ReactOS 0.4.15-dev-7674-gc0b4db1
verifier.c
Go to the documentation of this file.
1/*
2 * PROJECT: Application verifier
3 * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
4 * PURPOSE: Main entrypoint
5 * COPYRIGHT: Copyright 2018 Mark Jansen (mark.jansen@reactos.org)
6 */
7
8#include <ndk/rtlfuncs.h>
9#include <reactos/verifier.h>
10
11#if 0
12#define PROVIDER_PREFIX "AVRF"
13#else
14#define PROVIDER_PREFIX "RVRF"
15#endif
16
17
18VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
21
22// DPFLTR_VERIFIER_ID
23
24
30 _In_opt_ _When_(Name == NULL, _In_range_(>, 0)) ULONG Ordinal,
31 _Out_ PVOID *ProcedureAddress);
32
34{
35 { "LdrGetProcedureAddress", NULL, AVrfpLdrGetProcedureAddress },
36 { NULL }
37};
38
40
42{
43 { "GetProcAddress", NULL, AVrfpGetProcAddress },
44 { NULL }
45};
46
48{
49 { L"ntdll.dll", 0, NULL, AVrfpNtdllThunks },
50 { L"kernel32.dll", 0, NULL, AVrfpKernel32Thunks },
51 { NULL }
52};
53
55{
56 /*.Length =*/ sizeof(AVrfpProvider),
57 /*.ProviderDlls =*/ AVrfpDllDescriptors,
58 /*.ProviderDllLoadCallback =*/ AVrfpDllLoadCallback,
59 /*.ProviderDllUnloadCallback =*/ AVrfpDllUnloadCallback,
60 /*.VerifierImage =*/ NULL,
61 /*.VerifierFlags =*/ 0,
62 /*.VerifierDebug =*/ 0,
63 /*.RtlpGetStackTraceAddress =*/ NULL,
64 /*.RtlpDebugPageHeapCreate =*/ NULL,
65 /*.RtlpDebugPageHeapDestroy =*/ NULL,
66 /*.ProviderNtdllHeapFreeCallback =*/ AVrfpNtdllHeapFreeCallback
67};
68
69
70
72{
73 switch (dwReason)
74 {
79 break;
82 break;
83 }
84 return TRUE;
85}
86
88{
90 DbgPrint(PROVIDER_PREFIX ": %ws @ %p: ep: %p\n", DllName, DllBase, LdrEntry->EntryPoint);
91 /* TODO: Hook entrypoint */
92}
93
94
96{
97 DbgPrint(PROVIDER_PREFIX ": unloading %ws\n", DllName);
98}
99
101{
102 DbgPrint(PROVIDER_PREFIX ": Heap free 0x%x @ %p\n", AllocationSize, AllocationBase);
103 /* TODO: Sanity checks */
104}
105
107{
108 PRTL_VERIFIER_DLL_DESCRIPTOR DllDescriptor;
109 PRTL_VERIFIER_THUNK_DESCRIPTOR ThunkDescriptor;
110
111 for (DllDescriptor = AVrfpDllDescriptors; DllDescriptor->DllName; ++DllDescriptor)
112 {
113 for (ThunkDescriptor = DllDescriptor->DllThunks; ThunkDescriptor->ThunkName; ++ThunkDescriptor)
114 {
115 if (ThunkDescriptor->ThunkOldAddress == Proc)
116 {
117 return ThunkDescriptor->ThunkNewAddress;
118 }
119 }
120 }
121 return Proc;
122}
123
124
129 _In_opt_ _When_(Name == NULL, _In_range_(>, 0)) ULONG Ordinal,
130 _Out_ PVOID *ProcedureAddress)
131{
132 NTSTATUS(NTAPI *oLdrGetProcedureAddress)(
135 _In_opt_ _When_(Name == NULL, _In_range_(>, 0)) ULONG Ordinal,
136 _Out_ PVOID *ProcedureAddress);
138 PVOID Replacement;
139
140 oLdrGetProcedureAddress = AVrfpNtdllThunks[0].ThunkOldAddress;
141
142 Status = oLdrGetProcedureAddress(BaseAddress, Name, Ordinal, ProcedureAddress);
143 if (!NT_SUCCESS(Status))
144 return Status;
145
146 Replacement = AVrfpFindReplacementThunk(*ProcedureAddress);
147 if (Replacement != *ProcedureAddress)
148 {
149 *ProcedureAddress = Replacement;
151 DbgPrint(PROVIDER_PREFIX ": AVrfpLdrGetProcedureAddress (%p, %Z) -> thunk address %p\n", BaseAddress, Name, *ProcedureAddress);
152 }
153
154 return Status;
155}
156
158{
159 FARPROC (WINAPI* oGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);
160 FARPROC Proc, Replacement;
161
163 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s)\n", hModule, lpProcName);
164
165 oGetProcAddress = AVrfpKernel32Thunks[0].ThunkOldAddress;
166 Proc = oGetProcAddress(hModule, lpProcName);
167 if (!Proc)
168 return Proc;
169
170 Replacement = AVrfpFindReplacementThunk(Proc);
171 if (Replacement != Proc)
172 {
173 Proc = Replacement;
175 DbgPrint(PROVIDER_PREFIX ": AVrfpGetProcAddress (%p, %s) -> thunk address %p\n", hModule, lpProcName, Proc);
176 }
177
178 return Proc;
179}
180
struct NameRec_ * Name
Definition: cdprocs.h:460
LONG NTSTATUS
Definition: precomp.h:26
DWORD dwReason
Definition: misc.cpp:154
struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY
HINSTANCE hInstance
Definition: charmap.c:19
#define NULL
Definition: types.h:112
#define TRUE
Definition: types.h:120
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
#define NTSTATUS
Definition: precomp.h:21
HMODULE hModule
Definition: animate.c:44
#define DLL_THREAD_DETACH
Definition: compat.h:133
#define DLL_PROCESS_ATTACH
Definition: compat.h:131
#define DLL_PROCESS_DETACH
Definition: compat.h:130
int(* FARPROC)()
Definition: compat.h:36
#define DLL_THREAD_ATTACH
Definition: compat.h:132
IN PFCB IN PFILE_OBJECT FileObject IN ULONG AllocationSize
Definition: fatprocs.h:322
unsigned int BOOL
Definition: ntddk_ex.h:94
unsigned long DWORD
Definition: ntddk_ex.h:95
Status
Definition: gdiplustypes.h:25
#define DbgPrint
Definition: hal.h:12
#define _Notnull_
Definition: ms_sal.h:658
#define _Out_
Definition: ms_sal.h:345
#define _When_(expr, annos)
Definition: ms_sal.h:254
#define _In_
Definition: ms_sal.h:308
#define _In_opt_
Definition: ms_sal.h:309
#define _In_range_(lb, ub)
Definition: ms_sal.h:571
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
Definition: mmfuncs.h:404
#define L(x)
Definition: ntvdm.h:50
Definition: btrfs_drv.h:1876
PVOID EntryPoint
Definition: ntddk_ex.h:203
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks
Definition: verifier.h:20
uint16_t * PWSTR
Definition: typedefs.h:56
#define NTAPI
Definition: typedefs.h:36
ULONG_PTR SIZE_T
Definition: typedefs.h:80
#define IN
Definition: typedefs.h:39
uint32_t ULONG
Definition: typedefs.h:59
#define DLL_PROCESS_VERIFIER
Definition: verifier.h:4
#define RTL_VRF_DBG_VERIFIER_LOGCALLS
Definition: verifier.h:80
#define RTL_VRF_DBG_VERIFIER_SHOWDYNTHUNKS
Definition: verifier.h:81
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpKernel32Thunks[]
Definition: verifier.c:41
VOID NTAPI AVrfpDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:95
VOID NTAPI AVrfpDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
Definition: verifier.c:87
NTSTATUS NTAPI AVrfpLdrGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
Definition: verifier.c:126
static RTL_VERIFIER_DLL_DESCRIPTOR AVrfpDllDescriptors[]
Definition: verifier.c:47
VOID NTAPI AVrfpNtdllHeapFreeCallback(PVOID AllocationBase, SIZE_T AllocationSize)
Definition: verifier.c:100
FARPROC WINAPI AVrfpGetProcAddress(IN HMODULE hModule, IN LPCSTR lpProcName)
Definition: verifier.c:157
static RTL_VERIFIER_THUNK_DESCRIPTOR AVrfpNtdllThunks[]
Definition: verifier.c:33
PVOID AVrfpFindReplacementThunk(PVOID Proc)
Definition: verifier.c:106
#define PROVIDER_PREFIX
Definition: verifier.c:14
BOOL WINAPI DllMain(HANDLE hInstance, DWORD dwReason, LPVOID lpReserved)
Definition: verifier.c:71
RTL_VERIFIER_PROVIDER_DESCRIPTOR AVrfpProvider
Definition: verifier.c:54
_Reserved_ PVOID Reserved
Definition: winddi.h:3974
#define WINAPI
Definition: msvc.h:6
const char * LPCSTR
Definition: xmlstorage.h:183