542 lines
12 KiB
C
542 lines
12 KiB
C
#ifndef _NTLDR_H
|
|
#define _NTLDR_H
|
|
|
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
|
|
|
// DLLs
|
|
|
|
// symbols
|
|
typedef struct _LDR_SERVICE_TAG_RECORD
|
|
{
|
|
struct _LDR_SERVICE_TAG_RECORD *Next;
|
|
ULONG ServiceTag;
|
|
} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
|
|
|
|
// symbols
|
|
typedef struct _LDRP_CSLIST
|
|
{
|
|
PSINGLE_LIST_ENTRY Tail;
|
|
} LDRP_CSLIST, *PLDRP_CSLIST;
|
|
|
|
// symbols
|
|
typedef enum _LDR_DDAG_STATE
|
|
{
|
|
LdrModulesMerged = -5,
|
|
LdrModulesInitError = -4,
|
|
LdrModulesSnapError = -3,
|
|
LdrModulesUnloaded = -2,
|
|
LdrModulesUnloading = -1,
|
|
LdrModulesPlaceHolder = 0,
|
|
LdrModulesMapping = 1,
|
|
LdrModulesMapped = 2,
|
|
LdrModulesWaitingForDependencies = 3,
|
|
LdrModulesSnapping = 4,
|
|
LdrModulesSnapped = 5,
|
|
LdrModulesCondensed = 6,
|
|
LdrModulesReadyToInit = 7,
|
|
LdrModulesInitializing = 8,
|
|
LdrModulesReadyToRun = 9
|
|
} LDR_DDAG_STATE;
|
|
|
|
// symbols
|
|
typedef struct _LDR_DDAG_NODE
|
|
{
|
|
LIST_ENTRY Modules;
|
|
PLDR_SERVICE_TAG_RECORD ServiceTagList;
|
|
ULONG LoadCount;
|
|
ULONG ReferenceCount;
|
|
ULONG DependencyCount;
|
|
union
|
|
{
|
|
LDRP_CSLIST Dependencies;
|
|
SINGLE_LIST_ENTRY RemovalLink;
|
|
};
|
|
LDRP_CSLIST IncomingDependencies;
|
|
LDR_DDAG_STATE State;
|
|
SINGLE_LIST_ENTRY CondenseLink;
|
|
ULONG PreorderNumber;
|
|
ULONG LowestLink;
|
|
} LDR_DDAG_NODE, *PLDR_DDAG_NODE;
|
|
|
|
// rev
|
|
typedef struct _LDR_DEPENDENCY_RECORD
|
|
{
|
|
SINGLE_LIST_ENTRY DependencyLink;
|
|
PLDR_DDAG_NODE DependencyNode;
|
|
SINGLE_LIST_ENTRY IncomingDependencyLink;
|
|
PLDR_DDAG_NODE IncomingDependencyNode;
|
|
} LDR_DEPENDENCY_RECORD, *PLDR_DEPENDENCY_RECORD;
|
|
|
|
// symbols
|
|
typedef enum _LDR_DLL_LOAD_REASON
|
|
{
|
|
LoadReasonStaticDependency,
|
|
LoadReasonStaticForwarderDependency,
|
|
LoadReasonDynamicForwarderDependency,
|
|
LoadReasonDelayloadDependency,
|
|
LoadReasonDynamicLoad,
|
|
LoadReasonAsImageLoad,
|
|
LoadReasonAsDataLoad,
|
|
LoadReasonUnknown = -1
|
|
} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
|
|
|
|
#define LDRP_PACKAGED_BINARY 0x00000001
|
|
#define LDRP_IMAGE_DLL 0x00000004
|
|
#define LDRP_LOAD_IN_PROGRESS 0x00001000
|
|
#define LDRP_ENTRY_PROCESSED 0x00004000
|
|
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
|
|
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
|
|
#define LDRP_PROCESS_ATTACH_FAILED 0x00100000
|
|
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 // Vista and below
|
|
#define LDRP_COR_IMAGE 0x00400000
|
|
#define LDRP_DONT_RELOCATE 0x00800000
|
|
#define LDRP_REDIRECTED 0x10000000
|
|
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000
|
|
|
|
// Use the size of the structure as it was in Windows XP.
|
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
|
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)
|
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)
|
|
|
|
// symbols
|
|
typedef struct _LDR_DATA_TABLE_ENTRY
|
|
{
|
|
LIST_ENTRY InLoadOrderLinks;
|
|
LIST_ENTRY InMemoryOrderLinks;
|
|
union
|
|
{
|
|
LIST_ENTRY InInitializationOrderLinks;
|
|
LIST_ENTRY InProgressLinks;
|
|
};
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
union
|
|
{
|
|
UCHAR FlagGroup[4];
|
|
ULONG Flags;
|
|
struct
|
|
{
|
|
ULONG PackagedBinary : 1;
|
|
ULONG MarkedForRemoval : 1;
|
|
ULONG ImageDll : 1;
|
|
ULONG LoadNotificationsSent : 1;
|
|
ULONG TelemetryEntryProcessed : 1;
|
|
ULONG ProcessStaticImport : 1;
|
|
ULONG InLegacyLists : 1;
|
|
ULONG InIndexes : 1;
|
|
ULONG ShimDll : 1;
|
|
ULONG InExceptionTable : 1;
|
|
ULONG ReservedFlags1 : 2;
|
|
ULONG LoadInProgress : 1;
|
|
ULONG LoadConfigProcessed : 1;
|
|
ULONG EntryProcessed : 1;
|
|
ULONG ProtectDelayLoad : 1;
|
|
ULONG ReservedFlags3 : 2;
|
|
ULONG DontCallForThreads : 1;
|
|
ULONG ProcessAttachCalled : 1;
|
|
ULONG ProcessAttachFailed : 1;
|
|
ULONG CorDeferredValidate : 1;
|
|
ULONG CorImage : 1;
|
|
ULONG DontRelocate : 1;
|
|
ULONG CorILOnly : 1;
|
|
ULONG ReservedFlags5 : 3;
|
|
ULONG Redirected : 1;
|
|
ULONG ReservedFlags6 : 2;
|
|
ULONG CompatDatabaseProcessed : 1;
|
|
};
|
|
};
|
|
USHORT ObsoleteLoadCount;
|
|
USHORT TlsIndex;
|
|
LIST_ENTRY HashLinks;
|
|
ULONG TimeDateStamp;
|
|
struct _ACTIVATION_CONTEXT *EntryPointActivationContext;
|
|
PVOID Lock;
|
|
PLDR_DDAG_NODE DdagNode;
|
|
LIST_ENTRY NodeModuleLink;
|
|
struct _LDRP_LOAD_CONTEXT *LoadContext;
|
|
PVOID ParentDllBase;
|
|
PVOID SwitchBackContext;
|
|
RTL_BALANCED_NODE BaseAddressIndexNode;
|
|
RTL_BALANCED_NODE MappingInfoIndexNode;
|
|
ULONG_PTR OriginalBase;
|
|
LARGE_INTEGER LoadTime;
|
|
ULONG BaseNameHashValue;
|
|
LDR_DLL_LOAD_REASON LoadReason;
|
|
ULONG ImplicitPathOptions;
|
|
ULONG ReferenceCount;
|
|
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef BOOLEAN (NTAPI *PDLL_INIT_ROUTINE)(
|
|
_In_ PVOID DllHandle,
|
|
_In_ ULONG Reason,
|
|
_In_opt_ PCONTEXT Context
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrLoadDll(
|
|
_In_opt_ PWSTR DllPath,
|
|
_In_opt_ PULONG DllCharacteristics,
|
|
_In_ PUNICODE_STRING DllName,
|
|
_Out_ PVOID *DllHandle
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrUnloadDll(
|
|
_In_ PVOID DllHandle
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetDllHandle(
|
|
_In_opt_ PWSTR DllPath,
|
|
_In_opt_ PULONG DllCharacteristics,
|
|
_In_ PUNICODE_STRING DllName,
|
|
_Out_ PVOID *DllHandle
|
|
);
|
|
|
|
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001
|
|
#define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetDllHandleEx(
|
|
_In_ ULONG Flags,
|
|
_In_opt_ PCWSTR DllPath,
|
|
_In_opt_ PULONG DllCharacteristics,
|
|
_In_ PUNICODE_STRING DllName,
|
|
_Out_opt_ PVOID *DllHandle
|
|
);
|
|
|
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
|
// rev
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetDllHandleByMapping(
|
|
_In_ PVOID Base,
|
|
_Out_ PVOID *DllHandle
|
|
);
|
|
#endif
|
|
|
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
|
// rev
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetDllHandleByName(
|
|
_In_opt_ PUNICODE_STRING BaseDllName,
|
|
_In_opt_ PUNICODE_STRING FullDllName,
|
|
_Out_ PVOID *DllHandle
|
|
);
|
|
#endif
|
|
|
|
#define LDR_ADDREF_DLL_PIN 0x00000001
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrAddRefDll(
|
|
_In_ ULONG Flags,
|
|
_In_ PVOID DllHandle
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetProcedureAddress(
|
|
_In_ PVOID DllHandle,
|
|
_In_opt_ PANSI_STRING ProcedureName,
|
|
_In_opt_ ULONG ProcedureNumber,
|
|
_Out_ PVOID *ProcedureAddress
|
|
);
|
|
|
|
// rev
|
|
#define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001
|
|
|
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetProcedureAddressEx(
|
|
_In_ PVOID DllHandle,
|
|
_In_opt_ PANSI_STRING ProcedureName,
|
|
_In_opt_ ULONG ProcedureNumber,
|
|
_Out_ PVOID *ProcedureAddress,
|
|
_In_ ULONG Flags
|
|
);
|
|
#endif
|
|
|
|
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
|
|
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002
|
|
|
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0
|
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1
|
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrLockLoaderLock(
|
|
_In_ ULONG Flags,
|
|
_Out_opt_ ULONG *Disposition,
|
|
_Out_ PVOID *Cookie
|
|
);
|
|
|
|
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrUnlockLoaderLock(
|
|
_In_ ULONG Flags,
|
|
_Inout_ PVOID Cookie
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrRelocateImage(
|
|
_In_ PVOID NewBase,
|
|
_In_ PSTR LoaderName,
|
|
_In_ NTSTATUS Success,
|
|
_In_ NTSTATUS Conflict,
|
|
_In_ NTSTATUS Invalid
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrRelocateImageWithBias(
|
|
_In_ PVOID NewBase,
|
|
_In_ LONGLONG Bias,
|
|
_In_ PSTR LoaderName,
|
|
_In_ NTSTATUS Success,
|
|
_In_ NTSTATUS Conflict,
|
|
_In_ NTSTATUS Invalid
|
|
);
|
|
|
|
NTSYSAPI
|
|
PIMAGE_BASE_RELOCATION
|
|
NTAPI
|
|
LdrProcessRelocationBlock(
|
|
_In_ ULONG_PTR VA,
|
|
_In_ ULONG SizeOfBlock,
|
|
_In_ PUSHORT NextOffset,
|
|
_In_ LONG_PTR Diff
|
|
);
|
|
|
|
NTSYSAPI
|
|
BOOLEAN
|
|
NTAPI
|
|
LdrVerifyMappedImageMatchesChecksum(
|
|
_In_ PVOID BaseAddress,
|
|
_In_ SIZE_T NumberOfBytes,
|
|
_In_ ULONG FileLength
|
|
);
|
|
|
|
typedef VOID (NTAPI *PLDR_IMPORT_MODULE_CALLBACK)(
|
|
_In_ PVOID Parameter,
|
|
_In_ PSTR ModuleName
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrVerifyImageMatchesChecksum(
|
|
_In_ HANDLE ImageFileHandle,
|
|
_In_opt_ PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine,
|
|
_In_ PVOID ImportCallbackParameter,
|
|
_Out_opt_ PUSHORT ImageCharacteristics
|
|
);
|
|
|
|
// private
|
|
typedef struct _LDR_IMPORT_CALLBACK_INFO
|
|
{
|
|
PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine;
|
|
PVOID ImportCallbackParameter;
|
|
} LDR_IMPORT_CALLBACK_INFO, *PLDR_IMPORT_CALLBACK_INFO;
|
|
|
|
// private
|
|
typedef struct _LDR_SECTION_INFO
|
|
{
|
|
HANDLE SectionHandle;
|
|
ACCESS_MASK DesiredAccess;
|
|
POBJECT_ATTRIBUTES ObjA;
|
|
ULONG SectionPageProtection;
|
|
ULONG AllocationAttributes;
|
|
} LDR_SECTION_INFO, *PLDR_SECTION_INFO;
|
|
|
|
// private
|
|
typedef struct _LDR_VERIFY_IMAGE_INFO
|
|
{
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
LDR_IMPORT_CALLBACK_INFO CallbackInfo;
|
|
LDR_SECTION_INFO SectionInfo;
|
|
USHORT ImageCharacteristics;
|
|
} LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO;
|
|
|
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrVerifyImageMatchesChecksumEx(
|
|
_In_ HANDLE ImageFileHandle,
|
|
_Inout_ PLDR_VERIFY_IMAGE_INFO VerifyInfo
|
|
);
|
|
#endif
|
|
|
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrQueryModuleServiceTags(
|
|
_In_ PVOID DllHandle,
|
|
_Out_writes_(*BufferSize) PULONG ServiceTagBuffer,
|
|
_Inout_ PULONG BufferSize
|
|
);
|
|
#endif
|
|
|
|
// begin_msdn:"DLL Load Notification"
|
|
|
|
#define LDR_DLL_NOTIFICATION_REASON_LOADED 1
|
|
#define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2
|
|
|
|
typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
|
|
{
|
|
ULONG Flags;
|
|
PUNICODE_STRING FullDllName;
|
|
PUNICODE_STRING BaseDllName;
|
|
PVOID DllBase;
|
|
ULONG SizeOfImage;
|
|
} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;
|
|
|
|
typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA
|
|
{
|
|
ULONG Flags;
|
|
PCUNICODE_STRING FullDllName;
|
|
PCUNICODE_STRING BaseDllName;
|
|
PVOID DllBase;
|
|
ULONG SizeOfImage;
|
|
} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
|
|
|
|
typedef union _LDR_DLL_NOTIFICATION_DATA
|
|
{
|
|
LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
|
|
LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
|
|
} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;
|
|
|
|
typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(
|
|
_In_ ULONG NotificationReason,
|
|
_In_ PLDR_DLL_NOTIFICATION_DATA NotificationData,
|
|
_In_opt_ PVOID Context
|
|
);
|
|
|
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrRegisterDllNotification(
|
|
_In_ ULONG Flags,
|
|
_In_ PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
|
|
_In_ PVOID Context,
|
|
_Out_ PVOID *Cookie
|
|
);
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrUnregisterDllNotification(
|
|
_In_ PVOID Cookie
|
|
);
|
|
|
|
#endif
|
|
|
|
// end_msdn
|
|
|
|
// Load as data table
|
|
|
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
|
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrAddLoadAsDataTable(
|
|
_In_ PVOID Module,
|
|
_In_ PWSTR FilePath,
|
|
_In_ SIZE_T Size,
|
|
_In_ HANDLE Handle
|
|
);
|
|
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrRemoveLoadAsDataTable(
|
|
_In_ PVOID InitModule,
|
|
_Out_opt_ PVOID *BaseModule,
|
|
_Out_opt_ PSIZE_T Size,
|
|
_In_ ULONG Flags
|
|
);
|
|
|
|
// private
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetFileNameFromLoadAsDataTable(
|
|
_In_ PVOID Module,
|
|
_Out_ PVOID *pFileNamePrt
|
|
);
|
|
|
|
#endif
|
|
|
|
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
|
|
|
|
// Module information
|
|
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
|
{
|
|
HANDLE Section;
|
|
PVOID MappedBase;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[256];
|
|
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
|
|
|
|
typedef struct _RTL_PROCESS_MODULES
|
|
{
|
|
ULONG NumberOfModules;
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
|
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
|
|
|
|
// private
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
|
|
{
|
|
USHORT NextOffset;
|
|
RTL_PROCESS_MODULE_INFORMATION BaseInfo;
|
|
ULONG ImageChecksum;
|
|
ULONG TimeDateStamp;
|
|
PVOID DefaultBase;
|
|
} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;
|
|
|
|
#endif
|