ReactOS 0.4.15-dev-7834-g00c4b3d
verifier.c File Reference
#include <ndk/rtlfuncs.h>
#include <reactos/verifier.h>
Include dependency graph for verifier.c:

Go to the source code of this file.

Macros

#define PROVIDER_PREFIX   "RVRF"
 

Functions

VOID NTAPI AVrfpDllLoadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
 
VOID NTAPI AVrfpDllUnloadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
 
VOID NTAPI AVrfpNtdllHeapFreeCallback (PVOID AllocationBase, SIZE_T AllocationSize)
 
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress (_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
 
FARPROC WINAPI AVrfpGetProcAddress (IN HMODULE hModule, IN LPCSTR lpProcName)
 
BOOL WINAPI DllMain (HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
 
PVOID AVrfpFindReplacementThunk (PVOID Proc)
 

Variables

static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks []
 
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks []
 
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors []
 
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
 

Macro Definition Documentation

◆ PROVIDER_PREFIX

#define PROVIDER_PREFIX   "RVRF"

Definition at line 14 of file verifier.c.

Function Documentation

◆ AVrfpDllLoadCallback()

VOID NTAPI AVrfpDllLoadCallback ( PWSTR  DllName,
PVOID  DllBase,
SIZE_T  DllSize,
PVOID  Reserved 
)

Definition at line 87 of file verifier.c.

88{
90 DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
91 /* TODO: Hook entrypoint */
92}
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
#define DbgPrint
Definition: hal.h:12
Definition: btrfs_drv.h:1876
PVOID EntryPoint
Definition: ntddk_ex.h:203
#define PROVIDER_PREFIX
Definition: verifier.c:14
_Reserved_ PVOID Reserved
Definition: winddi.h:3974

◆ AVrfpDllUnloadCallback()

VOID NTAPI AVrfpDllUnloadCallback ( PWSTR  DllName,
PVOID  DllBase,
SIZE_T  DllSize,
PVOID  Reserved 
)

Definition at line 95 of file verifier.c.

96{
97 DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
98}

◆ AVrfpFindReplacementThunk()

PVOID AVrfpFindReplacementThunk ( PVOID  Proc)

Definition at line 106 of file verifier.c.

107{
108 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
109 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
110
111 for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
112 {
113 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
114 {
115 if (ThunkDescriptor->ThunkOldAddress == Proc)
116 {
117 return ThunkDescriptor->ThunkNewAddress;
118 }
119 }
120 }
121 return Proc;
122}
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:47

Referenced by AVrfpGetProcAddress(), and AVrfpLdrGetProcedureAddress().

◆ AVrfpGetProcAddress()

FARPROC WINAPI AVrfpGetProcAddress ( IN HMODULE  hModule,
IN LPCSTR  lpProcName 
)

Definition at line 157 of file verifier.c.

158{
159 FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
160 FARPROC Proc, Replacement;
161
163 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
164
165 oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
166 Proc = oGetProcAddress(hModule, lpProcName);
167 if (!Proc)
168 return Proc;
169
170 Replacement = AVrfpFindReplacementThunk(Proc);
171 if (Replacement != Proc)
172 {
173 Proc = Replacement;
175 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
176 }
177
178 return Proc;
179}
HMODULE hModule
Definition: animate.c:44
int(* FARPROC)()
Definition: compat.h:36
#define IN
Definition: typedefs.h:39
#define RTL_VRF_DBG_VERIFIER_LOGCALLS
Definition: verifier.h:80
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:41
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:106
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:54
#define WINAPI
Definition: msvc.h:6
const char * LPCSTR
Definition: xmlstorage.h:183

◆ AVrfpLdrGetProcedureAddress()

NTSTATUS NTAPI AVrfpLdrGetProcedureAddress ( _In_ PVOID  BaseAddress,
_In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING  Name,
_In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG  Ordinal,
_Out_ PVOID ProcedureAddress 
)

Definition at line 126 of file verifier.c.

131{
132 NTSTATUS(NTAPI *oLdrGetProcedureAddress)(
135 _In_opt_ _When_(Name == NULL, _In_range_(>, 0)) ULONG Ordinal,
136 _Out_ PVOID *ProcedureAddress);
138 PVOID Replacement;
139
140 oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
141
142 Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
145
146 Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
147 if (Replacement != *ProcedureAddress)
148 {
149 *ProcedureAddress = Replacement;
151 DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
152 }
153
154 return Status;
155}
struct NameRec_ * Name
Definition: cdprocs.h:460
LONG NTSTATUS
Definition: precomp.h:26
return
Definition: dirsup.c:529
#define NULL
Definition: types.h:112
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define NTSTATUS
Definition: precomp.h:21
Status
Definition: gdiplustypes.h:25
if(dx< 0)
Definition: linetemp.h:194
#define _Notnull_
Definition: ms_sal.h:658
#define _Out_
Definition: ms_sal.h:345
#define _When_(expr, annos)
Definition: ms_sal.h:254
#define _In_
Definition: ms_sal.h:308
#define _In_opt_
Definition: ms_sal.h:309
#define _In_range_(lb, ub)
Definition: ms_sal.h:571
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define NTAPI
Definition: typedefs.h:36
uint32_t ULONG
Definition: typedefs.h:59
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:33

◆ AVrfpNtdllHeapFreeCallback()

VOID NTAPI AVrfpNtdllHeapFreeCallback ( PVOID  AllocationBase,
SIZE_T  AllocationSize 
)

Definition at line 100 of file verifier.c.

101{
102 DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
103 /* TODO: Sanity checks */
104}
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
Definition: fatprocs.h:322

◆ DllMain()

BOOL WINAPI DllMain ( HANDLE  hInstance,
DWORD  dwReason,
LPVOID  lpReserved 
)

Definition at line 71 of file verifier.c.

72{
73 switch (dwReason)
74 {
79 break;
82 break;
83 }
84 return TRUE;
85}
DWORD dwReason
Definition: misc.cpp:154
#define TRUE
Definition: types.h:120
#define DLL_THREAD_DETACH
Definition: compat.h:133
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define DLL_PROCESS_DETACH
Definition: compat.h:130
#define DLL_THREAD_ATTACH
Definition: compat.h:132
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4

Variable Documentation

◆ AVrfpDllDescriptors

RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
static
Initial value:
=
{
{ L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
{ L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
{ NULL }
}
#define L(x)
Definition: ntvdm.h:50

Definition at line 47 of file verifier.c.

Referenced by AVrfpFindReplacementThunk().

◆ AVrfpKernel32Thunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
static
Initial value:
=
{
{ "GetProcAddress", NULL, AVrfpGetProcAddress },
{ NULL }
}
FARPROC WINAPI AVrfpGetProcAddress(IN HMODULE hModule, IN LPCSTR lpProcName)
Definition: verifier.c:157

Definition at line 41 of file verifier.c.

Referenced by AVrfpGetProcAddress().

◆ AVrfpNtdllThunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
static
Initial value:
=
{
{ "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
{ NULL }
}
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
Definition: verifier.c:126

Definition at line 33 of file verifier.c.

Referenced by AVrfpLdrGetProcedureAddress().

◆ AVrfpProvider

Initial value:
=
{
sizeof(AVrfpProvider),
0,
0,
}
VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:95
VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:87
VOID NTAPI AVrfpNtdllHeapFreeCallback(PVOID AllocationBase, SIZE_T AllocationSize)
Definition: verifier.c:100

Definition at line 54 of file verifier.c.

Referenced by AVrfpGetProcAddress(), AVrfpLdrGetProcedureAddress(), and DllMain().