvertStateChangeStructure ( _In_ PDBGUI_WAIT_STATE_CHANGE  WaitStateChange,
_In_ PVOID  DebugEvent 
)

◆ DbgUiDebugActiveProcess()

NTSTATUS NTAPI DbgUiDebugActiveProcess ( _In_ HANDLE  Process)

◆ DbgUiGetThreadDebugObject()

HANDLE NTAPI DbgUiGetThreadDebugObject ( VOID  )

Definition at line 333 of file dbgui.c.

334{
335 /* Just return the handle from the TEB */
336 return NtCurrentTeb()->DbgSsReserved[1];
337}

Referenced by CreateProcessInternalW(), and DebugSetProcessKillOnExit().

◆ DbgUiIssueRemoteBreakin()

NTSTATUS NTAPI DbgUiIssueRemoteBreakin ( _In_ HANDLE  Process)

◆ DbgUiRemoteBreakin()

VOID NTAPI DbgUiRemoteBreakin ( VOID  )

Definition at line 289 of file dbgui.c.

290{
291 /* Make sure a debugger is enabled; if so, breakpoint */
292 if (NtCurrentPeb()->BeingDebugged) DbgBreakPoint();
293
294 /* Exit the thread */
296}
#define NtCurrentPeb()
Definition: FLS.c:22
NTSYSAPI void WINAPI DbgBreakPoint(void)
NTSYSAPI VOID NTAPI RtlExitUserThread(_In_ NTSTATUS Status)

Referenced by DbgUiIssueRemoteBreakin().

◆ DbgUiStopDebugging()

NTSTATUS NTAPI DbgUiStopDebugging ( _In_ HANDLE  Process)

◆ DbgUiWaitStateChange()

NTSYSAPI NTSTATUS NTAPI DbgUiWaitStateChange ( _In_ PDBGUI_WAIT_STATE_CHANGE  DbgUiWaitStateCange,
_In_ PLARGE_INTEGER  TimeOut 
)

◆ LdrAddRefDll()

NTSTATUS NTAPI LdrAddRefDll ( _In_ ULONG  Flags,
_In_ PVOID  BaseAddress 
)

Definition at line 1205 of file ldrapi.c.

1208{
1209 PLDR_DATA_TABLE_ENTRY LdrEntry;
1213
1214 /* Check for invalid flags */
1215 if (Flags & ~(LDR_ADDREF_DLL_PIN))
1216 {
1217 /* Fail with invalid parameter status if so */
1219 goto quickie;
1220 }
1221
1222 /* Acquire the loader lock if not in init phase */
1223 if (!LdrpInLdrInit)
1224 {
1225 /* Acquire the lock */
1227 if (!NT_SUCCESS(Status)) goto quickie;
1228 Locked = TRUE;
1229 }
1230
1231 /* Get this module's data table entry */
1233 {
1234 if (!LdrEntry)
1235 {
1236 /* Shouldn't happen */
1238 goto quickie;
1239 }
1240
1241 /* If this is not a pinned module */
1242 if (LdrEntry->LoadCount != 0xFFFF)
1243 {
1244 /* Update its load count */
1246 {
1247 /* Pin it by setting load count to -1 */
1248 LdrEntry->LoadCount = 0xFFFF;
1250 }
1251 else
1252 {
1253 /* Increase its load count by one */
1254 LdrEntry->LoadCount++;
1256 }
1257
1258 /* Clear load in progress */
1260 }
1261 }
1262 else
1263 {
1264 /* There was an error getting this module's handle, return invalid param status */
1266 }
1267
1268quickie:
1269 /* Check for error case */
1270 if (!NT_SUCCESS(Status))
1271 {
1272 /* Print debug information */
1273 if ((ShowSnaps) || ((Status != STATUS_NO_SUCH_FILE) &&
1276 {
1277 DPRINT1("LDR: LdrAddRefDll(%p) 0x%08lx\n", BaseAddress, Status);
1278 }
1279 }
1280
1281 /* Release the lock if needed */
1283 return Status;
1284}
unsigned char BOOLEAN
LONG NTSTATUS
Definition: precomp.h:26
#define DPRINT1
Definition: precomp.h:8
#define TRUE
Definition: types.h:120
#define FALSE
Definition: types.h:117
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
Status
Definition: gdiplustypes.h:25
NTSTATUS NTAPI LdrUnlockLoaderLock(_In_ ULONG Flags, _In_opt_ ULONG_PTR Cookie)
Definition: ldrapi.c:101
NTSTATUS NTAPI LdrLockLoaderLock(_In_ ULONG Flags, _Out_opt_ PULONG Disposition, _Out_opt_ PULONG_PTR Cookie)
Definition: ldrapi.c:174
#define LDR_ADDREF_DLL_PIN
Definition: ldrtypes.h:71
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
Definition: ldrtypes.h:82
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
Definition: newmm.h:209
BOOLEAN LdrpInLdrInit
Definition: ldrinit.c:30
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
Definition: ldrutils.c:1595
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
Definition: ldrutils.c:434
BOOLEAN ShowSnaps
Definition: ldrinit.c:81
#define LDRP_UPDATE_PIN
Definition: ntdllp.h:17
#define LDRP_UPDATE_REFCOUNT
Definition: ntdllp.h:15
ULONG NTAPI LdrpClearLoadInProgress(VOID)
Definition: ldrutils.c:2644
#define STATUS_INTERNAL_ERROR
Definition: ntstatus.h:465
#define STATUS_DLL_NOT_FOUND
Definition: ntstatus.h:545
Definition: btrfs_drv.h:1876
USHORT LoadCount
Definition: ntddk_ex.h:208
uint32_t ULONG_PTR
Definition: typedefs.h:65
#define STATUS_INVALID_PARAMETER
Definition: udferr_usr.h:135
#define STATUS_NO_SUCH_FILE
Definition: udferr_usr.h:137
#define STATUS_OBJECT_NAME_NOT_FOUND
Definition: udferr_usr.h:149
_Must_inspect_result_ _In_ ULONG Flags
Definition: wsk.h:170
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
Definition: cmfuncs.h:14

Referenced by BasepGetModuleHandleExW().

◆ LdrDisableThreadCalloutsForDll()

NTSTATUS NTAPI LdrDisableThreadCalloutsForDll ( _In_ PVOID  BaseAddress)

Definition at line 1154 of file ldrapi.c.

1156{
1157 PLDR_DATA_TABLE_ENTRY LdrEntry;
1159 BOOLEAN LockHeld;
1161 DPRINT("LdrDisableThreadCalloutsForDll (BaseAddress %p)\n", BaseAddress);
1162
1163 /* Don't do it during shutdown */
1165
1166 /* Check if we should grab the lock */
1167 LockHeld = FALSE;
1168 if (!LdrpInLdrInit)
1169 {
1170 /* Grab the lock */
1172 if (!NT_SUCCESS(Status)) return Status;
1173 LockHeld = TRUE;
1174 }
1175
1176 /* Make sure the DLL is valid and get its entry */
1179 {
1180 /* Get if it has a TLS slot */
1181 if (!LdrEntry->TlsIndex)
1182 {
1183 /* It doesn't, so you're allowed to call this */
1184 LdrEntry->Flags |= LDRP_DONT_CALL_FOR_THREADS;
1186 }
1187 }
1188
1189 /* Check if the lock was held */
1190 if (LockHeld)
1191 {
1192 /* Release it */
1194 }
1195
1196 /* Return the status */
1197 return Status;
1198}
#define LDRP_DONT_CALL_FOR_THREADS
Definition: ldrtypes.h:48
BOOLEAN LdrpShutdownInProgress
Definition: ldrinit.c:34
#define DPRINT
Definition: sndvol32.h:73
USHORT TlsIndex
Definition: ntddk_ex.h:209
ULONG Flags
Definition: ntddk_ex.h:207

Referenced by DisableThreadLibraryCalls(), and DllMain().

◆ LdrFindEntryForAddress()

NTSTATUS NTAPI LdrFindEntryForAddress ( _In_ PVOID  Address,
_Out_ PLDR_DATA_TABLE_ENTRY Module 
)

Definition at line 425 of file ldrapi.c.

428{
429 PLIST_ENTRY ListHead, NextEntry;
430 PLDR_DATA_TABLE_ENTRY LdrEntry;
431 PIMAGE_NT_HEADERS NtHeader;
432 PPEB_LDR_DATA Ldr = NtCurrentPeb()->Ldr;
433 ULONG_PTR DllBase, DllEnd;
434
435 DPRINT("LdrFindEntryForAddress(Address %p)\n", Address);
436
437 /* Nothing to do */
438 if (!Ldr) return STATUS_NO_MORE_ENTRIES;
439
440 /* Get the current entry */
441 LdrEntry = Ldr->EntryInProgress;
442 if (LdrEntry)
443 {
444 /* Get the NT Headers */
445 NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
446 if (NtHeader)
447 {
448 /* Get the Image Base */
449 DllBase = (ULONG_PTR)LdrEntry->DllBase;
450 DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
451
452 /* Check if they match */
453 if (((ULONG_PTR)Address >= DllBase) &&
454 ((ULONG_PTR)Address < DllEnd))
455 {
456 /* Return it */
457 *Module = LdrEntry;
458 return STATUS_SUCCESS;
459 }
460 }
461 }
462
463 /* Loop the module list */
464 ListHead = &Ldr->InMemoryOrderModuleList;
465 NextEntry = ListHead->Flink;
466 while (NextEntry != ListHead)
467 {
468 /* Get the entry and NT Headers */
469 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
470 NtHeader = RtlImageNtHeader(LdrEntry->DllBase);
471 if (NtHeader)
472 {
473 /* Get the Image Base */
474 DllBase = (ULONG_PTR)LdrEntry->DllBase;
475 DllEnd = DllBase + NtHeader->OptionalHeader.SizeOfImage;
476
477 /* Check if they match */
478 if (((ULONG_PTR)Address >= DllBase) &&
479 ((ULONG_PTR)Address < DllEnd))
480 {
481 /* Return it */
482 *Module = LdrEntry;
483 return STATUS_SUCCESS;
484 }
485
486 /* Next Entry */
487 NextEntry = NextEntry->Flink;
488 }
489 }
490
491 /* Nothing found */
494 "LDR: %s() exiting 0x%08lx\n",
498}
#define RtlImageNtHeader
Definition: compat.h:806
@ DPFLTR_LDR_ID
Definition: dpfilter.h:113
#define __FUNCTION__
Definition: types.h:116
#define ULONG_PTR
Definition: config.h:101
if(dx< 0)
Definition: linetemp.h:194
#define DPFLTR_WARNING_LEVEL
Definition: kdtypes.h:31
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
#define STATUS_NO_MORE_ENTRIES
Definition: ntstatus.h:205
static WCHAR Address[46]
Definition: ping.c:68
IMAGE_OPTIONAL_HEADER32 OptionalHeader
Definition: ntddk_ex.h:184
PVOID DllBase
Definition: btrfs_drv.h:1880
Definition: typedefs.h:120
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
PVOID EntryInProgress
Definition: ldrtypes.h:123
LIST_ENTRY InMemoryOrderModuleList
Definition: btrfs_drv.h:1895
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260

Referenced by find_query_actctx(), and get_module_filename().

◆ LdrGetDllHandle()

NTSTATUS NTAPI LdrGetDllHandle ( _In_opt_ PWSTR  DllPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_ PVOID DllHandle 
)

Definition at line 770 of file ldrapi.c.

775{
776 /* Call the newer API */
778 DllPath,
779 DllCharacteristics,
780 DllName,
781 DllHandle);
782}
NTSTATUS NTAPI LdrGetDllHandleEx(_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
Definition: ldrapi.c:505
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT
Definition: ldrtypes.h:87
static const char const char * DllPath
Definition: image.c:34

Referenced by BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), FirstSoundSentry(), GetModuleHandleForUnicodeString(), SeiAddHooks(), SeiFindHookModuleInfoForImportDescriptor(), and SeiInit().

◆ LdrGetDllHandleEx()

NTSTATUS NTAPI LdrGetDllHandleEx ( _In_ ULONG  Flags,
_In_opt_ PWSTR  DllPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_opt_ PVOID DllHandle 
)

Definition at line 505 of file ldrapi.c.

511{
513 PLDR_DATA_TABLE_ENTRY LdrEntry;
514 UNICODE_STRING RedirectName, DynamicString, RawDllName;
515 PUNICODE_STRING pRedirectName, CompareName;
516 PWCHAR p1, p2, p3;
517 BOOLEAN Locked, RedirectedDll;
519 ULONG LoadFlag, Length;
520
521 /* Initialize the strings */
522 RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
523 RtlInitEmptyUnicodeString(&RawDllName, NULL, 0);
524 RedirectName = *DllName;
525 pRedirectName = &RedirectName;
526
527 /* Initialize state */
528 RedirectedDll = Locked = FALSE;
529 LdrEntry = NULL;
530 Cookie = 0;
531
532 /* Clear the handle */
533 if (DllHandle) *DllHandle = NULL;
534
535 /* Check for a valid flag combination */
537 (!DllHandle && !(Flags & LDR_GET_DLL_HANDLE_EX_PIN)))
538 {
539 DPRINT1("Flags are invalid or no DllHandle given\n");
541 goto Quickie;
542 }
543
544 /* If not initializing */
545 if (!LdrpInLdrInit)
546 {
547 /* Acquire the lock */
549 if (!NT_SUCCESS(Status)) goto Quickie;
550
551 /* Remember we own it */
552 Locked = TRUE;
553 }
554
556 pRedirectName, &LdrApiDefaultExtension, NULL, &DynamicString, &pRedirectName, &RedirectedDll);
557 if (!NT_SUCCESS(Status))
558 {
559 DPRINT1("LdrpApplyFileNameRedirection FAILED: (Status 0x%x)\n", Status);
560 goto Quickie;
561 }
562
563 /* Set default failure code */
565
566 /* Use the cache if we can */
568 {
569 /* Check if we were redirected */
570 if (RedirectedDll)
571 {
572 /* Check the flag */
574 {
575 goto DontCompare;
576 }
577
578 /* Use the right name */
580 }
581 else
582 {
583 /* Check the flag */
585 {
586 goto DontCompare;
587 }
588
589 /* Use the right name */
591 }
592
593 /* Check if the name matches */
594 if (RtlEqualUnicodeString(pRedirectName,
596 TRUE))
597 {
598 /* Skip the rest */
599 LdrEntry = LdrpGetModuleHandleCache;
600
601 /* Return success */
603 goto Quickie;
604 }
605 }
606
607DontCompare:
608 /* Find the name without the extension */
609 p1 = pRedirectName->Buffer;
610 p2 = NULL;
611 p3 = &p1[pRedirectName->Length / sizeof(WCHAR)];
612 while (p1 != p3)
613 {
614 if (*p1++ == L'.')
615 {
616 p2 = p1;
617 }
618 else if (*p1 == L'\\')
619 {
620 p2 = NULL;
621 }
622 }
623
624 /* Check if no extension was found or if we got a slash */
625 if (!(p2) || (*p2 == L'\\') || (*p2 == L'/'))
626 {
627 /* Check that we have space to add one */
628 Length = pRedirectName->Length +
631 {
632 /* No space to add the extension */
634 goto Quickie;
635 }
636
637 /* Setup the string */
638 RawDllName.MaximumLength = Length;
639 ASSERT(Length >= sizeof(UNICODE_NULL));
640 RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
641 0,
642 RawDllName.MaximumLength);
643 if (!RawDllName.Buffer)
644 {
646 goto Quickie;
647 }
648
649 /* Copy the string and add extension */
650 RtlCopyUnicodeString(&RawDllName, pRedirectName);
652 }
653 else
654 {
655 /* Check if there's something in the name */
656 Length = pRedirectName->Length;
657 if (Length)
658 {
659 /* Check and remove trailing period */
660 if (pRedirectName->Buffer[Length / sizeof(WCHAR) - sizeof(ANSI_NULL)] == '.')
661 {
662 /* Decrease the size */
663 pRedirectName->Length -= sizeof(WCHAR);
664 }
665 }
666
667 /* Setup the string */
668 RawDllName.MaximumLength = pRedirectName->Length + sizeof(WCHAR);
669 RawDllName.Buffer = RtlAllocateHeap(RtlGetProcessHeap(),
670 0,
671 RawDllName.MaximumLength);
672 if (!RawDllName.Buffer)
673 {
675 goto Quickie;
676 }
677
678 /* Copy the string */
679 RtlCopyUnicodeString(&RawDllName, pRedirectName);
680 }
681
682 /* Display debug string */
683 if (ShowSnaps)
684 {
685 DPRINT1("LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
686 &RawDllName,
687 DllPath ? ((ULONG_PTR)DllPath == 1 ? L"" : DllPath) : L"");
688 }
689
690 /* Do the lookup */
692 &RawDllName,
693 ((ULONG_PTR)DllPath == 1) ? TRUE : FALSE,
694 RedirectedDll,
695 &LdrEntry))
696 {
697 /* Update cached entry */
698 LdrpGetModuleHandleCache = LdrEntry;
699
700 /* Return success */
702 }
703 else
704 {
705 /* Make sure to NULL this */
706 LdrEntry = NULL;
707 }
708Quickie:
709 /* The success path must have a valid loader entry */
710 ASSERT((LdrEntry != NULL) == NT_SUCCESS(Status));
711
712 /* Check if we got an entry and success */
713 DPRINT("Got LdrEntry->BaseDllName %wZ\n", LdrEntry ? &LdrEntry->BaseDllName : NULL);
714 if ((LdrEntry) && (NT_SUCCESS(Status)))
715 {
716 /* Check if the DLL is locked */
717 if ((LdrEntry->LoadCount != 0xFFFF) &&
719 {
720 /* Check what to do with the load count */
722 {
723 /* Pin it */
724 LdrEntry->LoadCount = 0xFFFF;
725 LoadFlag = LDRP_UPDATE_PIN;
726 }
727 else
728 {
729 /* Increase the load count */
730 LdrEntry->LoadCount++;
731 LoadFlag = LDRP_UPDATE_REFCOUNT;
732 }
733
734 /* Update the load count now */
735 LdrpUpdateLoadCount2(LdrEntry, LoadFlag);
737 }
738
739 /* Check if the caller is requesting the handle */
740 if (DllHandle) *DllHandle = LdrEntry->DllBase;
741 }
742
743 /* Free string if needed */
745
746 /* Free the raw DLL Name if needed */
747 if (RawDllName.Buffer)
748 {
749 /* Free the heap-allocated buffer */
750 RtlFreeHeap(RtlGetProcessHeap(), 0, RawDllName.Buffer);
751 RawDllName.Buffer = NULL;
752 }
753
754 /* Release lock */
755 if (Locked)
756 {
758 Cookie);
759 }
760
761 /* Return */
762 return Status;
763}
IN PUNICODE_STRING IN PUNICODE_STRING DynamicString
static BOOL CompareName(LPCWSTR pszName1, LPCWSTR pszName2)
Definition: find.c:72
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:590
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:608
UNICODE_STRING LdrApiDefaultExtension
Definition: ldrapi.c:22
#define LDRP_REDIRECTED
Definition: ldrtypes.h:58
#define LDR_GET_DLL_HANDLE_EX_PIN
Definition: ldrtypes.h:88
#define ASSERT(a)
Definition: mode.c:44
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define UNICODE_NULL
#define UNICODE_STRING_MAX_BYTES
#define ANSI_NULL
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
NTSYSAPI NTSTATUS NTAPI LdrpApplyFileNameRedirection(_In_ PUNICODE_STRING OriginalName, _In_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING StaticString, _Inout_opt_ PUNICODE_STRING DynamicString, _Inout_ PUNICODE_STRING *NewName, _Inout_ PBOOLEAN RedirectedDll)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
Definition: ldrutils.c:19
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
Definition: ldrutils.c:1953
#define STATUS_NO_MEMORY
Definition: ntstatus.h:260
#define STATUS_NAME_TOO_LONG
Definition: ntstatus.h:498
#define L(x)
Definition: ntvdm.h:50
UNICODE_STRING FullDllName
Definition: btrfs_drv.h:1882
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
USHORT MaximumLength
Definition: env_spec_w32.h:370
uint16_t * PWCHAR
Definition: typedefs.h:56
uint32_t ULONG
Definition: typedefs.h:59
__wchar_t WCHAR
Definition: xmlstorage.h:180

Referenced by LdrGetDllHandle(), and LoadLibraryExW().

◆ LdrGetProcedureAddress()

NTSTATUS NTAPI LdrGetProcedureAddress ( _In_ PVOID  BaseAddress,
_In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING  Name,
_In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG  Ordinal,
_Out_ PVOID ProcedureAddress 
)

Definition at line 789 of file ldrapi.c.

794{
795 /* Call the internal routine and tell it to execute DllInit */
796 return LdrpGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress, TRUE);
797}
NTSTATUS NTAPI LdrpGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress, _In_ BOOLEAN ExecuteInit)
Definition: ldrutils.c:2226

Referenced by BaseInitApphelp(), BasepReplaceProcessThreadTokens(), BaseSrvDelayLoadKernel32(), BroadcastDriveLetterChange(), CsrClientConnectToServer(), CsrConnectToUser(), CsrLoadServerDll(), FirstSoundSentry(), GetProcAddress(), InitApphelp(), LdrpInitializeProcess(), LoadOle32Export(), LsapAddAuthPackage(), SeiCreateShimModuleInfo(), and SeiResolveAPI().

◆ LdrInitializeThunk()

VOID NTAPI LdrInitializeThunk ( ULONG  Unknown1,
ULONG  Unknown2,
ULONG  Unknown3,
ULONG  Unknown4 
)

◆ LdrLoadDll()

NTSTATUS NTAPI LdrLoadDll ( _In_opt_ PWSTR  SearchPath,
_In_opt_ PULONG  DllCharacteristics,
_In_ PUNICODE_STRING  DllName,
_Out_ PVOID BaseAddress 
)

Definition at line 312 of file ldrapi.c.

317{
320 BOOLEAN RedirectedDll = FALSE;
323 PUNICODE_STRING OldTldDll;
324 PTEB Teb = NtCurrentTeb();
325
326 /* Initialize the strings */
327 RtlInitEmptyUnicodeString(&StaticString, StringBuffer, sizeof(StringBuffer));
328 RtlInitEmptyUnicodeString(&DynamicString, NULL, 0);
329
331
332 /* Lock the loader lock */
334
335 /* Check if there's a TLD DLL being loaded */
336 OldTldDll = LdrpTopLevelDllBeingLoaded;
338 {
339
340 if (OldTldDll)
341 {
342 /* This is a recursive load, do something about it? */
344 {
345 /* Print out debug messages */
346 DPRINT1("[%p, %p] LDR: Recursive DLL Load\n",
349 DPRINT1("[%p, %p] Previous DLL being loaded \"%wZ\"\n",
352 OldTldDll);
353 DPRINT1("[%p, %p] DLL being requested \"%wZ\"\n",
356 DllName);
357
358 /* Was it initializing too? */
360 {
361 DPRINT1("[%p, %p] LDR: No DLL Initializer was running\n",
364 }
365 else
366 {
367 DPRINT1("[%p, %p] DLL whose initializer was currently running \"%wZ\"\n",
371 }
372 }
373 }
374
375 /* Set this one as the TLD DLL being loaded*/
377
378 /* Load the DLL */
379 Status = LdrpLoadDll(RedirectedDll,
381 DllCharacteristics,
382 DllName,
384 TRUE);
385 if (NT_SUCCESS(Status))
386 {
388 }
389 else if ((Status != STATUS_NO_SUCH_FILE) &&
393 {
396 "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
398 DllName,
399 Status);
400 }
401 }
403 {
404 /* Restore the old TLD DLL */
405 LdrpTopLevelDllBeingLoaded = OldTldDll;
406
407 /* Release the lock */
409 }
410 _SEH2_END;
411
412 /* Do we have a redirect string? */
415
416 /* Return */
417 return Status;
418}
IN PUNICODE_STRING StaticString
#define MAX_PATH
Definition: compat.h:34
#define _SEH2_FINALLY
Definition: filesup.c:21
#define _SEH2_END
Definition: filesup.c:22
#define _SEH2_TRY
Definition: filesup.c:19
BOOLEAN LdrpBreakOnRecursiveDllLoads
Definition: ldrapi.c:21
BOOLEAN LdrpShowRecursiveLoads
Definition: ldrapi.c:21
WCHAR StringBuffer[156]
Definition: ldrinit.c:41
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
Definition: ldrtypes.h:76
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
Definition: ldrutils.c:2409
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
Definition: ldrinit.c:43
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
Definition: ldrinit.c:40
#define STATUS_DLL_INIT_FAILED
Definition: ntstatus.h:558
HANDLE UniqueThread
Definition: compat.h:826
HANDLE UniqueProcess
Definition: compat.h:825
Definition: compat.h:836
CLIENT_ID ClientId
Definition: compat.h:839
CLIENT_ID RealClientId
Definition: compat.h:861
#define SearchPath
Definition: winbase.h:3900

Referenced by AVrfpLoadAndInitializeProvider(), BaseInitApphelp(), BaseSrvDelayLoadKernel32(), CsrLoadServerDll(), InitApphelp(), LdrpInitializeProcess(), LoadLibraryExW(), LoadOle32Export(), LsapAddAuthPackage(), SeiInit(), and START_TEST().

◆ LdrOpenImageFileOptionsKey()

NTSTATUS NTAPI LdrOpenImageFileOptionsKey ( _In_ PUNICODE_STRING  SubKey,
_In_ BOOLEAN  Wow64,
_Out_ PHANDLE  NewKeyHandle 
)

Definition at line 112 of file ldrinit.c.

116{
117 PHANDLE RootKeyLocation;
119 UNICODE_STRING SubKeyString;
122 PWCHAR p1;
123
124 /* Check which root key to open */
125 if (Wow64)
126 RootKeyLocation = &Wow64ExecOptionsKey;
127 else
128 RootKeyLocation = &ImageExecOptionsKey;
129
130 /* Get the current key */
131 RootKey = *RootKeyLocation;
132
133 /* Setup the object attributes */
135 Wow64 ?
138 NULL,
139 NULL);
140
141 /* Open the root key */
143 if (NT_SUCCESS(Status))
144 {
145 /* Write the key handle */
146 if (InterlockedCompareExchangePointer(RootKeyLocation, RootKey, NULL) != NULL)
147 {
148 /* Someone already opened it, use it instead */
150 RootKey = *RootKeyLocation;
151 }
152
153 /* Extract the name */
154 SubKeyString = *SubKey;
155 p1 = (PWCHAR)((ULONG_PTR)SubKeyString.Buffer + SubKeyString.Length);
156 while (SubKeyString.Length)
157 {
158 if (p1[-1] == L'\\') break;
159 p1--;
160 SubKeyString.Length -= sizeof(*p1);
161 }
162 SubKeyString.Buffer = p1;
163 SubKeyString.Length = SubKey->Length - SubKeyString.Length;
164
165 /* Setup the object attributes */
167 &SubKeyString,
169 RootKey,
170 NULL);
171
172 /* Open the setting key */
173 Status = ZwOpenKey((PHANDLE)NewKeyHandle, GENERIC_READ, &ObjectAttributes);
174 }
175
176 /* Return to caller */
177 return Status;
178}
#define GENERIC_READ
Definition: compat.h:135
#define OBJ_CASE_INSENSITIVE
Definition: winternl.h:228
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
HANDLE ImageExecOptionsKey
Definition: ldrinit.c:22
HANDLE Wow64ExecOptionsKey
Definition: ldrinit.c:23
UNICODE_STRING ImageExecOptionsString
Definition: ldrinit.c:24
UNICODE_STRING Wow64OptionsString
Definition: ldrinit.c:25
#define KEY_ENUMERATE_SUB_KEYS
Definition: nt_native.h:1019
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
Definition: obhandle.c:3402
PVOID *typedef PHANDLE
Definition: ntsecpkg.h:455
static PMEMKEY RootKey
Definition: registry.c:55

Referenced by CreateProcessInternalW(), LdrpInitializeExecutionOptions(), and LdrQueryImageFileExecutionOptionsEx().

◆ LdrProcessRelocationBlock()

PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock ( _In_ ULONG_PTR  Address,
_In_ ULONG  Count,
_In_ PUSHORT  TypeOffset,
_In_ LONG_PTR  Delta 
)

Definition at line 1568 of file ldrapi.c.

1573{
1575}
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlockLongLong(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONGLONG Delta)
int Count
Definition: noreturn.cpp:7
static ULONG Delta
Definition: xboxvideo.c:33

◆ LdrQueryImageFileExecutionOptions()

NTSTATUS NTAPI LdrQueryImageFileExecutionOptions ( _In_ PUNICODE_STRING  SubKey,
_In_ PCWSTR  ValueName,
_In_ ULONG  Type,
_Out_ PVOID  Buffer,
_In_ ULONG  BufferSize,
_Out_opt_ PULONG  ReturnedLength 
)

Definition at line 389 of file ldrinit.c.

396{
397 /* Call the newer function */
399 ValueName,
400 Type,
401 Buffer,
404 FALSE);
405}
Type
Definition: Type.h:7
_In_ ULONG _In_ BATTERY_QUERY_INFORMATION_LEVEL _In_ LONG _In_ ULONG _Out_ PULONG ReturnedLength
Definition: batclass.h:188
Definition: bufpool.h:45
NTSTATUS NTAPI LdrQueryImageFileExecutionOptionsEx(_In_ PUNICODE_STRING SubKey, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength, _In_ BOOLEAN Wow64)
Definition: ldrinit.c:350
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
Definition: wdfmemory.h:254
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
Definition: wdfregistry.h:243

Referenced by LdrpRunInitializeRoutines(), and SmpLoadSubSystemsForMuSession().

◆ LdrQueryImageFileKeyOption()

NTSTATUS NTAPI LdrQueryImageFileKeyOption ( _In_ HANDLE  KeyHandle,
_In_ PCWSTR  ValueName,
_In_ ULONG  Type,
_Out_ PVOID  Buffer,
_In_ ULONG  BufferSize,
_Out_opt_ PULONG  ReturnedLength 
)

Definition at line 185 of file ldrinit.c.

192{
193 ULONG KeyInfo[256];
194 UNICODE_STRING ValueNameString, IntegerString;
195 ULONG KeyInfoSize, ResultSize;
197 BOOLEAN FreeHeap = FALSE;
199
200 /* Build a string for the value name */
201 Status = RtlInitUnicodeStringEx(&ValueNameString, ValueName);
202 if (!NT_SUCCESS(Status)) return Status;
203
204 /* Query the value */
205 Status = ZwQueryValueKey(KeyHandle,
206 &ValueNameString,
208 KeyValueInformation,
209 sizeof(KeyInfo),
210 &ResultSize);
212 {
213 /* Our local buffer wasn't enough, allocate one */
214 KeyInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) +
215 KeyValueInformation->DataLength;
216 KeyValueInformation = RtlAllocateHeap(RtlGetProcessHeap(),
217 0,
218 KeyInfoSize);
219 if (KeyValueInformation != NULL)
220 {
221 /* Try again */
222 Status = ZwQueryValueKey(KeyHandle,
223 &ValueNameString,
225 KeyValueInformation,
226 KeyInfoSize,
227 &ResultSize);
228 FreeHeap = TRUE;
229 }
230 else
231 {
232 /* Give up this time */
234 }
235 }
236
237 /* Check for success */
238 if (NT_SUCCESS(Status))
239 {
240 /* Handle binary data */
241 if (KeyValueInformation->Type == REG_BINARY)
242 {
243 /* Check validity */
244 if ((Buffer) && (KeyValueInformation->DataLength <= BufferSize))
245 {
246 /* Copy into buffer */
248 &KeyValueInformation->Data,
249 KeyValueInformation->DataLength);
250 }
251 else
252 {
254 }
255
256 /* Copy the result length */
257 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
258 }
259 else if (KeyValueInformation->Type == REG_DWORD)
260 {
261 /* Check for valid type */
262 if (KeyValueInformation->Type != Type)
263 {
264 /* Error */
266 }
267 else
268 {
269 /* Check validity */
270 if ((Buffer) &&
271 (BufferSize == sizeof(ULONG)) &&
272 (KeyValueInformation->DataLength <= BufferSize))
273 {
274 /* Copy into buffer */
276 &KeyValueInformation->Data,
277 KeyValueInformation->DataLength);
278 }
279 else
280 {
282 }
283
284 /* Copy the result length */
285 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
286 }
287 }
288 else if (KeyValueInformation->Type != REG_SZ)
289 {
290 /* We got something weird */
292 }
293 else
294 {
295 /* String, check what you requested */
296 if (Type == REG_DWORD)
297 {
298 /* Validate */
299 if (BufferSize != sizeof(ULONG))
300 {
301 /* Invalid size */
302 BufferSize = 0;
304 }
305 else
306 {
307 /* OK, we know what you want... */
308 IntegerString.Buffer = (PWSTR)KeyValueInformation->Data;
309 IntegerString.Length = (USHORT)KeyValueInformation->DataLength -
310 sizeof(WCHAR);
311 IntegerString.MaximumLength = (USHORT)KeyValueInformation->DataLength;
312 Status = RtlUnicodeStringToInteger(&IntegerString, 0, (PULONG)Buffer);
313 }
314 }
315 else
316 {
317 /* Validate */
318 if (KeyValueInformation->DataLength > BufferSize)
319 {
320 /* Invalid */
322 }
323 else
324 {
325 /* Set the size */
326 BufferSize = KeyValueInformation->DataLength;
327 }
328
329 /* Copy the string */
330 RtlMoveMemory(Buffer, &KeyValueInformation->Data, BufferSize);
331 }
332
333 /* Copy the result length */
334 if (ReturnedLength) *ReturnedLength = KeyValueInformation->DataLength;
335 }
336 }
337
338 /* Check if buffer was in heap */
339 if (FreeHeap) RtlFreeHeap(RtlGetProcessHeap(), 0, KeyValueInformation);
340
341 /* Return status */
342 return Status;
343}
NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING, PCWSTR)
#define REG_SZ
Definition: layer.c:22
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4715
#define REG_BINARY
Definition: nt_native.h:1496
@ KeyValuePartialInformation
Definition: nt_native.h:1182
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(PUNICODE_STRING String, ULONG Base, PULONG Value)
struct _KEY_VALUE_PARTIAL_INFORMATION KEY_VALUE_PARTIAL_INFORMATION
struct _KEY_VALUE_PARTIAL_INFORMATION * PKEY_VALUE_PARTIAL_INFORMATION
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:273
unsigned short USHORT
Definition: pedump.c:61
#define REG_DWORD
Definition: sdbapi.c:596
#define STATUS_BUFFER_OVERFLOW
Definition: shellext.h:66
uint16_t * PWSTR
Definition: typedefs.h:56
uint32_t * PULONG
Definition: typedefs.h:59
#define RtlMoveMemory(Destination, Source, Length)
Definition: typedefs.h:264
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133

Referenced by AVrfReadIFEO(), CreateProcessInternalW(), LdrpInitializeExecutionOptions(), LdrpInitializeProcess(), and LdrQueryImageFileExecutionOptionsEx().

◆ LdrQueryProcessModuleInformation()

NTSTATUS NTAPI LdrQueryProcessModuleInformation ( _Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES  ModuleInformation,
_In_ ULONG  Size,
_Out_opt_ PULONG  ReturnedSize 
)

Definition at line 1076 of file ldrapi.c.

1080{
1081 /* Call Ex version of the API */
1082 return LdrQueryProcessModuleInformationEx(0, 0, ModuleInformation, Size, ReturnedSize);
1083}
ULONG ReturnedSize
NTSTATUS NTAPI LdrQueryProcessModuleInformationEx(_In_opt_ ULONG ProcessId, _Reserved_ ULONG Reserved, _Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
Definition: ldrapi.c:947
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4533

Referenced by RtlQueryProcessDebugInformation(), and Test_ProcessModules().

◆ LdrSetDllManifestProber()

VOID NTAPI LdrSetDllManifestProber ( _In_ PLDR_MANIFEST_PROBER_ROUTINE  Routine)

Definition at line 73 of file ldrapi.c.

75{
77}
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
Definition: ldrpe.c:18

Referenced by DllMain().

◆ LdrShutdownProcess()

NTSTATUS NTAPI LdrShutdownProcess ( VOID  )

Definition at line 943 of file ldrinit.c.

944{
946 PLDR_DATA_TABLE_ENTRY LdrEntry;
947 PLIST_ENTRY NextEntry, ListHead;
948 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
949 PVOID EntryPoint;
950
951 DPRINT("LdrShutdownProcess() called for %wZ\n", &LdrpImageEntry->BaseDllName);
953
954 /* Tell the Shim Engine */
955 if (g_ShimsEnabled)
956 {
960 }
961
962 /* Tell the world */
963 if (ShowSnaps)
964 {
965 DPRINT1("\n");
966 }
967
968 /* Set the shutdown variables */
969 LdrpShutdownThreadId = NtCurrentTeb()->RealClientId.UniqueThread;
971
972 /* Enter the Loader Lock */
974
975 /* Cleanup trace logging data (Etw) */
976 if (SharedUserData->TraceLogging)
977 {
978 /* FIXME */
979 DPRINT1("We don't support Etw yet.\n");
980 }
981
982 /* Start at the end */
984 NextEntry = ListHead->Blink;
985 while (NextEntry != ListHead)
986 {
987 /* Get the current entry */
988 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
989 NextEntry = NextEntry->Blink;
990
991 /* Make sure it's not ourselves */
992 if (Peb->ImageBaseAddress != LdrEntry->DllBase)
993 {
994 /* Get the entrypoint */
995 EntryPoint = LdrEntry->EntryPoint;
996
997 /* Check if we are ready to call it */
998 if (EntryPoint &&
999 (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
1000 LdrEntry->Flags)
1001 {
1002 /* Set up the Act Ctx */
1003 ActCtx.Size = sizeof(ActCtx);
1004 ActCtx.Format = 1;
1006
1007 /* Activate the ActCtx */
1008 RtlActivateActivationContextUnsafeFast(&ActCtx,
1009 LdrEntry->EntryPointActivationContext);
1010
1011 _SEH2_TRY
1012 {
1013 /* Check if it has TLS */
1014 if (LdrEntry->TlsIndex)
1015 {
1016 /* Call TLS */
1018 }
1019
1020 /* Call the Entrypoint */
1021 DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
1022 &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
1023 LdrpCallInitRoutine(EntryPoint,
1024 LdrEntry->DllBase,
1026 (PVOID)1);
1027 }
1029 {
1030 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1031 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1032 }
1033 _SEH2_END;
1034
1035 /* Deactivate the ActCtx */
1036 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1037 }
1038 }
1039 }
1040
1041 /* Check for TLS */
1042 if (LdrpImageHasTls)
1043 {
1044 /* Set up the Act Ctx */
1045 ActCtx.Size = sizeof(ActCtx);
1046 ActCtx.Format = 1;
1048
1049 /* Activate the ActCtx */
1050 RtlActivateActivationContextUnsafeFast(&ActCtx,
1052
1053 _SEH2_TRY
1054 {
1055 /* Do TLS callbacks */
1057 }
1059 {
1060 /* Do nothing */
1061 }
1062 _SEH2_END;
1063
1064 /* Deactivate the ActCtx */
1065 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1066 }
1067
1068 /* FIXME: Do Heap detection and Etw final shutdown */
1069
1070 /* Release the lock */
1072 DPRINT("LdrpShutdownProcess() done\n");
1073
1074 return STATUS_SUCCESS;
1075}
#define VOID
Definition: acefi.h:82
#define DLL_PROCESS_DETACH
Definition: compat.h:130
PPEB Peb
Definition: dllmain.c:27
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
Definition: ldrinit.c:39
BOOLEAN LdrpShutdownInProgress
Definition: ldrinit.c:34
HANDLE LdrpShutdownThreadId
Definition: ldrinit.c:35
BOOLEAN LdrpImageHasTls
Definition: ldrinit.c:52
BOOLEAN ShowSnaps
Definition: ldrinit.c:81
RTL_CRITICAL_SECTION LdrpLoaderLock
Definition: ldrinit.c:70
_In_ PCWSTR _Out_ PVOID * ActCtx
Definition: ldrtypes.h:247
#define LDRP_PROCESS_ATTACH_CALLED
Definition: ldrtypes.h:49
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
Definition: ldrutils.c:447
PVOID g_pfnSE_ProcessDying
Definition: ldrutils.c:27
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
Definition: ldrutils.c:100
BOOLEAN g_ShimsEnabled
Definition: ldrutils.c:21
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:66
#define SharedUserData
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
Definition: process.c:439
VOID NTAPI SE_ProcessDying(VOID)
Definition: shimeng.c:1441
PACTIVATION_CONTEXT EntryPointActivationContext
Definition: ldrtypes.h:163
PVOID EntryPoint
Definition: ntddk_ex.h:203
struct _LIST_ENTRY * Blink
Definition: typedefs.h:122
LIST_ENTRY InInitializationOrderModuleList
Definition: ldrtypes.h:122
PPEB_LDR_DATA Ldr
Definition: btrfs_drv.h:1912
PVOID ImageBaseAddress
Definition: ntddk_ex.h:245
#define NTAPI
Definition: typedefs.h:36
#define RtlZeroMemory(Destination, Length)
Definition: typedefs.h:262

◆ LdrShutdownThread()

NTSTATUS NTAPI LdrShutdownThread ( VOID  )

Definition at line 1082 of file ldrinit.c.

1083{
1084 PPEB Peb = NtCurrentPeb();
1085 PTEB Teb = NtCurrentTeb();
1086 PLDR_DATA_TABLE_ENTRY LdrEntry;
1087 PLIST_ENTRY NextEntry, ListHead;
1088 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
1089 PVOID EntryPoint;
1090
1091 DPRINT("LdrShutdownThread() called for %wZ\n",
1093
1094 /* Cleanup trace logging data (Etw) */
1095 if (SharedUserData->TraceLogging)
1096 {
1097 /* FIXME */
1098 DPRINT1("We don't support Etw yet.\n");
1099 }
1100
1101 /* Get the Ldr Lock */
1103
1104 /* Start at the end */
1106 NextEntry = ListHead->Blink;
1107 while (NextEntry != ListHead)
1108 {
1109 /* Get the current entry */
1110 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks);
1111 NextEntry = NextEntry->Blink;
1112
1113 /* Make sure it's not ourselves */
1114 if (Peb->ImageBaseAddress != LdrEntry->DllBase)
1115 {
1116 /* Check if we should call */
1117 if (!(LdrEntry->Flags & LDRP_DONT_CALL_FOR_THREADS) &&
1118 (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) &&
1119 (LdrEntry->Flags & LDRP_IMAGE_DLL))
1120 {
1121 /* Get the entrypoint */
1122 EntryPoint = LdrEntry->EntryPoint;
1123
1124 /* Check if we are ready to call it */
1125 if (EntryPoint)
1126 {
1127 /* Set up the Act Ctx */
1128 ActCtx.Size = sizeof(ActCtx);
1129 ActCtx.Format = 1;
1131
1132 /* Activate the ActCtx */
1133 RtlActivateActivationContextUnsafeFast(&ActCtx,
1134 LdrEntry->EntryPointActivationContext);
1135
1136 _SEH2_TRY
1137 {
1138 /* Check if it has TLS */
1139 if (LdrEntry->TlsIndex)
1140 {
1141 /* Make sure we're not shutting down */
1143 {
1144 /* Call TLS */
1146 }
1147 }
1148
1149 /* Make sure we're not shutting down */
1151 {
1152 /* Call the Entrypoint */
1153 DPRINT("%wZ - Calling entry point at %p for thread detaching\n",
1154 &LdrEntry->BaseDllName, LdrEntry->EntryPoint);
1155 LdrpCallInitRoutine(EntryPoint,
1156 LdrEntry->DllBase,
1158 NULL);
1159 }
1160 }
1162 {
1163 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_THREAD_DETACH) for %wZ\n",
1164 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1165 }
1166 _SEH2_END;
1167
1168 /* Deactivate the ActCtx */
1169 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1170 }
1171 }
1172 }
1173 }
1174
1175 /* Check for TLS */
1176 if (LdrpImageHasTls)
1177 {
1178 /* Set up the Act Ctx */
1179 ActCtx.Size = sizeof(ActCtx);
1180 ActCtx.Format = 1;
1182
1183 /* Activate the ActCtx */
1184 RtlActivateActivationContextUnsafeFast(&ActCtx,
1186
1187 _SEH2_TRY
1188 {
1189 /* Do TLS callbacks */
1191 }
1193 {
1194 /* Do nothing */
1195 }
1196 _SEH2_END;
1197
1198 /* Deactivate the ActCtx */
1199 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1200 }
1201
1202 /* Free TLS */
1203 LdrpFreeTls();
1205
1206 /* Check for expansion slots */
1207 if (Teb->TlsExpansionSlots)
1208 {
1209 /* Free expansion slots */
1210 RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->TlsExpansionSlots);
1211 }
1212
1213 /* Check for FLS Data */
1214 if (Teb->FlsData)
1215 {
1216 /* Mimic BaseRundownFls */
1217 ULONG n, FlsHighIndex;
1218 PRTL_FLS_DATA pFlsData;
1219 PFLS_CALLBACK_FUNCTION lpCallback;
1220
1221 pFlsData = Teb->FlsData;
1222
1224 FlsHighIndex = NtCurrentPeb()->FlsHighIndex;
1225 RemoveEntryList(&pFlsData->ListEntry);
1227
1228 for (n = 1; n <= FlsHighIndex; ++n)
1229 {
1230 lpCallback = NtCurrentPeb()->FlsCallback[n];
1231 if (lpCallback && pFlsData->Data[n])
1232 {
1233 lpCallback(pFlsData->Data[n]);
1234 }
1235 }
1236
1237 RtlFreeHeap(RtlGetProcessHeap(), 0, pFlsData);
1238 Teb->FlsData = NULL;
1239 }
1240
1241 /* Check for Fiber data */
1242 if (Teb->HasFiberData)
1243 {
1244 /* Free Fiber data*/
1245 RtlFreeHeap(RtlGetProcessHeap(), 0, Teb->NtTib.FiberData);
1246 Teb->NtTib.FiberData = NULL;
1247 }
1248
1249 /* Free the activation context stack */
1251 DPRINT("LdrShutdownThread() done\n");
1252
1253 return STATUS_SUCCESS;
1254}
#define DLL_THREAD_DETACH
Definition: compat.h:133
#define RemoveEntryList(Entry)
Definition: env_spec_w32.h:986
GLdouble n
Definition: glext.h:7729
NTSYSAPI void WINAPI RtlReleasePebLock(void)
Definition: libsupp.c:84
NTSYSAPI void WINAPI RtlAcquirePebLock(void)
Definition: libsupp.c:74
NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void)
Definition: actctx.c:5548
VOID NTAPI LdrpFreeTls(VOID)
Definition: ldrinit.c:1384
#define LDRP_IMAGE_DLL
Definition: ldrtypes.h:39
PVOID FiberData
Definition: compat.h:716
LIST_ENTRY ListEntry
Definition: rtltypes.h:1223
PVOID Data[RTL_FLS_MAXIMUM_AVAILABLE]
Definition: rtltypes.h:1224
PVOID * TlsExpansionSlots
Definition: compat.h:894
NT_TIB NtTib
Definition: ntddk_ex.h:332
VOID(WINAPI * PFLS_CALLBACK_FUNCTION)(PVOID)
Definition: winbase.h:1444

◆ LdrUnloadDll()

NTSTATUS NTAPI LdrUnloadDll ( _In_ PVOID  BaseAddress)

Definition at line 1291 of file ldrapi.c.

1293{
1295 PPEB Peb = NtCurrentPeb();
1296 PLDR_DATA_TABLE_ENTRY LdrEntry, CurrentEntry;
1297 PVOID EntryPoint;
1298 PLIST_ENTRY NextEntry;
1299 LIST_ENTRY UnloadList;
1300 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
1301 PVOID CorImageData;
1302 ULONG ComSectionSize;
1303
1304 /* Get the LDR Lock */
1306
1307 /* Increase the unload count */
1309
1310 /* Skip unload */
1311 if (LdrpShutdownInProgress) goto Quickie;
1312
1313 /* Make sure the DLL is valid and get its entry */
1315 {
1317 goto Quickie;
1318 }
1319
1320 /* Check the current Load Count */
1321 if (LdrEntry->LoadCount != 0xFFFF)
1322 {
1323 /* Decrease it */
1324 LdrEntry->LoadCount--;
1325
1326 /* If it's a dll */
1327 if (LdrEntry->Flags & LDRP_IMAGE_DLL)
1328 {
1329 /* Set up the Act Ctx */
1330 ActCtx.Size = sizeof(ActCtx);
1333
1334 /* Activate the ActCtx */
1335 RtlActivateActivationContextUnsafeFast(&ActCtx,
1336 LdrEntry->EntryPointActivationContext);
1337
1338 /* Update the load count */
1340
1341 /* Release the context */
1342 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1343 }
1344 }
1345 else
1346 {
1347 /* The DLL is locked */
1348 goto Quickie;
1349 }
1350
1351 /* Show debug message */
1352 if (ShowSnaps) DPRINT1("LDR: UNINIT LIST\n");
1353
1354 /* Check if this is our only unload and initialize the list if so */
1356
1357 /* Loop the modules to build the list */
1359 while (NextEntry != &Peb->Ldr->InInitializationOrderModuleList)
1360 {
1361 /* Get the entry */
1362 LdrEntry = CONTAINING_RECORD(NextEntry,
1364 InInitializationOrderLinks);
1365 NextEntry = NextEntry->Blink;
1366
1367 /* Remove flag */
1368 LdrEntry->Flags &= ~LDRP_UNLOAD_IN_PROGRESS;
1369
1370 /* If the load count is now 0 */
1371 if (!LdrEntry->LoadCount)
1372 {
1373 /* Show message */
1374 if (ShowSnaps)
1375 {
1376 DPRINT1("(%lu) [%ws] %ws (%lx) deinit %p\n",
1378 LdrEntry->BaseDllName.Buffer,
1379 LdrEntry->FullDllName.Buffer,
1380 (ULONG)LdrEntry->LoadCount,
1381 LdrEntry->EntryPoint);
1382 }
1383
1384 /* Call Shim Engine and notify */
1385 if (g_ShimsEnabled)
1386 {
1388 SE_DllUnloaded(LdrEntry);
1389 }
1390
1391 /* Unlink it */
1392 CurrentEntry = LdrEntry;
1394 RemoveEntryList(&CurrentEntry->InMemoryOrderLinks);
1395 RemoveEntryList(&CurrentEntry->HashLinks);
1396
1397 /* If there's more then one active unload */
1398 if (LdrpActiveUnloadCount > 1)
1399 {
1400 /* Flush the cached DLL handle and clear the list */
1402 CurrentEntry->InMemoryOrderLinks.Flink = NULL;
1403 }
1404
1405 /* Add the entry on the unload list */
1406 InsertTailList(&LdrpUnloadHead, &CurrentEntry->HashLinks);
1407 }
1408 }
1409
1410 /* Only call the entrypoints once */
1411 if (LdrpActiveUnloadCount > 1) goto Quickie;
1412
1413 /* Now loop the unload list and create our own */
1414 InitializeListHead(&UnloadList);
1415 CurrentEntry = NULL;
1416 NextEntry = LdrpUnloadHead.Flink;
1417 while (NextEntry != &LdrpUnloadHead)
1418 {
1419 /* Get the current entry */
1420 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
1421
1422 LdrpRecordUnloadEvent(LdrEntry);
1423
1424 /* Set the entry and clear it from the list */
1425 CurrentEntry = LdrEntry;
1427 CurrentEntry->InMemoryOrderLinks.Flink = NULL;
1428
1429 /* Move it from the global to the local list */
1430 RemoveEntryList(&CurrentEntry->HashLinks);
1431 InsertTailList(&UnloadList, &CurrentEntry->HashLinks);
1432
1433 /* Get the entrypoint */
1434 EntryPoint = LdrEntry->EntryPoint;
1435
1436 /* Check if we should call it */
1437 if ((EntryPoint) && (LdrEntry->Flags & LDRP_PROCESS_ATTACH_CALLED))
1438 {
1439 /* Show message */
1440 if (ShowSnaps)
1441 {
1442 DPRINT1("LDR: Calling deinit %p\n", EntryPoint);
1443 }
1444
1445 /* Set up the Act Ctx */
1446 ActCtx.Size = sizeof(ActCtx);
1449
1450 /* Activate the ActCtx */
1451 RtlActivateActivationContextUnsafeFast(&ActCtx,
1452 LdrEntry->EntryPointActivationContext);
1453
1454 /* Call the entrypoint */
1455 _SEH2_TRY
1456 {
1458 LdrEntry->DllBase,
1460 NULL);
1461 }
1463 {
1464 DPRINT1("WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1465 _SEH2_GetExceptionCode(), &LdrEntry->BaseDllName);
1466 }
1467 _SEH2_END;
1468
1469 /* Release the context */
1470 RtlDeactivateActivationContextUnsafeFast(&ActCtx);
1471 }
1472
1473 /* Remove it from the list */
1474 RemoveEntryList(&CurrentEntry->InLoadOrderLinks);
1475 CurrentEntry = NULL;
1476 NextEntry = LdrpUnloadHead.Flink;
1477 }
1478
1479 /* Now loop our local list */
1480 NextEntry = UnloadList.Flink;
1481 while (NextEntry != &UnloadList)
1482 {
1483 /* Get the entry */
1484 LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
1485 NextEntry = NextEntry->Flink;
1486 CurrentEntry = LdrEntry;
1487
1488 /* Notify Application Verifier */
1490 {
1491 AVrfDllUnloadNotification(LdrEntry);
1492 }
1493
1494 /* Show message */
1495 if (ShowSnaps)
1496 {
1497 DPRINT1("LDR: Unmapping [%ws]\n", LdrEntry->BaseDllName.Buffer);
1498 }
1499
1500 /* Check if this is a .NET executable */
1501 CorImageData = RtlImageDirectoryEntryToData(LdrEntry->DllBase,
1502 TRUE,
1504 &ComSectionSize);
1505 if (CorImageData)
1506 {
1507 /* FIXME */
1508 DPRINT1(".NET Images are not supported yet\n");
1509 }
1510
1511 /* Check if we should unmap*/
1512 if (!(CurrentEntry->Flags & LDR_COR_OWNS_UNMAP))
1513 {
1514 /* Unmap the DLL */
1516 CurrentEntry->DllBase);
1518 }
1519
1520 /* Unload the alternate resource module, if any */
1522
1523 /* FIXME: Send shutdown notification */
1524 //LdrpSendDllNotifications(CurrentEntry, 2, LdrpShutdownInProgress);
1525
1526 /* Check if a Hotpatch is active */
1527 if (LdrEntry->PatchInformation)
1528 {
1529 /* FIXME */
1530 DPRINT1("We don't support Hotpatching yet\n");
1531 }
1532
1533 /* Deallocate the Entry */
1535
1536 /* If this is the cached entry, invalidate it */
1537 if (LdrpGetModuleHandleCache == CurrentEntry)
1538 {
1540 }
1541 }
1542
1543Quickie:
1544 /* Decrease unload count */
1547
1548 /* Return to caller */
1549 return Status;
1550}
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
Definition: section.c:3481
#define RtlImageDirectoryEntryToData
Definition: compat.h:809
#define InsertTailList(ListHead, Entry)
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
#define FLG_HEAP_ENABLE_TAIL_CHECK
Definition: pstypes.h:60
LIST_ENTRY LdrpUnloadHead
Definition: ldrapi.c:19
BOOLEAN NTAPI LdrUnloadAlternateResourceModule(_In_ PVOID BaseAddress)
Definition: ldrapi.c:1601
#define LDR_COR_OWNS_UNMAP
Definition: ldrtypes.h:53
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
Definition: rtltypes.h:101
#define NtCurrentProcess()
Definition: nt_native.h:1657
#define LDRP_UPDATE_DEREFCOUNT
Definition: ntdllp.h:16
ULONG LdrpActiveUnloadCount
Definition: ldrinit.c:84
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
Definition: ldrutils.c:1572
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:328
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: trace.c:28
PVOID g_pfnSE_DllUnloaded
Definition: ldrutils.c:24
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
Definition: ntdllp.h:59
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Definition: ntimage.h:489
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: shimeng.c:1465
LIST_ENTRY InLoadOrderLinks
Definition: ldrtypes.h:138
LIST_ENTRY InInitializationOrderLinks
Definition: ldrtypes.h:140
LIST_ENTRY InMemoryOrderLinks
Definition: btrfs_drv.h:1878
LIST_ENTRY HashLinks
Definition: ldrtypes.h:151
PVOID PatchInformation
Definition: ldrtypes.h:164
PVOID LoaderLock
Definition: ntddk_ex.h:295
ULONG NtGlobalFlag
Definition: ntddk_ex.h:270
void * PVOID
Definition: typedefs.h:50

Referenced by BasepReplaceProcessThreadTokens(), CsrLoadServerDll(), FreeLibrary(), FreeLibraryAndExitThread(), InitApphelp(), LdrpLoadDll(), LdrpUnloadShimEngine(), LsapAddAuthPackage(), PropertyLengthAsVariant(), RtlConvertPropertyToVariant(), RtlConvertVariantToProperty(), and START_TEST().

◆ LdrVerifyImageMatchesChecksum()

NTSTATUS NTAPI LdrVerifyImageMatchesChecksum ( _In_ HANDLE  FileHandle,
_In_ PLDR_CALLBACK  Callback,
_In_ PVOID  CallbackContext,
_Out_ PUSHORT  ImageCharacteristics 
)

Definition at line 804 of file ldrapi.c.

809{
810 FILE_STANDARD_INFORMATION FileStandardInfo;
811 PIMAGE_IMPORT_DESCRIPTOR ImportData;
812 PIMAGE_SECTION_HEADER LastSection = NULL;
814 PIMAGE_NT_HEADERS NtHeader;
815 HANDLE SectionHandle;
817 PVOID ViewBase;
818 BOOLEAN Result, NoActualCheck;
820 PVOID ImportName;
821 ULONG Size;
822 DPRINT("LdrVerifyImageMatchesChecksum() called\n");
823
824 /* If the handle has the magic KnownDll flag, skip actual checksums */
825 NoActualCheck = ((ULONG_PTR)FileHandle & 1);
826
827 /* Create the section */
828 Status = NtCreateSection(&SectionHandle,
830 NULL,
831 NULL,
834 FileHandle);
835 if (!NT_SUCCESS(Status))
836 {
837 DPRINT1 ("NtCreateSection() failed (Status 0x%x)\n", Status);
838 return Status;
839 }
840
841 /* Map the section */
842 ViewSize = 0;
843 ViewBase = NULL;
844 Status = NtMapViewOfSection(SectionHandle,
846 &ViewBase,
847 0,
848 0,
849 NULL,
850 &ViewSize,
851 ViewShare,
852 0,
854 if (!NT_SUCCESS(Status))
855 {
856 DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
857 NtClose(SectionHandle);
858 return Status;
859 }
860
861 /* Get the file information */
864 &FileStandardInfo,
867 if (!NT_SUCCESS(Status))
868 {
869 DPRINT1("NtMapViewOfSection() failed (Status 0x%x)\n", Status);
871 NtClose(SectionHandle);
872 return Status;
873 }
874
875 /* Protect with SEH */
877 {
878 /* Check if this is the KnownDll hack */
879 if (NoActualCheck)
880 {
881 /* Don't actually do it */
882 Result = TRUE;
883 }
884 else
885 {
886 /* Verify the checksum */
888 FileStandardInfo.EndOfFile.LowPart,
889 FileStandardInfo.EndOfFile.LowPart);
890 }
891
892 /* Check if a callback was supplied */
893 if ((Result) && (Callback))
894 {
895 /* Get the NT Header */
896 NtHeader = RtlImageNtHeader(ViewBase);
897
898 /* Check if caller requested this back */
899 if (ImageCharacteristics)
900 {
901 /* Return to caller */
902 *ImageCharacteristics = NtHeader->FileHeader.Characteristics;
903 }
904
905 /* Get the Import Directory Data */
906 ImportData = RtlImageDirectoryEntryToData(ViewBase,
907 FALSE,
909 &Size);
910
911 /* Make sure there is one */
912 if (ImportData)
913 {
914 /* Loop the imports */
915 while (ImportData->Name)
916 {
917 /* Get the name */
918 ImportName = RtlImageRvaToVa(NtHeader,
919 ViewBase,
920 ImportData->Name,
921 &LastSection);
922
923 /* Notify the callback */
924 Callback(CallbackContext, ImportName);
925 ImportData++;
926 }
927 }
928 }
929 }
931 {
932 /* Fail the request returning STATUS_IMAGE_CHECKSUM_MISMATCH */
933 Result = FALSE;
934 }
935 _SEH2_END;
936
937 /* Unmap file and close handle */
939 NtClose(SectionHandle);
940
941 /* Return status */
943}
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
Definition: section.c:3074
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
Definition: section.c:3255
#define RtlImageRvaToVa
Definition: compat.h:807
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
Definition: fltkernel.h:1231
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
static OUT PIO_STATUS_BLOCK IoStatusBlock
Definition: pipe.c:75
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
Definition: mmfuncs.h:408
#define SEC_COMMIT
Definition: mmtypes.h:100
#define SECTION_MAP_EXECUTE
Definition: nt_native.h:1290
#define PAGE_EXECUTE
Definition: nt_native.h:1306
NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, OUT PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
@ ViewShare
Definition: nt_native.h:1278
#define STATUS_IMAGE_CHECKSUM_MISMATCH
Definition: ntstatus.h:677
#define IMAGE_DIRECTORY_ENTRY_IMPORT
Definition: pedump.c:260
#define FileStandardInformation
Definition: propsheet.cpp:61
IMAGE_FILE_HEADER FileHeader
Definition: ntddk_ex.h:183
ULONG_PTR SIZE_T
Definition: typedefs.h:80
ULONG LowPart
Definition: typedefs.h:106
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
Definition: wdfinterrupt.h:458
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR _In_ ULONGLONG _In_ ULONGLONG _In_opt_ PEVENT_FILTER_DESCRIPTOR _Inout_opt_ PVOID CallbackContext
Definition: wmitypes.h:60
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
Definition: wsk.h:409

Referenced by SmpInitializeKnownDllsInternal().