cicbase.cpp File Reference

#include "precomp.h"
#include "cicbase.h"
#include <shlwapi.h>
#include <stdlib.h>
#include <string.h>
#include <tchar.h>
#include <strsafe.h>

Include dependency graph for cicbase.cpp:

Go to the source code of this file.

Typedefs
typedef enum _PROCESSINFOCLASS	PROCESSINFOCLASS
typedef LONG	NTSTATUS
typedef NTSTATUS(WINAPI *	FN_NtQueryInformationProcess) (HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG)

Enumerations
enum	_PROCESSINFOCLASS {   ProcessBasicInformation = 0 , ProcessDebugPort = 7 , ProcessWow64Information = 26 , ProcessImageFileName = 27 ,   ProcessBreakOnTermination = 29 , ProcessBasicInformation = 0 , ProcessDebugPort = 7 , ProcessWow64Information = 26 ,   ProcessImageFileName = 27 , ProcessBreakOnTermination = 29 , ProcessBasicInformation = 0 , ProcessQuotaLimits = 1 ,   ProcessIoCounters = 2 , ProcessVmCounters = 3 , ProcessTimes = 4 , ProcessBasePriority = 5 ,   ProcessRaisePriority = 6 , ProcessDebugPort = 7 , ProcessExceptionPort = 8 , ProcessAccessToken = 9 ,   ProcessLdtInformation = 10 , ProcessLdtSize = 11 , ProcessDefaultHardErrorMode = 12 , ProcessIoPortHandlers = 13 ,   ProcessPooledUsageAndLimits = 14 , ProcessWorkingSetWatch = 15 , ProcessUserModeIOPL = 16 , ProcessEnableAlignmentFaultFixup = 17 ,   ProcessPriorityClass = 18 , ProcessWx86Information = 19 , ProcessHandleCount = 20 , ProcessAffinityMask = 21 ,   ProcessPriorityBoost = 22 , ProcessDeviceMap = 23 , ProcessSessionInformation = 24 , ProcessForegroundInformation = 25 ,   ProcessWow64Information = 26 , ProcessImageFileName = 27 , ProcessLUIDDeviceMapsEnabled = 28 , ProcessBreakOnTermination = 29 ,   ProcessDebugObjectHandle = 30 , ProcessDebugFlags = 31 , ProcessHandleTracing = 32 , ProcessIoPriority = 33 ,   ProcessExecuteFlags = 34 , ProcessTlsInformation = 35 , ProcessCookie = 36 , ProcessImageInformation = 37 ,   ProcessCycleTime = 38 , ProcessPagePriority = 39 , ProcessInstrumentationCallback = 40 , ProcessThreadStackAllocation = 41 ,   ProcessWorkingSetWatchEx = 42 , ProcessImageFileNameWin32 = 43 , ProcessImageFileMapping = 44 , ProcessAffinityUpdateMode = 45 ,   ProcessMemoryAllocationMode = 46 , ProcessGroupInformation = 47 , ProcessTokenVirtualizationEnabled = 48 , ProcessConsoleHostProcess = 49 ,   ProcessWindowInformation = 50 , ProcessHandleInformation = 51 , ProcessMitigationPolicy = 52 , ProcessDynamicFunctionTableInformation = 53 ,   ProcessHandleCheckingMode = 54 , ProcessKeepAliveCount = 55 , ProcessRevokeFileHandles = 56 , ProcessWorkingSetControl = 57 ,   ProcessHandleTable = 58 , ProcessCheckStackExtentsMode = 59 , ProcessCommandLineInformation = 60 , ProcessProtectionInformation = 61 ,   ProcessMemoryExhaustion = 62 , ProcessFaultInformation = 63 , ProcessTelemetryIdInformation = 64 , ProcessCommitReleaseInformation = 65 ,   ProcessDefaultCpuSetsInformation = 66 , ProcessAllowedCpuSetsInformation = 67 , ProcessSubsystemProcess = 68 , ProcessJobMemoryInformation = 69 ,   ProcessInPrivate = 70 , ProcessRaiseUMExceptionOnInvalidHandleClose = 71 , ProcessIumChallengeResponse = 72 , ProcessChildProcessInformation = 73 ,   ProcessHighGraphicsPriorityInformation = 74 , ProcessSubsystemInformation = 75 , ProcessEnergyValues = 76 , ProcessPowerThrottlingState = 77 ,   ProcessReserved3Information = 78 , ProcessWin32kSyscallFilterInformation = 79 , ProcessDisableSystemAllowedCpuSets = 80 , ProcessWakeInformation = 81 ,   ProcessEnergyTrackingState = 82 , ProcessManageWritesToExecutableMemory = 83 , ProcessCaptureTrustletLiveDump = 84 , ProcessTelemetryCoverage = 85 ,   ProcessEnclaveInformation = 86 , ProcessEnableReadWriteVmLogging = 87 , ProcessUptimeInformation = 88 , ProcessImageSection = 89 ,   ProcessDebugAuthInformation = 90 , ProcessSystemResourceManagement = 91 , ProcessSequenceNumber = 92 , ProcessLoaderDetour = 93 ,   ProcessSecurityDomainInformation = 94 , ProcessCombineSecurityDomainsInformation = 95 , ProcessEnableLogging = 96 , ProcessLeapSecondInformation = 97 ,   ProcessFiberShadowStackAllocation = 98 , ProcessFreeFiberShadowStackAllocation = 99 , ProcessAltSystemCallInformation = 100 , ProcessDynamicEHContinuationTargets = 101 ,   ProcessDynamicEnforcedCetCompatibleRanges = 102 , ProcessCreateStateChange = 103 , ProcessApplyStateChange = 104 , ProcessEnableOptionalXStateFeatures = 105 ,   ProcessAltPrefetchParam = 106 , ProcessAssignCpuPartitions = 107 , ProcessPriorityClassEx = 108 , ProcessMembershipInformation = 109 ,   ProcessEffectiveIoPriority = 110 , ProcessEffectivePagePriority = 111 , MaxProcessInfoClass , ProcessBasicInformation ,   ProcessQuotaLimits , ProcessIoCounters , ProcessVmCounters , ProcessTimes ,   ProcessBasePriority , ProcessRaisePriority , ProcessDebugPort , ProcessExceptionPort ,   ProcessAccessToken , ProcessLdtInformation , ProcessLdtSize , ProcessDefaultHardErrorMode ,   ProcessIoPortHandlers , ProcessPooledUsageAndLimits , ProcessWorkingSetWatch , ProcessUserModeIOPL ,   ProcessEnableAlignmentFaultFixup , ProcessPriorityClass , ProcessWx86Information , ProcessHandleCount ,   ProcessAffinityMask , ProcessPriorityBoost , ProcessDeviceMap , ProcessSessionInformation ,   ProcessForegroundInformation , ProcessWow64Information , ProcessImageFileName , ProcessLUIDDeviceMapsEnabled ,   ProcessBreakOnTermination , ProcessDebugObjectHandle , ProcessDebugFlags , ProcessHandleTracing ,   ProcessIoPriority , ProcessExecuteFlags , ProcessTlsInformation , ProcessCookie ,   ProcessImageInformation , ProcessCycleTime , ProcessPagePriority , ProcessInstrumentationCallback ,   ProcessThreadStackAllocation , ProcessWorkingSetWatchEx , ProcessImageFileNameWin32 , ProcessImageFileMapping ,   ProcessAffinityUpdateMode , ProcessMemoryAllocationMode , ProcessGroupInformation , ProcessTokenVirtualizationEnabled ,   ProcessConsoleHostProcess , ProcessWindowInformation , MaxProcessInfoClass }

Functions
void *	operator new (size_t size, const CicNoThrow &) noexcept
void *	operator new[] (size_t size, const CicNoThrow &) noexcept
void	operator delete (void *ptr) noexcept
void	operator delete[] (void *ptr) noexcept
void	operator delete (void *ptr, size_t size) noexcept
void	operator delete[] (void *ptr, size_t size) noexcept
LPVOID	cicMemReCalloc (LPVOID mem, SIZE_T num, SIZE_T size) noexcept
EXTERN_C BOOL	cicIsWow64 (VOID)
EXTERN_C void	cicGetOSInfo (LPUINT puACP, LPDWORD pdwOSInfo)
EXTERN_C HINSTANCE	cicGetSystemModuleHandle (_In_ LPCTSTR pszFileName, _In_ BOOL bSysWinDir)
EXTERN_C HINSTANCE	cicLoadSystemLibrary (_In_ LPCTSTR pszFileName, _In_ BOOL bSysWinDir)
static FN_CoCreateInstance	_cicGetSetUserCoCreateInstance (FN_CoCreateInstance fnUserCoCreateInstance)
EXTERN_C HRESULT	cicRealCoCreateInstance (_In_ REFCLSID rclsid, _In_ LPUNKNOWN pUnkOuter, _In_ DWORD dwClsContext, _In_ REFIID iid, _Out_ LPVOID *ppv)
HRESULT	cicCoCreateInstance (_In_ REFCLSID rclsid, _In_ LPUNKNOWN pUnkOuter, _In_ DWORD dwClsContext, _In_ REFIID iid, _Out_ LPVOID *ppv)
EXTERN_C BOOL	TFInitLib (FN_CoCreateInstance fnCoCreateInstance)

Typedef Documentation

FN_NtQueryInformationProcess

typedef NTSTATUS(WINAPI * FN_NtQueryInformationProcess) (HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG)

Definition at line 74 of file cicbase.cpp.

NTSTATUS

typedef LONG NTSTATUS

Definition at line 71 of file cicbase.cpp.

PROCESSINFOCLASS

static PROCESSINFOCLASS

Definition at line 63 of file loader.c.

Enumeration Type Documentation

_PROCESSINFOCLASS

enum _PROCESSINFOCLASS

Enumerator
ProcessBasicInformation
ProcessDebugPort
ProcessWow64Information
ProcessImageFileName
ProcessBreakOnTermination
ProcessBasicInformation
ProcessDebugPort
ProcessWow64Information
ProcessImageFileName
ProcessBreakOnTermination
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessLdtInformation
ProcessLdtSize
ProcessDefaultHardErrorMode
ProcessIoPortHandlers
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
ProcessImageFileName
ProcessLUIDDeviceMapsEnabled
ProcessBreakOnTermination
ProcessDebugObjectHandle
ProcessDebugFlags
ProcessHandleTracing
ProcessIoPriority
ProcessExecuteFlags
ProcessTlsInformation
ProcessCookie
ProcessImageInformation
ProcessCycleTime
ProcessPagePriority
ProcessInstrumentationCallback
ProcessThreadStackAllocation
ProcessWorkingSetWatchEx
ProcessImageFileNameWin32
ProcessImageFileMapping
ProcessAffinityUpdateMode
ProcessMemoryAllocationMode
ProcessGroupInformation
ProcessTokenVirtualizationEnabled
ProcessConsoleHostProcess
ProcessWindowInformation
ProcessHandleInformation
ProcessMitigationPolicy
ProcessDynamicFunctionTableInformation
ProcessHandleCheckingMode
ProcessKeepAliveCount
ProcessRevokeFileHandles
ProcessWorkingSetControl
ProcessHandleTable
ProcessCheckStackExtentsMode
ProcessCommandLineInformation
ProcessProtectionInformation
ProcessMemoryExhaustion
ProcessFaultInformation
ProcessTelemetryIdInformation
ProcessCommitReleaseInformation
ProcessDefaultCpuSetsInformation
ProcessAllowedCpuSetsInformation
ProcessSubsystemProcess
ProcessJobMemoryInformation
ProcessInPrivate
ProcessRaiseUMExceptionOnInvalidHandleClose
ProcessIumChallengeResponse
ProcessChildProcessInformation
ProcessHighGraphicsPriorityInformation
ProcessSubsystemInformation
ProcessEnergyValues
ProcessPowerThrottlingState
ProcessReserved3Information
ProcessWin32kSyscallFilterInformation
ProcessDisableSystemAllowedCpuSets
ProcessWakeInformation
ProcessEnergyTrackingState
ProcessManageWritesToExecutableMemory
ProcessCaptureTrustletLiveDump
ProcessTelemetryCoverage
ProcessEnclaveInformation
ProcessEnableReadWriteVmLogging
ProcessUptimeInformation
ProcessImageSection
ProcessDebugAuthInformation
ProcessSystemResourceManagement
ProcessSequenceNumber
ProcessLoaderDetour
ProcessSecurityDomainInformation
ProcessCombineSecurityDomainsInformation
ProcessEnableLogging
ProcessLeapSecondInformation
ProcessFiberShadowStackAllocation
ProcessFreeFiberShadowStackAllocation
ProcessAltSystemCallInformation
ProcessDynamicEHContinuationTargets
ProcessDynamicEnforcedCetCompatibleRanges
ProcessCreateStateChange
ProcessApplyStateChange
ProcessEnableOptionalXStateFeatures
ProcessAltPrefetchParam
ProcessAssignCpuPartitions
ProcessPriorityClassEx
ProcessMembershipInformation
ProcessEffectiveIoPriority
ProcessEffectivePagePriority
MaxProcessInfoClass
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessLdtInformation
ProcessLdtSize
ProcessDefaultHardErrorMode
ProcessIoPortHandlers
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
ProcessImageFileName
ProcessLUIDDeviceMapsEnabled
ProcessBreakOnTermination
ProcessDebugObjectHandle
ProcessDebugFlags
ProcessHandleTracing
ProcessIoPriority
ProcessExecuteFlags
ProcessTlsInformation
ProcessCookie
ProcessImageInformation
ProcessCycleTime
ProcessPagePriority
ProcessInstrumentationCallback
ProcessThreadStackAllocation
ProcessWorkingSetWatchEx
ProcessImageFileNameWin32
ProcessImageFileMapping
ProcessAffinityUpdateMode
ProcessMemoryAllocationMode
ProcessGroupInformation
ProcessTokenVirtualizationEnabled
ProcessConsoleHostProcess
ProcessWindowInformation
MaxProcessInfoClass

Definition at line 61 of file cicbase.cpp.

{
    ProcessBasicInformation = 0,
    ProcessDebugPort = 7,
    ProcessWow64Information = 26,
    ProcessImageFileName = 27,
    ProcessBreakOnTermination = 29
} PROCESSINFOCLASS;

Function Documentation

_cicGetSetUserCoCreateInstance()

static FN_CoCreateInstance _cicGetSetUserCoCreateInstance ( FN_CoCreateInstance  fnUserCoCreateInstance )

static

Definition at line 215 of file cicbase.cpp.

{
    static FN_CoCreateInstance s_fn = NULL;
    if (fnUserCoCreateInstance)
        s_fn = fnUserCoCreateInstance;
    return s_fn;
}

Referenced by cicCoCreateInstance(), and TFInitLib().

cicCoCreateInstance()

HRESULT cicCoCreateInstance	(	_In_ REFCLSID	rclsid,
		_In_ LPUNKNOWN	pUnkOuter,
		_In_ DWORD	dwClsContext,
		_In_ REFIID	iid,
		_Out_ LPVOID *	ppv
	)

@implemented

Definition at line 250 of file cicbase.cpp.

{
    // NOTE: It looks like Cicero wants to hook CoCreateInstance
    FN_CoCreateInstance fnUserCoCreateInstance = _cicGetSetUserCoCreateInstance(NULL);
    if (fnUserCoCreateInstance)
        return fnUserCoCreateInstance(rclsid, pUnkOuter, dwClsContext, iid, ppv);
 
    return cicRealCoCreateInstance(rclsid, pUnkOuter, dwClsContext, iid, ppv);
}

Referenced by GetUIMCat(), and InitDisplayAttrbuteLib().

cicGetOSInfo()

EXTERN_C void cicGetOSInfo	(	LPUINT	puACP,
		LPDWORD	pdwOSInfo
	)

Definition at line 101 of file cicbase.cpp.

{
    *pdwOSInfo = 0;
 
    /* Check OS version info */
    OSVERSIONINFO VerInfo;
    VerInfo.dwOSVersionInfoSize = sizeof(VerInfo);
    GetVersionEx(&VerInfo);
    if (VerInfo.dwPlatformId == DLLVER_PLATFORM_NT)
    {
        *pdwOSInfo |= CIC_OSINFO_NT;
        if (VerInfo.dwMajorVersion >= 5)
        {
            *pdwOSInfo |= CIC_OSINFO_2KPLUS;
            if (VerInfo.dwMinorVersion > 0)
                *pdwOSInfo |= CIC_OSINFO_XPPLUS;
        }
    }
    else
    {
        if (VerInfo.dwMinorVersion >= 10)
            *pdwOSInfo |= CIC_OSINFO_98PLUS;
        else
            *pdwOSInfo |= CIC_OSINFO_95;
    }
 
    /* Check codepage */
    *puACP = GetACP();
    switch (*puACP)
    {
        case 932: /* Japanese (Japan) */
        case 936: /* Chinese (PRC, Singapore) */
        case 949: /* Korean (Korea) */
        case 950: /* Chinese (Taiwan, Hong Kong) */
            *pdwOSInfo |= CIC_OSINFO_CJK;
            break;
    }
 
    if (GetSystemMetrics(SM_IMMENABLED))
        *pdwOSInfo |= CIC_OSINFO_IMM;
 
    if (GetSystemMetrics(SM_DBCSENABLED))
        *pdwOSInfo |= CIC_OSINFO_DBCS;
}

Referenced by InitApp(), and ProcessAttach().

cicGetSystemModuleHandle()

EXTERN_C HINSTANCE cicGetSystemModuleHandle	(	_In_ LPCTSTR	pszFileName,
		_In_ BOOL	bSysWinDir
	)

Definition at line 149 of file cicbase.cpp.

{
    CicSystemModulePath ModPath;
    if (!ModPath.Init(pszFileName, bSysWinDir))
        return NULL;
    return GetModuleHandle(ModPath.m_szPath);
}

Referenced by CheckX64System(), cicIsWow64(), DelayedRegNotifyChangeKeyValue(), DllShutdownInProgress(), and InitApp().

cicIsWow64()

EXTERN_C BOOL cicIsWow64

(

VOID

)

Definition at line 77 of file cicbase.cpp.

{
    static FN_NtQueryInformationProcess s_fnNtQueryInformationProcess = NULL;
    ULONG_PTR Value;
 
    if (!s_fnNtQueryInformationProcess)
    {
        HMODULE hNTDLL = cicGetSystemModuleHandle(TEXT("ntdll.dll"), FALSE);
        if (!hNTDLL)
            return FALSE;
 
        s_fnNtQueryInformationProcess =
            (FN_NtQueryInformationProcess)GetProcAddress(hNTDLL, "NtQueryInformationProcess");
        if (!s_fnNtQueryInformationProcess)
            return FALSE;
    }
 
    Value = 0;
    s_fnNtQueryInformationProcess(GetCurrentProcess(), ProcessWow64Information,
                                  &Value, sizeof(Value), NULL);
    return !!Value;
}

Referenced by InitApp(), and ProcessAttach().

cicLoadSystemLibrary()

EXTERN_C HINSTANCE cicLoadSystemLibrary	(	_In_ LPCTSTR	pszFileName,
		_In_ BOOL	bSysWinDir
	)

Definition at line 162 of file cicbase.cpp.

{
    CicSystemModulePath ModPath;
    if (!ModPath.Init(pszFileName, bSysWinDir))
        return NULL;
    return ::LoadLibrary(ModPath.m_szPath);
}

Referenced by cicRealCoCreateInstance(), and CRegWatcher::UpdateSpTip().

cicMemReCalloc()

LPVOID cicMemReCalloc ( LPVOID  mem, SIZE_T  num, SIZE_T  size  )

noexcept

Definition at line 41 of file cicbase.cpp.

{
    SIZE_T old_size, new_size = num * size;
    LPVOID ret;
 
    if (!mem)
        return cicMemAllocClear(new_size);
 
    old_size = LocalSize(mem);
    ret = cicMemReAlloc(mem, new_size);
    if (!ret)
        return NULL;
 
    if (new_size > old_size)
        ZeroMemory((PBYTE)ret + old_size, new_size - old_size);
 
    return ret;
}

Referenced by generate_Cookie().

cicRealCoCreateInstance()

EXTERN_C HRESULT cicRealCoCreateInstance	(	_In_ REFCLSID	rclsid,
		_In_ LPUNKNOWN	pUnkOuter,
		_In_ DWORD	dwClsContext,
		_In_ REFIID	iid,
		_Out_ LPVOID *	ppv
	)

Definition at line 225 of file cicbase.cpp.

{
    static HINSTANCE s_hOle32 = NULL;
    static FN_CoCreateInstance s_fnCoCreateInstance = NULL;
    if (!s_fnCoCreateInstance)
    {
        if (!s_hOle32)
            s_hOle32 = cicLoadSystemLibrary(TEXT("ole32.dll"), FALSE);
        s_fnCoCreateInstance = (FN_CoCreateInstance)GetProcAddress(s_hOle32, "CoCreateInstance");
        if (!s_fnCoCreateInstance)
            return E_NOTIMPL;
    }
 
    return s_fnCoCreateInstance(rclsid, pUnkOuter, dwClsContext, iid, ppv);
}

Referenced by cicCoCreateInstance(), and MsUtbCoCreateInstance().

operator delete() [1/2]

void operator delete ( void *  ptr )

noexcept

Definition at line 24 of file cicbase.cpp.

{
    cicMemFree(ptr);
}

operator delete() [2/2]

void operator delete ( void *  ptr, size_t  size  )

noexcept

Definition at line 32 of file cicbase.cpp.

{
    cicMemFree(ptr);
}

operator delete[]() [1/2]

void operator delete[] ( void *  ptr )

noexcept

Definition at line 28 of file cicbase.cpp.

{
    cicMemFree(ptr);
}

operator delete[]() [2/2]

void operator delete[] ( void *  ptr, size_t  size  )

noexcept

Definition at line 36 of file cicbase.cpp.

{
    cicMemFree(ptr);
}

operator new()

void * operator new ( size_t  size, const CicNoThrow &    )

noexcept

Definition at line 16 of file cicbase.cpp.

{
    return cicMemAllocClear(size);
}

operator new[]()

void * operator new[] ( size_t  size, const CicNoThrow &    )

noexcept

Definition at line 20 of file cicbase.cpp.

{
    return cicMemAllocClear(size);
}

TFInitLib()

EXTERN_C BOOL TFInitLib

(

FN_CoCreateInstance

fnCoCreateInstance

)

@implemented

Definition at line 270 of file cicbase.cpp.

{
    if (fnCoCreateInstance)
        _cicGetSetUserCoCreateInstance(fnCoCreateInstance);
    return TRUE;
}

Referenced by ProcessAttach().