shimdbg.c File Reference

#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <ntndk.h>

Include dependency graph for shimdbg.c:

Go to the source code of this file.

Classes
struct	tagATTRINFO

Macros
#define	DPFLTR_ERROR_LEVEL   0
#define	TAG_TYPE_MASK   0xF000
#define	TAG_TYPE_DWORD   0x4000
#define	TAG_TYPE_QWORD   0x5000
#define	TAG_TYPE_STRINGREF   0x6000
#define	ATTRIBUTE_AVAILABLE   0x1
#define	ATTRIBUTE_FAILED   0x2
#define	REG_BINARY   ( 3 )

Typedefs
typedef WORD	TAG
typedef UINT64	QWORD
typedef struct tagATTRINFO	ATTRINFO
typedef struct tagATTRINFO *	PATTRINFO

Functions
NTSYSAPI ULONG NTAPI	vDbgPrintEx (_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ PCCH Format, _In_ va_list ap)
void	xprintf (const char *fmt,...)
void	CallApphelp (APPHELPCACHESERVICECLASS Service, PAPPHELP_CACHE_SERVICE_LOOKUP CacheEntry)
HANDLE	MapFile (char *filename, UNICODE_STRING *PathName, int MapIt)
void	CallApphelpWithImage (char *filename, int MapIt, APPHELPCACHESERVICECLASS Service, char *ServiceName)
int	IsOpt (char *argv, const char *check)
int	HandleImageArg (int argc, char *argv[], int *pn, char MapItChar, APPHELPCACHESERVICECLASS Service, char *ServiceName)
static	LPCWSTR (WINAPI *pSdbTagToString)(TAG)
static	BOOL (WINAPI *pSdbGetFileAttributes)(LPCWSTR
static BOOL	InitApphelp ()
int	HandleDumpAttributes (int argc, char *argv[], int *pn, const char *opt)
void	hexdump (unsigned char *p, unsigned int len)
void	DumpRegistryData (int IncludeDump)
int	_getch ()
int	main (int argc, char *argv[])

Variables
static PVOID	hdll
static PATTRINFO	LPDWORD
UNICODE_STRING	AppCompatCacheKey = RTL_CONSTANT_STRING(L"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache")
OBJECT_ATTRIBUTES	AppCompatKeyAttributes = RTL_CONSTANT_OBJECT_ATTRIBUTES(&AppCompatCacheKey, OBJ_CASE_INSENSITIVE)
UNICODE_STRING	AppCompatCacheValue = RTL_CONSTANT_STRING(L"AppCompatCache")

Macro Definition Documentation

ATTRIBUTE_AVAILABLE

#define ATTRIBUTE_AVAILABLE   0x1

Definition at line 111 of file shimdbg.c.

ATTRIBUTE_FAILED

#define ATTRIBUTE_FAILED   0x2

Definition at line 112 of file shimdbg.c.

DPFLTR_ERROR_LEVEL

#define DPFLTR_ERROR_LEVEL   0

Definition at line 14 of file shimdbg.c.

REG_BINARY

#define REG_BINARY   ( 3 )

Definition at line 230 of file shimdbg.c.

TAG_TYPE_DWORD

#define TAG_TYPE_DWORD   0x4000

Definition at line 107 of file shimdbg.c.

TAG_TYPE_MASK

#define TAG_TYPE_MASK   0xF000

Definition at line 106 of file shimdbg.c.

TAG_TYPE_QWORD

#define TAG_TYPE_QWORD   0x5000

Definition at line 108 of file shimdbg.c.

TAG_TYPE_STRINGREF

#define TAG_TYPE_STRINGREF   0x6000

Definition at line 109 of file shimdbg.c.

Typedef Documentation

ATTRINFO

typedef struct tagATTRINFO ATTRINFO

PATTRINFO

typedef struct tagATTRINFO * PATTRINFO

QWORD

static QWORD

Definition at line 104 of file shimdbg.c.

TAG

typedef WORD TAG

Definition at line 103 of file shimdbg.c.

Function Documentation

_getch()

int _getch

(

)

Definition at line 16 of file getch.c.

{
    DWORD NumberOfCharsRead = 0;
    char c;
    HANDLE ConsoleHandle;
    BOOL RestoreMode;
    DWORD ConsoleMode;
 
    if (char_avail) {
        c = ungot_char;
        char_avail = 0;
    } else {
        /*
         * _getch() is documented to NOT echo characters. Testing shows it
         * doesn't wait for a CR either. So we need to switch off
         * ENABLE_ECHO_INPUT and ENABLE_LINE_INPUT if they're currently
         * switched on.
         */
        ConsoleHandle = (HANDLE) _get_osfhandle(stdin->_file);
        RestoreMode = GetConsoleMode(ConsoleHandle, &ConsoleMode) &&
                      (0 != (ConsoleMode &
                             (ENABLE_ECHO_INPUT | ENABLE_LINE_INPUT)));
        if (RestoreMode) {
            SetConsoleMode(ConsoleHandle,
                           ConsoleMode & (~ (ENABLE_ECHO_INPUT | ENABLE_LINE_INPUT)));
        }
        ReadConsoleA((HANDLE)_get_osfhandle(stdin->_file),
                     &c,
                     1,
                     &NumberOfCharsRead,
                     NULL);
        if (RestoreMode) {
            SetConsoleMode(ConsoleHandle, ConsoleMode);
        }
    }
    if (c == 10)
        c = 13;
    return c;
}

Referenced by _cgets(), _getche(), _tmain(), abort(), DumpFont(), GetPass(), gl_getc(), gl_getcx(), gl_getpass(), main(), MainUsage(), PrintHelp(), ShowAppList(), TestEventsGeneration(), Wait(), and wmain().

BOOL()

static BOOL ( WINAPI *  pSdbGetFileAttributes )

static

CallApphelp()

void CallApphelp	(	APPHELPCACHESERVICECLASS	Service,
		PAPPHELP_CACHE_SERVICE_LOOKUP	CacheEntry
	)

Definition at line 27 of file shimdbg.c.

{
    NTSTATUS Status = NtApphelpCacheControl(Service, CacheEntry);
    xprintf("NtApphelpCacheControl returned 0x%x\n", (unsigned int)Status);
}

Referenced by CallApphelpWithImage(), and main().

CallApphelpWithImage()

void CallApphelpWithImage	(	char *	filename,
		int	MapIt,
		APPHELPCACHESERVICECLASS	Service,
		char *	ServiceName
	)

Definition at line 59 of file shimdbg.c.

{
    UNICODE_STRING PathName = {0};
    APPHELP_CACHE_SERVICE_LOOKUP CacheEntry;
 
    HANDLE FileHandle = MapFile(filename, &PathName, MapIt);
 
    xprintf("Calling %s %s mapping\n", ServiceName, (MapIt ? "with" : "without"));
 
    RtlInitUnicodeString(&CacheEntry.ImageName, PathName.Buffer);
    CacheEntry.ImageHandle = FileHandle ? FileHandle : (HANDLE)-1;
    CallApphelp(Service, &CacheEntry);
    // we piggy-back on the PathName, so let the Cleanup take care of the string
    //RtlFreeUnicodeString(&CacheEntry.ImageName);
 
    if (FileHandle)
        NtClose(FileHandle);
    RtlFreeUnicodeString(&PathName);
}

Referenced by HandleImageArg().

DumpRegistryData()

void DumpRegistryData

(

int

IncludeDump

)

Definition at line 261 of file shimdbg.c.

{
    HANDLE KeyHandle;
    NTSTATUS Status;
    KEY_VALUE_PARTIAL_INFORMATION KeyValueObject;
    PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation = &KeyValueObject;
    ULONG KeyInfoSize, ResultSize;
 
    xprintf("Dumping AppCompatCache registry key\n");
 
    Status = NtOpenKey(&KeyHandle, KEY_QUERY_VALUE, &AppCompatKeyAttributes);
 
    Status = NtQueryValueKey(KeyHandle, &AppCompatCacheValue,
                KeyValuePartialInformation, KeyValueInformation,
                sizeof(KeyValueObject), &ResultSize);
 
    if (Status == STATUS_BUFFER_OVERFLOW)
    {
        KeyInfoSize = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + KeyValueInformation->DataLength;
        KeyValueInformation = malloc(KeyInfoSize);
        if (KeyValueInformation != NULL)
        {
            Status = NtQueryValueKey(KeyHandle, &AppCompatCacheValue,
                        KeyValuePartialInformation, KeyValueInformation,
                        KeyInfoSize, &ResultSize);
        }
    }
 
    if (NT_SUCCESS(Status) && KeyValueInformation->Type == REG_BINARY)
    {
        ULONG crc;
        if (IncludeDump)
            hexdump(KeyValueInformation->Data, KeyValueInformation->DataLength);
        crc = RtlComputeCrc32(0, KeyValueInformation->Data, KeyValueInformation->DataLength);
        xprintf("Len: %lu, Crc: 0x%lx\n", KeyValueInformation->DataLength, crc);
    }
    else
    {
        xprintf("Failed reading AppCompatCache from registry (0x%lx)\n", Status);
    }
 
    if (KeyValueInformation != &KeyValueObject)
        free(KeyValueInformation);
 
    if (KeyHandle)
        NtClose(KeyHandle);
}

Referenced by main().

HandleDumpAttributes()

int HandleDumpAttributes	(	int	argc,
		char *	argv[],
		int *	pn,
		const char *	opt
	)

Definition at line 158 of file shimdbg.c.

{
    UNICODE_STRING FileName;
    PATTRINFO attr;
    DWORD num_attr, n;
    int argn = *pn;
    const char* arg;
 
    if (!InitApphelp())
        return 1;
 
    if (strlen(argv[argn]) > (strlen(opt)+1))
    {
        arg = argv[argn] + strlen(opt);
    }
    else if (argn+1 >= argc)
    {
        xprintf("Error: no image name specified\n");
        return 1;
    }
    else
    {
        arg = argv[argn+1];
        (*pn) += 1;
    }
 
    RtlCreateUnicodeStringFromAsciiz(&FileName, arg);
 
    if (pSdbGetFileAttributes(FileName.Buffer, &attr, &num_attr))
    {
        xprintf("Dumping attributes for %s\n", arg);
        for (n = 0; n < num_attr; ++n)
        {
            TAG tagType;
            LPCWSTR tagName;
            if (attr[n].flags != ATTRIBUTE_AVAILABLE)
                continue;
 
            tagName = pSdbTagToString(attr[n].type);
 
            tagType = attr[n].type & TAG_TYPE_MASK;
            switch (tagType)
            {
            case TAG_TYPE_DWORD:
                xprintf("<%ls>0x%lx</%ls>\n", tagName, attr[n].dwattr, tagName);
                break;
            case TAG_TYPE_STRINGREF:
                xprintf("<%ls>%ls</%ls>\n", tagName, attr[n].lpattr, tagName);
                break;
            case TAG_TYPE_QWORD:
                xprintf("<%ls>0x%I64x</%ls>\n", tagName, attr[n].qwattr, tagName);
                break;
            default:
                xprintf("<!-- Unknown tag type: 0x%x (from 0x%x)\n", tagType, attr[n].type);
                break;
            }
        }
        xprintf("Done\n");
    }
    else
    {
        xprintf("Unable to get attributes from %s\n", arg);
    }
 
 
    RtlFreeUnicodeString(&FileName);
    return 0;
}

Referenced by main().

HandleImageArg()

int HandleImageArg	(	int	argc,
		char *	argv[],
		int *	pn,
		char	MapItChar,
		APPHELPCACHESERVICECLASS	Service,
		char *	ServiceName
	)

Definition at line 88 of file shimdbg.c.

{
    int n = *pn;
    if (n+1 < argc)
    {
        int MapIt = argv[n][1] == MapItChar;
        CallApphelpWithImage(argv[n+1], MapIt, Service, ServiceName);
        (*pn) += 1;
        return 0;
    }
    xprintf("Error: no image name specified\n");
    return 1;
}

Referenced by main().

hexdump()

void hexdump	(	unsigned char *	p,
		unsigned int	len
	)

Definition at line 234 of file shimdbg.c.

{
    unsigned char *line = p;
    unsigned int i, thisline, offset = 0;
 
    while (offset < len)
    {
        xprintf("%04x ", offset);
        thisline = len - offset;
        if (thisline > 16)
            thisline = 16;
 
        for (i = 0; i < thisline; i++)
            xprintf("%02x ", line[i]);
 
        for (; i < 16; i++)
            xprintf("   ");
 
        for (i = 0; i < thisline; i++)
            xprintf("%c", (line[i] >= 0x20 && line[i] < 0x7f) ? line[i] : '.');
 
        xprintf("\n");
        offset += thisline;
        line += thisline;
    }
}

Referenced by DumpRegistryData().

InitApphelp()

static BOOL InitApphelp ( )

static

Definition at line 131 of file shimdbg.c.

{
    if (!hdll)
    {
        static UNICODE_STRING DllName = RTL_CONSTANT_STRING(L"apphelp.dll");
        static ANSI_STRING SdbTagToString = RTL_CONSTANT_STRING("SdbTagToString");
        static ANSI_STRING SdbGetFileAttributes = RTL_CONSTANT_STRING("SdbGetFileAttributes");
        static ANSI_STRING SdbFreeFileAttributes = RTL_CONSTANT_STRING("SdbFreeFileAttributes");
        if (!NT_SUCCESS(LdrLoadDll(NULL, NULL, &DllName, &hdll)))
        {
            xprintf("Unable to load apphelp.dll\n");
            return FALSE;
        }
        if (!NT_SUCCESS(LdrGetProcedureAddress(hdll, &SdbTagToString, 0, (PVOID)&pSdbTagToString)) ||
            !NT_SUCCESS(LdrGetProcedureAddress(hdll, &SdbGetFileAttributes, 0, (PVOID)&pSdbGetFileAttributes)) ||
            !NT_SUCCESS(LdrGetProcedureAddress(hdll, &SdbFreeFileAttributes, 0, (PVOID)&pSdbFreeFileAttributes)))
        {
            LdrUnloadDll(hdll);
            hdll = NULL;
            xprintf("Unable to resolve functions\n");
            return FALSE;
        }
    }
    return TRUE;
}

Referenced by HandleDumpAttributes().

IsOpt()

int IsOpt	(	char *	argv,
		const char *	check
	)

Definition at line 80 of file shimdbg.c.

{
    if( argv && (argv[0] == '-' || argv[0] == '/') ) {
        return !_strnicmp(argv + 1, check, strlen(check));
    }
    return 0;
}

Referenced by main().

LPCWSTR()

static LPCWSTR ( WINAPI *  pSdbTagToString )

static

main()

int main	(	int argc	,
		char *	argv[]
	)

Definition at line 311 of file shimdbg.c.

{
    int n, unhandled = 0, keepopen = 0;
 
    for (n = 1; n < argc; ++n)
    {
        char* arg = argv[n];
        if (IsOpt(arg, "d"))
        {
            xprintf("Calling ApphelpCacheServiceDump\n");
            CallApphelp(ApphelpCacheServiceDump, NULL);
            unhandled = 0;
        }
        else if (IsOpt(arg, "h"))
        {
            DumpRegistryData(arg[1] == 'h');
            unhandled = 0;
        }
        else if (IsOpt(arg, "f"))
        {
            xprintf("Calling ApphelpCacheServiceFlush\n");
            CallApphelp(ApphelpCacheServiceFlush, NULL);
            unhandled = 0;
        }
        else if (IsOpt(arg, "z"))
        {
            xprintf("Calling ApphelpDBGReadRegistry\n");
            CallApphelp(ApphelpDBGReadRegistry, NULL);
            unhandled = 0;
        }
        else if (IsOpt(arg, "x"))
        {
            xprintf("Calling ApphelpDBGWriteRegistry\n");
            CallApphelp(ApphelpDBGWriteRegistry, NULL);
            unhandled = 0;
        }
        else if (IsOpt(arg, "l"))
        {
            unhandled |= HandleImageArg(argc, argv, &n, 'l',
                        ApphelpCacheServiceLookup, "ApphelpCacheServiceLookup");
        }
        else if (IsOpt(arg, "u"))
        {
            unhandled |= HandleImageArg(argc, argv, &n, 'u',
                        ApphelpCacheServiceUpdate, "ApphelpCacheServiceUpdate");
        }
        else if (IsOpt(arg, "r"))
        {
            unhandled |= HandleImageArg(argc, argv, &n, 'r',
                        ApphelpCacheServiceRemove, "ApphelpCacheServiceRemove");
        }
        else if (IsOpt(arg, "a"))
        {
            unhandled |= HandleDumpAttributes(argc, argv, &n, "a");
        }
        else if (IsOpt(arg, "k"))
        {
            keepopen = 1;
        }
        else
        {
            unhandled = 1;
        }
    }
    if (unhandled || argc == 1)
    {
        xprintf("Usage: %s [-d|-z|-x|-h|-H|-f|-[l|L] <image>|-[u|U] <image>|-[r|R] <image>|-k]\n", argv[0]);
        xprintf("           -d: Dump shim cache over debug output\n");
        xprintf("           -z: DEBUG Read shim cache from registry\n");
        xprintf("           -x: DEBUG Write shim cache to registry\n");
        xprintf("           -h: Hexdump shim registry key\n");
        xprintf("           -H: Crc + Length from shim registry key only\n");
        xprintf("           -f: Flush (clear) the shim cache\n");
        xprintf("           -l: Lookup <image> in the shim cache\n");
        xprintf("           -L: Lookup <image> in the shim cache without mapping it\n");
        xprintf("           -u: Update (insert) <image> in the shim cache\n");
        xprintf("           -U: Update (insert) <image> in the shim cache without mapping it\n");
        xprintf("           -r: Remove <image> from the shim cache\n");
        xprintf("           -R: Remove <image> from the shim cache without mapping it\n");
        xprintf("           -a: Dump file attributes as used in the appcompat database\n");
        xprintf("           -k: Keep the console open\n");
    }
    if (keepopen)
    {
        _getch();
    }
    return unhandled;
}

MapFile()

HANDLE MapFile	(	char *	filename,
		UNICODE_STRING *	PathName,
		int	MapIt
	)

Definition at line 34 of file shimdbg.c.

{
    OBJECT_ATTRIBUTES LocalObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    NTSTATUS Status;
    HANDLE FileHandle = NULL;
    RtlCreateUnicodeStringFromAsciiz(PathName, filename);
    if (MapIt)
    {
        InitializeObjectAttributes(&LocalObjectAttributes, PathName,
            OBJ_CASE_INSENSITIVE, NULL, NULL);
        Status = NtOpenFile(&FileHandle,
                    SYNCHRONIZE | FILE_READ_ATTRIBUTES | FILE_READ_DATA | FILE_EXECUTE,
                    &LocalObjectAttributes, &IoStatusBlock,
                    FILE_SHARE_READ | FILE_SHARE_DELETE,
                    FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE);
        if (!NT_SUCCESS(Status))
        {
            xprintf("Failed opening the file, using a NULL handle\n");
            FileHandle = NULL;
        }
    }
    return FileHandle;
}

Referenced by CallApphelpWithImage().

vDbgPrintEx()

NTSYSAPI ULONG NTAPI vDbgPrintEx	(	_In_ ULONG	ComponentId,
		_In_ ULONG	Level,
		_In_z_ PCCH	Format,
		_In_ va_list	ap
	)

Referenced by xprintf().

xprintf()

void xprintf	(	const char *	fmt,
			...
	)

Definition at line 16 of file shimdbg.c.

{
    va_list ap;
 
    va_start(ap, fmt);
    vprintf(fmt, ap);
    vDbgPrintEx(-1, DPFLTR_ERROR_LEVEL, fmt, ap);
    va_end(ap);
}

Referenced by CallApphelp(), CallApphelpWithImage(), DumpRegistryData(), extract_test_proc(), HandleDumpAttributes(), HandleImageArg(), hexdump(), InitApphelp(), main(), MapFile(), print_version(), run_test(), and run_tests().

Variable Documentation

AppCompatCacheKey

UNICODE_STRING AppCompatCacheKey = RTL_CONSTANT_STRING(L"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache")

Definition at line 227 of file shimdbg.c.

AppCompatCacheValue

UNICODE_STRING AppCompatCacheValue = RTL_CONSTANT_STRING(L"AppCompatCache")

Definition at line 229 of file shimdbg.c.

Referenced by DumpRegistryData().

AppCompatKeyAttributes

OBJECT_ATTRIBUTES AppCompatKeyAttributes = RTL_CONSTANT_OBJECT_ATTRIBUTES(&AppCompatCacheKey, OBJ_CASE_INSENSITIVE)

Definition at line 228 of file shimdbg.c.

Referenced by DumpRegistryData(), and IsShimInfrastructureDisabled().

hdll

PVOID hdll

static

Definition at line 126 of file shimdbg.c.

Referenced by add_zone_to_listview(), DllMain(), Init(), init_function_pointers(), init_test(), InitApphelp(), load_it_up(), parse_url_from_outside(), path_to_pidl(), ResProtocol_Start(), START_TEST(), test_format_message(), and test_loadlibraryshim().

LPDWORD

PATTRINFO LPDWORD

Definition at line 128 of file shimdbg.c.