ReactOS  0.4.15-dev-1386-g5cb9f87
verifier.c File Reference
#include <ntdll.h>
#include <reactos/verifier.h>
#include <debug.h>
Include dependency graph for verifier.c:

Go to the source code of this file.

Classes

struct  _VERIFIER_PROVIDER
 

Macros

#define NDEBUG
 
#define VERIFIER_DLL_FLAGS_RESOLVED   1
 

Typedefs

typedef struct _VERIFIER_PROVIDER VERIFIER_PROVIDER
 
typedef struct _VERIFIER_PROVIDERPVERIFIER_PROVIDER
 

Functions

VOID NTAPI AVrfReadIFEO (HANDLE KeyHandle)
 
NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage (HANDLE KeyHandle, PPEB Peb, BOOLEAN SystemWide, BOOLEAN ReadAdvancedOptions)
 
BOOLEAN AVrfpIsVerifierProviderDll (PVOID BaseAddress)
 
SIZE_T AVrfpCountThunks (PIMAGE_THUNK_DATA Thunk)
 
VOID AVrfpSnapDllImports (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID AvrfpResolveThunks (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfDllLoadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfDllUnloadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfPageHeapDllNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
 
VOID NTAPI AVrfpResnapInitialModules (VOID)
 
PVOID NTAPI AvrfpFindDuplicateThunk (PLIST_ENTRY EndEntry, PWCHAR DllName, PCHAR ThunkName)
 
VOID NTAPI AVrfpChainDuplicateThunks (VOID)
 
NTSTATUS NTAPI AVrfpLoadAndInitializeProvider (PVERIFIER_PROVIDER Provider)
 
NTSTATUS NTAPI AVrfInitializeVerifier (VOID)
 

Variables

PLDR_DATA_TABLE_ENTRY LdrpImageEntry
 
ULONG AVrfpVerifierFlags = 0
 
WCHAR AVrfpVerifierDllsString [256] = { 0 }
 
ULONG AVrfpDebug = 0
 
BOOL AVrfpInitialized = FALSE
 
RTL_CRITICAL_SECTION AVrfpVerifierLock
 
LIST_ENTRY AVrfpVerifierProvidersList
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 13 of file verifier.c.

◆ VERIFIER_DLL_FLAGS_RESOLVED

#define VERIFIER_DLL_FLAGS_RESOLVED   1

Definition at line 24 of file verifier.c.

Typedef Documentation

◆ PVERIFIER_PROVIDER

◆ VERIFIER_PROVIDER

Function Documentation

◆ AVrfDllLoadNotification()

VOID NTAPI AVrfDllLoadNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 294 of file verifier.c.

295 {
297 
299  return;
300 
302  if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
303  {
304  AvrfpResolveThunks(LdrEntry);
305 
307  {
309  RTL_VERIFIER_DLL_LOAD_CALLBACK ProviderDllLoadCallback;
310 
312 
313  ProviderDllLoadCallback = Provider->ProviderDllLoadCallback;
314  if (ProviderDllLoadCallback)
315  {
316  ProviderDllLoadCallback(LdrEntry->BaseDllName.Buffer,
317  LdrEntry->DllBase,
318  LdrEntry->SizeOfImage,
319  LdrEntry);
320  }
321  }
322  }
324 }
RTL_CRITICAL_SECTION AVrfpVerifierLock
Definition: verifier.c:21
struct _Entry Entry
Definition: kefuncs.h:627
VOID(NTAPI * RTL_VERIFIER_DLL_LOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.h:6
BOOLEAN AVrfpIsVerifierProviderDll(PVOID BaseAddress)
Definition: verifier.c:103
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define FLG_APPLICATION_VERIFIER
Definition: pstypes.h:64
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
VOID AvrfpResolveThunks(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:235
Definition: typedefs.h:119
#define NtCurrentPeb()
Definition: FLS.c:20
ULONG NtGlobalFlag
Definition: init.c:52
base of all file and directory entries
Definition: entries.h:82

Referenced by LdrpWalkImportDescriptor().

◆ AVrfDllUnloadNotification()

VOID NTAPI AVrfDllUnloadNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 328 of file verifier.c.

329 {
331 
333  return;
334 
336  if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
337  {
339  {
341  RTL_VERIFIER_DLL_UNLOAD_CALLBACK ProviderDllUnloadCallback;
342 
344 
345  ProviderDllUnloadCallback = Provider->ProviderDllUnloadCallback;
346  if (ProviderDllUnloadCallback)
347  {
348  ProviderDllUnloadCallback(LdrEntry->BaseDllName.Buffer,
349  LdrEntry->DllBase,
350  LdrEntry->SizeOfImage,
351  LdrEntry);
352  }
353  }
354  }
356 }
RTL_CRITICAL_SECTION AVrfpVerifierLock
Definition: verifier.c:21
struct _Entry Entry
Definition: kefuncs.h:627
BOOLEAN AVrfpIsVerifierProviderDll(PVOID BaseAddress)
Definition: verifier.c:103
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
VOID(NTAPI * RTL_VERIFIER_DLL_UNLOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.h:7
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define FLG_APPLICATION_VERIFIER
Definition: pstypes.h:64
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
Definition: typedefs.h:119
#define NtCurrentPeb()
Definition: FLS.c:20
ULONG NtGlobalFlag
Definition: init.c:52
base of all file and directory entries
Definition: entries.h:82

Referenced by LdrUnloadDll().

◆ AVrfInitializeVerifier()

NTSTATUS NTAPI AVrfInitializeVerifier ( VOID  )

Definition at line 612 of file verifier.c.

613 {
617  WCHAR* Ptr, *Next;
618 
621 
622  if (!NT_SUCCESS(Status))
623  return Status;
624 
625  DbgPrint("AVRF: %wZ: pid 0x%X: flags 0x%X: application verifier enabled\n",
627 
628  Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
629  if (!Provider)
630  return STATUS_NO_MEMORY;
631 
632  RtlInitUnicodeString(&Provider->DllName, L"verifier.dll");
634 
636 
637  do
638  {
639  while (*Next == L' ' || *Next == L'\t')
640  Next++;
641 
642  Ptr = Next;
643 
644  while (*Next != ' ' && *Next != '\t' && *Next)
645  Next++;
646 
647  if (*Next)
648  *(Next++) = '\0';
649  else
650  Next = NULL;
651 
652  if (*Ptr)
653  {
654  Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
655  if (!Provider)
656  return STATUS_NO_MEMORY;
657  RtlInitUnicodeString(&Provider->DllName, Ptr);
659  }
660  } while (Next);
661 
664  {
666  Entry = Entry->Flink;
667 
669  if (!NT_SUCCESS(Status))
670  {
671  RemoveEntryList(&Provider->ListEntry);
672  RtlFreeHeap(RtlGetProcessHeap(), 0, Provider);
673  }
674  }
675 
676  if (!NT_SUCCESS(Status))
677  {
678  DbgPrint("AVRF: %wZ: pid 0x%X: application verifier will be disabled due to an initialization error.\n",
680  NtCurrentPeb()->NtGlobalFlag &= ~FLG_APPLICATION_VERIFIER;
681  }
682 
683  return Status;
684 }
RTL_CRITICAL_SECTION AVrfpVerifierLock
Definition: verifier.c:21
struct _Entry Entry
Definition: kefuncs.h:627
#define DbgPrint
Definition: loader.c:25
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
LONG NTSTATUS
Definition: precomp.h:26
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
Definition: heap.c:606
#define InsertTailList(ListHead, Entry)
HANDLE UniqueProcess
Definition: compat.h:684
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
Definition: rtlfuncs.h:105
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
#define FLG_APPLICATION_VERIFIER
Definition: pstypes.h:64
ULONG AVrfpVerifierFlags
Definition: verifier.c:17
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
Definition: heap.c:588
Status
Definition: gdiplustypes.h:24
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1163
__wchar_t WCHAR
Definition: xmlstorage.h:180
NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
static const WCHAR L[]
Definition: oid.c:1250
Definition: typedefs.h:119
WCHAR AVrfpVerifierDllsString[256]
Definition: verifier.c:18
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
Definition: psfuncs.h:420
#define NtCurrentPeb()
Definition: FLS.c:20
#define InitializeListHead(ListHead)
Definition: env_spec_w32.h:944
#define STATUS_NO_MEMORY
Definition: ntstatus.h:260
NTSTATUS NTAPI AVrfpLoadAndInitializeProvider(PVERIFIER_PROVIDER Provider)
Definition: verifier.c:485
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
#define NULL
Definition: types.h:112
#define HEAP_ZERO_MEMORY
Definition: compat.h:134
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
Definition: ldrinit.c:39
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
base of all file and directory entries
Definition: entries.h:82

Referenced by LdrpInitializeProcess().

◆ AVrfPageHeapDllNotification()

VOID NTAPI AVrfPageHeapDllNotification ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 361 of file verifier.c.

362 {
363  /* Check if page heap dll notification is turned on */
365  return;
366 
367  /* We don't support this flag currently */
369 }
ULONG RtlpDphGlobalFlags
Definition: heappage.c:107
#define DPH_FLAG_DLL_NOTIFY
Definition: ntdllp.h:24
#define UNIMPLEMENTED
Definition: debug.h:115

Referenced by LdrpWalkImportDescriptor().

◆ AVrfpChainDuplicateThunks()

VOID NTAPI AVrfpChainDuplicateThunks ( VOID  )

Definition at line 448 of file verifier.c.

449 {
452 
454  {
455  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
456  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
457 
459 
460  for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
461  {
462  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
463  {
464  PVOID Ptr;
465 
467  DbgPrint("AVRF: Checking %wZ for duplicate (%ws: %s)\n",
468  &Provider->DllName, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
469 
470  Ptr = AvrfpFindDuplicateThunk(Entry, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
471  if (Ptr)
472  {
474  DbgPrint("AVRF: Chaining (%ws: %s) to %wZ\n", DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
475 
476  ThunkDescriptor->ThunkOldAddress = Ptr;
477  }
478  }
479  }
480  }
481 }
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
struct _Entry Entry
Definition: kefuncs.h:627
#define DbgPrint
Definition: loader.c:25
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
ULONG AVrfpDebug
Definition: verifier.c:19
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
PVOID NTAPI AvrfpFindDuplicateThunk(PLIST_ENTRY EndEntry, PWCHAR DllName, PCHAR ThunkName)
Definition: verifier.c:402
Definition: typedefs.h:119
#define RTL_VRF_DBG_SHOWCHAINING
Definition: verifier.h:73
base of all file and directory entries
Definition: entries.h:82
#define RTL_VRF_DBG_SHOWCHAINING_DEBUG
Definition: verifier.h:74

Referenced by AVrfpLoadAndInitializeProvider().

◆ AVrfpCountThunks()

SIZE_T AVrfpCountThunks ( PIMAGE_THUNK_DATA  Thunk)

Definition at line 120 of file verifier.c.

121 {
122  SIZE_T Count = 0;
123  while (Thunk[Count].u1.Function)
124  Count++;
125  return Count;
126 }
GLdouble u1
Definition: glext.h:8308
int Count
Definition: noreturn.cpp:7
ULONG_PTR SIZE_T
Definition: typedefs.h:80

Referenced by AVrfpSnapDllImports().

◆ AvrfpFindDuplicateThunk()

PVOID NTAPI AvrfpFindDuplicateThunk ( PLIST_ENTRY  EndEntry,
PWCHAR  DllName,
PCHAR  ThunkName 
)

Definition at line 402 of file verifier.c.

403 {
405 
406  for (Entry = AVrfpVerifierProvidersList.Flink; Entry != EndEntry; Entry = Entry->Flink)
407  {
409  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
410 
412 
414  DbgPrint("AVRF: chain: searching in %wZ\n", &Provider->DllName);
415 
416  for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
417  {
418  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
419 
421  DbgPrint("AVRF: chain: dll: %ws\n", DllDescriptor->DllName);
422 
423  if (_wcsicmp(DllDescriptor->DllName, DllName))
424  continue;
425 
426  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
427  {
429  DbgPrint("AVRF: chain: thunk: %s == %s ?\n", ThunkDescriptor->ThunkName, ThunkName);
430 
431  if (!_stricmp(ThunkDescriptor->ThunkName, ThunkName))
432  {
434  DbgPrint("AVRF: Found duplicate for (%ws: %s) in %wZ\n",
435  DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
436 
437  return ThunkDescriptor->ThunkNewAddress;
438  }
439  }
440  }
441  }
442  return NULL;
443 }
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
struct _Entry Entry
Definition: kefuncs.h:627
#define DbgPrint
Definition: loader.c:25
ULONG AVrfpDebug
Definition: verifier.c:19
#define _stricmp
Definition: cat.c:22
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
Definition: typedefs.h:119
#define NULL
Definition: types.h:112
base of all file and directory entries
Definition: entries.h:82
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)
#define RTL_VRF_DBG_SHOWCHAINING_DEBUG
Definition: verifier.h:74

Referenced by AVrfpChainDuplicateThunks().

◆ AVrfpIsVerifierProviderDll()

BOOLEAN AVrfpIsVerifierProviderDll ( PVOID  BaseAddress)

Definition at line 103 of file verifier.c.

104 {
107 
109  {
111 
112  if (BaseAddress == Provider->BaseAddress)
113  return TRUE;
114  }
115 
116  return FALSE;
117 }
struct _Entry Entry
Definition: kefuncs.h:627
#define TRUE
Definition: types.h:120
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
#define FALSE
Definition: types.h:117
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
Definition: typedefs.h:119
base of all file and directory entries
Definition: entries.h:82

Referenced by AVrfDllLoadNotification(), AVrfDllUnloadNotification(), and AVrfpResnapInitialModules().

◆ AVrfpLoadAndInitializeProvider()

NTSTATUS NTAPI AVrfpLoadAndInitializeProvider ( PVERIFIER_PROVIDER  Provider)

Definition at line 485 of file verifier.c.

486 {
492 
493  RtlInitEmptyUnicodeString(&DllPath, StringBuffer, sizeof(StringBuffer));
495  RtlAppendUnicodeToString(&DllPath, L"\\System32\\");
496 
498  DbgPrint("AVRF: verifier dll `%wZ'\n", &Provider->DllName);
499 
500  Status = LdrLoadDll(DllPath.Buffer, NULL, &Provider->DllName, &Provider->BaseAddress);
501  if (!NT_SUCCESS(Status))
502  {
503  DbgPrint("AVRF: %wZ: failed to load provider `%wZ' (status %08X) from %wZ\n",
505  &Provider->DllName,
506  Status,
507  &DllPath);
508  return Status;
509  }
510 
511  /* Prevent someone funny from specifying his own application as provider */
512  ImageNtHeader = RtlImageNtHeader(Provider->BaseAddress);
513  if (!ImageNtHeader ||
515  {
516  DbgPrint("AVRF: provider %wZ is not a DLL image\n", &Provider->DllName);
517  return STATUS_DLL_INIT_FAILED;
518  }
519 
520  Provider->EntryPoint = LdrpFetchAddressOfEntryPoint(Provider->BaseAddress);
521  if (!Provider->EntryPoint)
522  {
523  DbgPrint("AVRF: cannot find an entry point for provider %wZ\n", &Provider->DllName);
525  }
526 
527  _SEH2_TRY
528  {
529  if (LdrpCallInitRoutine(Provider->EntryPoint,
530  Provider->BaseAddress,
532  &Descriptor))
533  {
534  if (Descriptor && Descriptor->Length == sizeof(RTL_VERIFIER_PROVIDER_DESCRIPTOR))
535  {
536  /* Copy the data */
537  Provider->ProviderDlls = Descriptor->ProviderDlls;
538  Provider->ProviderDllLoadCallback = Descriptor->ProviderDllLoadCallback;
539  Provider->ProviderDllUnloadCallback = Descriptor->ProviderDllUnloadCallback;
540  Provider->ProviderNtdllHeapFreeCallback = Descriptor->ProviderNtdllHeapFreeCallback;
541 
542  /* Update some info for the provider */
543  Descriptor->VerifierImage = LdrpImageEntry->BaseDllName.Buffer;
544  Descriptor->VerifierFlags = AVrfpVerifierFlags;
545  Descriptor->VerifierDebug = AVrfpDebug;
546 
547  /* We don't have these yet */
548  DPRINT1("AVRF: RtlpGetStackTraceAddress MISSING\n");
549  DPRINT1("AVRF: RtlpDebugPageHeapCreate MISSING\n");
550  DPRINT1("AVRF: RtlpDebugPageHeapDestroy MISSING\n");
551  Descriptor->RtlpGetStackTraceAddress = NULL;
552  Descriptor->RtlpDebugPageHeapCreate = NULL;
553  Descriptor->RtlpDebugPageHeapDestroy = NULL;
555  }
556  else
557  {
558  DbgPrint("AVRF: provider %wZ passed an invalid descriptor @ %p\n", &Provider->DllName, Descriptor);
560  }
561  }
562  else
563  {
564  DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
566  }
567  }
569  {
571  }
572  _SEH2_END;
573 
574  if (!NT_SUCCESS(Status))
575  return Status;
576 
577 
579  DbgPrint("AVRF: initialized provider %wZ (descriptor @ %p)\n", &Provider->DllName, Descriptor);
580 
581  /* Done loading providers, allow dll notifications */
583 
586 
587  /* Manually call with DLL_PROCESS_ATTACH, since the process is not done initializing */
588  _SEH2_TRY
589  {
590  if (!LdrpCallInitRoutine(Provider->EntryPoint,
591  Provider->BaseAddress,
593  NULL))
594  {
595  DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
597  }
598 
599  }
601  {
603  }
604  _SEH2_END;
605 
606  return Status;
607 }
_Must_inspect_result_ _In_ WDFIORESLIST _In_ PIO_RESOURCE_DESCRIPTOR Descriptor
Definition: wdfresource.h:339
#define DbgPrint
Definition: loader.c:25
#define TRUE
Definition: types.h:120
#define RTL_VRF_DBG_SHOWSNAPS
Definition: verifier.h:69
LONG NTSTATUS
Definition: precomp.h:26
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
ULONG AVrfpDebug
Definition: verifier.c:19
#define IMAGE_FILE_DLL
Definition: pedump.c:169
_SEH2_TRY
Definition: create.c:4226
VOID NTAPI AVrfpChainDuplicateThunks(VOID)
Definition: verifier.c:448
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:85
PVOID NTAPI LdrpFetchAddressOfEntryPoint(PVOID ImageBase)
ULONG AVrfpVerifierFlags
Definition: verifier.c:17
IMAGE_FILE_HEADER FileHeader
Definition: ntddk_ex.h:183
Status
Definition: gdiplustypes.h:24
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
Definition: string_lib.cpp:62
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define MAX_PATH
Definition: compat.h:34
#define RTL_VRF_DBG_LISTPROVIDERS
Definition: verifier.h:72
BOOL AVrfpInitialized
Definition: verifier.c:20
#define SharedUserData
static const WCHAR L[]
Definition: oid.c:1250
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
Definition: ldrapi.c:310
#define STATUS_DLL_INIT_FAILED
Definition: ntstatus.h:558
_SEH2_END
Definition: create.c:4400
static const char const char * DllPath
Definition: image.c:34
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145
#define NULL
Definition: types.h:112
#define STATUS_PROCEDURE_NOT_FOUND
Definition: ntstatus.h:358
#define DPRINT1
Definition: precomp.h:8
#define RtlImageNtHeader
Definition: compat.h:665
PLDR_DATA_TABLE_ENTRY LdrpImageEntry
Definition: ldrinit.c:39
PIMAGE_NT_HEADERS WINAPI ImageNtHeader(_In_ PVOID)
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:6
VOID NTAPI AVrfpResnapInitialModules(VOID)
Definition: verifier.c:374
#define STATUS_SUCCESS
Definition: shellext.h:65
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:12
#define STATUS_INVALID_PARAMETER_4
Definition: ntstatus.h:478
WCHAR StringBuffer[156]
Definition: ldrinit.c:41
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
Definition: ldrutils.c:100

Referenced by AVrfInitializeVerifier().

◆ AVrfpResnapInitialModules()

VOID NTAPI AVrfpResnapInitialModules ( VOID  )

Definition at line 374 of file verifier.c.

375 {
376  PLIST_ENTRY ListHead, ListEntry;
377 
378  ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
379  for (ListEntry = ListHead->Flink; ListHead != ListEntry; ListEntry = ListEntry->Flink)
380  {
381  PLDR_DATA_TABLE_ENTRY LdrEntry;
382 
383  LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
384 
385  if (AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
386  {
388  DbgPrint("AVRF: skipped resnapping provider %wZ ...\n", &LdrEntry->BaseDllName);
389  }
390  else
391  {
393  DbgPrint("AVRF: resnapping %wZ ...\n", &LdrEntry->BaseDllName);
394 
395  AvrfpResolveThunks(LdrEntry);
396  }
397  }
398 }
#define DbgPrint
Definition: loader.c:25
#define RTL_VRF_DBG_SHOWSNAPS
Definition: verifier.h:69
BOOLEAN AVrfpIsVerifierProviderDll(PVOID BaseAddress)
Definition: verifier.c:103
ULONG AVrfpDebug
Definition: verifier.c:19
PVOID DllBase
Definition: btrfs_drv.h:1926
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
VOID AvrfpResolveThunks(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:235
Definition: btrfs_drv.h:1922
Definition: typedefs.h:119
#define NtCurrentPeb()
Definition: FLS.c:20
UNICODE_STRING BaseDllName
Definition: ldrtypes.h:145

Referenced by AVrfpLoadAndInitializeProvider().

◆ AvrfpResolveThunks()

VOID AvrfpResolveThunks ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 235 of file verifier.c.

236 {
239 
240  if (!AVrfpInitialized)
241  return;
242 
244  {
245  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
246 
248 
249  for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
250  {
251  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
252 
253  if ((DllDescriptor->DllFlags & VERIFIER_DLL_FLAGS_RESOLVED) ||
254  _wcsicmp(DllDescriptor->DllName, LdrEntry->BaseDllName.Buffer))
255  continue;
256 
258  DbgPrint("AVRF: pid 0x%X: found dll descriptor for `%wZ' with verified exports\n",
260  &LdrEntry->BaseDllName);
261 
262  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
263  {
264  if (!ThunkDescriptor->ThunkOldAddress)
265  {
266  ANSI_STRING ThunkName;
267 
268  RtlInitAnsiString(&ThunkName, ThunkDescriptor->ThunkName);
269  /* We cannot call the public api, because that would run init routines! */
270  if (NT_SUCCESS(LdrpGetProcedureAddress(LdrEntry->DllBase, &ThunkName, 0, &ThunkDescriptor->ThunkOldAddress, FALSE)))
271  {
273  DbgPrint("AVRF: (%wZ) %Z export found.\n", &LdrEntry->BaseDllName, &ThunkName);
274  }
275  else
276  {
278  DbgPrint("AVRF: warning: did not find `%Z' export in %wZ.\n", &ThunkName, &LdrEntry->BaseDllName);
279  }
280  }
281  }
282 
283  DllDescriptor->DllFlags |= VERIFIER_DLL_FLAGS_RESOLVED;
284  }
285  }
286 
287  AVrfpSnapDllImports(LdrEntry);
288 }
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
struct _Entry Entry
Definition: kefuncs.h:627
#define DbgPrint
Definition: loader.c:25
#define RTL_VRF_DBG_SHOWVERIFIEDEXPORTS
Definition: verifier.h:71
VOID AVrfpSnapDllImports(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
Definition: verifier.c:129
HANDLE UniqueProcess
Definition: compat.h:684
ULONG AVrfpDebug
Definition: verifier.c:19
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
#define FALSE
Definition: types.h:117
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
_Out_ PCLIENT_ID ClientId
Definition: kefuncs.h:1163
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
Definition: ldrutils.c:2252
BOOL AVrfpInitialized
Definition: verifier.c:20
#define VERIFIER_DLL_FLAGS_RESOLVED
Definition: verifier.c:24
Definition: typedefs.h:119
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
Definition: psfuncs.h:420
#define RTL_VRF_DBG_SHOWFOUNDEXPORTS
Definition: verifier.h:70
base of all file and directory entries
Definition: entries.h:82
_Check_return_ _CRTIMP int __cdecl _wcsicmp(_In_z_ const wchar_t *_Str1, _In_z_ const wchar_t *_Str2)

Referenced by AVrfDllLoadNotification(), and AVrfpResnapInitialModules().

◆ AVrfpSnapDllImports()

VOID AVrfpSnapDllImports ( IN PLDR_DATA_TABLE_ENTRY  LdrEntry)

Definition at line 129 of file verifier.c.

130 {
131  ULONG Size;
132  PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
133  PBYTE DllBase = LdrEntry->DllBase;
134 
135  ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size);
136  if (!ImportDescriptor)
137  {
138  //SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
139  return;
140  }
141 
142  for (; ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
143  {
144  PIMAGE_THUNK_DATA FirstThunk;
145  PVOID UnprotectedPtr = NULL;
146  SIZE_T UnprotectedSize = 0;
147  ULONG OldProtection = 0;
148  FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
149 
150  /* Walk all imports */
151  for (;FirstThunk->u1.Function; FirstThunk++)
152  {
155 
157  {
158  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
159 
161  for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
162  {
163  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
164 
165  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
166  {
167  /* Just compare function addresses, the loader will have handled forwarders and ordinals for us */
168  if ((PVOID)FirstThunk->u1.Function != ThunkDescriptor->ThunkOldAddress)
169  continue;
170 
171  if (!UnprotectedPtr)
172  {
173  PVOID Ptr = &FirstThunk->u1.Function;
174  SIZE_T Size = sizeof(FirstThunk->u1.Function) * AVrfpCountThunks(FirstThunk);
176 
177  UnprotectedPtr = Ptr;
178  UnprotectedSize = Size;
179 
181  &Ptr,
182  &Size,
184  &OldProtection);
185 
186  if (!NT_SUCCESS(Status))
187  {
188  DbgPrint("AVRF: Unable to unprotect IAT to modify thunks (status %08X).\n", Status);
189  UnprotectedPtr = NULL;
190  continue;
191  }
192  }
193 
194  if (ThunkDescriptor->ThunkNewAddress == NULL)
195  {
196  DbgPrint("AVRF: internal error: New thunk for %s is null.\n", ThunkDescriptor->ThunkName);
197  continue;
198  }
199  FirstThunk->u1.Function = (SIZE_T)ThunkDescriptor->ThunkNewAddress;
201  DbgPrint("AVRF: Snapped (%wZ: %s) with (%wZ: %p).\n",
202  &LdrEntry->BaseDllName,
203  ThunkDescriptor->ThunkName,
204  &Provider->DllName,
205  ThunkDescriptor->ThunkNewAddress);
206  }
207  }
208  }
209  }
210 
211  if (UnprotectedPtr)
212  {
213  PVOID Ptr = UnprotectedPtr;
214  SIZE_T Size = UnprotectedSize;
216 
217  UnprotectedPtr = Ptr;
218  UnprotectedSize = Size;
219 
221  &Ptr,
222  &Size,
223  OldProtection,
224  &OldProtection);
225  if (!NT_SUCCESS(Status))
226  {
227  DbgPrint("AVRF: Unable to reprotect IAT to modify thunks (status %08X).\n", Status);
228  }
229  }
230  }
231 }
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
struct _Entry Entry
Definition: kefuncs.h:627
#define DbgPrint
Definition: loader.c:25
#define TRUE
Definition: types.h:120
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
Definition: fsrtlfuncs.h:898
#define RTL_VRF_DBG_SHOWSNAPS
Definition: verifier.h:69
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
Definition: virtual.c:3026
LONG NTSTATUS
Definition: precomp.h:26
IN PVOID IN PVOID IN USHORT IN USHORT Size
Definition: pci.h:361
ULONG AVrfpDebug
Definition: verifier.c:19
LIST_ENTRY AVrfpVerifierProvidersList
Definition: verifier.c:22
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
Definition: Messaging.c:560
#define NtCurrentProcess()
Definition: nt_native.h:1657
Status
Definition: gdiplustypes.h:24
struct _LIST_ENTRY * Flink
Definition: typedefs.h:121
if(!(yy_init))
Definition: macro.lex.yy.c:714
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define RtlImageDirectoryEntryToData
Definition: compat.h:668
Definition: typedefs.h:119
ULONG_PTR SIZE_T
Definition: typedefs.h:80
#define NULL
Definition: types.h:112
#define IMAGE_DIRECTORY_ENTRY_IMPORT
Definition: pedump.c:260
union _IMAGE_THUNK_DATA32::@2116 u1
unsigned int ULONG
Definition: retypes.h:1
#define PAGE_EXECUTE_READWRITE
Definition: nt_native.h:1308
BYTE * PBYTE
Definition: pedump.c:66
base of all file and directory entries
Definition: entries.h:82
SIZE_T AVrfpCountThunks(PIMAGE_THUNK_DATA Thunk)
Definition: verifier.c:120
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
Definition: ntimage.h:566

Referenced by AvrfpResolveThunks().

◆ AVrfReadIFEO()

VOID NTAPI AVrfReadIFEO ( HANDLE  KeyHandle)

Definition at line 46 of file verifier.c.

47 {
49 
51  L"VerifierDlls",
52  REG_SZ,
54  sizeof(AVrfpVerifierDllsString) - sizeof(WCHAR),
55  NULL);
56 
57  if (!NT_SUCCESS(Status))
59 
61  L"VerifierFlags",
62  REG_DWORD,
64  sizeof(AVrfpVerifierFlags),
65  NULL);
66  if (!NT_SUCCESS(Status))
68 
70  L"VerifierDebug",
71  REG_DWORD,
72  &AVrfpDebug,
73  sizeof(AVrfpDebug),
74  NULL);
75  if (!NT_SUCCESS(Status))
76  AVrfpDebug = 0;
77 }
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
Definition: ldrinit.c:184
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
LONG NTSTATUS
Definition: precomp.h:26
#define RTL_VRF_FLG_FAST_FILL_HEAP
Definition: verifier.h:60
ULONG AVrfpDebug
Definition: verifier.c:19
#define UNICODE_NULL
ULONG AVrfpVerifierFlags
Definition: verifier.c:17
Status
Definition: gdiplustypes.h:24
__wchar_t WCHAR
Definition: xmlstorage.h:180
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define RTL_VRF_FLG_HANDLE_CHECKS
Definition: verifier.h:47
static const WCHAR L[]
Definition: oid.c:1250
WCHAR AVrfpVerifierDllsString[256]
Definition: verifier.c:18
#define NULL
Definition: types.h:112
#define RTL_VRF_FLG_LOCK_CHECKS
Definition: verifier.h:64
#define REG_DWORD
Definition: sdbapi.c:596
#define REG_SZ
Definition: layer.c:22

Referenced by LdrpInitializeApplicationVerifierPackage().

◆ LdrpInitializeApplicationVerifierPackage()

NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage ( HANDLE  KeyHandle,
PPEB  Peb,
BOOLEAN  SystemWide,
BOOLEAN  ReadAdvancedOptions 
)

Definition at line 82 of file verifier.c.

83 {
84  /* If global flags request DPH, perform some additional actions */
86  {
87  // TODO: Read advanced DPH flags from the registry if requested
88  if (ReadAdvancedOptions)
89  {
91  }
92 
93  /* Enable page heap */
95  }
96 
98 
99  return STATUS_SUCCESS;
100 }
PPEB Peb
Definition: dllmain.c:27
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
Definition: ndis.h:4711
#define TRUE
Definition: types.h:120
BOOLEAN RtlpPageHeapEnabled
Definition: heappage.c:106
ULONG NtGlobalFlag
Definition: ntddk_ex.h:270
#define FLG_HEAP_PAGE_ALLOCS
Definition: pstypes.h:84
VOID NTAPI AVrfReadIFEO(HANDLE KeyHandle)
Definition: verifier.c:46
#define UNIMPLEMENTED
Definition: debug.h:115
#define STATUS_SUCCESS
Definition: shellext.h:65

Variable Documentation

◆ AVrfpDebug

◆ AVrfpInitialized

BOOL AVrfpInitialized = FALSE

Definition at line 20 of file verifier.c.

Referenced by AVrfpLoadAndInitializeProvider(), and AvrfpResolveThunks().

◆ AVrfpVerifierDllsString

WCHAR AVrfpVerifierDllsString[256] = { 0 }

Definition at line 18 of file verifier.c.

Referenced by AVrfInitializeVerifier(), and AVrfReadIFEO().

◆ AVrfpVerifierFlags

ULONG AVrfpVerifierFlags = 0

Definition at line 17 of file verifier.c.

Referenced by AVrfInitializeVerifier(), AVrfpLoadAndInitializeProvider(), and AVrfReadIFEO().

◆ AVrfpVerifierLock

RTL_CRITICAL_SECTION AVrfpVerifierLock

◆ AVrfpVerifierProvidersList

◆ LdrpImageEntry