ReactOS 0.4.15-dev-5669-g09dde2c
verifier.c File Reference
#include <ntdll.h>
#include <reactos/verifier.h>
#include <debug.h>
Include dependency graph for verifier.c:

Go to the source code of this file.

Classes

struct  _VERIFIER_PROVIDER
 

Macros

#define NDEBUG
 
#define VERIFIER_DLL_FLAGS_RESOLVED   1
 

Typedefs

typedef struct _VERIFIER_PROVIDER VERIFIER_PROVIDER
 
typedef struct _VERIFIER_PROVIDERPVERIFIER_PROVIDER
 

Functions

VOID NTAPI AVrfReadIFEO (HANDLE KeyHandle)
 
NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage (HANDLE KeyHandle, PPEB Peb, BOOLEAN SystemWide, BOOLEAN ReadAdvancedOptions)
 
BOOLEAN AVrfpIsVerifierProviderDll (PVOID BaseAddress)
 
SIZE_T AVrfpCountThunks (PIMAGE_THUNK_DATA Thunk)
 
VOID AVrfpSnapDllImports (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID AvrfpResolveThunks (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfDllLoadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfDllUnloadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfPageHeapDllNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfpResnapInitialModules (VOID)
 
PVOID NTAPI AvrfpFindDuplicateThunk (PLIST_ENTRY EndEntry, PWCHAR DllName, PCHAR ThunkName)
 
VOID NTAPI AVrfpChainDuplicateThunks (VOID)
 
NTSTATUS NTAPI AVrfpLoadAndInitializeProvider (PVERIFIER_PROVIDER Provider)
 
NTSTATUS NTAPI AVrfInitializeVerifier (VOID)
 

Variables

PLDR_DATA_TABLE_ENTRY LdrpImageEntry
 
ULONG AVrfpVerifierFlags = 0
 
WCHAR AVrfpVerifierDllsString [256] = { 0 }
 
ULONG AVrfpDebug = 0
 
BOOL AVrfpInitialized = FALSE
 
RTL_CRITICAL_SECTION AVrfpVerifierLock
 
LIST_ENTRY AVrfpVerifierProvidersList
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 13 of file verifier.c.

◆ VERIFIER_DLL_FLAGS_RESOLVED

#define VERIFIER_DLL_FLAGS_RESOLVED   1

Definition at line 24 of file verifier.c.

Typedef Documentation

◆ PVERIFIER_PROVIDER

◆ VERIFIER_PROVIDER

Function Documentation

◆ AVrfDllLoadNotification()

VOID NTAPI AVrfDllLoadNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 294 of file verifier.c.

295{
297
299 return;
300
302 if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
303 {
304 AvrfpResolveThunks(LdrEntry);
305
307 {
309 RTL_VERIFIER_DLL_LOAD_CALLBACK ProviderDllLoadCallback;
310
312
313 ProviderDllLoadCallback = Provider->ProviderDllLoadCallback;
314 if (ProviderDllLoadCallback)
315 {
316 ProviderDllLoadCallback(LdrEntry->BaseDllName.Buffer,
317 LdrEntry->DllBase,
318 LdrEntry->SizeOfImage,
319 LdrEntry);
320 }
321 }
322 }
324}
#define NtCurrentPeb()
Definition: FLS.c:22
#define FLG_APPLICATION_VERIFIER
Definition: pstypes.h:64
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
RTL_CRITICAL_SECTION AVrfpVerifierLock
Definition: verifier.c:21
BOOLEAN AVrfpIsVerifierProviderDll(PVOID BaseAddress)
Definition: verifier.c:103
VOID AvrfpResolveThunks(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:235
ULONG NtGlobalFlag
Definition: init.c:54
base of all file and directory entries
Definition: entries.h:83
Definition: typedefs.h:120
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
#define CONTAINING_RECORD(address, type, field)
Definition: typedefs.h:260
VOID(NTAPI * RTL_VERIFIER_DLL_LOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.h:6

Referenced by LdrpWalkImportDescriptor().

◆ AVrfDllUnloadNotification()

VOID NTAPI AVrfDllUnloadNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 328 of file verifier.c.

329{
331
333 return;
334
336 if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
337 {
339 {
341 RTL_VERIFIER_DLL_UNLOAD_CALLBACK ProviderDllUnloadCallback;
342
344
345 ProviderDllUnloadCallback = Provider->ProviderDllUnloadCallback;
346 if (ProviderDllUnloadCallback)
347 {
348 ProviderDllUnloadCallback(LdrEntry->BaseDllName.Buffer,
349 LdrEntry->DllBase,
350 LdrEntry->SizeOfImage,
351 LdrEntry);
352 }
353 }
354 }
356}
VOID(NTAPI * RTL_VERIFIER_DLL_UNLOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.h:7

Referenced by LdrUnloadDll().

◆ AVrfInitializeVerifier()

NTSTATUS NTAPI AVrfInitializeVerifier ( VOID  )

Definition at line 612 of file verifier.c.

613{
617 WCHAR* Ptr, *Next;
618
621
622 if (!NT_SUCCESS(Status))
623 return Status;
624
625 DbgPrint("AVRF: %wZ: pid 0x%X: flags 0x%X: application verifier enabled\n",
627
628 Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
629 if (!Provider)
630 return STATUS_NO_MEMORY;
631
632 RtlInitUnicodeString(&Provider->DllName, L"verifier.dll");
634
636
637 do
638 {
639 while (*Next == L' ' || *Next == L'\t')
640 Next++;
641
642 Ptr = Next;
643
644 while (*Next != ' ' && *Next != '\t' && *Next)
645 Next++;
646
647 if (*Next)
648 *(Next++) = '\0';
649 else
650 Next = NULL;
651
652 if (*Ptr)
653 {
654 Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
655 if (!Provider)
656 return STATUS_NO_MEMORY;
659 }
660 } while (Next);
661
664 {
666 Entry = Entry->Flink;
667
669 if (!NT_SUCCESS(Status))
670 {
671 RemoveEntryList(&Provider->ListEntry);
672 RtlFreeHeap(RtlGetProcessHeap(), 0, Provider);
673 }
674 }
675
676 if (!NT_SUCCESS(Status))
677 {
678 DbgPrint("AVRF: %wZ: pid 0x%X: application verifier will be disabled due to an initialization error.\n",
680 NtCurrentPeb()->NtGlobalFlag &= ~FLG_APPLICATION_VERIFIER;
681 }
682
683 return Status;
684}
LONG NTSTATUS
Definition: precomp.h:26
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:588
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:606
#define NULL
Definition: types.h:112
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define HEAP_ZERO_MEMORY
Definition: compat.h:134
#define RemoveEntryList(Entry)
Definition: env_spec_w32.h:986
#define InsertTailList(ListHead, Entry)
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
Status
Definition: gdiplustypes.h:25
#define DbgPrint
Definition: hal.h:12
#define NtCurrentTeb
NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
ULONG AVrfpVerifierFlags
Definition: verifier.c:17
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
Definition: ldrinit.c:39
WCHAR AVrfpVerifierDllsString[256]
Definition: verifier.c:18
NTSTATUS NTAPI AVrfpLoadAndInitializeProvider(PVERIFIER_PROVIDER Provider)
Definition: verifier.c:485
#define STATUS_NO_MEMORY
Definition: ntstatus.h:260
#define L(x)
Definition: ntvdm.h:50
HANDLE UniqueProcess
Definition: compat.h:825
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1165
__wchar_t WCHAR
Definition: xmlstorage.h:180

Referenced by LdrpInitializeProcess().

◆ AVrfPageHeapDllNotification()

VOID NTAPI AVrfPageHeapDllNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 361 of file verifier.c.

362{
363 /* Check if page heap dll notification is turned on */
365 return;
366
367 /* We don't support this flag currently */
369}
#define UNIMPLEMENTED
Definition: debug.h:115
ULONG RtlpDphGlobalFlags
Definition: heappage.c:108
#define DPH_FLAG_DLL_NOTIFY
Definition: ntdllp.h:24

Referenced by LdrpWalkImportDescriptor().

◆ AVrfpChainDuplicateThunks()

VOID NTAPI AVrfpChainDuplicateThunks ( VOID  )

Definition at line 448 of file verifier.c.

449{
452
454 {
455 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
456 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
457
459
460 for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
461 {
462 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
463 {
464 PVOID Ptr;
465
467 DbgPrint("AVRF: Checking %wZ for duplicate (%ws: %s)\n",
468 &Provider->DllName, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
469
470 Ptr = AvrfpFindDuplicateThunk(Entry, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
471 if (Ptr)
472 {
474 DbgPrint("AVRF: Chaining (%ws: %s) to %wZ\n", DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
475
476 ThunkDescriptor->ThunkOldAddress = Ptr;
477 }
478 }
479 }
480 }
481}
ULONG AVrfpDebug
Definition: verifier.c:19
PVOID NTAPI AvrfpFindDuplicateThunk(PLIST_ENTRY EndEntry, PWCHAR DllName, PCHAR ThunkName)
Definition: verifier.c:402
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
#define RTL_VRF_DBG_SHOWCHAINING
Definition: verifier.h:73
#define RTL_VRF_DBG_SHOWCHAINING_DEBUG
Definition: verifier.h:74

Referenced by AVrfpLoadAndInitializeProvider().

◆ AVrfpCountThunks()

SIZE_T AVrfpCountThunks ( PIMAGE_THUNK_DATA  Thunk)

Definition at line 120 of file verifier.c.

121{
122 SIZE_T Count = 0;
123 while (Thunk[Count].u1.Function)
124 Count++;
125 return Count;
126}
GLdouble u1
Definition: glext.h:8308
int Count
Definition: noreturn.cpp:7
ULONG_PTR SIZE_T
Definition: typedefs.h:80

Referenced by AVrfpSnapDllImports().

◆ AvrfpFindDuplicateThunk()

PVOID NTAPI AvrfpFindDuplicateThunk ( PLIST_ENTRY  EndEntry,
PWCHAR  DllName,
PCHAR  ThunkName 
)

Definition at line 402 of file verifier.c.

403{
405
406 for (Entry = AVrfpVerifierProvidersList.Flink; Entry != EndEntry; Entry = Entry->Flink)
407 {
409 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
410
412
414 DbgPrint("AVRF: chain: searching in %wZ\n", &Provider->DllName);
415
416 for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
417 {
418 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
419
421 DbgPrint("AVRF: chain: dll: %ws\n", DllDescriptor->DllName);
422
423 if (_wcsicmp(DllDescriptor->DllName, DllName))
424 continue;
425
426 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
427 {
429 DbgPrint("AVRF: chain: thunk: %s == %s ?\n", ThunkDescriptor->ThunkName, ThunkName);
430
431 if (!_stricmp(ThunkDescriptor->ThunkName, ThunkName))
432 {
434 DbgPrint("AVRF: Found duplicate for (%ws: %s) in %wZ\n",
435 DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
436
437 return ThunkDescriptor->ThunkNewAddress;
438 }
439 }
440 }
441 }
442 return NULL;
443}
#define _stricmp
Definition: cat.c:22
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)

Referenced by AVrfpChainDuplicateThunks().

◆ AVrfpIsVerifierProviderDll()

BOOLEAN AVrfpIsVerifierProviderDll ( PVOID  BaseAddress)

Definition at line 103 of file verifier.c.

104{
107
109 {
111
112 if (BaseAddress == Provider->BaseAddress)
113 return TRUE;
114 }
115
116 return FALSE;
117}
#define TRUE
Definition: types.h:120
#define FALSE
Definition: types.h:117
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404

Referenced by AVrfDllLoadNotification(), AVrfDllUnloadNotification(), and AVrfpResnapInitialModules().

◆ AVrfpLoadAndInitializeProvider()

NTSTATUS NTAPI AVrfpLoadAndInitializeProvider ( PVERIFIER_PROVIDER  Provider)

Definition at line 485 of file verifier.c.

486{
492
493 RtlInitEmptyUnicodeString(&DllPath, StringBuffer, sizeof(StringBuffer));
495 RtlAppendUnicodeToString(&DllPath, L"\\System32\\");
496
498 DbgPrint("AVRF: verifier dll `%wZ'\n", &Provider->DllName);
499
500 Status = LdrLoadDll(DllPath.Buffer, NULL, &Provider->DllName, &Provider->BaseAddress);
501 if (!NT_SUCCESS(Status))
502 {
503 DbgPrint("AVRF: %wZ: failed to load provider `%wZ' (status %08X) from %wZ\n",
505 &Provider->DllName,
506 Status,
507 &DllPath);
508 return Status;
509 }
510
511 /* Prevent someone funny from specifying his own application as provider */
513 if (!ImageNtHeader ||
515 {
516 DbgPrint("AVRF: provider %wZ is not a DLL image\n", &Provider->DllName);
518 }
519
520 Provider->EntryPoint = LdrpFetchAddressOfEntryPoint(Provider->BaseAddress);
521 if (!Provider->EntryPoint)
522 {
523 DbgPrint("AVRF: cannot find an entry point for provider %wZ\n", &Provider->DllName);
525 }
526
528 {
529 if (LdrpCallInitRoutine(Provider->EntryPoint,
530 Provider->BaseAddress,
532 &Descriptor))
533 {
535 {
536 /* Copy the data */
537 Provider->ProviderDlls = Descriptor->ProviderDlls;
538 Provider->ProviderDllLoadCallback = Descriptor->ProviderDllLoadCallback;
539 Provider->ProviderDllUnloadCallback = Descriptor->ProviderDllUnloadCallback;
540 Provider->ProviderNtdllHeapFreeCallback = Descriptor->ProviderNtdllHeapFreeCallback;
541
542 /* Update some info for the provider */
544 Descriptor->VerifierFlags = AVrfpVerifierFlags;
545 Descriptor->VerifierDebug = AVrfpDebug;
546
547 /* We don't have these yet */
548 DPRINT1("AVRF: RtlpGetStackTraceAddress MISSING\n");
549 DPRINT1("AVRF: RtlpDebugPageHeapCreate MISSING\n");
550 DPRINT1("AVRF: RtlpDebugPageHeapDestroy MISSING\n");
551 Descriptor->RtlpGetStackTraceAddress = NULL;
552 Descriptor->RtlpDebugPageHeapCreate = NULL;
553 Descriptor->RtlpDebugPageHeapDestroy = NULL;
555 }
556 else
557 {
558 DbgPrint("AVRF: provider %wZ passed an invalid descriptor @ %p\n", &Provider->DllName, Descriptor);
560 }
561 }
562 else
563 {
564 DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
566 }
567 }
569 {
571 }
572 _SEH2_END;
573
574 if (!NT_SUCCESS(Status))
575 return Status;
576
577
579 DbgPrint("AVRF: initialized provider %wZ (descriptor @ %p)\n", &Provider->DllName, Descriptor);
580
581 /* Done loading providers, allow dll notifications */
583
586
587 /* Manually call with DLL_PROCESS_ATTACH, since the process is not done initializing */
589 {
590 if (!LdrpCallInitRoutine(Provider->EntryPoint,
591 Provider->BaseAddress,
593 NULL))
594 {
595 DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
597 }
598
599 }
601 {
603 }
604 _SEH2_END;
605
606 return Status;
607}
#define DPRINT1
Definition: precomp.h:8
PIMAGE_NT_HEADERS WINAPI ImageNtHeader(_In_ PVOID)
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define RtlImageNtHeader
Definition: compat.h:806
#define MAX_PATH
Definition: compat.h:34
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
Definition: string_lib.cpp:62
#define _SEH2_END
Definition: filesup.c:22
#define _SEH2_TRY
Definition: filesup.c:19
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
Definition: ldrapi.c:310
WCHAR StringBuffer[156]
Definition: ldrinit.c:41
static const char const char * DllPath
Definition: image.c:34
BOOL AVrfpInitialized
Definition: verifier.c:20
VOID NTAPI AVrfpResnapInitialModules(VOID)
Definition: verifier.c:374
VOID NTAPI AVrfpChainDuplicateThunks(VOID)
Definition: verifier.c:448
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
Definition: ldrutils.c:100
PVOID NTAPI LdrpFetchAddressOfEntryPoint(PVOID ImageBase)
#define STATUS_INVALID_PARAMETER_4
Definition: ntstatus.h:478
#define STATUS_PROCEDURE_NOT_FOUND
Definition: ntstatus.h:358
#define STATUS_DLL_INIT_FAILED
Definition: ntstatus.h:558
#define IMAGE_FILE_DLL
Definition: pedump.c:169
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:159
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:34
#define SharedUserData
#define STATUS_SUCCESS
Definition: shellext.h:65
IMAGE_FILE_HEADER FileHeader
Definition: ntddk_ex.h:183
#define RTL_VRF_DBG_LISTPROVIDERS
Definition: verifier.h:72
#define RTL_VRF_DBG_SHOWSNAPS
Definition: verifier.h:69
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
_Must_inspect_result_ _In_ WDFIORESLIST _In_ PIO_RESOURCE_DESCRIPTOR Descriptor
Definition: wdfresource.h:342

Referenced by AVrfInitializeVerifier().

◆ AVrfpResnapInitialModules()

VOID NTAPI AVrfpResnapInitialModules ( VOID  )

Definition at line 374 of file verifier.c.

375{
376 PLIST_ENTRY ListHead, ListEntry;
377
378 ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
379 for (ListEntry = ListHead->Flink; ListHead != ListEntry; ListEntry = ListEntry->Flink)
380 {
381 PLDR_DATA_TABLE_ENTRY LdrEntry;
382
383 LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
384
385 if (AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
386 {
388 DbgPrint("AVRF: skipped resnapping provider %wZ ...\n", &LdrEntry->BaseDllName);
389 }
390 else
391 {
393 DbgPrint("AVRF: resnapping %wZ ...\n", &LdrEntry->BaseDllName);
394
395 AvrfpResolveThunks(LdrEntry);
396 }
397 }
398}
Definition: btrfs_drv.h:1876
PVOID DllBase
Definition: btrfs_drv.h:1880

Referenced by AVrfpLoadAndInitializeProvider().

◆ AvrfpResolveThunks()

VOID AvrfpResolveThunks ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 235 of file verifier.c.

236{
239
240 if (!AVrfpInitialized)
241 return;
242
244 {
245 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
246
248
249 for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
250 {
251 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
252
253 if ((DllDescriptor->DllFlags & VERIFIER_DLL_FLAGS_RESOLVED) ||
254 _wcsicmp(DllDescriptor->DllName, LdrEntry->BaseDllName.Buffer))
255 continue;
256
258 DbgPrint("AVRF: pid 0x%X: found dll descriptor for `%wZ' with verified exports\n",
260 &LdrEntry->BaseDllName);
261
262 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
263 {
264 if (!ThunkDescriptor->ThunkOldAddress)
265 {
266 ANSI_STRING ThunkName;
267
268 RtlInitAnsiString(&ThunkName, ThunkDescriptor->ThunkName);
269 /* We cannot call the public api, because that would run init routines! */
270 if (NT_SUCCESS(LdrpGetProcedureAddress(LdrEntry->DllBase, &ThunkName, 0, &ThunkDescriptor->ThunkOldAddress, FALSE)))
271 {
273 DbgPrint("AVRF: (%wZ) %Z export found.\n", &LdrEntry->BaseDllName, &ThunkName);
274 }
275 else
276 {
278 DbgPrint("AVRF: warning: did not find `%Z' export in %wZ.\n", &ThunkName, &LdrEntry->BaseDllName);
279 }
280 }
281 }
282
283 DllDescriptor->DllFlags |= VERIFIER_DLL_FLAGS_RESOLVED;
284 }
285 }
286
287 AVrfpSnapDllImports(LdrEntry);
288}
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
#define VERIFIER_DLL_FLAGS_RESOLVED
Definition: verifier.c:24
VOID AVrfpSnapDllImports(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:129
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
Definition: ldrutils.c:2252
#define RTL_VRF_DBG_SHOWFOUNDEXPORTS
Definition: verifier.h:70
#define RTL_VRF_DBG_SHOWVERIFIEDEXPORTS
Definition: verifier.h:71

Referenced by AVrfDllLoadNotification(), and AVrfpResnapInitialModules().

◆ AVrfpSnapDllImports()

VOID AVrfpSnapDllImports ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 129 of file verifier.c.

130{
131 ULONG Size;
132 PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
133 PBYTE DllBase = LdrEntry->DllBase;
134
136 if (!ImportDescriptor)
137 {
138 //SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
139 return;
140 }
141
142 for (; ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
143 {
144 PIMAGE_THUNK_DATA FirstThunk;
145 PVOID UnprotectedPtr = NULL;
146 SIZE_T UnprotectedSize = 0;
147 ULONG OldProtection = 0;
148 FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
149
150 /* Walk all imports */
151 for (;FirstThunk->u1.Function; FirstThunk++)
152 {
155
157 {
158 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
159
161 for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
162 {
163 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
164
165 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
166 {
167 /* Just compare function addresses, the loader will have handled forwarders and ordinals for us */
168 if ((PVOID)FirstThunk->u1.Function != ThunkDescriptor->ThunkOldAddress)
169 continue;
170
171 if (!UnprotectedPtr)
172 {
173 PVOID Ptr = &FirstThunk->u1.Function;
174 SIZE_T Size = sizeof(FirstThunk->u1.Function) * AVrfpCountThunks(FirstThunk);
176
177 UnprotectedPtr = Ptr;
178 UnprotectedSize = Size;
179
181 &Ptr,
182 &Size,
184 &OldProtection);
185
186 if (!NT_SUCCESS(Status))
187 {
188 DbgPrint("AVRF: Unable to unprotect IAT to modify thunks (status %08X).\n", Status);
189 UnprotectedPtr = NULL;
190 continue;
191 }
192 }
193
194 if (ThunkDescriptor->ThunkNewAddress == NULL)
195 {
196 DbgPrint("AVRF: internal error: New thunk for %s is null.\n", ThunkDescriptor->ThunkName);
197 continue;
198 }
199 FirstThunk->u1.Function = (SIZE_T)ThunkDescriptor->ThunkNewAddress;
201 DbgPrint("AVRF: Snapped (%wZ: %s) with (%wZ: %p).\n",
202 &LdrEntry->BaseDllName,
203 ThunkDescriptor->ThunkName,
204 &Provider->DllName,
205 ThunkDescriptor->ThunkNewAddress);
206 }
207 }
208 }
209 }
210
211 if (UnprotectedPtr)
212 {
213 PVOID Ptr = UnprotectedPtr;
214 SIZE_T Size = UnprotectedSize;
216
217 UnprotectedPtr = Ptr;
218 UnprotectedSize = Size;
219
221 &Ptr,
222 &Size,
223 OldProtection,
224 &OldProtection);
225 if (!NT_SUCCESS(Status))
226 {
227 DbgPrint("AVRF: Unable to reprotect IAT to modify thunks (status %08X).\n", Status);
228 }
229 }
230 }
231}
#define RtlImageDirectoryEntryToData
Definition: compat.h:809
if(dx< 0)
Definition: linetemp.h:194
#define NtCurrentProcess()
Definition: nt_native.h:1657
#define PAGE_EXECUTE_READWRITE
Definition: nt_native.h:1308
SIZE_T AVrfpCountThunks(PIMAGE_THUNK_DATA Thunk)
Definition: verifier.c:120
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
Definition: ntimage.h:566
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
Definition: virtual.c:3105
#define IMAGE_DIRECTORY_ENTRY_IMPORT
Definition: pedump.c:260
BYTE * PBYTE
Definition: pedump.c:66
union _IMAGE_THUNK_DATA32::@2107 u1
uint32_t ULONG
Definition: typedefs.h:59
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
Definition: wdfdevice.h:4533

Referenced by AvrfpResolveThunks().

◆ AVrfReadIFEO()

VOID NTAPI AVrfReadIFEO ( HANDLE  KeyHandle)

Definition at line 46 of file verifier.c.

47{
49
51 L"VerifierDlls",
52 REG_SZ,
54 sizeof(AVrfpVerifierDllsString) - sizeof(WCHAR),
55 NULL);
56
57 if (!NT_SUCCESS(Status))
59
61 L"VerifierFlags",
64 sizeof(AVrfpVerifierFlags),
65 NULL);
66 if (!NT_SUCCESS(Status))
68
70 L"VerifierDebug",
73 sizeof(AVrfpDebug),
74 NULL);
75 if (!NT_SUCCESS(Status))
76 AVrfpDebug = 0;
77}
#define REG_SZ
Definition: layer.c:22
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
Definition: ldrinit.c:184
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4715
#define UNICODE_NULL
#define REG_DWORD
Definition: sdbapi.c:596
#define RTL_VRF_FLG_HANDLE_CHECKS
Definition: verifier.h:47
#define RTL_VRF_FLG_LOCK_CHECKS
Definition: verifier.h:64
#define RTL_VRF_FLG_FAST_FILL_HEAP
Definition: verifier.h:60

Referenced by LdrpInitializeApplicationVerifierPackage().

◆ LdrpInitializeApplicationVerifierPackage()

NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage ( HANDLE  KeyHandle,
PPEB  Peb,
BOOLEAN  SystemWide,
BOOLEAN  ReadAdvancedOptions 
)

Definition at line 82 of file verifier.c.

83{
84 /* If global flags request DPH, perform some additional actions */
86 {
87 // TODO: Read advanced DPH flags from the registry if requested
88 if (ReadAdvancedOptions)
89 {
91 }
92
93 /* Enable page heap */
95 }
96
98
99 return STATUS_SUCCESS;
100}
PPEB Peb
Definition: dllmain.c:27
#define FLG_HEAP_PAGE_ALLOCS
Definition: pstypes.h:84
VOID NTAPI AVrfReadIFEO(HANDLE KeyHandle)
Definition: verifier.c:46
BOOLEAN RtlpPageHeapEnabled
Definition: heappage.c:107
ULONG NtGlobalFlag
Definition: ntddk_ex.h:270

Variable Documentation

◆ AVrfpDebug

◆ AVrfpInitialized

BOOL AVrfpInitialized = FALSE

Definition at line 20 of file verifier.c.

Referenced by AVrfpLoadAndInitializeProvider(), and AvrfpResolveThunks().

◆ AVrfpVerifierDllsString

WCHAR AVrfpVerifierDllsString[256] = { 0 }

Definition at line 18 of file verifier.c.

Referenced by AVrfInitializeVerifier(), and AVrfReadIFEO().

◆ AVrfpVerifierFlags

ULONG AVrfpVerifierFlags = 0

Definition at line 17 of file verifier.c.

Referenced by AVrfInitializeVerifier(), AVrfpLoadAndInitializeProvider(), and AVrfReadIFEO().

◆ AVrfpVerifierLock

RTL_CRITICAL_SECTION AVrfpVerifierLock

◆ AVrfpVerifierProvidersList

◆ LdrpImageEntry