ReactOS 0.4.15-dev-6694-g4ba8af9
verifier.c
Go to the documentation of this file.
1/*
2 * PROJECT: Application verifier
3 * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
4 * PURPOSE: Main entrypoint
5 * COPYRIGHT: Copyright 2018 Mark Jansen (mark.jansen@reactos.org)
6 */
7
8#include <ndk/rtlfuncs.h>
9#include <reactos/verifier.h>
10
11#if 0
12#define PROVIDER_PREFIX "AVRF"
13#else
14#define PROVIDER_PREFIX "RVRF"
15#endif
16
17
18VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
21
22// DPFLTR_VERIFIER_ID
23
24
26
28{
29 { "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
30 { NULL }
31};
32
34
36{
37 { "GetProcAddress", NULL, AVrfpGetProcAddress },
38 { NULL }
39};
40
42{
43 { L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
44 { L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
45 { NULL }
46};
47
49{
50 /*.Length =*/ sizeof(AVrfpProvider),
51 /*.ProviderDlls =*/ AVrfpDllDescriptors,
52 /*.ProviderDllLoadCallback =*/ AVrfpDllLoadCallback,
53 /*.ProviderDllUnloadCallback =*/ AVrfpDllUnloadCallback,
54 /*.VerifierImage =*/ NULL,
55 /*.VerifierFlags =*/ 0,
56 /*.VerifierDebug =*/ 0,
57 /*.RtlpGetStackTraceAddress =*/ NULL,
58 /*.RtlpDebugPageHeapCreate =*/ NULL,
59 /*.RtlpDebugPageHeapDestroy =*/ NULL,
60 /*.ProviderNtdllHeapFreeCallback =*/ AVrfpNtdllHeapFreeCallback
61};
62
63
64
66{
67 switch (dwReason)
68 {
73 break;
76 break;
77 }
78 return TRUE;
79}
80
82{
84 DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
85 /* TODO: Hook entrypoint */
86}
87
88
90{
91 DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
92}
93
95{
96 DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
97 /* TODO: Sanity checks */
98}
99
101{
102 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
103 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
104
105 for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
106 {
107 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
108 {
109 if (ThunkDescriptor->ThunkOldAddress == Proc)
110 {
111 return ThunkDescriptor->ThunkNewAddress;
112 }
113 }
114 }
115 return Proc;
116}
117
118
120{
121 NTSTATUS (NTAPI *oLdrGetProcedureAddress)(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress);
123 PVOID Replacement;
124
125 oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
126
127 Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
128 if (!NT_SUCCESS(Status))
129 return Status;
130
131 Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
132 if (Replacement != *ProcedureAddress)
133 {
134 *ProcedureAddress = Replacement;
136 DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
137 }
138
139 return Status;
140}
141
143{
144 FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
145 FARPROC Proc, Replacement;
146
148 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
149
150 oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
151 Proc = oGetProcAddress(hModule, lpProcName);
152 if (!Proc)
153 return Proc;
154
155 Replacement = AVrfpFindReplacementThunk(Proc);
156 if (Replacement != Proc)
157 {
158 Proc = Replacement;
160 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
161 }
162
163 return Proc;
164}
165
struct NameRec_ * Name
Definition: cdprocs.h:460
LONG NTSTATUS
Definition: precomp.h:26
DWORD dwReason
Definition: misc.cpp:154
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
HINSTANCE hInstance
Definition: charmap.c:19
#define NULL
Definition: types.h:112
#define TRUE
Definition: types.h:120
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define NTSTATUS
Definition: precomp.h:21
HMODULE hModule
Definition: animate.c:44
#define DLL_THREAD_DETACH
Definition: compat.h:133
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define DLL_PROCESS_DETACH
Definition: compat.h:130
int(* FARPROC)()
Definition: compat.h:36
#define DLL_THREAD_ATTACH
Definition: compat.h:132
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
Definition: fatprocs.h:322
unsigned int BOOL
Definition: ntddk_ex.h:94
unsigned long DWORD
Definition: ntddk_ex.h:95
Status
Definition: gdiplustypes.h:25
#define DbgPrint
Definition: hal.h:12
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define L(x)
Definition: ntvdm.h:50
Definition: btrfs_drv.h:1876
PVOID EntryPoint
Definition: ntddk_ex.h:203
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
uint16_t * PWSTR
Definition: typedefs.h:56
#define NTAPI
Definition: typedefs.h:36
ULONG_PTR SIZE_T
Definition: typedefs.h:80
#define IN
Definition: typedefs.h:39
uint32_t ULONG
Definition: typedefs.h:59
#define OUT
Definition: typedefs.h:40
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
#define RTL_VRF_DBG_VERIFIER_LOGCALLS
Definition: verifier.h:80
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:35
VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:89
VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:81
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:41
VOID NTAPI AVrfpNtdllHeapFreeCallback(PVOID AllocationBase, SIZE_T AllocationSize)
Definition: verifier.c:94
FARPROC WINAPI AVrfpGetProcAddress(IN HMODULE hModule, IN LPCSTR lpProcName)
Definition: verifier.c:142
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
Definition: verifier.c:119
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:27
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:100
#define PROVIDER_PREFIX
Definition: verifier.c:14
BOOL WINAPI DllMain(HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
Definition: verifier.c:65
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48
_Reserved_ PVOID Reserved
Definition: winddi.h:3974
#define WINAPI
Definition: msvc.h:6
const char * LPCSTR
Definition: xmlstorage.h:183