kse.h File Reference

Go to the source code of this file.

Classes
struct	_KSE_HOOK
struct	_KSE_HOOK_COLLECTION
struct	_KSE_DRIVER_IO_CALLBACKS
struct	_KSE_CALLBACK_ROUTINES
struct	_KSE_SHIM

Macros
#define	KseHookFunction   0
#define	KseHookIRPCallback   1
#define	KseHookInvalid   2
#define	KseHookCallbackDriverInit   1
#define	KseHookCallbackDriverStartIo   2
#define	KseHookCallbackDriverUnload   3
#define	KseHookCallbackAddDevice   4
#define	KseHookCallbackMajorFunction   100
#define	KseCollectionNtExport   0
#define	KseCollectionHalExport   1
#define	KseCollectionDriverExport   2
#define	KseCollectionCallback   3
#define	KseCollectionInvalid   4

Typedefs
typedef struct _KSE_HOOK	KSE_HOOK
typedef struct _KSE_HOOK *	PKSE_HOOK
typedef struct _KSE_HOOK_COLLECTION	KSE_HOOK_COLLECTION
typedef struct _KSE_HOOK_COLLECTION *	PKSE_HOOK_COLLECTION
typedef VOID(NTAPI *	PKSE_HOOK_DRIVER_TARGETED) (_In_ PUNICODE_STRING BaseName, _In_ PVOID BaseAddress, _In_ ULONG SizeOfImage, _In_ ULONG TimeDateStamp, _In_ ULONG CheckSum)
typedef VOID(NTAPI *	PKSE_HOOK_DRIVER_UNTARGETED) (_In_ PVOID BaseAddress)
typedef struct _KSE_DRIVER_IO_CALLBACKS	KSE_DRIVER_IO_CALLBACKS
typedef struct _KSE_DRIVER_IO_CALLBACKS *	PKSE_DRIVER_IO_CALLBACKS
typedef KSE_GET_IO_CALLBACKS *	PKSE_GET_IO_CALLBACKS
typedef _In_ PIRP	Irp
typedef _In_ PIRP _In_ PIO_COMPLETION_ROUTINE	CompletionRoutine = CompletionRoutine
typedef _In_ PIRP _In_ PIO_COMPLETION_ROUTINE _In_ PVOID	Context
typedef KSE_SET_COMPLETION_HOOK *	PKSE_SET_COMPLETION_HOOK
typedef struct _KSE_CALLBACK_ROUTINES	KSE_CALLBACK_ROUTINES
typedef struct _KSE_CALLBACK_ROUTINES *	PKSE_CALLBACK_ROUTINES
typedef struct _KSE_SHIM *	PKSE_SHIM
typedef struct _KSE_SHIM	KSE_SHIM

Functions
typedef	PKSE_DRIVER_IO_CALLBACKS (NTAPI KSE_GET_IO_CALLBACKS)(_In_ PDRIVER_OBJECT DriverObject)
typedef	NTSTATUS (NTAPI KSE_SET_COMPLETION_HOOK)(_In_ PDEVICE_OBJECT DeviceObject
NTSTATUS NTAPI	KseRegisterShim (_In_ PKSE_SHIM Shim, _In_ PVOID Ignored, _In_ ULONG Flags)
NTSTATUS NTAPI	KseRegisterShimEx (_In_ PKSE_SHIM Shim, _In_ PVOID Ignored, _In_ ULONG Flags, _In_opt_ PVOID DriverObject)
NTSTATUS NTAPI	KseUnregisterShim (_In_ PKSE_SHIM Shim, _In_ PVOID Unknown1, _In_ PVOID Unknown2)
NTSTATUS NTAPI	KseInitialize (_In_ ULONG BootPhase, _In_ PLOADER_PARAMETER_BLOCK LoaderBlock)
NTSTATUS NTAPI	KseShimDriverIoCallbacks (_In_ PDRIVER_OBJECT DriverObject)
NTSTATUS NTAPI	KseDriverLoadImage (_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
PKSE_SHIM NTAPI	KsepFindShim (_In_ PCUNICODE_STRING Name)
VOID NTAPI	KsepAddShimByName (_In_ PCUNICODE_STRING Name, _Inout_ PKSE_SHIM *Shims, _Inout_ PULONG NumberOfShims)
NTSTATUS NTAPI	KseDbInitialize (_In_ PVOID DatabaseImage, _In_ ULONG DatabaseSize)
VOID NTAPI	KseDbGetShimsForDriver (_In_ PLDR_DATA_TABLE_ENTRY LdrEntry, _Inout_ PKSE_SHIM *Shims, _Inout_ PULONG NumberOfShims)
NTSTATUS NTAPI	KseDriverScopeInitialize (VOID)
NTSTATUS NTAPI	KseIgnoreFreePoolTagInitialize (VOID)

Macro Definition Documentation

KseCollectionCallback

#define KseCollectionCallback   3

Definition at line 37 of file kse.h.

KseCollectionDriverExport

#define KseCollectionDriverExport   2

Definition at line 36 of file kse.h.

KseCollectionHalExport

#define KseCollectionHalExport   1

Definition at line 35 of file kse.h.

KseCollectionInvalid

#define KseCollectionInvalid   4

Definition at line 38 of file kse.h.

KseCollectionNtExport

#define KseCollectionNtExport   0

Definition at line 34 of file kse.h.

KseHookCallbackAddDevice

#define KseHookCallbackAddDevice   4

Definition at line 18 of file kse.h.

KseHookCallbackDriverInit

#define KseHookCallbackDriverInit   1

Definition at line 15 of file kse.h.

KseHookCallbackDriverStartIo

#define KseHookCallbackDriverStartIo   2

Definition at line 16 of file kse.h.

KseHookCallbackDriverUnload

#define KseHookCallbackDriverUnload   3

Definition at line 17 of file kse.h.

KseHookCallbackMajorFunction

#define KseHookCallbackMajorFunction   100

Definition at line 19 of file kse.h.

KseHookFunction

#define KseHookFunction   0

Definition at line 11 of file kse.h.

KseHookInvalid

#define KseHookInvalid   2

Definition at line 13 of file kse.h.

KseHookIRPCallback

#define KseHookIRPCallback   1

Definition at line 12 of file kse.h.

Typedef Documentation

CompletionRoutine

irpSp CompletionRoutine = CompletionRoutine

Definition at line 80 of file kse.h.

Context

_Must_inspect_result_ _In_ WDFREQUEST _In_ SECURITY_IMPERSONATION_LEVEL _In_ PFN_WDF_REQUEST_IMPERSONATE _In_opt_ PVOID Context

Initial value:

{
    return ((PFN_WDFDMATRANSACTIONEXECUTE) WdfFunctions[WdfDmaTransactionExecuteTableIndex])(WdfDriverGlobals, DmaTransaction, Context)

Definition at line 81 of file kse.h.

Irp

_Must_inspect_result_ _In_ WDFDEVICE _In_ PIRP Irp

Initial value:

{
    return ((PFN_WDFDEVICEWDMDISPATCHPREPROCESSEDIRP) WdfFunctions[WdfDeviceWdmDispatchPreprocessedIrpTableIndex])(WdfDriverGlobals, Device, Irp)

Definition at line 79 of file kse.h.

KSE_CALLBACK_ROUTINES

typedef struct _KSE_CALLBACK_ROUTINES KSE_CALLBACK_ROUTINES

KSE_DRIVER_IO_CALLBACKS

typedef struct _KSE_DRIVER_IO_CALLBACKS KSE_DRIVER_IO_CALLBACKS

KSE_HOOK

typedef struct _KSE_HOOK KSE_HOOK

KSE_HOOK_COLLECTION

typedef struct _KSE_HOOK_COLLECTION KSE_HOOK_COLLECTION

KSE_SHIM

typedef struct _KSE_SHIM KSE_SHIM

PKSE_CALLBACK_ROUTINES

typedef struct _KSE_CALLBACK_ROUTINES * PKSE_CALLBACK_ROUTINES

PKSE_DRIVER_IO_CALLBACKS

typedef struct _KSE_DRIVER_IO_CALLBACKS * PKSE_DRIVER_IO_CALLBACKS

PKSE_GET_IO_CALLBACKS

typedef KSE_GET_IO_CALLBACKS* PKSE_GET_IO_CALLBACKS

Definition at line 74 of file kse.h.

PKSE_HOOK

typedef struct _KSE_HOOK * PKSE_HOOK

PKSE_HOOK_COLLECTION

typedef struct _KSE_HOOK_COLLECTION * PKSE_HOOK_COLLECTION

PKSE_HOOK_DRIVER_TARGETED

typedef VOID(NTAPI * PKSE_HOOK_DRIVER_TARGETED) (_In_ PUNICODE_STRING BaseName, _In_ PVOID BaseAddress, _In_ ULONG SizeOfImage, _In_ ULONG TimeDateStamp, _In_ ULONG CheckSum)

Definition at line 48 of file kse.h.

PKSE_HOOK_DRIVER_UNTARGETED

typedef VOID(NTAPI * PKSE_HOOK_DRIVER_UNTARGETED) (_In_ PVOID BaseAddress)

Definition at line 56 of file kse.h.

PKSE_SET_COMPLETION_HOOK

typedef KSE_SET_COMPLETION_HOOK* PKSE_SET_COMPLETION_HOOK

Definition at line 82 of file kse.h.

PKSE_SHIM

typedef struct _KSE_SHIM * PKSE_SHIM

Function Documentation

KseDbGetShimsForDriver()

VOID NTAPI KseDbGetShimsForDriver	(	_In_ PLDR_DATA_TABLE_ENTRY	LdrEntry,
		_Inout_ PKSE_SHIM *	Shims,
		_Inout_ PULONG	NumberOfShims
	)

Definition at line 199 of file ksedb.c.

{
    TAGID Driver, MatchingFile, ShimRef;
    UNICODE_STRING ShimName;
    PWSTR Name;
    BOOLEAN Match;
 
    if (KseDatabaseRoot == TAGID_NULL)
        return;
 
    for (Driver = SdbFindFirstTag(&KseDriverDatabase, KseDatabaseRoot, TAG_KDRIVER);
         Driver != TAGID_NULL;
         Driver = SdbFindNextTag(&KseDriverDatabase, KseDatabaseRoot, Driver))
    {
        if (!KsepDbStringEquals(Driver, TAG_NAME, &LdrEntry->BaseDllName))
            continue;
 
        Match = TRUE;
        for (MatchingFile = SdbFindFirstTag(&KseDriverDatabase, Driver, TAG_MATCHING_FILE);
             MatchingFile != TAGID_NULL && Match;
             MatchingFile = SdbFindNextTag(&KseDriverDatabase, Driver, MatchingFile))
        {
            Match = KsepDbMatchingFileMatches(MatchingFile, LdrEntry);
        }
 
        if (!Match)
        {
            DPRINT1("KSE: %wZ is in the driver database, but does not match\n", &LdrEntry->BaseDllName);
            continue;
        }
 
        for (ShimRef = SdbFindFirstTag(&KseDriverDatabase, Driver, TAG_KSHIM_REF);
             ShimRef != TAGID_NULL;
             ShimRef = SdbFindNextTag(&KseDriverDatabase, Driver, ShimRef))
        {
            Name = SdbGetStringTagPtr(&KseDriverDatabase, SdbFindFirstTag(&KseDriverDatabase, ShimRef, TAG_NAME));
            if (!Name)
                continue;
 
            RtlInitUnicodeString(&ShimName, Name);
            KsepAddShimByName(&ShimName, Shims, NumberOfShims);
        }
    }
}

Referenced by KsepGetShimsForDriver().

KseDbInitialize()

NTSTATUS NTAPI KseDbInitialize	(	_In_ PVOID	DatabaseImage,
		_In_ ULONG	DatabaseSize
	)

Definition at line 92 of file ksedb.c.

{
    PULONG Header = DatabaseImage;
    PUCHAR Data;
 
    if (!DatabaseImage || DatabaseSize <= SDB_HEADER_SIZE || Header[2] != SDB_HEADER_MAGIC)
        return STATUS_INVALID_IMAGE_FORMAT;
 
    /* The loader block is freed after boot, so keep a copy */
    Data = ExAllocatePoolWithTag(PagedPool, DatabaseSize, TAG_KSE_DATABASE);
    if (!Data)
        return STATUS_INSUFFICIENT_RESOURCES;
    RtlCopyMemory(Data, DatabaseImage, DatabaseSize);
 
    RtlZeroMemory(&KseDriverDatabase, sizeof(KseDriverDatabase));
    KseDriverDatabase.data = Data;
    KseDriverDatabase.size = DatabaseSize;
    KseDriverDatabase.major = Header[0];
    KseDriverDatabase.minor = Header[1];
    KseDriverDatabase.stringtable = SdbFindFirstTag(&KseDriverDatabase, TAGID_ROOT, TAG_STRINGTABLE);
 
    KseDatabaseRoot = SdbFindFirstTag(&KseDriverDatabase, TAGID_ROOT, TAG_DATABASE);
    if (KseDatabaseRoot == TAGID_NULL)
    {
        ExFreePoolWithTag(Data, TAG_KSE_DATABASE);
        RtlZeroMemory(&KseDriverDatabase, sizeof(KseDriverDatabase));
        return STATUS_INVALID_IMAGE_FORMAT;
    }
 
    DPRINT1("KSE: Loaded driver database version %lu.%lu (%lu bytes)\n",
            KseDriverDatabase.major, KseDriverDatabase.minor, DatabaseSize);
    return STATUS_SUCCESS;
}

Referenced by CODE_SEG().

KseDriverLoadImage()

NTSTATUS NTAPI KseDriverLoadImage

(

_In_ PLDR_DATA_TABLE_ENTRY

LdrEntry

)

Definition at line 773 of file kse.c.

{
    PKSE_SHIM Shims[KSE_MAX_SHIMS_PER_DRIVER];
    ULONG NumberOfShims, n;
    NTSTATUS Status;
 
    if (KseEngine.State != KSE_STATE_INITIALIZED)
        return STATUS_SUCCESS;
 
    Status = KsepGetShimsForDriver(LdrEntry, Shims, &NumberOfShims);
    if (!NT_SUCCESS(Status))
    {
        DPRINT("KSE: No Shim found for %wZ\n", &LdrEntry->BaseDllName);
        return STATUS_SUCCESS;
    }
 
    for (n = 0; n < NumberOfShims; n++)
    {
        DPRINT1("KSE: Applying shim %S (0x%08lx) to %wZ\n",
                Shims[n]->ShimName, Shims[n]->ShimGuid->Data1, &LdrEntry->BaseDllName);
 
        KsepApplyShimToDriver(Shims[n], LdrEntry);
 
        if (Shims[n]->ShimmedDriverTargetedNotification)
        {
            PIMAGE_NT_HEADERS NtHeaders = RtlImageNtHeader(LdrEntry->DllBase);
 
            Shims[n]->ShimmedDriverTargetedNotification(&LdrEntry->BaseDllName,
                                                        LdrEntry->DllBase,
                                                        LdrEntry->SizeOfImage,
                                                        NtHeaders ? NtHeaders->FileHeader.TimeDateStamp : 0,
                                                        LdrEntry->CheckSum);
        }
    }
 
    return STATUS_SUCCESS;
}

Referenced by IopInitializeBuiltinDriver(), and MmLoadSystemImage().

KseDriverScopeInitialize()

NTSTATUS NTAPI KseDriverScopeInitialize

(

VOID

)

Definition at line 353 of file driverscope.c.

{
    NTSTATUS Status;
 
    Status = KseRegisterShim(&KmDsShim, NULL, 0);
    if (NT_SUCCESS(Status))
        DPRINT("KSE: driver scope shim registered.\n");
 
    return Status;
}

Referenced by KseInitialize().

KseIgnoreFreePoolTagInitialize()

NTSTATUS NTAPI KseIgnoreFreePoolTagInitialize

(

VOID

)

Definition at line 59 of file ignorepooltag.c.

{
    NTSTATUS Status;
 
    Status = KseRegisterShim(&KseIgnoreFreePoolTagShim, NULL, 0);
    if (!NT_SUCCESS(Status))
        DPRINT1("KSE: Unable to register IgnoreFreePoolTag shim (0x%lx)\n", Status);
 
    return Status;
}

Referenced by KseInitialize().

KseInitialize()

NTSTATUS NTAPI KseInitialize	(	_In_ ULONG	BootPhase,
		_In_ PLOADER_PARAMETER_BLOCK	LoaderBlock
	)

Definition at line 403 of file kse.c.

{
    PLOADER_PARAMETER_EXTENSION LoaderExtension;
    NTSTATUS Status = STATUS_SUCCESS;
    ULONG Flags;
 
    if (BootPhase == 0)
    {
        if (InitSafeBootMode != 0 || /* Safe Boot enabled */
            NT_SUCCESS(MmIsVerifierEnabled(&Flags))) /* Driver Verifier enabled */
        {
            DPRINT("KSE: Not initializing (verifier or safe boot)\n");
            return STATUS_SUCCESS;
        }
 
        LoaderExtension = LoaderBlock->Extension;
        if (!LoaderExtension || /* No loader extension */
            LoaderExtension->Size < FIELD_OFFSET(LOADER_PARAMETER_EXTENSION, NetworkLoaderBlock) || /* Too small loader extension */
            !LoaderExtension->DrvDBImage) /* No driver database */
        {
            DPRINT("KSE: Not initializing (invalid DB)\n");
            return STATUS_SUCCESS;
        }
 
        /* Temp mark us as initialized, so providers can be registered */
        KseEngine.State = KSE_STATE_INITIALIZED;
        InitializeListHead(&KseEngine.ProvidersListHead);
        InitializeListHead(&KseEngine.ShimmedDriversListHead);
        KseEngine.KseCallbackRoutines.KseGetIoCallbacksRoutine = KseGetIoCallbacks;
        KseEngine.KseCallbackRoutines.KseSetCompletionHookRoutine = KseSetCompletionHook;
        Status = KseShimDatabaseBootInitialize(LoaderExtension);
        if (NT_SUCCESS(Status))
        {
            Status = KsepMatchInitMachineInfo();
            if (NT_SUCCESS(Status))
            {
                Status = KseDriverScopeInitialize();
            }
        }
        /* We are not done yet! */
        KseEngine.State = KSE_STATE_INITIALIZING;
    }
    else if (BootPhase == 1)
    {
        /* Phase 0 bailed out */
        if (KseEngine.State != KSE_STATE_INITIALIZING)
            return STATUS_SUCCESS;
 
        /* Done initializing, so register the remainder of the shims */
        KseEngine.State = KSE_STATE_INITIALIZED;
        Status = KseIgnoreFreePoolTagInitialize();
    }
 
    DPRINT1("KseInitialize(BootPhase %ld) => %08lx\n", BootPhase, Status);
    return Status;
}

Referenced by IoInitSystem().

KsepAddShimByName()

VOID NTAPI KsepAddShimByName	(	_In_ PCUNICODE_STRING	Name,
		_Inout_ PKSE_SHIM *	Shims,
		_Inout_ PULONG	NumberOfShims
	)

Definition at line 107 of file kse.c.

{
    PKSE_SHIM Shim;
    ULONG n;
 
    Shim = KsepFindShim(Name);
    if (!Shim)
    {
        DPRINT1("KSE: Shim %wZ not found\n", Name);
        return;
    }
 
    for (n = 0; n < *NumberOfShims; n++)
    {
        if (Shims[n] == Shim)
            return;
    }
 
    if (*NumberOfShims >= KSE_MAX_SHIMS_PER_DRIVER)
    {
        DPRINT1("KSE: Too many shims, ignoring %wZ\n", Name);
        return;
    }
 
    Shims[(*NumberOfShims)++] = Shim;
}

Referenced by KseDbGetShimsForDriver(), and KsepMultiSzToShims().

KsepFindShim()

PKSE_SHIM NTAPI KsepFindShim

(

_In_ PCUNICODE_STRING

Name

)

Definition at line 82 of file kse.c.

{
    PKSE_PROVIDER ProviderEntry;
    PLIST_ENTRY ListEntry;
    UNICODE_STRING ShimName;
 
    for (ListEntry = KseEngine.ProvidersListHead.Flink;
         ListEntry != &KseEngine.ProvidersListHead;
         ListEntry = ListEntry->Flink)
    {
        ProviderEntry = CONTAINING_RECORD(ListEntry, KSE_PROVIDER, ProviderList);
        if (!ProviderEntry->Shim->ShimName)
            continue;
 
        RtlInitUnicodeString(&ShimName, ProviderEntry->Shim->ShimName);
        if (RtlEqualUnicodeString(&ShimName, Name, TRUE))
            return ProviderEntry->Shim;
    }
 
    return NULL;
}

Referenced by KsepAddShimByName().

KseRegisterShim()

NTSTATUS NTAPI KseRegisterShim	(	_In_ PKSE_SHIM	Shim,
		_In_ PVOID	Ignored,
		_In_ ULONG	Flags
	)

Definition at line 464 of file kse.c.

{
    return KseRegisterShimEx(Shim, Ignored, Flags, NULL);
}

Referenced by KseDriverScopeInitialize(), and KseIgnoreFreePoolTagInitialize().

KseRegisterShimEx()

NTSTATUS NTAPI KseRegisterShimEx	(	_In_ PKSE_SHIM	Shim,
		_In_ PVOID	Ignored,
		_In_ ULONG	Flags,
		_In_opt_ PVOID	DriverObject
	)

Definition at line 474 of file kse.c.

{
    PKSE_PROVIDER ProviderEntry;
    PLIST_ENTRY ListEntry;
    PLDR_DATA_TABLE_ENTRY DataTableEntry;
    PKSE_HOOK_COLLECTION HookCollection;
    PKSE_HOOK Hook;
    BOOLEAN InKernel;
 
    UNREFERENCED_PARAMETER(Ignored);
 
    if (!Shim || !Shim->ShimGuid)
    {
        DPRINT1("KSE: Unable to register empty shim or shim without guid\n");
        return STATUS_INVALID_PARAMETER;
    }
 
    if (KseEngine.State != KSE_STATE_INITIALIZED)
    {
        DPRINT1("KSE: Unable to register shim 0x%08x before engine is initialized\n", Shim->ShimGuid->Data1);
        return STATUS_UNSUCCESSFUL;
    }
 
    /* Search the loaded module associated to caller */
    if (!KiPcToFileHeader(_ReturnAddress(), &DataTableEntry, FALSE, &InKernel))
        return STATUS_NOT_FOUND;
 
    /* Check if all shim functions belong to caller */
    for (HookCollection = Shim->HookCollectionsArray; HookCollection->Type != KseCollectionInvalid; HookCollection++)
    {
        for (Hook = HookCollection->HookArray; Hook->Type != KseHookInvalid; Hook++)
        {
            if (Hook->HookFunction < DataTableEntry->DllBase)
                return STATUS_UNSUCCESSFUL;
            if ((ULONG_PTR)Hook->HookFunction - (ULONG_PTR)DataTableEntry->DllBase >= DataTableEntry->SizeOfImage)
                return STATUS_UNSUCCESSFUL;
        }
    }
 
    /* Search if shim is already loaded */
    for (ListEntry = KseEngine.ProvidersListHead.Flink;
         ListEntry != &KseEngine.ProvidersListHead;
         ListEntry = ListEntry->Flink)
    {
        ProviderEntry = CONTAINING_RECORD(ListEntry, KSE_PROVIDER, ProviderList);
        if (IsEqualGUID(ProviderEntry->Shim->ShimGuid, Shim->ShimGuid))
        {
            DPRINT1("KSE: GUID already registered\n");
            return STATUS_OBJECT_NAME_COLLISION;
        }
    }
 
    /* Allocate a new entry for this shim */
    ProviderEntry = ExAllocatePoolWithTag(PagedPool, sizeof(*ProviderEntry), TAG_KSE_PROVIDER);
    if (!ProviderEntry)
        return STATUS_NO_MEMORY;
 
    ProviderEntry->Shim = Shim;
    InsertTailList(&KseEngine.ProvidersListHead, &ProviderEntry->ProviderList);
 
    /* Now, update the shim */
    Shim->KseCallbackRoutines = &KseEngine.KseCallbackRoutines;
 
    if (DriverObject)
        ObReferenceObject(DriverObject);
 
    DPRINT1("KSE: Registered shim %S\n", Shim->ShimName);
 
    return STATUS_SUCCESS;
}

Referenced by KseRegisterShim().

KseShimDriverIoCallbacks()

NTSTATUS NTAPI KseShimDriverIoCallbacks

(

_In_ PDRIVER_OBJECT

DriverObject

)

Definition at line 301 of file kse.c.

{
    KSE_DRIVER_IO_CALLBACKS IoCallbacks;
    PKSE_DRIVER_IO_CALLBACKS KseCallbacks;
    PLDR_DATA_TABLE_ENTRY LdrEntry;
    BOOLEAN InKernel;
    ULONG i;
    NTSTATUS Status;
    DPRINT("KseShimDriverIoCallbacks(%wZ)\n", &DriverObject->DriverName);
 
    if (KseEngine.State != KSE_STATE_INITIALIZED)
        return STATUS_SUCCESS;
 
    if (!KiPcToFileHeader(DriverObject->DriverStart, &LdrEntry, FALSE, &InKernel))
        return STATUS_NOT_FOUND;
 
    Status = KsepGetShimCallbacksForDriver(LdrEntry, &IoCallbacks);
    if (!NT_SUCCESS(Status))
        return Status;
 
    KseCallbacks = KsepPoolAllocateNonPaged(sizeof(*KseCallbacks));
    if (!KseCallbacks)
        return STATUS_NO_MEMORY;
 
    RtlZeroMemory(KseCallbacks, sizeof(*KseCallbacks));
    if (DriverObject->DriverInit && IoCallbacks.DriverInit)
    {
        KseCallbacks->DriverInit = DriverObject->DriverInit;
        DriverObject->DriverInit = IoCallbacks.DriverInit;
    }
    if (DriverObject->DriverStartIo && IoCallbacks.DriverStartIo)
    {
        KseCallbacks->DriverStartIo = DriverObject->DriverStartIo;
        DriverObject->DriverStartIo = IoCallbacks.DriverStartIo;
    }
    if (DriverObject->DriverUnload && IoCallbacks.DriverUnload)
    {
        KseCallbacks->DriverUnload = DriverObject->DriverUnload;
        DriverObject->DriverUnload = IoCallbacks.DriverUnload;
    }
    if (DriverObject->DriverExtension->AddDevice && IoCallbacks.AddDevice)
    {
        KseCallbacks->AddDevice = DriverObject->DriverExtension->AddDevice;
        DriverObject->DriverExtension->AddDevice = IoCallbacks.AddDevice;
    }
 
    for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
    {
        if (DriverObject->MajorFunction[i] && IoCallbacks.MajorFunction[i])
        {
            KseCallbacks->MajorFunction[i] = DriverObject->MajorFunction[i];
            DriverObject->MajorFunction[i] = IoCallbacks.MajorFunction[i];
        }
    }
    IoGetDrvObjExtension(DriverObject)->KseCallbacks = KseCallbacks;
 
    return STATUS_SUCCESS;
}

Referenced by IoCreateDriver().

KseUnregisterShim()

NTSTATUS NTAPI KseUnregisterShim	(	_In_ PKSE_SHIM	Shim,
		_In_ PVOID	Unknown1,
		_In_ PVOID	Unknown2
	)

Definition at line 551 of file kse.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_SUPPORTED;
}

NTSTATUS()

typedef NTSTATUS

(

NTAPI

KSE_SET_COMPLETION_HOOK

)

PKSE_DRIVER_IO_CALLBACKS()

typedef PKSE_DRIVER_IO_CALLBACKS

(

NTAPI

KSE_GET_IO_CALLBACKS

)