ldrapi.c File Reference

#include "ldrp.h"

Go to the source code of this file.

Defines
#define	DLLEXTENSION   ((PWSTR)".\0d\0l\0l\0\0")
Functions
ULONG	LdrpClearLoadInProgress (VOID)
NTSTATUS	LdrLoadDll (IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
NTSTATUS NTAPI	LdrpLoadDll (IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle, IN BOOLEAN RunInitRoutines)
NTSTATUS	LdrGetDllHandle (IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
NTSTATUS	LdrDisableThreadCalloutsForDll (IN PVOID DllHandle)
NTSTATUS	LdrUnloadDll (IN PVOID DllHandle)
NTSTATUS	LdrGetProcedureAddress (IN PVOID DllHandle, IN PANSI_STRING ProcedureName OPTIONAL, IN ULONG ProcedureNumber OPTIONAL, OUT PVOID *ProcedureAddress)
NTSTATUS	LdrpGetProcedureAddress (IN PVOID DllHandle, IN PANSI_STRING ProcedureName OPTIONAL, IN ULONG ProcedureNumber OPTIONAL, OUT PVOID *ProcedureAddress, IN BOOLEAN RunInitRoutines)
NTSTATUS NTAPI	LdrVerifyImageMatchesChecksum (IN HANDLE ImageFileHandle, IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine OPTIONAL, IN PVOID ImportCallbackParameter, OUT PUSHORT ImageCharacteristics OPTIONAL)
NTSTATUS	LdrQueryProcessModuleInformation (OUT PRTL_PROCESS_MODULES ModuleInformation, IN ULONG ModuleInformationLength, OUT PULONG ReturnLength OPTIONAL)

---

Define Documentation

#define DLLEXTENSION   ((PWSTR)".\0d\0l\0l\0\0")

Definition at line 26 of file ldrapi.c. Referenced by LdrGetDllHandle(), and LdrpLoadDll().

---

Function Documentation

NTSTATUS LdrDisableThreadCalloutsForDll (  IN PVOID  DllHandle  )

Definition at line 474 of file ldrapi.c. References FALSE, LdrpCheckForLoadedDllHandle(), LdrpInLdrInit, LdrpShutdownInProgress, LoaderLock, and NTSTATUS(). Referenced by CsrClientConnectToServer(). : This function disables thread attach and detach notification for the specified DLL. Arguments: DllHandle - Supplies a handle to the DLL to disable. Return Value: TBD --*/ { NTSTATUS st; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; st = STATUS_SUCCESS; try { if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } if ( LdrpShutdownInProgress ) { return STATUS_SUCCESS; } if (LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)) { if ( LdrDataTableEntry->TlsIndex ) { st = STATUS_DLL_NOT_FOUND; } else { LdrDataTableEntry->Flags |= LDRP_DONT_CALL_FOR_THREADS; } } } finally { if ( LdrpInLdrInit == FALSE ) { RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } return st; }

NTSTATUS LdrGetDllHandle (  IN PWSTR DllPath  OPTIONAL, IN PULONG DllCharacteristics  OPTIONAL, IN PUNICODE_STRING  DllName, OUT PVOID *  DllHandle )

Definition at line 295 of file ldrapi.c. References DbgPrint, DLLEXTENSION, FALSE, L, LdrpCheckForLoadedDll(), LdrpGetModuleHandleCache, LdrpInLdrInit, LoaderLock, NTSTATUS(), NULL, RtlEqualUnicodeString(), RtlInitUnicodeString(), ShowSnaps, and TRUE. Referenced by CsrClientConnectToServer(). : This function locates the specified DLL and returns its handle. Arguments: DllPath - Supplies the search path to be used to locate the DLL. DllCharacteristics - Supplies an optional DLL characteristics flag, that if specified is used to match against the dll being loaded. DllName - Supplies the name of the DLL to load. DllHandle - Returns a handle to the loaded DLL. Return Value: TBD --*/ { NTSTATUS st; PPEB Peb; PTEB Teb; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; PWSTR ActualDllName; PWCH p, pp; UNICODE_STRING ActualDllNameStr; BOOLEAN Wx86KnownDll = FALSE; WCHAR FreeBuffer[266]; DllCharacteristics; Peb = NtCurrentPeb(); Teb = NtCurrentTeb(); st = STATUS_DLL_NOT_FOUND; try { // // Grab Peb lock // if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } #if defined (WX86) if (Teb->Wx86Thread.UseKnownWx86Dll) { Wx86KnownDll = Teb->Wx86Thread.UseKnownWx86Dll; Teb->Wx86Thread.UseKnownWx86Dll = FALSE; } // // No module handle cache lookup for Wx86, // (relies on unique basename) // if (Wx86ProcessInit) { LdrpGetModuleHandleCache = NULL; } #endif if ( LdrpGetModuleHandleCache ) { if (RtlEqualUnicodeString(DllName, &LdrpGetModuleHandleCache->BaseDllName, TRUE )) { *DllHandle = (PVOID)LdrpGetModuleHandleCache->DllBase; st = STATUS_SUCCESS; leave; } } p = DllName->Buffer; pp = NULL; while (*p) { if (*p++ == (WCHAR)'.') { // // pp will point to first character after last '.' // pp = p; } } ActualDllName = FreeBuffer; if ( DllName->Length >= sizeof(FreeBuffer)) { return STATUS_NAME_TOO_LONG; } RtlMoveMemory(ActualDllName, DllName->Buffer, DllName->Length); if (!pp || *pp == (WCHAR)'\\') { // // No extension found (just ..\) // if ( DllName->Length+10 >= sizeof(FreeBuffer) ) { return STATUS_NAME_TOO_LONG; } RtlMoveMemory((PCHAR)ActualDllName+DllName->Length, DLLEXTENSION, 10); } else { // // see if the name ends in . If it does, trim out the trailing // . // if ( ActualDllName[ (DllName->Length-2) >> 1] == L'.' ) { DllName->Length -= 2; } ActualDllName[DllName->Length >> 1] = UNICODE_NULL; } // // Check the LdrTable to see if Dll has already been loaded // into this image. // RtlInitUnicodeString(&ActualDllNameStr,ActualDllName); ActualDllNameStr.MaximumLength = sizeof(FreeBuffer); if (ShowSnaps) { DbgPrint("LDR: LdrGetDllHandle, searching for %ws from %ws\n", ActualDllName, ARGUMENT_PRESENT(DllPath) ? (DllPath == (PWSTR)1 ? L"" : DllPath) : L"" ); } // // sort of a hack, but done to speed up GetModuleHandle. kernel32 // now does a two pass call here to avoid computing // process dll path // if (LdrpCheckForLoadedDll( DllPath, &ActualDllNameStr, (BOOLEAN)(DllPath == (PWSTR)1 ? TRUE : FALSE), Wx86KnownDll, &LdrDataTableEntry ) ) { *DllHandle = (PVOID)LdrDataTableEntry->DllBase; LdrpGetModuleHandleCache = LdrDataTableEntry; st = STATUS_SUCCESS; } } finally { if ( LdrpInLdrInit == FALSE ) { RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } return st; }

NTSTATUS LdrGetProcedureAddress (  IN PVOID  DllHandle, IN PANSI_STRING ProcedureName  OPTIONAL, IN ULONG ProcedureNumber  OPTIONAL, OUT PVOID *  ProcedureAddress )

Definition at line 838 of file ldrapi.c. References LdrpGetProcedureAddress(), and TRUE. Referenced by CsrClientConnectToServer(), and LdrpInitializeProcess(). { return LdrpGetProcedureAddress(DllHandle,ProcedureName,ProcedureNumber,ProcedureAddress,TRUE); }

NTSTATUS LdrLoadDll (  IN PWSTR DllPath  OPTIONAL, IN PULONG DllCharacteristics  OPTIONAL, IN PUNICODE_STRING  DllName, OUT PVOID *  DllHandle )

Definition at line 35 of file ldrapi.c. References LdrpLoadDll(), and TRUE. Referenced by LdrpInitializeProcess(), and SetConsolePalette(). : This function loads a DLL into the calling process address space. Arguments: DllPath - Supplies the search path to be used to locate the DLL. DllCharacteristics - Supplies an optional DLL characteristics flag, that if specified is used to match against the dll being loaded. DllName - Supplies the name of the DLL to load. DllHandle - Returns a handle to the loaded DLL. Return Value: TBD --*/ { return LdrpLoadDll(DllPath,DllCharacteristics,DllName,DllHandle,TRUE); }

ULONG LdrpClearLoadInProgress (  VOID   )

Definition at line 622 of file ldrsnap.c. Referenced by LdrpLoadDll(), and LdrpRunInitializeRoutines(). { PLIST_ENTRY Head, Next; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; ULONG i; Head = &NtCurrentPeb()->Ldr->InInitializationOrderModuleList; Next = Head->Flink; i = 0; while ( Next != Head ) { LdrDataTableEntry = CONTAINING_RECORD(Next, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks); LdrDataTableEntry->Flags &= ~LDRP_LOAD_IN_PROGRESS; // // return the number of entries that have not been processed, but // have init routines // if ( !(LdrDataTableEntry->Flags & LDRP_ENTRY_PROCESSED) && LdrDataTableEntry->EntryPoint) { i++; } Next = Next->Flink; } return i; }

NTSTATUS LdrpGetProcedureAddress (  IN PVOID  DllHandle, IN PANSI_STRING ProcedureName  OPTIONAL, IN ULONG ProcedureNumber  OPTIONAL, OUT PVOID *  ProcedureAddress, IN BOOLEAN  RunInitRoutines )

Definition at line 851 of file ldrapi.c. References DbgPrint, EXCEPTION_EXECUTE_HANDLER, FALSE, LdrpCheckForLoadedDllHandle(), LdrpInLdrInit, LdrpRunInitializeRoutines(), LdrpSnapThunk(), LoaderLock, MAKE_TAG, NT_SUCCESS, NTSTATUS(), NULL, RtlAllocateHeap, RtlFreeHeap, RtlImageDirectoryEntryToData(), RtlImageNtHeader(), ShowSnaps, TEMP_TAG, TRUE, and USHORT. Referenced by LdrGetProcedureAddress(), and LdrpSnapThunk(). : This function locates the address of the specified procedure in the specified DLL and returns its address. Arguments: DllHandle - Supplies a handle to the DLL that the address is being looked up in. ProcedureName - Supplies that address of a string that contains the name of the procedure to lookup in the DLL. If this argument is not specified, then the ProcedureNumber is used. ProcedureNumber - Supplies the procedure number to lookup. If ProcedureName is specified, then this argument is ignored. Otherwise, it specifies the procedure ordinal number to locate in the DLL. ProcedureAddress - Returns the address of the procedure found in the DLL. Return Value: TBD --*/ { NTSTATUS st; UCHAR FunctionNameBuffer[64]; PUCHAR src, dst; ULONG cb, ExportSize; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; IMAGE_THUNK_DATA Thunk; PVOID ImageBase; PIMAGE_IMPORT_BY_NAME FunctionName; PIMAGE_EXPORT_DIRECTORY ExportDirectory; PLIST_ENTRY Next; #if defined (WX86) PTEB Teb; BOOLEAN Wx86KnownDll = FALSE; #endif if (ShowSnaps) { DbgPrint("LDR: LdrGetProcedureAddress by "); } #if defined (WX86) Teb = NtCurrentTeb(); if (Teb->Wx86Thread.UseKnownWx86Dll) { Wx86KnownDll = Teb->Wx86Thread.UseKnownWx86Dll; Teb->Wx86Thread.UseKnownWx86Dll = FALSE; } #endif FunctionName = NULL; if ( ARGUMENT_PRESENT(ProcedureName) ) { if (ShowSnaps) { DbgPrint("NAME - %s\n", ProcedureName->Buffer); } // // BUGBUG need STRING to PSZ // if (ProcedureName->Length >= sizeof( FunctionNameBuffer )-1 ) { FunctionName = RtlAllocateHeap(RtlProcessHeap(), MAKE_TAG( TEMP_TAG ),ProcedureName->Length+1+sizeof(USHORT)); if ( !FunctionName ) { return STATUS_INVALID_PARAMETER; } } else { FunctionName = (PIMAGE_IMPORT_BY_NAME) FunctionNameBuffer; } FunctionName->Hint = 0; cb = ProcedureName->Length; src = ProcedureName->Buffer; dst = FunctionName->Name; while (cb--) { *dst++ = *src++; } *dst = '\0'; // // Make sure we don't pass in address with high bit set so we // can still use it as ordinal flag // ImageBase = FunctionName; Thunk.u1.AddressOfData = 0; } else { ImageBase = NULL; if (ShowSnaps) { DbgPrint("ORDINAL - %lx\n", ProcedureNumber); } if (ProcedureNumber) { Thunk.u1.Ordinal = ProcedureNumber | IMAGE_ORDINAL_FLAG; } else { return STATUS_INVALID_PARAMETER; } } if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } try { if (!LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)) { st = STATUS_DLL_NOT_FOUND; return st; } ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData( LdrDataTableEntry->DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &ExportSize ); if (!ExportDirectory) { return STATUS_PROCEDURE_NOT_FOUND; } st = LdrpSnapThunk(LdrDataTableEntry->DllBase, ImageBase, &Thunk, &Thunk, ExportDirectory, ExportSize, FALSE, NULL ); if ( RunInitRoutines ) { PLDR_DATA_TABLE_ENTRY LdrInitEntry; // // Look at last entry in init order list. If entry processed // flag is not set, then a forwarded dll was loaded during the // getprocaddr call and we need to run init routines // Next = NtCurrentPeb()->Ldr->InInitializationOrderModuleList.Blink; LdrInitEntry = CONTAINING_RECORD(Next, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks); if ( !(LdrInitEntry->Flags & LDRP_ENTRY_PROCESSED) ) { try { st = LdrpRunInitializeRoutines(NULL); } except( EXCEPTION_EXECUTE_HANDLER ) { st = GetExceptionCode(); } } } if ( NT_SUCCESS(st) ) { *ProcedureAddress = (PVOID)Thunk.u1.Function; #if defined (WX86) // For dlls loaded as a Wx86 plugin ... if (Wx86ProcessInit && (LdrDataTableEntry->Flags & LDRP_WX86_PLUGIN)) { PVOID ExportThunk = NULL; USHORT MachineType = RtlImageNtHeader(LdrDataTableEntry->DllBase)->FileHeader.Machine; // and the GetProcAddress call is cross-architecture ... if ((!Wx86KnownDll && (MachineType == IMAGE_FILE_MACHINE_I386)) || (Wx86KnownDll && (MachineType != IMAGE_FILE_MACHINE_I386))) { // Thunk the export st = Wx86ThunkPluginExport(LdrDataTableEntry->DllBase, FunctionName? FunctionName->Name : NULL, ProcedureNumber, (PVOID)(Thunk.u1.Function), &ExportThunk ); if (NT_SUCCESS(st) && ExportThunk) { *ProcedureAddress = ExportThunk; } else { // Don't let unthunked cross-architecture addresses get out *ProcedureAddress = NULL; st = STATUS_INVALID_IMAGE_FORMAT; } } } #endif } } finally { if ( FunctionName && (FunctionName != (PIMAGE_IMPORT_BY_NAME) FunctionNameBuffer) ) { RtlFreeHeap(RtlProcessHeap(),0,FunctionName); } if ( LdrpInLdrInit == FALSE ) { RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } return st; }

NTSTATUS NTAPI LdrpLoadDll (  IN PWSTR DllPath  OPTIONAL, IN PULONG DllCharacteristics  OPTIONAL, IN PUNICODE_STRING  DllName, OUT PVOID *  DllHandle, IN BOOLEAN  RunInitRoutines )

Definition at line 70 of file ldrapi.c. References DbgPrint, DLLEXTENSION, EXCEPTION_EXECUTE_HANDLER, FALSE, L, LdrpCheckForLoadedDll(), LdrpClearLoadInProgress(), LdrpInLdrInit, LdrpLdrDatabaseIsSetup, LdrpMapDll(), LdrpReferenceLoadedDll, LdrpRunInitializeRoutines(), LdrpWalkImportDescriptor(), LdrUnloadDll(), LoaderLock, NT_SUCCESS, NTSTATUS(), NULL, RtlInitUnicodeString(), and ShowSnaps. Referenced by LdrLoadDll(), and LdrpSnapThunk(). { PPEB Peb; PTEB Teb; NTSTATUS st; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; PWSTR ActualDllName; PWCH p, pp; UNICODE_STRING ActualDllNameStr; BOOLEAN Wx86KnownDll = FALSE; WCHAR FreeBuffer[266]; Peb = NtCurrentPeb(); Teb = NtCurrentTeb(); st = STATUS_SUCCESS; try { // // Grab Peb lock and Snap All Links to specified DLL // if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } #if defined (WX86) if (Teb->Wx86Thread.UseKnownWx86Dll) { Wx86KnownDll = Teb->Wx86Thread.UseKnownWx86Dll; Teb->Wx86Thread.UseKnownWx86Dll = FALSE; } #endif p = DllName->Buffer; pp = NULL; while (*p) { if (*p++ == (WCHAR)'.') { // // pp will point to first character after last '.' // pp = p; } } ActualDllName = FreeBuffer; if ( DllName->Length >= sizeof(FreeBuffer)) { return STATUS_NAME_TOO_LONG; } RtlMoveMemory(ActualDllName, DllName->Buffer, DllName->Length); if (!pp || *pp == (WCHAR)'\\') { // // No extension found (just ..\) // if ( DllName->Length+10 >= sizeof(FreeBuffer) ) { return STATUS_NAME_TOO_LONG; } RtlMoveMemory((PCHAR)ActualDllName+DllName->Length, DLLEXTENSION, 10); } else { ActualDllName[DllName->Length >> 1] = UNICODE_NULL; } if (ShowSnaps) { DbgPrint("LDR: LdrLoadDll, loading %ws from %ws\n", ActualDllName, ARGUMENT_PRESENT(DllPath) ? DllPath : L"" ); } RtlInitUnicodeString(&ActualDllNameStr,ActualDllName); ActualDllNameStr.MaximumLength = sizeof(FreeBuffer); if (!LdrpCheckForLoadedDll( DllPath, &ActualDllNameStr, FALSE, Wx86KnownDll, &LdrDataTableEntry ) ) { st = LdrpMapDll(DllPath, ActualDllName, DllCharacteristics, FALSE, Wx86KnownDll, &LdrDataTableEntry ); if (!NT_SUCCESS(st)) { return st; } if (ARGUMENT_PRESENT( DllCharacteristics ) && *DllCharacteristics & IMAGE_FILE_EXECUTABLE_IMAGE ) { LdrDataTableEntry->EntryPoint = 0; LdrDataTableEntry->Flags &= ~LDRP_IMAGE_DLL; } // // and walk the import descriptor. // if (LdrDataTableEntry->Flags & LDRP_IMAGE_DLL) { try { st = LdrpWalkImportDescriptor( DllPath, LdrDataTableEntry ); } except(EXCEPTION_EXECUTE_HANDLER) { st = GetExceptionCode(); } if ( LdrDataTableEntry->LoadCount != 0xffff ) { LdrDataTableEntry->LoadCount++; } LdrpReferenceLoadedDll(LdrDataTableEntry); if (!NT_SUCCESS(st)) { LdrDataTableEntry->EntryPoint = NULL; InsertTailList(&NtCurrentPeb()->Ldr->InInitializationOrderModuleList, &LdrDataTableEntry->InInitializationOrderLinks); LdrpClearLoadInProgress(); LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase); return st; } } else { if ( LdrDataTableEntry->LoadCount != 0xffff ) { LdrDataTableEntry->LoadCount++; } } // // Add init routine to list // InsertTailList(&NtCurrentPeb()->Ldr->InInitializationOrderModuleList, &LdrDataTableEntry->InInitializationOrderLinks); // // If the loader data base is not fully setup, this load was because // of a forwarder in the static load set. Can't run init routines // yet because the load counts are NOT set // if ( RunInitRoutines && LdrpLdrDatabaseIsSetup ) { try { st = LdrpRunInitializeRoutines(NULL); if ( !NT_SUCCESS(st) ) { LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase); } } except( EXCEPTION_EXECUTE_HANDLER ) { LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase); return GetExceptionCode(); } } else { st = STATUS_SUCCESS; } } else { // // Count it. And everything that it imports. // if ( LdrDataTableEntry->Flags & LDRP_IMAGE_DLL && LdrDataTableEntry->LoadCount != 0xffff ) { LdrDataTableEntry->LoadCount++; LdrpReferenceLoadedDll(LdrDataTableEntry); // // Now clear the Load in progress bits // LdrpClearLoadInProgress(); } else { if ( LdrDataTableEntry->LoadCount != 0xffff ) { LdrDataTableEntry->LoadCount++; } } } } finally { if ( LdrpInLdrInit == FALSE ) { RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } if ( NT_SUCCESS(st) ) { *DllHandle = (PVOID)LdrDataTableEntry->DllBase; } else { *DllHandle = NULL; } return st; }

NTSTATUS LdrQueryProcessModuleInformation (  OUT PRTL_PROCESS_MODULES  ModuleInformation, IN ULONG  ModuleInformationLength, OUT PULONG ReturnLength  OPTIONAL )

Definition at line 1210 of file ldrapi.c. References FALSE, LdrpInLdrInit, LoaderLock, NTSTATUS(), NULL, RtlUnicodeStringToAnsiString(), Status, and USHORT. Referenced by RtlQueryProcessModuleInformation(). { NTSTATUS Status; PPEB Peb; PLIST_ENTRY LoadOrderListHead; PLIST_ENTRY InitOrderListHead; ULONG RequiredLength; PLIST_ENTRY Next; PLIST_ENTRY Next1; PRTL_PROCESS_MODULE_INFORMATION ModuleInfo; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry1; ANSI_STRING AnsiString; PUCHAR s; Peb = NtCurrentPeb(); // // Grab Peb lock and capture information about of DLLs loaded in current process. // if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } try { RequiredLength = FIELD_OFFSET( RTL_PROCESS_MODULES, Modules ); if (ModuleInformationLength < RequiredLength) { Status = STATUS_INFO_LENGTH_MISMATCH; ModuleInfo = NULL; } else { ModuleInformation->NumberOfModules = 0; ModuleInfo = &ModuleInformation->Modules[ 0 ]; Status = STATUS_SUCCESS; } LoadOrderListHead = &Peb->Ldr->InLoadOrderModuleList; InitOrderListHead = &Peb->Ldr->InInitializationOrderModuleList; Next = LoadOrderListHead->Flink; while ( Next != LoadOrderListHead ) { LdrDataTableEntry = CONTAINING_RECORD( Next, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks ); RequiredLength += sizeof( RTL_PROCESS_MODULE_INFORMATION ); if (ModuleInformationLength < RequiredLength) { Status = STATUS_INFO_LENGTH_MISMATCH; } else { ModuleInfo->MappedBase = NULL; ModuleInfo->ImageBase = LdrDataTableEntry->DllBase; ModuleInfo->ImageSize = LdrDataTableEntry->SizeOfImage; ModuleInfo->Flags = LdrDataTableEntry->Flags; ModuleInfo->LoadCount = LdrDataTableEntry->LoadCount; ModuleInfo->LoadOrderIndex = (USHORT)(ModuleInformation->NumberOfModules); ModuleInfo->InitOrderIndex = 0; Next1 = InitOrderListHead->Flink; while ( Next1 != InitOrderListHead ) { LdrDataTableEntry1 = CONTAINING_RECORD( Next1, LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks ); ModuleInfo->InitOrderIndex++; if (LdrDataTableEntry1 == LdrDataTableEntry) { break; } Next1 = Next1->Flink; } AnsiString.Buffer = ModuleInfo->FullPathName; AnsiString.Length = 0; AnsiString.MaximumLength = sizeof( ModuleInfo->FullPathName ); RtlUnicodeStringToAnsiString( &AnsiString, &LdrDataTableEntry->FullDllName, FALSE ); s = AnsiString.Buffer + AnsiString.Length; while (s > AnsiString.Buffer && *--s) { if (*s == (UCHAR)OBJ_NAME_PATH_SEPARATOR) { s++; break; } } ModuleInfo->OffsetToFileName = (USHORT)(s - AnsiString.Buffer); ModuleInfo++; } if (ModuleInformation != NULL) { ModuleInformation->NumberOfModules++; } Next = Next->Flink; } if (ARGUMENT_PRESENT( ReturnLength )) { *ReturnLength = RequiredLength; } } finally { if ( LdrpInLdrInit == FALSE ) { RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } return( Status ); }

NTSTATUS LdrUnloadDll (  IN PVOID  DllHandle  )

Definition at line 528 of file ldrapi.c. References ASSERT, DbgPrint, EXCEPTION_EXECUTE_HANDLER, FALSE, LdrpActiveUnloadCount, LdrpCallInitRoutine, LdrpCheckForLoadedDllHandle(), LdrpDereferenceLoadedDll, LdrpGetModuleHandleCache, LdrpInLdrInit, LdrpLoadedDllHandleCache, LdrpShutdownInProgress, LdrpUnloadHead, LdrUnloadAlternateResourceModule(), LoaderLock, NT_SUCCESS, NTSTATUS(), NtUnmapViewOfSection(), NULL, RtlFreeHeap, RtlFreeUnicodeString(), and ShowSnaps. Referenced by LdrpLoadDll(). : This function unloads the DLL from the specified process Arguments: DllHandle - Supplies a handle to the DLL to unload. Return Value: TBD --*/ { NTSTATUS st; PPEB Peb; PLDR_DATA_TABLE_ENTRY LdrDataTableEntry; PLDR_DATA_TABLE_ENTRY Entry; PDLL_INIT_ROUTINE InitRoutine; LIST_ENTRY LocalUnloadHead; PLIST_ENTRY Next; #if defined (WX86) PVOID Wx86Plugin = NULL; #endif Peb = NtCurrentPeb(); st = STATUS_SUCCESS; try { // // Grab Peb lock and decrement reference count of all affected DLLs // if ( LdrpInLdrInit == FALSE ) { RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } LdrpActiveUnloadCount++; if ( LdrpShutdownInProgress ) { goto leave_finally; } if (!LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)) { st = STATUS_DLL_NOT_FOUND; goto leave_finally; } // // Now that we have the data table entry, unload it // if ( LdrDataTableEntry->LoadCount != 0xffff ) { LdrDataTableEntry->LoadCount--; if ( LdrDataTableEntry->Flags & LDRP_IMAGE_DLL ) { LdrpDereferenceLoadedDll(LdrDataTableEntry); } } else { // // if the load count is 0xffff, then we do not need to recurse // through this DLL's import table. // // Additionally, we don't have to scan more LoadCount == 0 // modules since nothing could have happened as a result of a free on this // DLL. goto leave_finally; } // // Now process init routines and then in a second pass, unload // DLLs // if (ShowSnaps) { DbgPrint("LDR: UNINIT LIST\n"); } if (LdrpActiveUnloadCount == 1 ) { InitializeListHead(&LdrpUnloadHead); } // // Go in reverse order initialization order and build // the unload list // Next = Peb->Ldr->InInitializationOrderModuleList.Blink; while ( Next != &Peb->Ldr->InInitializationOrderModuleList) { LdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY) (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,InInitializationOrderLinks)); Next = Next->Blink; LdrDataTableEntry->Flags &= ~LDRP_UNLOAD_IN_PROGRESS; if (LdrDataTableEntry->LoadCount == 0) { if (ShowSnaps) { DbgPrint(" (%d) [%ws] %ws (%lx) deinit %lx\n", LdrpActiveUnloadCount, LdrDataTableEntry->BaseDllName.Buffer, LdrDataTableEntry->FullDllName.Buffer, (ULONG)LdrDataTableEntry->LoadCount, LdrDataTableEntry->EntryPoint ); } Entry = LdrDataTableEntry; RemoveEntryList(&Entry->InInitializationOrderLinks); RemoveEntryList(&Entry->InMemoryOrderLinks); RemoveEntryList(&Entry->HashLinks); if ( LdrpActiveUnloadCount > 1 ) { LdrpLoadedDllHandleCache = NULL; Entry->InMemoryOrderLinks.Flink = NULL; } InsertTailList(&LdrpUnloadHead,&Entry->HashLinks); } } // // End of new code // // // We only do init routine call's and module free's at the top level, // so if the active count is > 1, just return // if (LdrpActiveUnloadCount > 1 ) { goto leave_finally; } // // Now that the unload list is built, walk through the unload // list in order and call the init routine. The dll must remain // on the InLoadOrderLinks so that the pctoheader stuff will // still work // InitializeListHead(&LocalUnloadHead); Entry = NULL; Next = LdrpUnloadHead.Flink; while ( Next != &LdrpUnloadHead ) { top: if ( Entry ) { RemoveEntryList(&(Entry->InLoadOrderLinks)); Entry = NULL; Next = LdrpUnloadHead.Flink; if (Next == &LdrpUnloadHead ) { goto bottom; } } LdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY) (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,HashLinks)); // // Remove dll from the global unload list and place // on the local unload list. This is because the global list // can change during the callout to the init routine // Entry = LdrDataTableEntry; LdrpLoadedDllHandleCache = NULL; Entry->InMemoryOrderLinks.Flink = NULL; RemoveEntryList(&Entry->HashLinks); InsertTailList(&LocalUnloadHead,&Entry->HashLinks); // // If the function has an init routine, call it. // InitRoutine = (PDLL_INIT_ROUTINE)LdrDataTableEntry->EntryPoint; #if defined (WX86) if (Wx86ProcessInit) { try { LdrpWx86DllProcessDetach(LdrDataTableEntry); RemoveEntryList(&Entry->InLoadOrderLinks); Entry = NULL; Next = LdrpUnloadHead.Flink; } except(EXCEPTION_EXECUTE_HANDLER){ goto top; } } else #endif if (InitRoutine && (LdrDataTableEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) ) { try { if (ShowSnaps) { DbgPrint("LDR: Calling deinit %lx\n",InitRoutine); } LdrpCallInitRoutine(InitRoutine, LdrDataTableEntry->DllBase, DLL_PROCESS_DETACH, NULL); RemoveEntryList(&Entry->InLoadOrderLinks); Entry = NULL; Next = LdrpUnloadHead.Flink; } except(EXCEPTION_EXECUTE_HANDLER){ goto top; } } else { RemoveEntryList(&(Entry->InLoadOrderLinks)); Entry = NULL; Next = LdrpUnloadHead.Flink; } } bottom: #if defined (WX86) if (Wx86ProcessInit) { // // Notify Wx86 that the modules are about to be unmapped. This // must be done in a separate pass from the unmap loop, as wx86.dll // might be in the list of modules to unmap. // Next = LocalUnloadHead.Flink; while ( Next != &LocalUnloadHead ) { LdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY) (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,HashLinks)); Next = Next->Flink; LdrpWx86DllMapNotify(LdrDataTableEntry->DllBase, FALSE); // Remember if we are unloading a plugin dll if ((LdrDataTableEntry->DllBase == DllHandle) && (LdrDataTableEntry->Flags & LDRP_WX86_PLUGIN)) { Wx86Plugin = DllHandle; } } } #endif // // Now, go through the modules and unmap them // Next = LocalUnloadHead.Flink; while ( Next != &LocalUnloadHead ) { LdrDataTableEntry = (PLDR_DATA_TABLE_ENTRY) (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,HashLinks)); Next = Next->Flink; Entry = LdrDataTableEntry; if (ShowSnaps) { DbgPrint("LDR: Unmapping [%ws]\n", LdrDataTableEntry->BaseDllName.Buffer ); } st = NtUnmapViewOfSection(NtCurrentProcess(),Entry->DllBase); ASSERT(NT_SUCCESS(st)); LdrUnloadAlternateResourceModule(Entry->DllBase); if (Entry->FullDllName.Buffer) { RtlFreeUnicodeString(&Entry->FullDllName); } if (Entry->BaseDllName.Buffer) { RtlFreeUnicodeString(&Entry->BaseDllName); } if ( Entry == LdrpGetModuleHandleCache ) { LdrpGetModuleHandleCache = NULL; } RtlFreeHeap(Peb->ProcessHeap, 0,Entry); } leave_finally:; } finally { LdrpActiveUnloadCount--; if ( LdrpInLdrInit == FALSE ) { #if defined (WX86) if (Wx86ProcessInit && Wx86Plugin) { Wx86UnloadProviders( Wx86Plugin ); } #endif RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)NtCurrentPeb()->LoaderLock); } } return st; }

NTSTATUS NTAPI LdrVerifyImageMatchesChecksum (  IN HANDLE  ImageFileHandle, IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine  OPTIONAL, IN PVOID  ImportCallbackParameter, OUT PUSHORT ImageCharacteristics  OPTIONAL )

Definition at line 1069 of file ldrapi.c. References EXCEPTION_EXECUTE_HANDLER, FALSE, L, LdrVerifyMappedImageMatchesChecksum(), NT_SUCCESS, NtClose(), NtCreateSection(), NtMapViewOfSection(), NtQueryInformationFile(), NTSTATUS(), NtUnmapViewOfSection(), NULL, RtlImageDirectoryEntryToData(), RtlImageNtHeader(), RtlImageRvaToVa(), Status, and TRUE. { NTSTATUS Status; HANDLE Section; PVOID ViewBase; SIZE_T ViewSize; IO_STATUS_BLOCK IoStatusBlock; FILE_STANDARD_INFORMATION StandardInfo; PIMAGE_SECTION_HEADER LastRvaSection; BOOLEAN b; BOOLEAN JustDoSideEffects; // // stevewo added all sorts of side effects to this API. We want to stop // doing checksums for known dll's, but really want the sideeffects // (ImageCharacteristics write, and Import descriptor walk). // if ( (UINT_PTR) ImageFileHandle & 1 ) { JustDoSideEffects = TRUE; } else { JustDoSideEffects = FALSE; } Status = NtCreateSection( &Section, SECTION_MAP_EXECUTE, NULL, NULL, PAGE_EXECUTE, SEC_COMMIT, ImageFileHandle ); if ( !NT_SUCCESS(Status) ) { return Status; } ViewBase = NULL; ViewSize = 0; Status = NtMapViewOfSection( Section, NtCurrentProcess(), (PVOID *)&ViewBase, 0L, 0L, NULL, &ViewSize, ViewShare, 0L, PAGE_EXECUTE ); if ( !NT_SUCCESS(Status) ) { NtClose(Section); return Status; } // // now the image is mapped as a data file... Calculate it's size and then // check it's checksum // Status = NtQueryInformationFile( ImageFileHandle, &IoStatusBlock, &StandardInfo, sizeof(StandardInfo), FileStandardInformation ); if ( !NT_SUCCESS(Status) ) { NtUnmapViewOfSection(NtCurrentProcess(),ViewBase); NtClose(Section); return Status; } try { if ( JustDoSideEffects ) { b = TRUE; } else { b = LdrVerifyMappedImageMatchesChecksum(ViewBase,StandardInfo.EndOfFile.LowPart); } if (b && ARGUMENT_PRESENT( ImportCallbackRoutine )) { PIMAGE_NT_HEADERS NtHeaders; PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor; ULONG ImportSize; PCHAR ImportName; // // Caller wants to enumerate the import descriptors while we have // the image mapped. Call back to their routine for each module // name in the import descriptor table. // LastRvaSection = NULL; NtHeaders = RtlImageNtHeader( ViewBase ); if (ARGUMENT_PRESENT( ImageCharacteristics )) { *ImageCharacteristics = NtHeaders->FileHeader.Characteristics; } ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR) RtlImageDirectoryEntryToData( ViewBase, FALSE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ImportSize ); if (ImportDescriptor != NULL) { while (ImportDescriptor->Name) { ImportName = (PSZ)RtlImageRvaToVa( NtHeaders, ViewBase, ImportDescriptor->Name, &LastRvaSection ); (*ImportCallbackRoutine)( ImportCallbackParameter, ImportName ); ImportDescriptor += 1; } } } } except (EXCEPTION_EXECUTE_HANDLER) { NtUnmapViewOfSection(NtCurrentProcess(),ViewBase); NtClose(Section); return STATUS_IMAGE_CHECKSUM_MISMATCH; } NtUnmapViewOfSection(NtCurrentProcess(),ViewBase); NtClose(Section); if ( !b ) { Status = STATUS_IMAGE_CHECKSUM_MISMATCH; } return Status; }

---