cmboot.h File Reference

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_BOOT_DRIVER_NODE

Typedefs
typedef struct _BOOT_DRIVER_NODE	BOOT_DRIVER_NODE
typedef struct _BOOT_DRIVER_NODE *	PBOOT_DRIVER_NODE

Functions
HCELL_INDEX NTAPI	CmpFindControlSet (_In_ PHHIVE SystemHive, _In_ HCELL_INDEX RootCell, _In_ PCUNICODE_STRING SelectKeyName, _Out_ PBOOLEAN AutoSelect)
	Finds the corresponding "HKLM\SYSTEM\ControlSetXXX" system control set registry key, according to the "Current", "Default", or "LastKnownGood" values in the "HKLM\SYSTEM\Select" registry key.
BOOLEAN NTAPI	CmpFindDrivers (_In_ PHHIVE Hive, _In_ HCELL_INDEX ControlSet, _In_ SERVICE_LOAD_TYPE LoadType, _In_opt_ PCWSTR BootFileSystem, _Inout_ PLIST_ENTRY DriverListHead)
	Enumerates all drivers within the given control set and load type, present in the "Services" sub-key, and inserts them into the driver list.
BOOLEAN NTAPI	CmpSortDriverList (_In_ PHHIVE Hive, _In_ HCELL_INDEX ControlSet, _Inout_ PLIST_ENTRY DriverListHead)
	Sorts the driver list, according to the drivers' group load ordering.
BOOLEAN NTAPI	CmpResolveDriverDependencies (_Inout_ PLIST_ENTRY DriverListHead)
	Removes potential circular dependencies (cycles) and sorts the driver list.
VOID NTAPI	CmpFreeDriverList (_In_ PHHIVE Hive, _Inout_ PLIST_ENTRY DriverListHead)
	Empties the driver list and frees all allocated driver nodes in it.

Typedef Documentation

BOOT_DRIVER_NODE

typedef struct _BOOT_DRIVER_NODE BOOT_DRIVER_NODE

PBOOT_DRIVER_NODE

typedef struct _BOOT_DRIVER_NODE * PBOOT_DRIVER_NODE

Function Documentation

CmpFindControlSet()

HCELL_INDEX NTAPI CmpFindControlSet	(	_In_ PHHIVE	SystemHive,
		_In_ HCELL_INDEX	RootCell,
		_In_ PCUNICODE_STRING	SelectKeyName,
		_Out_ PBOOLEAN	AutoSelect
	)

Finds the corresponding "HKLM\SYSTEM\ControlSetXXX" system control set registry key, according to the "Current", "Default", or "LastKnownGood" values in the "HKLM\SYSTEM\Select" registry key.

Parameters

[in]	SystemHive	The SYSTEM hive.
[in]	RootCell	The root cell of the SYSTEM hive.
[in]	SelectKeyName	The control set to check for: either "Current", "Default", or "LastKnownGood", the value of which selects the corresponding "HKLM\SYSTEM\ControlSetXXX" control set registry key.
[out]	AutoSelect	Value of the "AutoSelect" registry value (unused).

Returns

The control set registry key's hive cell (if found), or HCELL_NIL.

Definition at line 82 of file cmboot.c.

{
    UNICODE_STRING Name;
    PCM_KEY_NODE Node;
    HCELL_INDEX SelectCell, AutoSelectCell, SelectValueCell, ControlSetCell;
    HCELL_INDEX CurrentValueCell;
    PCM_KEY_VALUE Value;
    ULONG Length;
    NTSTATUS Status;
    PULONG CurrentData;
    PULONG ControlSetId;
    WCHAR Buffer[128];
 
    /* Sanity check: We shouldn't need to release any acquired cells */
    ASSERT(SystemHive->ReleaseCellRoutine == NULL);
 
    /* Get the Select key */
    RtlInitUnicodeString(&Name, L"select");
    Node = (PCM_KEY_NODE)HvGetCell(SystemHive, RootCell);
    if (!Node) return HCELL_NIL;
    SelectCell = CmpFindSubKeyByName(SystemHive, Node, &Name);
    if (SelectCell == HCELL_NIL) return HCELL_NIL;
 
    /* Get AutoSelect value */
    RtlInitUnicodeString(&Name, L"AutoSelect");
    Node = (PCM_KEY_NODE)HvGetCell(SystemHive, SelectCell);
    if (!Node) return HCELL_NIL;
    AutoSelectCell = CmpFindValueByName(SystemHive, Node, &Name);
    if (AutoSelectCell == HCELL_NIL)
    {
        /* Assume TRUE if the value is missing */
        *AutoSelect = TRUE;
    }
    else
    {
        /* Read the value */
        Value = (PCM_KEY_VALUE)HvGetCell(SystemHive, AutoSelectCell);
        if (!Value) return HCELL_NIL;
        // if (Value->Type != REG_DWORD) return HCELL_NIL;
 
        /* Convert it to a boolean */
        CurrentData = (PULONG)CmpValueToData(SystemHive, Value, &Length);
        if (!CurrentData) return HCELL_NIL;
        // if (Length < sizeof(ULONG)) return HCELL_NIL;
 
        *AutoSelect = *(PBOOLEAN)CurrentData;
    }
 
    /* Now find the control set being looked up */
    Node = (PCM_KEY_NODE)HvGetCell(SystemHive, SelectCell);
    if (!Node) return HCELL_NIL;
    SelectValueCell = CmpFindValueByName(SystemHive, Node, SelectKeyName);
    if (SelectValueCell == HCELL_NIL) return HCELL_NIL;
 
    /* Read the value (corresponding to the CCS ID) */
    Value = (PCM_KEY_VALUE)HvGetCell(SystemHive, SelectValueCell);
    if (!Value) return HCELL_NIL;
    if (Value->Type != REG_DWORD) return HCELL_NIL;
    ControlSetId = (PULONG)CmpValueToData(SystemHive, Value, &Length);
    if (!ControlSetId) return HCELL_NIL;
    if (Length < sizeof(ULONG)) return HCELL_NIL;
 
    /* Now build the CCS's Name */
    Status = RtlStringCbPrintfW(Buffer, sizeof(Buffer),
                                L"ControlSet%03lu", *ControlSetId);
    if (!NT_SUCCESS(Status)) return HCELL_NIL;
    /* RtlStringCbPrintfW ensures the buffer to be NULL-terminated */
    RtlInitUnicodeString(&Name, Buffer);
 
    /* Now open it */
    Node = (PCM_KEY_NODE)HvGetCell(SystemHive, RootCell);
    if (!Node) return HCELL_NIL;
    ControlSetCell = CmpFindSubKeyByName(SystemHive, Node, &Name);
    if (ControlSetCell == HCELL_NIL) return HCELL_NIL;
 
    /* Get the value of the "Current" CCS */
    RtlInitUnicodeString(&Name, L"Current");
    Node =  (PCM_KEY_NODE)HvGetCell(SystemHive, SelectCell);
    if (!Node) return HCELL_NIL;
    CurrentValueCell = CmpFindValueByName(SystemHive, Node, &Name);
 
    /* Make sure it exists */
    if (CurrentValueCell != HCELL_NIL)
    {
        /* Get the current value and make sure it's a ULONG */
        Value = (PCM_KEY_VALUE)HvGetCell(SystemHive, CurrentValueCell);
        if (!Value) return HCELL_NIL;
        if (Value->Type == REG_DWORD)
        {
            /* Get the data and update it */
            CurrentData = (PULONG)CmpValueToData(SystemHive, Value, &Length);
            if (!CurrentData) return HCELL_NIL;
            if (Length < sizeof(ULONG)) return HCELL_NIL;
 
            *CurrentData = *ControlSetId;
        }
    }
 
    /* Return the CCS cell */
    return ControlSetCell;
}

Referenced by CmGetSystemControlValues(), CmGetSystemDriverList(), and RegInitCurrentControlSet().

CmpFindDrivers()

BOOLEAN NTAPI CmpFindDrivers	(	_In_ PHHIVE	Hive,
		_In_ HCELL_INDEX	ControlSet,
		_In_ SERVICE_LOAD_TYPE	LoadType,
		_In_opt_ PCWSTR	BootFileSystem,
		_Inout_ PLIST_ENTRY	DriverListHead
	)

Enumerates all drivers within the given control set and load type, present in the "Services" sub-key, and inserts them into the driver list.

Parameters

[in]	Hive	The SYSTEM hive.
[in]	ControlSet	The control set registry key's hive cell.
[in]	LoadType	The load type the driver should match.
[in]	BootFileSystem	Optional name of the boot file system, for which to insert its corresponding driver.
[in,out]	DriverListHead	The driver list where to insert the enumerated drivers.

Returns

TRUE if the drivers have been successfully enumerated and inserted, FALSE if not.

Definition at line 677 of file cmboot.c.

{
    HCELL_INDEX ServicesCell, ControlCell, GroupOrderCell, DriverCell;
    HCELL_INDEX SafeBootCell = HCELL_NIL;
    ULONG i;
    UNICODE_STRING Name;
    UNICODE_STRING KeyPath;
    PCM_KEY_NODE ControlNode, ServicesNode, Node;
    PBOOT_DRIVER_NODE FsNode;
 
    /* Sanity check: We shouldn't need to release any acquired cells */
    ASSERT(Hive->ReleaseCellRoutine == NULL);
 
    /* Open the control set key */
    ControlNode = (PCM_KEY_NODE)HvGetCell(Hive, ControlSet);
    if (!ControlNode) return FALSE;
 
    /* Get services cell */
    RtlInitUnicodeString(&Name, L"Services");
    ServicesCell = CmpFindSubKeyByName(Hive, ControlNode, &Name);
    if (ServicesCell == HCELL_NIL) return FALSE;
 
    /* Open services key */
    ServicesNode = (PCM_KEY_NODE)HvGetCell(Hive, ServicesCell);
    if (!ServicesNode) return FALSE;
 
    /* Get control cell */
    RtlInitUnicodeString(&Name, L"Control");
    ControlCell = CmpFindSubKeyByName(Hive, ControlNode, &Name);
    if (ControlCell == HCELL_NIL) return FALSE;
 
    /* Get the group order cell and read it */
    Node = (PCM_KEY_NODE)HvGetCell(Hive, ControlCell);
    if (!Node) return FALSE;
    RtlInitUnicodeString(&Name, L"GroupOrderList");
    GroupOrderCell = CmpFindSubKeyByName(Hive, Node, &Name);
    if (GroupOrderCell == HCELL_NIL) return FALSE;
 
    /* Get Safe Boot cell */
    if (InitSafeBootMode)
    {
        /* Open the Safe Boot key */
        RtlInitUnicodeString(&Name, L"SafeBoot");
        Node = (PCM_KEY_NODE)HvGetCell(Hive, ControlCell);
        if (!Node) return FALSE;
        SafeBootCell = CmpFindSubKeyByName(Hive, Node, &Name);
        if (SafeBootCell == HCELL_NIL) return FALSE;
 
        /* Open the correct start key (depending on the mode) */
        Node = (PCM_KEY_NODE)HvGetCell(Hive, SafeBootCell);
        if (!Node) return FALSE;
        switch (InitSafeBootMode)
        {
            /* NOTE: Assumes MINIMAL (1) and DSREPAIR (3) load same items */
            case 1:
            case 3: RtlInitUnicodeString(&Name, L"Minimal"); break;
            case 2: RtlInitUnicodeString(&Name, L"Network"); break;
            default: return FALSE;
        }
        SafeBootCell = CmpFindSubKeyByName(Hive, Node, &Name);
        if (SafeBootCell == HCELL_NIL) return FALSE;
    }
 
    /* Build the root registry path */
    RtlInitUnicodeString(&KeyPath, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");
 
    /* Enumerate each sub-key */
    i = 0;
    DriverCell = CmpFindSubKeyByNumber(Hive, ServicesNode, i);
    while (DriverCell != HCELL_NIL)
    {
        /* Make sure it's a driver of this start type AND is "safe" to load */
        if (CmpIsLoadType(Hive, DriverCell, LoadType) &&
            CmpIsSafe(Hive, SafeBootCell, DriverCell))
        {
            /* Add it to the list */
            if (!CmpAddDriverToList(Hive,
                                    DriverCell,
                                    GroupOrderCell,
                                    &KeyPath,
                                    DriverListHead))
            {
                CMTRACE(CM_BOOT_DEBUG, "  Failed to add boot driver\n");
            }
        }
 
        /* Go to the next sub-key */
        DriverCell = CmpFindSubKeyByNumber(Hive, ServicesNode, ++i);
    }
 
    /* Check if we have a boot file system */
    if (BootFileSystem)
    {
        /* Find it */
        RtlInitUnicodeString(&Name, BootFileSystem);
        DriverCell = CmpFindSubKeyByName(Hive, ServicesNode, &Name);
        if (DriverCell != HCELL_NIL)
        {
            CMTRACE(CM_BOOT_DEBUG, "Adding Boot FileSystem '%S'\n",
                    BootFileSystem);
 
            /* Always add it to the list */
            if (!CmpAddDriverToList(Hive,
                                    DriverCell,
                                    GroupOrderCell,
                                    &KeyPath,
                                    DriverListHead))
            {
                CMTRACE(CM_BOOT_DEBUG, "  Failed to add boot driver\n");
            }
            else
            {
                /* Mark it as critical so it always loads */
                FsNode = CONTAINING_RECORD(DriverListHead->Flink,
                                           BOOT_DRIVER_NODE,
                                           ListEntry.Link);
                FsNode->ErrorControl = SERVICE_ERROR_CRITICAL;
            }
        }
    }
 
    /* We're done! */
    return TRUE;
}

Referenced by CmGetSystemDriverList(), and WinLdrScanRegistry().

CmpFreeDriverList()

VOID NTAPI CmpFreeDriverList	(	_In_ PHHIVE	Hive,
		_Inout_ PLIST_ENTRY	DriverListHead
	)

Empties the driver list and frees all allocated driver nodes in it.

Parameters

[in]	Hive	The SYSTEM hive (used only for the Hive->Free() memory deallocator).
[in,out]	DriverListHead	The driver list to free.

Returns

None

Definition at line 1222 of file cmboot.c.

{
    PLIST_ENTRY Entry;
    PBOOT_DRIVER_NODE DriverNode;
 
    /* Loop through the list and remove each driver node */
    while (!IsListEmpty(DriverListHead))
    {
        /* Get the driver node */
        Entry = RemoveHeadList(DriverListHead);
        DriverNode = CONTAINING_RECORD(Entry,
                                       BOOT_DRIVER_NODE,
                                       ListEntry.Link);
 
        /* Free any allocated string buffers, then the node */
        if (DriverNode->ListEntry.RegistryPath.Buffer)
        {
            Hive->Free(DriverNode->ListEntry.RegistryPath.Buffer,
                       DriverNode->ListEntry.RegistryPath.MaximumLength);
        }
        if (DriverNode->ListEntry.FilePath.Buffer)
        {
            Hive->Free(DriverNode->ListEntry.FilePath.Buffer,
                       DriverNode->ListEntry.FilePath.MaximumLength);
        }
        if (DriverNode->Name.Buffer)
        {
            Hive->Free(DriverNode->Name.Buffer,
                       DriverNode->Name.MaximumLength);
        }
        Hive->Free(DriverNode, sizeof(BOOT_DRIVER_NODE));
    }
}

Referenced by CmGetSystemDriverList(), and WinLdrScanRegistry().

CmpResolveDriverDependencies()

BOOLEAN NTAPI CmpResolveDriverDependencies

(

_Inout_ PLIST_ENTRY

DriverListHead

)

Removes potential circular dependencies (cycles) and sorts the driver list.

Parameters

[in,out]

DriverListHead

The driver list to sort.

Returns

Always TRUE.

Definition at line 1028 of file cmboot.c.

{
    PLIST_ENTRY NextEntry;
    PBOOT_DRIVER_NODE StartNode, EndNode, CurrentNode;
 
    /* Loop the list */
    NextEntry = DriverListHead->Flink;
    while (NextEntry != DriverListHead)
    {
        /* Find the first entry */
        StartNode = CONTAINING_RECORD(NextEntry,
                                      BOOT_DRIVER_NODE,
                                      ListEntry.Link);
        do
        {
            /* Find the last entry */
            EndNode = CONTAINING_RECORD(NextEntry,
                                        BOOT_DRIVER_NODE,
                                        ListEntry.Link);
 
            /* Get the next entry */
            NextEntry = NextEntry->Flink;
            CurrentNode = CONTAINING_RECORD(NextEntry,
                                            BOOT_DRIVER_NODE,
                                            ListEntry.Link);
 
            /* If the next entry is back to the top, break out */
            if (NextEntry == DriverListHead) break;
 
            /* Otherwise, check if this entry is equal */
            if (!RtlEqualUnicodeString(&StartNode->Group,
                                       &CurrentNode->Group,
                                       TRUE))
            {
                /* It is, so we've detected a cycle, break out */
                break;
            }
        } while (NextEntry != DriverListHead);
 
        /* Now we have the correct start and end pointers, so do the sort */
        CmpOrderGroup(StartNode, EndNode);
    }
 
    /* We're done */
    return TRUE;
}

Referenced by CmGetSystemDriverList(), and WinLdrScanRegistry().

CmpSortDriverList()

BOOLEAN NTAPI CmpSortDriverList	(	_In_ PHHIVE	Hive,
		_In_ HCELL_INDEX	ControlSet,
		_Inout_ PLIST_ENTRY	DriverListHead
	)

Sorts the driver list, according to the drivers' group load ordering.

Parameters

[in]	Hive	The SYSTEM hive.
[in]	ControlSet	The control set registry key's hive cell.
[in,out]	DriverListHead	The driver list to sort.

Returns

TRUE if sorting has been successfully done, FALSE if not.

Definition at line 900 of file cmboot.c.

{
    PCM_KEY_NODE Node;
    PCM_KEY_VALUE ListValue;
    HCELL_INDEX ControlCell, GroupOrder, ListCell;
    UNICODE_STRING Name, OrderList;
    ULONG Length;
 
    /* Sanity check: We shouldn't need to release any acquired cells */
    ASSERT(Hive->ReleaseCellRoutine == NULL);
 
    /* Open the control key */
    Node = (PCM_KEY_NODE)HvGetCell(Hive, ControlSet);
    if (!Node) return FALSE;
    RtlInitUnicodeString(&Name, L"Control");
    ControlCell = CmpFindSubKeyByName(Hive, Node, &Name);
    if (ControlCell == HCELL_NIL) return FALSE;
 
    /* Open the service group order */
    Node = (PCM_KEY_NODE)HvGetCell(Hive, ControlCell);
    if (!Node) return FALSE;
    RtlInitUnicodeString(&Name, L"ServiceGroupOrder");
    GroupOrder = CmpFindSubKeyByName(Hive, Node, &Name);
    if (GroupOrder == HCELL_NIL) return FALSE;
 
    /* Open the list key */
    Node = (PCM_KEY_NODE)HvGetCell(Hive, GroupOrder);
    if (!Node) return FALSE;
    RtlInitUnicodeString(&Name, L"list");
    ListCell = CmpFindValueByName(Hive, Node, &Name);
    if (ListCell == HCELL_NIL) return FALSE;
 
    /* Read the actual list */
    ListValue = (PCM_KEY_VALUE)HvGetCell(Hive, ListCell);
    if (!ListValue) return FALSE;
    if (ListValue->Type != REG_MULTI_SZ) return FALSE;
 
    /* Copy it into a buffer */
    OrderList.Buffer = (PWCHAR)CmpValueToData(Hive, ListValue, &Length);
    if (!OrderList.Buffer) return FALSE;
    if (!IS_NULL_TERMINATED(OrderList.Buffer, Length)) return FALSE;
    OrderList.Length = (USHORT)Length - sizeof(UNICODE_NULL);
    OrderList.MaximumLength = OrderList.Length;
 
    /* And start the sort algorithm */
    return CmpDoSort(DriverListHead, &OrderList);
}

Referenced by CmGetSystemDriverList(), and WinLdrScanRegistry().