verifier.c File Reference

#include <ndk/rtlfuncs.h>
#include <reactos/verifier.h>

Include dependency graph for verifier.c:

Go to the source code of this file.

Macros
#define	PROVIDER_PREFIX   "RVRF"

Functions
VOID NTAPI	AVrfpDllLoadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
VOID NTAPI	AVrfpDllUnloadCallback (PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
VOID NTAPI	AVrfpNtdllHeapFreeCallback (PVOID AllocationBase, SIZE_T AllocationSize)
NTSTATUS NTAPI	AVrfpLdrGetProcedureAddress (_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
FARPROC WINAPI	AVrfpGetProcAddress (IN HMODULE hModule, IN LPCSTR lpProcName)
BOOL WINAPI	DllMain (HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
PVOID	AVrfpFindReplacementThunk (PVOID Proc)

Variables
static RTL_VERIFIER_THUNK_DESCRIPTOR	AVrfpNtdllThunks []
static RTL_VERIFIER_THUNK_DESCRIPTOR	AVrfpKernel32Thunks []
static RTL_VERIFIER_DLL_DESCRIPTOR	AVrfpDllDescriptors []
RTL_VERIFIER_PROVIDER_DESCRIPTOR	AVrfpProvider

Macro Definition Documentation

PROVIDER_PREFIX

#define PROVIDER_PREFIX   "RVRF"

Definition at line 14 of file verifier.c.

Function Documentation

AVrfpDllLoadCallback()

VOID NTAPI AVrfpDllLoadCallback	(	PWSTR	DllName,
		PVOID	DllBase,
		SIZE_T	DllSize,
		PVOID	Reserved
	)

Definition at line 87 of file verifier.c.

{
    PLDR_DATA_TABLE_ENTRY LdrEntry = (PLDR_DATA_TABLE_ENTRY)Reserved;
    DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
    /* TODO: Hook entrypoint */
}

AVrfpDllUnloadCallback()

VOID NTAPI AVrfpDllUnloadCallback	(	PWSTR	DllName,
		PVOID	DllBase,
		SIZE_T	DllSize,
		PVOID	Reserved
	)

Definition at line 95 of file verifier.c.

{
    DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
}

AVrfpFindReplacementThunk()

PVOID AVrfpFindReplacementThunk

(

PVOID

Proc

)

Definition at line 106 of file verifier.c.

{
    PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
    PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
 
    for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
    {
        for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
        {
            if (ThunkDescriptor->ThunkOldAddress == Proc)
            {
                return ThunkDescriptor->ThunkNewAddress;
            }
        }
    }
    return Proc;
}

Referenced by AVrfpGetProcAddress(), and AVrfpLdrGetProcedureAddress().

AVrfpGetProcAddress()

FARPROC WINAPI AVrfpGetProcAddress	(	IN HMODULE	hModule,
		IN LPCSTR	lpProcName
	)

Definition at line 157 of file verifier.c.

{
    FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
    FARPROC Proc, Replacement;
 
    if (AVrfpProvider.VerifierDebug & RTL_VRF_DBG_VERIFIER_LOGCALLS)
        DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
 
    oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
    Proc = oGetProcAddress(hModule, lpProcName);
    if (!Proc)
        return Proc;
 
    Replacement = AVrfpFindReplacementThunk(Proc);
    if (Replacement != Proc)
    {
        Proc = Replacement;
        if (AVrfpProvider.VerifierDebug & RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS)
            DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
    }
 
    return Proc;
}

AVrfpLdrGetProcedureAddress()

NTSTATUS NTAPI AVrfpLdrGetProcedureAddress	(	_In_ PVOID	BaseAddress,
		_In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING	Name,
		_In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG	Ordinal,
		_Out_ PVOID *	ProcedureAddress
	)

Definition at line 126 of file verifier.c.

{
    NTSTATUS(NTAPI *oLdrGetProcedureAddress)(
        _In_ PVOID BaseAddress,
        _In_opt_ _When_(Ordinal == 0, _Notnull_) PANSI_STRING Name,
        _In_opt_ _When_(Name == NULL, _In_range_(>, 0)) ULONG Ordinal,
        _Out_ PVOID *ProcedureAddress);
    NTSTATUS Status;
    PVOID Replacement;
 
    oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
 
    Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
    if (Replacement != *ProcedureAddress)
    {
        *ProcedureAddress = Replacement;
        if (AVrfpProvider.VerifierDebug & RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS)
            DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
    }
 
    return Status;
}

AVrfpNtdllHeapFreeCallback()

VOID NTAPI AVrfpNtdllHeapFreeCallback	(	PVOID	AllocationBase,
		SIZE_T	AllocationSize
	)

Definition at line 100 of file verifier.c.

{
    DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
    /* TODO: Sanity checks */
}

DllMain()

BOOL WINAPI DllMain	(	HANDLE	hInstance,
		DWORD	dwReason,
		LPVOID	lpReserved
	)

Definition at line 71 of file verifier.c.

{
    switch (dwReason)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    case DLL_PROCESS_VERIFIER:
        *(PRTL_VERIFIER_PROVIDER_DESCRIPTOR*)lpReserved = &AVrfpProvider;
        break;
    }
    return TRUE;
}

Variable Documentation

AVrfpDllDescriptors

RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]

static

Initial value:

=
{
    { L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
    { L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
    { NULL }
}

Definition at line 47 of file verifier.c.

Referenced by AVrfpFindReplacementThunk().

AVrfpKernel32Thunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]

static

Initial value:

=
{
    { "GetProcAddress", NULL, AVrfpGetProcAddress },
    { NULL }
}

Definition at line 41 of file verifier.c.

Referenced by AVrfpGetProcAddress().

AVrfpNtdllThunks

RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]

static

Initial value:

=
{
    { "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
    { NULL }
}

Definition at line 33 of file verifier.c.

Referenced by AVrfpLdrGetProcedureAddress().

AVrfpProvider

RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider

Initial value:

=
{
     sizeof(AVrfpProvider),
     AVrfpDllDescriptors,
     AVrfpDllLoadCallback,
     AVrfpDllUnloadCallback,
     NULL,
     0,
     0,
     NULL,
     NULL,
     NULL,
     AVrfpNtdllHeapFreeCallback
}

Definition at line 54 of file verifier.c.

Referenced by AVrfpGetProcAddress(), AVrfpLdrGetProcedureAddress(), and DllMain().