11#define LDR_HASH_TABLE_ENTRIES 32
12#define LDR_GET_HASH_ENTRY(x) (RtlUpcaseUnicodeChar((x)) & (LDR_HASH_TABLE_ENTRIES - 1))
15#define LDRP_UPDATE_REFCOUNT 0x01
16#define LDRP_UPDATE_DEREFCOUNT 0x02
17#define LDRP_UPDATE_PIN 0x03
20#define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001
21#define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
24#define DPH_FLAG_DLL_NOTIFY 0x40
IN PUNICODE_STRING StaticString
IN PUNICODE_STRING IN PUNICODE_STRING DynamicString
struct tagCallbackData CallbackData
_Inout_opt_ PUNICODE_STRING Extension
BOOLEAN(NTAPI * PDLL_INIT_ROUTINE)(_In_ PVOID DllHandle, _In_ ULONG Reason, _In_opt_ PCONTEXT Context)
VOID NTAPI LdrpUnloadShimEngine()
VOID NTAPI LdrpGetShimEngineInterface()
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
static const char const char * DllPath
static const char * ImageName
#define _When_(expr, annos)
#define _In_range_(lb, ub)
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
_In_ HANDLE ProcessHandle
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason)
NTSYSAPI NTSTATUS NTAPI LdrpApplyFileNameRedirection(_In_ PUNICODE_STRING OriginalName, _In_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING StaticString, _Inout_opt_ PUNICODE_STRING DynamicString, _Inout_ PUNICODE_STRING *NewName, _Inout_ PBOOLEAN RedirectedDll)
NTSTATUS NTAPI LdrpInitializeApplicationVerifierPackage(IN HANDLE KeyHandle, IN PPEB Peb, IN BOOLEAN SystemWide, IN BOOLEAN ReadAdvancedOptions)
BOOLEAN NTAPI RtlDoesFileExists_UStr(IN PUNICODE_STRING FileName)
ULONG LdrpGetResidentSize(PIMAGE_NT_HEADERS NTHeaders)
BOOLEAN LdrpShutdownInProgress
VOID NTAPI LdrpFreeUnicodeString(PUNICODE_STRING String)
PVOID g_pfnSE_InstallBeforeInit
NTSTATUS NTAPI LdrpMapDll(IN PWSTR SearchPath OPTIONAL, IN PWSTR DllPath2, IN PWSTR DllName OPTIONAL, IN PULONG DllCharacteristics, IN BOOLEAN Static, IN BOOLEAN Redirect, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry)
PVOID g_pfnSE_InstallAfterInit
UNICODE_STRING LdrpDefaultPath
VOID NTAPI LdrpLoadShimEngine(IN PWSTR ImageName, IN PUNICODE_STRING ProcessImage, IN PVOID pShimData)
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
PVOID g_pShimEngineModule
VOID NTAPI LdrpFreeTls(VOID)
NTSTATUS NTAPI LdrpWalkImportDescriptor(IN LPWSTR DllPath OPTIONAL, IN PLDR_DATA_TABLE_ENTRY LdrEntry)
PVOID g_pfnSE_ProcessDying
NTSTATUS NTAPI AVrfInitializeVerifier(VOID)
ULONG LdrpNumberOfProcessors
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
UNICODE_STRING LdrApiDefaultExtension
#define LDR_HASH_TABLE_ENTRIES
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
ULONG LdrpActiveUnloadCount
NTSTATUS(NTAPI * PEPFUNC)(PPEB)
NTSTATUS LdrMapNTDllForProcess(HANDLE ProcessHandle, PHANDLE NTDllSectionHandle)
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
NTSTATUS(NTAPI * PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(_In_ ULONG Flags, _In_ PCWSTR DllName, _In_ PCWSTR DllPath OPTIONAL, _Inout_opt_ PULONG DllCharacteristics, _In_ PVOID CallbackData, _Outptr_ PWSTR *EffectiveDllPath)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
NTSTATUS NTAPI LdrpGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress, _In_ BOOLEAN ExecuteInit)
NTSTATUS NTAPI LdrpLoadImportModule(IN PWSTR DllPath OPTIONAL, IN LPSTR ImportName, OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry, OUT PBOOLEAN Existing)
VOID NTAPI LdrpInsertMemoryTableEntry(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
ULONG LdrpFatalHardErrorCount
NTSTATUS LdrMapSections(HANDLE ProcessHandle, PVOID ImageBase, HANDLE SectionHandle, PIMAGE_NT_HEADERS NTHeaders)
NTSTATUS NTAPI LdrpSetProtection(PVOID ViewBase, BOOLEAN Restore)
struct _LDRP_TLS_DATA * PLDRP_TLS_DATA
VOID NTAPI LdrpValidateImageForMp(IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry)
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
LIST_ENTRY LdrpHashTable[LDR_HASH_TABLE_ENTRIES]
UNICODE_STRING LdrpKnownDllPath
PVOID NTAPI LdrpFetchAddressOfEntryPoint(PVOID ImageBase)
NTSTATUS NTAPI LdrpInitializeProcess(IN PCONTEXT Context, IN PVOID SystemArgument1)
NTSTATUS NTAPI LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL)
BOOLEAN RtlpPageHeapEnabled
PLDR_DATA_TABLE_ENTRY NTAPI LdrpAllocateDataTableEntry(IN PVOID BaseAddress)
BOOLEAN LdrpLdrDatabaseIsSetup
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
HANDLE LdrpKnownDllObjectDirectory
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
RTL_CRITICAL_SECTION LdrpLoaderLock
VOID NTAPI LdrpInitFailure(NTSTATUS Status)
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
VOID NTAPI AVrfDllLoadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSTATUS NTAPI LdrpInitializeTls(VOID)
VOID NTAPI LdrpEnsureLoaderLockIsHeld(VOID)
NTSTATUS NTAPI LdrpSnapThunk(IN PVOID ExportBase, IN PVOID ImportBase, IN PIMAGE_THUNK_DATA OriginalThunk, IN OUT PIMAGE_THUNK_DATA Thunk, IN PIMAGE_EXPORT_DIRECTORY ExportEntry, IN ULONG ExportSize, IN BOOLEAN Static, IN LPSTR DllName)
ULONG NTAPI LdrpClearLoadInProgress(VOID)
struct _LDRP_TLS_DATA LDRP_TLS_DATA
PVOID g_pfnSE_DllUnloaded
VOID NTAPI AVrfPageHeapDllNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI LdrpInitializeThread(IN PCONTEXT Context)
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
NTSTATUS NTAPI LdrpAllocateTls(VOID)
VOID NTAPI RtlpInitializeKeyedEvent(VOID)
PULONG MinorVersion OPTIONAL
base of all file and directory entries
IMAGE_TLS_DIRECTORY TlsDirectory
_Must_inspect_result_ _In_ WDFDEVICE _In_ WDFSTRING String
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_ PUNICODE_STRING NewName