ReactOS  0.4.15-dev-2956-g61e7ea5
verifier.c File Reference
#include <ndk/rtlfuncs.h>
#include <reactos/verifier.h>
Include dependency graph for verifier.c:

Go to the source code of this file.

Macros

#define PROVIDER_PREFIX   "RVRF"
 

Functions

VOID NTAPI AVrfpDllLoadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
 
VOID NTAPI AVrfpDllUnloadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
 
VOID NTAPI AVrfpNtdllHeapFreeCallback (PVOID AllocationBase, SIZE_T AllocationSize)
 
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress (IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
 
FARPROC WINAPI AVrfpGetProcAddress (IN HMODULE hModule, IN LPCSTR lpProcName)
 
BOOL WINAPI DllMain (HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
 
PVOID AVrfpFindReplacementThunk (PVOID Proc)
 

Variables

static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks []
 
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks []
 
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors []
 
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
 

Macro Definition Documentation

◆ PROVIDER_PREFIX

#define PROVIDER_PREFIX   "RVRF"

Definition at line 14 of file verifier.c.

Function Documentation

◆ AVrfpDllLoadCallback()

VOID NTAPI AVrfpDllLoadCallback ( PWSTR  DllName,
PVOID  DllBase,
SIZE_T  DllSize,
PVOID  Reserved 
)

Definition at line 81 of file verifier.c.

82 {
84  DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
85  /* TODO: Hook entrypoint */
86 }
#define DbgPrint
Definition: loader.c:25
#define PROVIDER_PREFIX
Definition: verifier.c:14
PVOID EntryPoint
Definition: ntddk_ex.h:203
_Reserved_ PVOID Reserved
Definition: winddi.h:3974
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
Definition: btrfs_drv.h:1922

◆ AVrfpDllUnloadCallback()

VOID NTAPI AVrfpDllUnloadCallback ( PWSTR  DllName,
PVOID  DllBase,
SIZE_T  DllSize,
PVOID  Reserved 
)

Definition at line 89 of file verifier.c.

90 {
91  DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
92 }
#define DbgPrint
Definition: loader.c:25
#define PROVIDER_PREFIX
Definition: verifier.c:14

◆ AVrfpFindReplacementThunk()

PVOID AVrfpFindReplacementThunk ( PVOID  Proc)

Definition at line 100 of file verifier.c.

101 {
102  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
103  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
104 
105  for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
106  {
107  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
108  {
109  if (ThunkDescriptor->ThunkOldAddress == Proc)
110  {
111  return ThunkDescriptor->ThunkNewAddress;
112  }
113  }
114  }
115  return Proc;
116 }
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:41

Referenced by AVrfpGetProcAddress(), and AVrfpLdrGetProcedureAddress().

◆ AVrfpGetProcAddress()

FARPROC WINAPI AVrfpGetProcAddress ( IN HMODULE  hModule,
IN LPCSTR  lpProcName 
)

Definition at line 142 of file verifier.c.

143 {
144  FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
145  FARPROC Proc, Replacement;
146 
148  DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
149 
150  oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
151  Proc = oGetProcAddress(hModule, lpProcName);
152  if (!Proc)
153  return Proc;
154 
155  Replacement = AVrfpFindReplacementThunk(Proc);
156  if (Replacement != Proc)
157  {
158  Proc = Replacement;
160  DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
161  }
162 
163  return Proc;
164 }
#define IN
Definition: typedefs.h:39
#define DbgPrint
Definition: loader.c:25
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:35
#define PROVIDER_PREFIX
Definition: verifier.c:14
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
const char * LPCSTR
Definition: xmlstorage.h:183
#define RTL_VRF_DBG_VERIFIER_LOGCALLS
Definition: verifier.h:80
#define WINAPI
Definition: msvc.h:6
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:100
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48
int(* FARPROC)()
Definition: compat.h:36
HMODULE hModule
Definition: animate.c:44

◆ AVrfpLdrGetProcedureAddress()

NTSTATUS NTAPI AVrfpLdrGetProcedureAddress ( IN PVOID  BaseAddress,
IN PANSI_STRING  Name,
IN ULONG  Ordinal,
OUT PVOID ProcedureAddress 
)

Definition at line 119 of file verifier.c.

120 {
121  NTSTATUS (NTAPI *oLdrGetProcedureAddress)(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress);
123  PVOID Replacement;
124 
125  oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
126 
127  Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
128  if (!NT_SUCCESS(Status))
129  return Status;
130 
131  Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
132  if (Replacement != *ProcedureAddress)
133  {
134  *ProcedureAddress = Replacement;
136  DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
137  }
138 
139  return Status;
140 }
#define IN
Definition: typedefs.h:39
#define DbgPrint
Definition: loader.c:25
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:27
LONG NTSTATUS
Definition: precomp.h:26
#define PROVIDER_PREFIX
Definition: verifier.c:14
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
Definition: IoEaTest.cpp:117
struct NameRec_ * Name
Definition: cdprocs.h:459
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
Status
Definition: gdiplustypes.h:24
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:100
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48
#define NTSTATUS
Definition: precomp.h:20
#define OUT
Definition: typedefs.h:40
unsigned int ULONG
Definition: retypes.h:1

◆ AVrfpNtdllHeapFreeCallback()

VOID NTAPI AVrfpNtdllHeapFreeCallback ( PVOID  AllocationBase,
SIZE_T  AllocationSize 
)

Definition at line 94 of file verifier.c.

95 {
96  DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
97  /* TODO: Sanity checks */
98 }
#define DbgPrint
Definition: loader.c:25
#define PROVIDER_PREFIX
Definition: verifier.c:14
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
Definition: fatprocs.h:319

◆ DllMain()

BOOL WINAPI DllMain ( HANDLE  hInstance,
DWORD  dwReason,
LPVOID  lpReserved 
)

Definition at line 65 of file verifier.c.

66 {
67  switch (dwReason)
68  {
69  case DLL_PROCESS_ATTACH:
70  case DLL_PROCESS_DETACH:
71  case DLL_THREAD_ATTACH:
72  case DLL_THREAD_DETACH:
73  break;
76  break;
77  }
78  return TRUE;
79 }
#define TRUE
Definition: types.h:120
#define DLL_THREAD_ATTACH
Definition: compat.h:132
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
#define DLL_THREAD_DETACH
Definition: compat.h:133
DWORD dwReason
Definition: misc.cpp:154
#define DLL_PROCESS_DETACH
Definition: compat.h:130
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48

Variable Documentation

◆ AVrfpDllDescriptors

RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
static
Initial value:
=
{
{ L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
{ L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
{ NULL }
}
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:27
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:35
static const WCHAR L[]
Definition: oid.c:1250
#define NULL
Definition: types.h:112

Definition at line 41 of file verifier.c.

Referenced by AVrfpFindReplacementThunk().

◆ AVrfpKernel32Thunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
static
Initial value:
=
{
{ "GetProcAddress", NULL, AVrfpGetProcAddress },
{ NULL }
}
FARPROC WINAPI AVrfpGetProcAddress(IN HMODULE hModule, IN LPCSTR lpProcName)
Definition: verifier.c:142
#define NULL
Definition: types.h:112

Definition at line 35 of file verifier.c.

Referenced by AVrfpGetProcAddress().

◆ AVrfpNtdllThunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
static
Initial value:
=
{
{ "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
{ NULL }
}
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
Definition: verifier.c:119
#define NULL
Definition: types.h:112

Definition at line 27 of file verifier.c.

Referenced by AVrfpLdrGetProcedureAddress().

◆ AVrfpProvider

Initial value:
=
{
sizeof(AVrfpProvider),
0,
0,
}
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:41
VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:89
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48
VOID NTAPI AVrfpNtdllHeapFreeCallback(PVOID AllocationBase, SIZE_T AllocationSize)
Definition: verifier.c:94
VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:81
#define NULL
Definition: types.h:112

Definition at line 48 of file verifier.c.

Referenced by AVrfpGetProcAddress(), AVrfpLdrGetProcedureAddress(), and DllMain().