ReactOS  0.4.13-dev-99-g7e18b6d
verifier.c
Go to the documentation of this file.
1 /*
2  * PROJECT: Application verifier
3  * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
4  * PURPOSE: Main entrypoint
5  * COPYRIGHT: Copyright 2018 Mark Jansen (mark.jansen@reactos.org)
6  */
7 
8 #include <ndk/rtlfuncs.h>
9 #include <reactos/verifier.h>
10 
11 #if 0
12 #define PROVIDER_PREFIX "AVRF"
13 #else
14 #define PROVIDER_PREFIX "RVRF"
15 #endif
16 
17 
18 VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
19 VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
21 
22 // DPFLTR_VERIFIER_ID
23 
24 
26 
28 {
29  { "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
30  { NULL }
31 };
32 
34 
36 {
37  { "GetProcAddress", NULL, AVrfpGetProcAddress },
38  { NULL }
39 };
40 
42 {
43  { L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
44  { L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
45  { NULL }
46 };
47 
49 {
50  /*.Length =*/ sizeof(AVrfpProvider),
51  /*.ProviderDlls =*/ AVrfpDllDescriptors,
52  /*.ProviderDllLoadCallback =*/ AVrfpDllLoadCallback,
53  /*.ProviderDllUnloadCallback =*/ AVrfpDllUnloadCallback,
54  /*.VerifierImage =*/ NULL,
55  /*.VerifierFlags =*/ 0,
56  /*.VerifierDebug =*/ 0,
57  /*.RtlpGetStackTraceAddress =*/ NULL,
58  /*.RtlpDebugPageHeapCreate =*/ NULL,
59  /*.RtlpDebugPageHeapDestroy =*/ NULL,
60  /*.ProviderNtdllHeapFreeCallback =*/ AVrfpNtdllHeapFreeCallback
61 };
62 
63 
64 
66 {
67  switch (dwReason)
68  {
69  case DLL_PROCESS_ATTACH:
70  case DLL_PROCESS_DETACH:
71  case DLL_THREAD_ATTACH:
72  case DLL_THREAD_DETACH:
73  break;
76  break;
77  }
78  return TRUE;
79 }
80 
82 {
84  DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
85  /* TODO: Hook entrypoint */
86 }
87 
88 
90 {
91  DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
92 }
93 
95 {
96  DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
97  /* TODO: Sanity checks */
98 }
99 
101 {
102  PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
103  PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
104 
105  for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
106  {
107  for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
108  {
109  if (ThunkDescriptor->ThunkOldAddress == Proc)
110  {
111  return ThunkDescriptor->ThunkNewAddress;
112  }
113  }
114  }
115  return Proc;
116 }
117 
118 
120 {
121  NTSTATUS (NTAPI *oLdrGetProcedureAddress)(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress);
123  PVOID Replacement;
124 
125  oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
126 
127  Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
128  if (!NT_SUCCESS(Status))
129  return Status;
130 
131  Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
132  if (Replacement != *ProcedureAddress)
133  {
134  *ProcedureAddress = Replacement;
136  DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
137  }
138 
139  return Status;
140 }
141 
143 {
144  FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
145  FARPROC Proc, Replacement;
146 
148  DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
149 
150  oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
151  Proc = oGetProcAddress(hModule, lpProcName);
152  if (!Proc)
153  return Proc;
154 
155  Replacement = AVrfpFindReplacementThunk(Proc);
156  if (Replacement != Proc)
157  {
158  Proc = Replacement;
160  DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
161  }
162 
163  return Proc;
164 }
165 
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
#define IN
Definition: typedefs.h:38
BOOL WINAPI DllMain(HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
Definition: verifier.c:65
#define TRUE
Definition: types.h:120
#define DbgPrint
Definition: loader.c:25
#define DLL_THREAD_ATTACH
Definition: compat.h:121
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:27
uint16_t * PWSTR
Definition: typedefs.h:54
LONG NTSTATUS
Definition: precomp.h:26
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:35
#define DLL_PROCESS_ATTACH
Definition: compat.h:120
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
FARPROC WINAPI AVrfpGetProcAddress(IN HMODULE hModule, IN LPCSTR lpProcName)
Definition: verifier.c:142
#define DLL_THREAD_DETACH
Definition: compat.h:122
DWORD dwReason
Definition: misc.cpp:154
#define PROVIDER_PREFIX
Definition: verifier.c:14
HINSTANCE hInstance
Definition: charmap.c:20
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
Definition: IoEaTest.cpp:117
unsigned int BOOL
Definition: ntddk_ex.h:94
PVOID EntryPoint
Definition: ntddk_ex.h:203
struct NameRec_ * Name
Definition: cdprocs.h:464
smooth NULL
Definition: ftsmooth.c:416
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:41
_Reserved_ PVOID Reserved
Definition: winddi.h:3974
const char * LPCSTR
Definition: xmlstorage.h:183
#define DLL_PROCESS_DETACH
Definition: compat.h:119
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define RTL_VRF_DBG_VERIFIER_LOGCALLS
Definition: verifier.h:80
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define WINAPI
Definition: msvc.h:8
unsigned long DWORD
Definition: ntddk_ex.h:95
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:100
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:89
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:48
static const WCHAR L[]
Definition: oid.c:1250
#define NTSTATUS
Definition: precomp.h:20
Definition: btrfs_drv.h:1801
VOID NTAPI AVrfpNtdllHeapFreeCallback(PVOID AllocationBase, SIZE_T AllocationSize)
Definition: verifier.c:94
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
Definition: verifier.c:119
Status
Definition: gdiplustypes.h:24
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
Definition: fatprocs.h:310
ULONG_PTR SIZE_T
Definition: typedefs.h:78
VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:81
#define OUT
Definition: typedefs.h:39
unsigned int ULONG
Definition: retypes.h:1
int(* FARPROC)()
Definition: compat.h:28
HMODULE hModule
Definition: animate.c:44