verifier.c File Reference

#include <ntdll.h>
#include <reactos/verifier.h>
#include <debug.h>

Include dependency graph for verifier.c:

Go to the source code of this file.

Classes
struct	_VERIFIER_PROVIDER

Macros
#define	NDEBUG
#define	VERIFIER_DLL_FLAGS_RESOLVED   1

Typedefs
typedef struct _VERIFIER_PROVIDER	VERIFIER_PROVIDER
typedef struct _VERIFIER_PROVIDER *	PVERIFIER_PROVIDER

Functions
HANDLE NTAPI	RtlpPageHeapCreate (ULONG Flags, PVOID Addr, SIZE_T TotalSize, SIZE_T CommitSize, PVOID Lock, PRTL_HEAP_PARAMETERS Parameters)
PVOID NTAPI	RtlpPageHeapDestroy (HANDLE HeapPtr)
VOID NTAPI	AVrfReadIFEO (HANDLE KeyHandle)
NTSTATUS NTAPI	LdrpInitializeApplicationVerifierPackage (HANDLE KeyHandle, PPEB Peb, BOOLEAN SystemWide, BOOLEAN ReadAdvancedOptions)
BOOLEAN	AVrfpIsVerifierProviderDll (PVOID BaseAddress)
SIZE_T	AVrfpCountThunks (PIMAGE_THUNK_DATA Thunk)
VOID	AVrfpSnapDllImports (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID	AvrfpResolveThunks (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI	AVrfDllLoadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI	AVrfDllUnloadNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI	AVrfInternalHeapFreeNotification (PVOID AllocationBase, SIZE_T AllocationSize)
VOID NTAPI	AVrfPageHeapDllNotification (IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI	AVrfpResnapInitialModules (VOID)
PVOID NTAPI	AvrfpFindDuplicateThunk (PLIST_ENTRY EndEntry, PWCHAR DllName, PCHAR ThunkName)
VOID NTAPI	AVrfpChainDuplicateThunks (VOID)
static PVOID NTAPI	AVrfpGetStackTraceAddress (ULONG Arg0)
static HANDLE NTAPI	AVrfpDebugPageHeapCreate (ULONG Flags, PVOID Addr, SIZE_T TotalSize, SIZE_T CommitSize, PVOID Lock, PRTL_HEAP_PARAMETERS Parameters)
static PVOID	AVrfpDebugPageHeapDestroy (HANDLE HeapPtr)
NTSTATUS NTAPI	AVrfpLoadAndInitializeProvider (PVERIFIER_PROVIDER Provider)
NTSTATUS NTAPI	AVrfInitializeVerifier (VOID)

Variables
PLDR_DATA_TABLE_ENTRY	LdrpImageEntry
ULONG	AVrfpVerifierFlags = 0
WCHAR	AVrfpVerifierDllsString [256] = { 0 }
ULONG	AVrfpDebug = 0
BOOL	AVrfpInitialized = FALSE
RTL_CRITICAL_SECTION	AVrfpVerifierLock
LIST_ENTRY	AVrfpVerifierProvidersList

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file verifier.c.

VERIFIER_DLL_FLAGS_RESOLVED

#define VERIFIER_DLL_FLAGS_RESOLVED   1

Definition at line 28 of file verifier.c.

Typedef Documentation

PVERIFIER_PROVIDER

typedef struct _VERIFIER_PROVIDER * PVERIFIER_PROVIDER

VERIFIER_PROVIDER

typedef struct _VERIFIER_PROVIDER VERIFIER_PROVIDER

Function Documentation

AVrfDllLoadNotification()

VOID NTAPI AVrfDllLoadNotification

(

IN PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 298 of file verifier.c.

{
    PLIST_ENTRY Entry;
 
    if (!(NtCurrentPeb()->NtGlobalFlag & FLG_APPLICATION_VERIFIER))
        return;
 
    RtlEnterCriticalSection(&AVrfpVerifierLock);
    if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
    {
        AvrfpResolveThunks(LdrEntry);
 
        for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
        {
            PVERIFIER_PROVIDER Provider;
            RTL_VERIFIER_DLL_LOAD_CALLBACK ProviderDllLoadCallback;
 
            Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
            ProviderDllLoadCallback = Provider->ProviderDllLoadCallback;
            if (ProviderDllLoadCallback)
            {
                ProviderDllLoadCallback(LdrEntry->BaseDllName.Buffer,
                                        LdrEntry->DllBase,
                                        LdrEntry->SizeOfImage,
                                        LdrEntry);
            }
        }
    }
    RtlLeaveCriticalSection(&AVrfpVerifierLock);
}

Referenced by LdrpWalkImportDescriptor().

AVrfDllUnloadNotification()

VOID NTAPI AVrfDllUnloadNotification

(

IN PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 332 of file verifier.c.

{
    PLIST_ENTRY Entry;
 
    if (!(NtCurrentPeb()->NtGlobalFlag & FLG_APPLICATION_VERIFIER) || !AVrfpInitialized)
        return;
 
    RtlEnterCriticalSection(&AVrfpVerifierLock);
    if (!AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
    {
        for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
        {
            PVERIFIER_PROVIDER Provider;
            RTL_VERIFIER_DLL_UNLOAD_CALLBACK ProviderDllUnloadCallback;
 
            Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
            ProviderDllUnloadCallback = Provider->ProviderDllUnloadCallback;
            if (ProviderDllUnloadCallback)
            {
                ProviderDllUnloadCallback(LdrEntry->BaseDllName.Buffer,
                                          LdrEntry->DllBase,
                                          LdrEntry->SizeOfImage,
                                          LdrEntry);
            }
        }
    }
    RtlLeaveCriticalSection(&AVrfpVerifierLock);
}

Referenced by LdrUnloadDll().

AVrfInitializeVerifier()

NTSTATUS NTAPI AVrfInitializeVerifier

(

VOID

)

Definition at line 672 of file verifier.c.

{
    NTSTATUS Status;
    PVERIFIER_PROVIDER Provider;
    PLIST_ENTRY Entry;
    WCHAR* Ptr, *Next;
 
    Status = RtlInitializeCriticalSection(&AVrfpVerifierLock);
    InitializeListHead(&AVrfpVerifierProvidersList);
 
    if (!NT_SUCCESS(Status))
        return Status;
 
    DbgPrint("AVRF: %wZ: pid 0x%X: flags 0x%X: application verifier enabled\n",
             &LdrpImageEntry->BaseDllName, NtCurrentTeb()->ClientId.UniqueProcess, AVrfpVerifierFlags);
 
    Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
    if (!Provider)
        return STATUS_NO_MEMORY;
 
    RtlInitUnicodeString(&Provider->DllName, L"verifier.dll");
    InsertTailList(&AVrfpVerifierProvidersList, &Provider->ListEntry);
 
    Next = AVrfpVerifierDllsString;
 
    do
    {
        while (*Next == L' ' || *Next == L'\t')
            Next++;
 
        Ptr = Next;
 
        while (*Next != ' ' && *Next != '\t' && *Next)
            Next++;
 
        if (*Next)
            *(Next++) = '\0';
        else
            Next = NULL;
 
        if (*Ptr)
        {
            Provider = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(VERIFIER_PROVIDER));
            if (!Provider)
                return STATUS_NO_MEMORY;
            RtlInitUnicodeString(&Provider->DllName, Ptr);
            InsertTailList(&AVrfpVerifierProvidersList, &Provider->ListEntry);
        }
    } while (Next);
 
    Entry = AVrfpVerifierProvidersList.Flink;
    while (Entry != &AVrfpVerifierProvidersList)
    {
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
        Entry = Entry->Flink;
 
        Status = AVrfpLoadAndInitializeProvider(Provider);
        if (!NT_SUCCESS(Status))
        {
            RemoveEntryList(&Provider->ListEntry);
            RtlFreeHeap(RtlGetProcessHeap(), 0, Provider);
        }
    }
 
    if (!NT_SUCCESS(Status))
    {
        DbgPrint("AVRF: %wZ: pid 0x%X: application verifier will be disabled due to an initialization error.\n",
                 &LdrpImageEntry->BaseDllName, NtCurrentTeb()->ClientId.UniqueProcess);
        NtCurrentPeb()->NtGlobalFlag &= ~FLG_APPLICATION_VERIFIER;
    }
 
    return Status;
}

Referenced by LdrpInitializeProcess().

AVrfInternalHeapFreeNotification()

VOID NTAPI AVrfInternalHeapFreeNotification	(	PVOID	AllocationBase,
		SIZE_T	AllocationSize
	)

Definition at line 364 of file verifier.c.

{
    PLIST_ENTRY Entry;
 
    if (!(NtCurrentPeb()->NtGlobalFlag & FLG_APPLICATION_VERIFIER) || !AVrfpInitialized)
        return;
 
    RtlEnterCriticalSection(&AVrfpVerifierLock);
    for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
    {
        PVERIFIER_PROVIDER Provider;
        RTL_VERIFIER_NTDLLHEAPFREE_CALLBACK ProviderHeapFreeCallback;
 
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
        ProviderHeapFreeCallback = Provider->ProviderNtdllHeapFreeCallback;
        if (ProviderHeapFreeCallback)
        {
            ProviderHeapFreeCallback(AllocationBase, AllocationSize);
        }
    }
    RtlLeaveCriticalSection(&AVrfpVerifierLock);
}

AVrfPageHeapDllNotification()

VOID NTAPI AVrfPageHeapDllNotification

(

IN PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 390 of file verifier.c.

{
    /* Check if page heap dll notification is turned on */
    if (!(RtlpDphGlobalFlags & DPH_FLAG_DLL_NOTIFY))
        return;
 
    /* We don't support this flag currently */
    UNIMPLEMENTED;
}

Referenced by LdrpWalkImportDescriptor().

AVrfpChainDuplicateThunks()

VOID NTAPI AVrfpChainDuplicateThunks

(

VOID

)

Definition at line 477 of file verifier.c.

{
    PLIST_ENTRY Entry;
    PVERIFIER_PROVIDER Provider;
 
    for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
    {
        PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
        PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
 
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
        for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
        {
            for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
            {
                PVOID Ptr;
 
                if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING_DEBUG)
                    DbgPrint("AVRF: Checking %wZ for duplicate (%ws: %s)\n",
                             &Provider->DllName, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
 
                Ptr = AvrfpFindDuplicateThunk(Entry, DllDescriptor->DllName, ThunkDescriptor->ThunkName);
                if (Ptr)
                {
                    if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING)
                        DbgPrint("AVRF: Chaining (%ws: %s) to %wZ\n", DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
 
                    ThunkDescriptor->ThunkOldAddress = Ptr;
                }
            }
        }
    }
}

Referenced by AVrfpLoadAndInitializeProvider().

AVrfpCountThunks()

SIZE_T AVrfpCountThunks

(

PIMAGE_THUNK_DATA

Thunk

)

Definition at line 124 of file verifier.c.

{
    SIZE_T Count = 0;
    while (Thunk[Count].u1.Function)
        Count++;
    return Count;
}

Referenced by AVrfpSnapDllImports().

AVrfpDebugPageHeapCreate()

static HANDLE NTAPI AVrfpDebugPageHeapCreate ( ULONG  Flags, PVOID  Addr, SIZE_T  TotalSize, SIZE_T  CommitSize, PVOID  Lock, PRTL_HEAP_PARAMETERS  Parameters  )

static

Definition at line 525 of file verifier.c.

{
    HANDLE hHeap;
    hHeap = RtlpPageHeapCreate(Flags, Addr, TotalSize, CommitSize, Lock, Parameters);
    DbgPrint("AVRF: DebugPageHeapCreate(Flags=%x, Addr=%p, TotalSize=%u, CommitSize=%u, Lock=%p, Parameters=%p) = %p\n",
             Flags, Addr, TotalSize, CommitSize, Lock, Parameters, hHeap);
    return hHeap;
}

Referenced by AVrfpLoadAndInitializeProvider().

AVrfpDebugPageHeapDestroy()

static PVOID AVrfpDebugPageHeapDestroy ( HANDLE  HeapPtr )

static

Definition at line 541 of file verifier.c.

{
    DbgPrint("AVRF: DebugPageHeapDestroy(HeapPtr=%p)\n", HeapPtr);
    return RtlpPageHeapDestroy(HeapPtr);
}

Referenced by AVrfpLoadAndInitializeProvider().

AvrfpFindDuplicateThunk()

PVOID NTAPI AvrfpFindDuplicateThunk	(	PLIST_ENTRY	EndEntry,
		PWCHAR	DllName,
		PCHAR	ThunkName
	)

Definition at line 431 of file verifier.c.

{
    PLIST_ENTRY Entry;
 
    for (Entry = AVrfpVerifierProvidersList.Flink; Entry != EndEntry; Entry = Entry->Flink)
    {
        PVERIFIER_PROVIDER Provider;
        PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
 
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
        if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING_DEBUG)
            DbgPrint("AVRF: chain: searching in %wZ\n", &Provider->DllName);
 
        for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
        {
            PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
 
            if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING_DEBUG)
                DbgPrint("AVRF: chain: dll: %ws\n", DllDescriptor->DllName);
 
            if (_wcsicmp(DllDescriptor->DllName, DllName))
                continue;
 
            for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
            {
                if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING_DEBUG)
                    DbgPrint("AVRF: chain: thunk: %s == %s ?\n", ThunkDescriptor->ThunkName, ThunkName);
 
                if (!_stricmp(ThunkDescriptor->ThunkName, ThunkName))
                {
                    if (AVrfpDebug & RTL_VRF_DBG_SHOWCHAINING_DEBUG)
                        DbgPrint("AVRF: Found duplicate for (%ws: %s) in %wZ\n",
                                    DllDescriptor->DllName, ThunkDescriptor->ThunkName, &Provider->DllName);
 
                    return ThunkDescriptor->ThunkNewAddress;
                }
            }
        }
    }
    return NULL;
}

Referenced by AVrfpChainDuplicateThunks().

AVrfpGetStackTraceAddress()

static PVOID NTAPI AVrfpGetStackTraceAddress ( ULONG  Arg0 )

static

Definition at line 515 of file verifier.c.

{
    UNIMPLEMENTED;
    DbgBreakPoint();
    return NULL;
}

Referenced by AVrfpLoadAndInitializeProvider().

AVrfpIsVerifierProviderDll()

BOOLEAN AVrfpIsVerifierProviderDll

(

PVOID

BaseAddress

)

Definition at line 107 of file verifier.c.

{
    PLIST_ENTRY Entry;
    PVERIFIER_PROVIDER Provider;
 
    for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
    {
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
        if (BaseAddress == Provider->BaseAddress)
            return TRUE;
    }
 
    return FALSE;
}

Referenced by AVrfDllLoadNotification(), AVrfDllUnloadNotification(), and AVrfpResnapInitialModules().

AVrfpLoadAndInitializeProvider()

NTSTATUS NTAPI AVrfpLoadAndInitializeProvider

(

PVERIFIER_PROVIDER

Provider

)

Definition at line 549 of file verifier.c.

{
    WCHAR StringBuffer[MAX_PATH + 11];
    UNICODE_STRING DllPath;
    PRTL_VERIFIER_PROVIDER_DESCRIPTOR Descriptor = NULL;
    PIMAGE_NT_HEADERS ImageNtHeader;
    NTSTATUS Status;
 
    RtlInitEmptyUnicodeString(&DllPath, StringBuffer, sizeof(StringBuffer));
    RtlAppendUnicodeToString(&DllPath, SharedUserData->NtSystemRoot);
    RtlAppendUnicodeToString(&DllPath, L"\\System32\\");
 
    if (AVrfpDebug & RTL_VRF_DBG_SHOWSNAPS)
        DbgPrint("AVRF: verifier dll `%wZ'\n", &Provider->DllName);
 
    Status = LdrLoadDll(DllPath.Buffer, NULL, &Provider->DllName, &Provider->BaseAddress);
    if (!NT_SUCCESS(Status))
    {
        DbgPrint("AVRF: %wZ: failed to load provider `%wZ' (status %08X) from %wZ\n",
                 &LdrpImageEntry->BaseDllName,
                 &Provider->DllName,
                 Status,
                 &DllPath);
        return Status;
    }
 
    /* Prevent someone funny from specifying his own application as provider */
    ImageNtHeader = RtlImageNtHeader(Provider->BaseAddress);
    if (!ImageNtHeader ||
        !(ImageNtHeader->FileHeader.Characteristics & IMAGE_FILE_DLL))
    {
        DbgPrint("AVRF: provider %wZ is not a DLL image\n", &Provider->DllName);
        return STATUS_DLL_INIT_FAILED;
    }
 
    Provider->EntryPoint = LdrpFetchAddressOfEntryPoint(Provider->BaseAddress);
    if (!Provider->EntryPoint)
    {
        DbgPrint("AVRF: cannot find an entry point for provider %wZ\n", &Provider->DllName);
        return STATUS_PROCEDURE_NOT_FOUND;
    }
 
    _SEH2_TRY
    {
        if (LdrpCallInitRoutine(Provider->EntryPoint,
                                Provider->BaseAddress,
                                DLL_PROCESS_VERIFIER,
                                &Descriptor))
        {
            if (Descriptor && Descriptor->Length == sizeof(RTL_VERIFIER_PROVIDER_DESCRIPTOR))
            {
                /* Copy the data */
                Provider->ProviderDlls = Descriptor->ProviderDlls;
                Provider->ProviderDllLoadCallback = Descriptor->ProviderDllLoadCallback;
                Provider->ProviderDllUnloadCallback = Descriptor->ProviderDllUnloadCallback;
                Provider->ProviderNtdllHeapFreeCallback = Descriptor->ProviderNtdllHeapFreeCallback;
 
                /* Update some info for the provider */
                Descriptor->VerifierImage = LdrpImageEntry->BaseDllName.Buffer;
                Descriptor->VerifierFlags = AVrfpVerifierFlags;
                Descriptor->VerifierDebug = AVrfpDebug;
 
                Descriptor->RtlpGetStackTraceAddress = AVrfpGetStackTraceAddress;
                Descriptor->RtlpDebugPageHeapCreate = AVrfpDebugPageHeapCreate;
                Descriptor->RtlpDebugPageHeapDestroy = AVrfpDebugPageHeapDestroy;
                Status = STATUS_SUCCESS;
            }
            else
            {
                DbgPrint("AVRF: provider %wZ passed an invalid descriptor @ %p\n", &Provider->DllName, Descriptor);
                Status = STATUS_INVALID_PARAMETER_4;
            }
        }
        else
        {
            DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
            Status = STATUS_DLL_INIT_FAILED;
        }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    if (!NT_SUCCESS(Status))
        return Status;
 
 
    if (AVrfpDebug & RTL_VRF_DBG_LISTPROVIDERS)
        DbgPrint("AVRF: initialized provider %wZ (descriptor @ %p)\n", &Provider->DllName, Descriptor);
 
    /* Done loading providers, allow dll notifications */
    AVrfpInitialized = TRUE;
 
    AVrfpChainDuplicateThunks();
    AVrfpResnapInitialModules();
 
    /* Manually call with DLL_PROCESS_ATTACH, since the process is not done initializing */
    _SEH2_TRY
    {
        if (!LdrpCallInitRoutine(Provider->EntryPoint,
                                 Provider->BaseAddress,
                                 DLL_PROCESS_ATTACH,
                                 NULL))
        {
            DbgPrint("AVRF: provider %wZ did not initialize correctly\n", &Provider->DllName);
            Status = STATUS_DLL_INIT_FAILED;
        }
 
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    return Status;
}

Referenced by AVrfInitializeVerifier().

AVrfpResnapInitialModules()

VOID NTAPI AVrfpResnapInitialModules

(

VOID

)

Definition at line 403 of file verifier.c.

{
    PLIST_ENTRY ListHead, ListEntry;
 
    ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
    for (ListEntry = ListHead->Flink; ListHead != ListEntry; ListEntry = ListEntry->Flink)
    {
        PLDR_DATA_TABLE_ENTRY LdrEntry;
 
        LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
 
        if (AVrfpIsVerifierProviderDll(LdrEntry->DllBase))
        {
            if (AVrfpDebug & RTL_VRF_DBG_SHOWSNAPS)
                DbgPrint("AVRF: skipped resnapping provider %wZ ...\n", &LdrEntry->BaseDllName);
        }
        else
        {
            if (AVrfpDebug & RTL_VRF_DBG_SHOWSNAPS)
                DbgPrint("AVRF: resnapping %wZ ...\n", &LdrEntry->BaseDllName);
 
            AvrfpResolveThunks(LdrEntry);
        }
    }
}

Referenced by AVrfpLoadAndInitializeProvider().

AvrfpResolveThunks()

VOID AvrfpResolveThunks

(

IN PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 239 of file verifier.c.

{
    PLIST_ENTRY Entry;
    PVERIFIER_PROVIDER Provider;
 
    if (!AVrfpInitialized)
        return;
 
    for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
    {
        PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
 
        Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
 
        for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
        {
            PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
 
            if ((DllDescriptor->DllFlags & VERIFIER_DLL_FLAGS_RESOLVED) ||
                _wcsicmp(DllDescriptor->DllName, LdrEntry->BaseDllName.Buffer))
                continue;
 
            if (AVrfpDebug & RTL_VRF_DBG_SHOWVERIFIEDEXPORTS)
                DbgPrint("AVRF: pid 0x%X: found dll descriptor for `%wZ' with verified exports\n",
                            NtCurrentTeb()->ClientId.UniqueProcess,
                            &LdrEntry->BaseDllName);
 
            for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
            {
                if (!ThunkDescriptor->ThunkOldAddress)
                {
                    ANSI_STRING ThunkName;
 
                    RtlInitAnsiString(&ThunkName, ThunkDescriptor->ThunkName);
                    /* We cannot call the public api, because that would run init routines! */
                    if (NT_SUCCESS(LdrpGetProcedureAddress(LdrEntry->DllBase, &ThunkName, 0, &ThunkDescriptor->ThunkOldAddress, FALSE)))
                    {
                        if (AVrfpDebug & RTL_VRF_DBG_SHOWFOUNDEXPORTS)
                            DbgPrint("AVRF: (%wZ) %Z export found.\n", &LdrEntry->BaseDllName, &ThunkName);
                    }
                    else
                    {
                        if (AVrfpDebug & RTL_VRF_DBG_SHOWFOUNDEXPORTS)
                            DbgPrint("AVRF: warning: did not find `%Z' export in %wZ.\n", &ThunkName, &LdrEntry->BaseDllName);
                    }
                }
            }
 
            DllDescriptor->DllFlags |= VERIFIER_DLL_FLAGS_RESOLVED;
        }
    }
 
    AVrfpSnapDllImports(LdrEntry);
}

Referenced by AVrfDllLoadNotification(), and AVrfpResnapInitialModules().

AVrfpSnapDllImports()

VOID AVrfpSnapDllImports

(

IN PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 133 of file verifier.c.

{
    ULONG Size;
    PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
    PBYTE DllBase = LdrEntry->DllBase;
 
    ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size);
    if (!ImportDescriptor)
    {
        //SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
        return;
    }
 
    for (; ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
    {
        PIMAGE_THUNK_DATA FirstThunk;
        PVOID UnprotectedPtr = NULL;
        SIZE_T UnprotectedSize = 0;
        ULONG OldProtection = 0;
        FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
 
        /* Walk all imports */
        for (;FirstThunk->u1.Function; FirstThunk++)
        {
            PLIST_ENTRY Entry;
            PVERIFIER_PROVIDER Provider;
 
            for (Entry = AVrfpVerifierProvidersList.Flink; Entry != &AVrfpVerifierProvidersList; Entry = Entry->Flink)
            {
                PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
 
                Provider = CONTAINING_RECORD(Entry, VERIFIER_PROVIDER, ListEntry);
                for (DllDescriptor = Provider->ProviderDlls; DllDescriptor && DllDescriptor->DllName; ++DllDescriptor)
                {
                    PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
 
                    for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor && ThunkDescriptor->ThunkName; ++ThunkDescriptor)
                    {
                        /* Just compare function addresses, the loader will have handled forwarders and ordinals for us */
                        if ((PVOID)FirstThunk->u1.Function != ThunkDescriptor->ThunkOldAddress)
                            continue;
 
                        if (!UnprotectedPtr)
                        {
                            PVOID Ptr = &FirstThunk->u1.Function;
                            SIZE_T Size = sizeof(FirstThunk->u1.Function) * AVrfpCountThunks(FirstThunk);
                            NTSTATUS Status;
 
                            UnprotectedPtr = Ptr;
                            UnprotectedSize = Size;
 
                            Status = NtProtectVirtualMemory(NtCurrentProcess(),
                                                            &Ptr,
                                                            &Size,
                                                            PAGE_EXECUTE_READWRITE,
                                                            &OldProtection);
 
                            if (!NT_SUCCESS(Status))
                            {
                                DbgPrint("AVRF: Unable to unprotect IAT to modify thunks (status %08X).\n", Status);
                                UnprotectedPtr = NULL;
                                continue;
                            }
                        }
 
                        if (ThunkDescriptor->ThunkNewAddress == NULL)
                        {
                            DbgPrint("AVRF: internal error: New thunk for %s is null.\n", ThunkDescriptor->ThunkName);
                            continue;
                        }
                        FirstThunk->u1.Function = (SIZE_T)ThunkDescriptor->ThunkNewAddress;
                        if (AVrfpDebug & RTL_VRF_DBG_SHOWSNAPS)
                            DbgPrint("AVRF: Snapped (%wZ: %s) with (%wZ: %p).\n",
                                        &LdrEntry->BaseDllName,
                                        ThunkDescriptor->ThunkName,
                                        &Provider->DllName,
                                        ThunkDescriptor->ThunkNewAddress);
                    }
                }
            }
        }
 
        if (UnprotectedPtr)
        {
            PVOID Ptr = UnprotectedPtr;
            SIZE_T Size = UnprotectedSize;
            NTSTATUS Status;
 
            UnprotectedPtr = Ptr;
            UnprotectedSize = Size;
 
            Status = NtProtectVirtualMemory(NtCurrentProcess(),
                                            &Ptr,
                                            &Size,
                                            OldProtection,
                                            &OldProtection);
            if (!NT_SUCCESS(Status))
            {
                DbgPrint("AVRF: Unable to reprotect IAT to modify thunks (status %08X).\n", Status);
            }
        }
    }
}

Referenced by AvrfpResolveThunks().

AVrfReadIFEO()

VOID NTAPI AVrfReadIFEO

(

HANDLE

KeyHandle

)

Definition at line 50 of file verifier.c.

{
    NTSTATUS Status;
 
    Status = LdrQueryImageFileKeyOption(KeyHandle,
                                        L"VerifierDlls",
                                        REG_SZ,
                                        AVrfpVerifierDllsString,
                                        sizeof(AVrfpVerifierDllsString) - sizeof(WCHAR),
                                        NULL);
 
    if (!NT_SUCCESS(Status))
        AVrfpVerifierDllsString[0] = UNICODE_NULL;
 
    Status = LdrQueryImageFileKeyOption(KeyHandle,
                                        L"VerifierFlags",
                                        REG_DWORD,
                                        &AVrfpVerifierFlags,
                                        sizeof(AVrfpVerifierFlags),
                                        NULL);
    if (!NT_SUCCESS(Status))
        AVrfpVerifierFlags = RTL_VRF_FLG_HANDLE_CHECKS | RTL_VRF_FLG_FAST_FILL_HEAP | RTL_VRF_FLG_LOCK_CHECKS;
 
    Status = LdrQueryImageFileKeyOption(KeyHandle,
                                        L"VerifierDebug",
                                        REG_DWORD,
                                        &AVrfpDebug,
                                        sizeof(AVrfpDebug),
                                        NULL);
    if (!NT_SUCCESS(Status))
        AVrfpDebug = 0;
}

Referenced by LdrpInitializeApplicationVerifierPackage().

LdrpInitializeApplicationVerifierPackage()

NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage	(	HANDLE	KeyHandle,
		PPEB	Peb,
		BOOLEAN	SystemWide,
		BOOLEAN	ReadAdvancedOptions
	)

Definition at line 86 of file verifier.c.

{
    /* If global flags request DPH, perform some additional actions */
    if (Peb->NtGlobalFlag & FLG_HEAP_PAGE_ALLOCS)
    {
        // TODO: Read advanced DPH flags from the registry if requested
        if (ReadAdvancedOptions)
        {
            UNIMPLEMENTED;
        }
 
        /* Enable page heap */
        RtlpPageHeapEnabled = TRUE;
    }
 
    AVrfReadIFEO(KeyHandle);
 
    return STATUS_SUCCESS;
}

RtlpPageHeapCreate()

HANDLE NTAPI RtlpPageHeapCreate	(	ULONG	Flags,
		PVOID	Addr,
		SIZE_T	TotalSize,
		SIZE_T	CommitSize,
		PVOID	Lock,
		PRTL_HEAP_PARAMETERS	Parameters
	)

Definition at line 1537 of file heappage.c.

{
    PVOID Base = NULL;
    PHEAP HeapPtr;
    PDPH_HEAP_ROOT DphRoot;
    PDPH_HEAP_BLOCK DphNode;
    ULONG MemSize;
    NTSTATUS Status;
    LARGE_INTEGER PerfCounter;
 
    /* Check for a DPH bypass flag */
    if ((ULONG_PTR)Parameters == -1) return NULL;
 
    /* Make sure no user-allocated stuff was provided */
    if (Addr || Lock) return NULL;
 
    /* Allocate minimum amount of virtual memory */
    MemSize = DPH_RESERVE_SIZE;
    Status = RtlpDphAllocateVm(&Base, MemSize, MEM_COMMIT, PAGE_NOACCESS);
    if (!NT_SUCCESS(Status))
    {
        ASSERT(FALSE);
        return NULL;
    }
 
    /* Set protection */
    Status = RtlpDphProtectVm(Base, 2*PAGE_SIZE + DPH_POOL_SIZE, PAGE_READWRITE);
    if (!NT_SUCCESS(Status))
    {
        //RtlpDphFreeVm(Base, 0, 0, 0);
        ASSERT(FALSE);
        return NULL;
    }
 
    /* Start preparing the 1st page. Fill it with the default filler */
    RtlFillMemoryUlong(Base, PAGE_SIZE, DPH_FILL);
 
    /* Set flags in the "HEAP" structure */
    HeapPtr = (PHEAP)Base;
    HeapPtr->Flags = Flags | HEAP_FLAG_PAGE_ALLOCS;
    HeapPtr->ForceFlags = Flags | HEAP_FLAG_PAGE_ALLOCS;
 
    /* Set 1st page to read only now */
    Status = RtlpDphProtectVm(Base, PAGE_SIZE, PAGE_READONLY);
    if (!NT_SUCCESS(Status))
    {
        ASSERT(FALSE);
        return NULL;
    }
 
    /* 2nd page is the real DPH root block */
    DphRoot = (PDPH_HEAP_ROOT)((PCHAR)Base + PAGE_SIZE);
 
    /* Initialize the DPH root */
    DphRoot->Signature = DPH_SIGNATURE;
    DphRoot->HeapFlags = Flags;
    DphRoot->HeapCritSect = (PHEAP_LOCK)((PCHAR)DphRoot + DPH_POOL_SIZE);
    DphRoot->ExtraFlags = RtlpDphGlobalFlags;
 
    ZwQueryPerformanceCounter(&PerfCounter, NULL);
    DphRoot->Seed = PerfCounter.LowPart;
 
    RtlInitializeHeapLock(&DphRoot->HeapCritSect);
    InitializeListHead(&DphRoot->AvailableAllocationHead);
 
    /* Create a normal heap for this paged heap */
    DphRoot->NormalHeap = RtlCreateHeap(Flags, NULL, TotalSize, CommitSize, NULL, (PRTL_HEAP_PARAMETERS)-1);
    if (!DphRoot->NormalHeap)
    {
        ASSERT(FALSE);
        return NULL;
    }
 
    /* 3rd page: a pool for DPH allocations */
    RtlpDphAddNewPool(DphRoot, NULL, DphRoot + 1, DPH_POOL_SIZE - sizeof(DPH_HEAP_ROOT), FALSE);
 
    /* Allocate internal heap blocks. For the root */
    DphNode = RtlpDphAllocateNode(DphRoot);
    ASSERT(DphNode != NULL);
    DphNode->pVirtualBlock = (PUCHAR)DphRoot;
    DphNode->nVirtualBlockSize = DPH_POOL_SIZE;
    RtlpDphPlaceOnPoolList(DphRoot, DphNode);
 
    /* For the memory we allocated as a whole */
    DphNode = RtlpDphAllocateNode(DphRoot);
    ASSERT(DphNode != NULL);
    DphNode->pVirtualBlock = Base;
    DphNode->nVirtualBlockSize = MemSize;
    RtlpDphPlaceOnVirtualList(DphRoot, DphNode);
 
    /* For the remaining part */
    DphNode = RtlpDphAllocateNode(DphRoot);
    ASSERT(DphNode != NULL);
    DphNode->pVirtualBlock = (PUCHAR)Base + 2*PAGE_SIZE + DPH_POOL_SIZE;
    DphNode->nVirtualBlockSize = MemSize - (2*PAGE_SIZE + DPH_POOL_SIZE);
    RtlpDphCoalesceNodeIntoAvailable(DphRoot, DphNode);
 
    //DphRoot->CreateStackTrace = RtlpDphLogStackTrace(1);
 
    /* Initialize AVL-based busy nodes table */
    RtlInitializeGenericTableAvl(&DphRoot->BusyNodesTable,
                                 RtlpDphCompareNodeForTable,
                                 RtlpDphAllocateNodeForTable,
                                 RtlpDphFreeNodeForTable,
                                 NULL);
 
    /* Initialize per-process startup info */
    if (!RtlpDphPageHeapListInitialized) RtlpDphProcessStartupInitialization();
 
    /* Acquire the heap list lock */
    RtlEnterHeapLock(RtlpDphPageHeapListLock, TRUE);
 
    /* Insert this heap to the tail of the global list */
    InsertTailList(&RtlpDphPageHeapList, &DphRoot->NextHeap);
 
    /* Note we increased the size of the list */
    RtlpDphPageHeapListLength++;
 
    /* Release the heap list lock */
    RtlLeaveHeapLock(RtlpDphPageHeapListLock);
 
    if (RtlpDphDebugOptions & DPH_DEBUG_VERBOSE)
    {
        DPRINT1("Page heap: process 0x%p created heap @ %p (%p, flags 0x%X)\n",
                NtCurrentTeb()->ClientId.UniqueProcess, (PUCHAR)DphRoot - PAGE_SIZE,
                DphRoot->NormalHeap, DphRoot->ExtraFlags);
    }
 
    /* Perform internal validation if required */
    if (RtlpDphDebugOptions & DPH_DEBUG_INTERNAL_VALIDATE)
        RtlpDphInternalValidatePageHeap(DphRoot, NULL, 0);
 
    return (PUCHAR)DphRoot - PAGE_SIZE;
}

Referenced by AVrfpDebugPageHeapCreate(), and RtlCreateHeap().

RtlpPageHeapDestroy()

PVOID NTAPI RtlpPageHeapDestroy

(

HANDLE

HeapPtr

)

Definition at line 1678 of file heappage.c.

{
    PDPH_HEAP_ROOT DphRoot;
    PVOID Ptr;
    PDPH_HEAP_BLOCK Node, Next;
    PHEAP NormalHeap;
    ULONG Value;
 
    /* Check if it's not a process heap */
    if (HeapPtr == RtlGetProcessHeap())
    {
        VERIFIER_STOP(APPLICATION_VERIFIER_DESTROY_PROCESS_HEAP,
                      "attempt to destroy process heap",
                      HeapPtr, "Heap handle",
                      0, "",
                      0, "",
                      0, "");
        return NULL;
    }
 
    /* Get pointer to the heap root */
    DphRoot = RtlpDphPointerFromHandle(HeapPtr);
    if (!DphRoot) return NULL;
 
    RtlpDphPreProcessing(DphRoot, DphRoot->HeapFlags);
 
    /* Get the pointer to the normal heap */
    NormalHeap = DphRoot->NormalHeap;
 
    /* Free the delayed-free blocks */
    RtlpDphFreeDelayedBlocksFromHeap(DphRoot, NormalHeap);
 
    /* Go through the busy blocks */
    Ptr = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, TRUE);
 
    while (Ptr)
    {
        Node = CONTAINING_RECORD(Ptr, DPH_HEAP_BLOCK, pUserAllocation);
        if (!(DphRoot->ExtraFlags & DPH_EXTRA_CHECK_UNDERRUN))
        {
            if (!RtlpDphIsPageHeapBlock(DphRoot, Node->pUserAllocation, &Value, TRUE))
            {
                RtlpDphReportCorruptedBlock(DphRoot, 3, Node->pUserAllocation, Value);
            }
        }
 
        AVrfInternalHeapFreeNotification(Node->pUserAllocation, Node->nUserRequestedSize);
 
        /* Go to the next node */
        Ptr = RtlEnumerateGenericTableAvl(&DphRoot->BusyNodesTable, FALSE);
    }
 
    /* Acquire the global heap list lock */
    RtlEnterHeapLock(RtlpDphPageHeapListLock, TRUE);
 
    /* Remove the entry and decrement the global counter */
    RemoveEntryList(&DphRoot->NextHeap);
    RtlpDphPageHeapListLength--;
 
    /* Release the global heap list lock */
    RtlLeaveHeapLock(RtlpDphPageHeapListLock);
 
    /* Leave and delete this heap's critical section */
    RtlLeaveHeapLock(DphRoot->HeapCritSect);
    RtlDeleteHeapLock(DphRoot->HeapCritSect);
 
    /* Now go through all virtual list nodes and release the VM */
    Node = DphRoot->pVirtualStorageListHead;
    while (Node)
    {
        Next = Node->pNextAlloc;
        /* Release the memory without checking result */
        RtlpDphFreeVm(Node->pVirtualBlock, 0, MEM_RELEASE);
        Node = Next;
    }
 
    /* Destroy the normal heap */
    RtlDestroyHeap(NormalHeap);
 
    /* Report success */
    if (RtlpDphDebugOptions & DPH_DEBUG_VERBOSE)
        DPRINT1("Page heap: process 0x%p destroyed heap @ %p (%p)\n",
                NtCurrentTeb()->ClientId.UniqueProcess, HeapPtr, NormalHeap);
 
    return NULL;
}

Referenced by AVrfpDebugPageHeapDestroy(), and RtlDestroyHeap().

Variable Documentation

AVrfpDebug

ULONG AVrfpDebug = 0

Definition at line 23 of file verifier.c.

Referenced by AVrfpChainDuplicateThunks(), AvrfpFindDuplicateThunk(), AVrfpLoadAndInitializeProvider(), AVrfpResnapInitialModules(), AvrfpResolveThunks(), AVrfpSnapDllImports(), and AVrfReadIFEO().

AVrfpInitialized

BOOL AVrfpInitialized = FALSE

Definition at line 24 of file verifier.c.

Referenced by AVrfDllUnloadNotification(), AVrfInternalHeapFreeNotification(), AVrfpLoadAndInitializeProvider(), and AvrfpResolveThunks().

AVrfpVerifierDllsString

WCHAR AVrfpVerifierDllsString[256] = { 0 }

Definition at line 22 of file verifier.c.

Referenced by AVrfInitializeVerifier(), and AVrfReadIFEO().

AVrfpVerifierFlags

ULONG AVrfpVerifierFlags = 0

Definition at line 21 of file verifier.c.

Referenced by AVrfInitializeVerifier(), AVrfpLoadAndInitializeProvider(), and AVrfReadIFEO().

AVrfpVerifierLock

RTL_CRITICAL_SECTION AVrfpVerifierLock

Definition at line 25 of file verifier.c.

Referenced by AVrfDllLoadNotification(), AVrfDllUnloadNotification(), AVrfInitializeVerifier(), and AVrfInternalHeapFreeNotification().

AVrfpVerifierProvidersList

LIST_ENTRY AVrfpVerifierProvidersList

Definition at line 26 of file verifier.c.

Referenced by AVrfDllLoadNotification(), AVrfDllUnloadNotification(), AVrfInitializeVerifier(), AVrfInternalHeapFreeNotification(), AVrfpChainDuplicateThunks(), AvrfpFindDuplicateThunk(), AVrfpIsVerifierProviderDll(), AvrfpResolveThunks(), and AVrfpSnapDllImports().

LdrpImageEntry

PLDR_DATA_TABLE_ENTRY LdrpImageEntry

extern

Definition at line 39 of file ldrinit.c.

Referenced by AVrfInitializeVerifier(), AVrfpLoadAndInitializeProvider(), LdrpInitializeProcess(), LdrpInitializeThread(), LdrpRunInitializeRoutines(), LdrShutdownProcess(), and LdrShutdownThread().