0d95d61183eab7b2c174f5cc2f4e8f3e073ea2c6
[reactos.git] / dll / appcompat / apphelp / shimeng.c
1 /*
2 * PROJECT: ReactOS Application compatibility module
3 * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
4 * PURPOSE: Shim engine core
5 * COPYRIGHT: Copyright 2015-2017 Mark Jansen (mark.jansen@reactos.org)
6 */
7
8 #define WIN32_NO_STATUS
9 #include "ntndk.h"
10 #define IN_APPHELP
11 #include "shimlib.h"
12 #include <strsafe.h>
13 /* Make sure we don't include apphelp logging */
14 #define APPHELP_NOSDBPAPI
15 #include "apphelp.h"
16 #include "shimeng.h"
17
18
19
20 FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName);
21 BOOL WINAPI SE_IsShimDll(PVOID BaseAddress);
22
23
24 extern HMODULE g_hInstance;
25 static UNICODE_STRING g_WindowsDirectory;
26 static UNICODE_STRING g_System32Directory;
27 static UNICODE_STRING g_SxsDirectory;
28 ULONG g_ShimEngDebugLevel = 0xffffffff;
29 BOOL g_bComPlusImage = FALSE;
30 BOOL g_bShimDuringInit = FALSE;
31 BOOL g_bInternalHooksUsed = FALSE;
32 static ARRAY g_pShimInfo; /* PSHIMMODULE */
33 static ARRAY g_pHookArray; /* HOOKMODULEINFO */
34 static ARRAY g_InExclude; /* INEXCLUDE */
35
36 /* If we have setup a hook for a function, we should also redirect GetProcAddress for this function */
37 HOOKAPIEX g_IntHookEx[] =
38 {
39 {
40 "kernel32.dll", /* LibraryName */
41 "GetProcAddress", /* FunctionName */
42 StubGetProcAddress, /* ReplacementFunction*/
43 NULL, /* OriginalFunction */
44 NULL, /* pShimInfo */
45 NULL /* Unused */
46 },
47 };
48
49 static inline BOOL ARRAY_InitWorker(PARRAY Array, DWORD ItemSize)
50 {
51 Array->Data__ = NULL;
52 Array->Size__ = Array->MaxSize__ = 0;
53 Array->ItemSize__ = ItemSize;
54
55 return TRUE;
56 }
57
58 static inline BOOL ARRAY_EnsureSize(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
59 {
60 PVOID pNewData;
61 DWORD Count;
62
63 ASSERT(Array);
64 ASSERT(ItemSize == Array->ItemSize__);
65
66 if (Array->MaxSize__ > Array->Size__)
67 return TRUE;
68
69 Count = Array->Size__ + GrowWith;
70 pNewData = SeiAlloc(Count * ItemSize);
71
72 if (!pNewData)
73 {
74 SHIMENG_FAIL("Failed to allocate %d bytes\n", Count * ItemSize);
75 return FALSE;
76 }
77 Array->MaxSize__ = Count;
78
79 if (Array->Data__)
80 {
81 memcpy(pNewData, Array->Data__, Array->Size__ * ItemSize);
82 SeiFree(Array->Data__);
83 }
84 Array->Data__ = pNewData;
85
86 return TRUE;
87 }
88
89 static inline PVOID ARRAY_AppendWorker(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
90 {
91 PBYTE pData;
92
93 if (!ARRAY_EnsureSize(Array, ItemSize, GrowWith))
94 return NULL;
95
96 pData = Array->Data__;
97 pData += (Array->Size__ * ItemSize);
98 Array->Size__++;
99
100 return pData;
101 }
102
103 static inline PVOID ARRAY_AtWorker(PARRAY Array, DWORD ItemSize, DWORD n)
104 {
105 PBYTE pData;
106
107 ASSERT(Array);
108 ASSERT(ItemSize == Array->ItemSize__);
109 ASSERT(n < Array->Size__);
110
111 pData = Array->Data__;
112 return pData + (n * ItemSize);
113 }
114
115
116 #define ARRAY_Init(Array, TypeOfArray) ARRAY_InitWorker((Array), sizeof(TypeOfArray))
117 #define ARRAY_Append(Array, TypeOfArray) (TypeOfArray*)ARRAY_AppendWorker((Array), sizeof(TypeOfArray), 5)
118 #define ARRAY_At(Array, TypeOfArray, at) (TypeOfArray*)ARRAY_AtWorker((Array), sizeof(TypeOfArray), at)
119 #define ARRAY_Size(Array) (Array)->Size__
120
121
122 VOID SeiInitDebugSupport(VOID)
123 {
124 static const UNICODE_STRING DebugKey = RTL_CONSTANT_STRING(L"SHIMENG_DEBUG_LEVEL");
125 UNICODE_STRING DebugValue;
126 NTSTATUS Status;
127 ULONG NewLevel = SEI_MSG; /* Show some basic info in the logs, unless configured different */
128 WCHAR Buffer[40];
129
130 RtlInitEmptyUnicodeString(&DebugValue, Buffer, sizeof(Buffer));
131
132 Status = RtlQueryEnvironmentVariable_U(NULL, &DebugKey, &DebugValue);
133
134 if (NT_SUCCESS(Status))
135 {
136 if (!NT_SUCCESS(RtlUnicodeStringToInteger(&DebugValue, 10, &NewLevel)))
137 NewLevel = 0;
138 }
139 g_ShimEngDebugLevel = NewLevel;
140 }
141
142
143 /**
144 * Outputs diagnostic info.
145 *
146 * @param [in] Level The level to log this message with, choose any of [SHIM_ERR,
147 * SHIM_WARN, SHIM_INFO].
148 * @param [in] FunctionName The function this log should be attributed to.
149 * @param [in] Format The format string.
150 * @param ... Variable arguments providing additional information.
151 *
152 * @return Success: TRUE Failure: FALSE.
153 */
154 BOOL WINAPIV SeiDbgPrint(SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format, ...)
155 {
156 char Buffer[512];
157 char* Current = Buffer;
158 const char* LevelStr;
159 size_t Length = sizeof(Buffer);
160 va_list ArgList;
161 HRESULT hr;
162
163 if (g_ShimEngDebugLevel == 0xffffffff)
164 SeiInitDebugSupport();
165
166 if (Level > g_ShimEngDebugLevel)
167 return FALSE;
168
169 switch (Level)
170 {
171 case SEI_MSG:
172 LevelStr = "MSG ";
173 break;
174 case SEI_FAIL:
175 LevelStr = "FAIL";
176 break;
177 case SEI_WARN:
178 LevelStr = "WARN";
179 break;
180 case SEI_INFO:
181 LevelStr = "INFO";
182 break;
183 default:
184 LevelStr = "USER";
185 break;
186 }
187
188 if (Function)
189 hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] [%s] ", LevelStr, Function);
190 else
191 hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] ", LevelStr);
192
193 if (!SUCCEEDED(hr))
194 return FALSE;
195
196 va_start(ArgList, Format);
197 hr = StringCchVPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, Format, ArgList);
198 va_end(ArgList);
199 if (!SUCCEEDED(hr))
200 return FALSE;
201
202 DbgPrint("%s", Buffer);
203 return TRUE;
204 }
205
206
207 PVOID SeiGetModuleFromAddress(PVOID addr)
208 {
209 PVOID hModule = NULL;
210 RtlPcToFileHeader(addr, &hModule);
211 return hModule;
212 }
213
214
215
216 /* TODO: Guard against recursive calling / calling init multiple times! */
217 VOID NotifyShims(DWORD dwReason, PVOID Info)
218 {
219 DWORD n;
220
221 for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
222 {
223 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
224 if (!pShimModule->pNotifyShims)
225 continue;
226
227 pShimModule->pNotifyShims(dwReason, Info);
228 }
229 }
230
231
232
233 VOID SeiCheckComPlusImage(PVOID BaseAddress)
234 {
235 ULONG ComSectionSize;
236 g_bComPlusImage = RtlImageDirectoryEntryToData(BaseAddress, TRUE, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &ComSectionSize) != NULL;
237
238 SHIMENG_INFO("COM+ executable %s\n", g_bComPlusImage ? "TRUE" : "FALSE");
239 }
240
241
242 PSHIMMODULE SeiGetShimModuleInfo(PVOID BaseAddress)
243 {
244 DWORD n;
245
246 for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
247 {
248 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
249
250 if (pShimModule->BaseAddress == BaseAddress)
251 return pShimModule;
252 }
253 return NULL;
254 }
255
256 PSHIMMODULE SeiCreateShimModuleInfo(PCWSTR DllName, PVOID BaseAddress)
257 {
258 static const ANSI_STRING GetHookAPIs = RTL_CONSTANT_STRING("GetHookAPIs");
259 static const ANSI_STRING NotifyShims = RTL_CONSTANT_STRING("NotifyShims");
260 PSHIMMODULE* pData, Data;
261 PVOID pGetHookAPIs, pNotifyShims;
262
263 if (!NT_SUCCESS(LdrGetProcedureAddress(BaseAddress, (PANSI_STRING)&GetHookAPIs, 0, &pGetHookAPIs)) ||
264 !NT_SUCCESS(LdrGetProcedureAddress(BaseAddress, (PANSI_STRING)&NotifyShims, 0, &pNotifyShims)))
265 {
266 SHIMENG_WARN("Failed to resolve entry points for %S\n", DllName);
267 return NULL;
268 }
269
270 pData = ARRAY_Append(&g_pShimInfo, PSHIMMODULE);
271 if (!pData)
272 return NULL;
273
274 *pData = SeiAlloc(sizeof(SHIMMODULE));
275
276 Data = *pData;
277
278 RtlCreateUnicodeString(&Data->Name, DllName);
279 Data->BaseAddress = BaseAddress;
280
281 Data->pGetHookAPIs = pGetHookAPIs;
282 Data->pNotifyShims = pNotifyShims;
283
284 ARRAY_Init(&Data->EnabledShims, PSHIMINFO);
285
286 return Data;
287 }
288
289 PSHIMINFO SeiAppendHookInfo(PSHIMMODULE pShimModuleInfo, PHOOKAPIEX pHookApi, DWORD dwHookCount, PCWSTR ShimName)
290 {
291 PSHIMINFO* pData, Data;
292
293 pData = ARRAY_Append(&pShimModuleInfo->EnabledShims, PSHIMINFO);
294 if (!pData)
295 return NULL;
296
297 *pData = SeiAlloc(sizeof(SHIMINFO));
298 Data = *pData;
299
300 if (!Data)
301 return NULL;
302
303 Data->ShimName = SdbpStrDup(ShimName);
304 if (!Data->ShimName)
305 return NULL;
306
307 Data->pHookApi = pHookApi;
308 Data->dwHookCount = dwHookCount;
309 Data->pShimModule = pShimModuleInfo;
310 ARRAY_Init(&Data->InExclude, INEXCLUDE);
311 return Data;
312 }
313
314 PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
315 {
316 DWORD n;
317
318 for (n = 0; n < ARRAY_Size(&g_pHookArray); ++n)
319 {
320 PHOOKMODULEINFO pModuleInfo = ARRAY_At(&g_pHookArray, HOOKMODULEINFO, n);
321
322 if (BaseAddress && BaseAddress == pModuleInfo->BaseAddress)
323 return pModuleInfo;
324
325 if (!BaseAddress && RtlEqualUnicodeString(ModuleName, &pModuleInfo->Name, TRUE))
326 return pModuleInfo;
327 }
328
329 return NULL;
330 }
331
332 PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor(PBYTE DllBase, PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor)
333 {
334 UNICODE_STRING DllName;
335 PVOID DllHandle;
336 NTSTATUS Success;
337
338 if (!RtlCreateUnicodeStringFromAsciiz(&DllName, (PCSZ)(DllBase + ImportDescriptor->Name)))
339 {
340 SHIMENG_FAIL("Unable to convert dll name to unicode\n");
341 return NULL;
342 }
343
344 Success = LdrGetDllHandle(NULL, NULL, &DllName, &DllHandle);
345 RtlFreeUnicodeString(&DllName);
346
347 if (!NT_SUCCESS(Success))
348 {
349 SHIMENG_FAIL("Unable to get module handle for %wZ\n", &DllName);
350 return NULL;
351 }
352
353 return SeiFindHookModuleInfo(NULL, DllHandle);
354 }
355
356 static LPCWSTR SeiGetStringPtr(PDB pdb, TAGID tag, TAG type)
357 {
358 TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
359 if (tagEntry == TAGID_NULL)
360 return NULL;
361
362 return SdbGetStringTagPtr(pdb, tagEntry);
363 }
364
365 static DWORD SeiGetDWORD(PDB pdb, TAGID tag, TAG type)
366 {
367 TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
368 if (tagEntry == TAGID_NULL)
369 return 0;
370
371 return SdbReadDWORDTag(pdb, tagEntry, TAGID_NULL);
372 }
373
374
375 static VOID SeiAddShim(TAGREF trShimRef, PARRAY pShimRef)
376 {
377 TAGREF* Data;
378
379 Data = ARRAY_Append(pShimRef, TAGREF);
380 if (!Data)
381 return;
382
383 *Data = trShimRef;
384 }
385
386 /* Propagate layers to child processes */
387 static VOID SeiSetLayerEnvVar(LPCWSTR wszLayer)
388 {
389 NTSTATUS Status;
390 UNICODE_STRING VarName = RTL_CONSTANT_STRING(L"__COMPAT_LAYER");
391 UNICODE_STRING Value;
392
393 RtlInitUnicodeString(&Value, wszLayer);
394
395 Status = RtlSetEnvironmentVariable(NULL, &VarName, &Value);
396 if (NT_SUCCESS(Status))
397 SHIMENG_INFO("Set env var %wZ=%wZ\n", &VarName, &Value);
398 else
399 SHIMENG_FAIL("Failed to set %wZ: 0x%x\n", &VarName, Status);
400 }
401
402 #define MAX_LAYER_LENGTH 256
403
404 /* Translate all Exe and Layer entries to Shims, and propagate all layers */
405 static VOID SeiBuildShimRefArray(HSDB hsdb, SDBQUERYRESULT* pQuery, PARRAY pShimRef)
406 {
407 WCHAR wszLayerEnvVar[MAX_LAYER_LENGTH] = { 0 };
408 DWORD n;
409
410 for (n = 0; n < pQuery->dwExeCount; ++n)
411 {
412 PDB pdb;
413 TAGID tag;
414 if (SdbTagRefToTagID(hsdb, pQuery->atrExes[n], &pdb, &tag))
415 {
416 LPCWSTR ExeName = SeiGetStringPtr(pdb, tag, TAG_NAME);
417 TAGID ShimRef = SdbFindFirstTag(pdb, tag, TAG_SHIM_REF);
418
419 if (ExeName)
420 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Exe(%S))\n", ExeName);
421
422 while (ShimRef != TAGID_NULL)
423 {
424 TAGREF trShimRef;
425 if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
426 SeiAddShim(trShimRef, pShimRef);
427
428
429 ShimRef = SdbFindNextTag(pdb, tag, ShimRef);
430 }
431
432 /* Handle FLAG_REF */
433 }
434 }
435
436
437 for (n = 0; n < pQuery->dwLayerCount; ++n)
438 {
439 PDB pdb;
440 TAGID tag;
441 if (SdbTagRefToTagID(hsdb, pQuery->atrLayers[n], &pdb, &tag))
442 {
443 LPCWSTR LayerName = SeiGetStringPtr(pdb, tag, TAG_NAME);
444 TAGID ShimRef = SdbFindFirstTag(pdb, tag, TAG_SHIM_REF);
445 if (LayerName)
446 {
447 HRESULT hr;
448 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Layer(%S))\n", LayerName);
449 if (wszLayerEnvVar[0])
450 StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), L" ");
451 hr = StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), LayerName);
452 if (!SUCCEEDED(hr))
453 {
454 SHIMENG_FAIL("Unable to append %S\n", LayerName);
455 }
456 }
457
458 while (ShimRef != TAGID_NULL)
459 {
460 TAGREF trShimRef;
461 if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
462 SeiAddShim(trShimRef, pShimRef);
463
464 ShimRef = SdbFindNextTag(pdb, tag, ShimRef);
465 }
466
467 /* Handle FLAG_REF */
468 }
469 }
470 if (wszLayerEnvVar[0])
471 SeiSetLayerEnvVar(wszLayerEnvVar);
472 }
473
474 /* Given the hooks from one shim, find the relevant modules and store the combination of module + hook */
475 VOID SeiAddHooks(PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
476 {
477 DWORD n, j;
478 UNICODE_STRING UnicodeModName;
479 WCHAR Buf[512];
480
481 RtlInitEmptyUnicodeString(&UnicodeModName, Buf, sizeof(Buf));
482
483 for (n = 0; n < dwHookCount; ++n)
484 {
485 ANSI_STRING AnsiString;
486 PVOID DllHandle;
487 PHOOKAPIEX hook = hooks + n;
488 PHOOKAPIEX* pHookApi;
489 PHOOKMODULEINFO HookModuleInfo;
490
491 RtlInitAnsiString(&AnsiString, hook->LibraryName);
492 if (!NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeModName, &AnsiString, FALSE)))
493 {
494 SHIMENG_FAIL("Unable to convert %s to Unicode\n", hook->LibraryName);
495 continue;
496 }
497
498 RtlInitAnsiString(&AnsiString, hook->FunctionName);
499 if (NT_SUCCESS(LdrGetDllHandle(NULL, 0, &UnicodeModName, &DllHandle)))
500 {
501 PVOID ProcAddress;
502
503
504 if (!NT_SUCCESS(LdrGetProcedureAddress(DllHandle, &AnsiString, 0, &ProcAddress)))
505 {
506 SHIMENG_FAIL("Unable to retrieve %s!%s\n", hook->LibraryName, hook->FunctionName);
507 continue;
508 }
509
510 HookModuleInfo = SeiFindHookModuleInfo(NULL, DllHandle);
511 hook->OriginalFunction = ProcAddress;
512 }
513 else
514 {
515 HookModuleInfo = SeiFindHookModuleInfo(&UnicodeModName, NULL);
516 DllHandle = NULL;
517 }
518
519 if (!HookModuleInfo)
520 {
521 HookModuleInfo = ARRAY_Append(&g_pHookArray, HOOKMODULEINFO);
522 if (!HookModuleInfo)
523 continue;
524
525 HookModuleInfo->BaseAddress = DllHandle;
526 ARRAY_Init(&HookModuleInfo->HookApis, PHOOKAPIEX);
527 RtlCreateUnicodeString(&HookModuleInfo->Name, UnicodeModName.Buffer);
528 }
529
530 hook->pShimInfo = pShim;
531
532 for (j = 0; j < ARRAY_Size(&HookModuleInfo->HookApis); ++j)
533 {
534 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, j);
535 int CmpResult = strcmp(hook->FunctionName, HookApi->FunctionName);
536 if (CmpResult == 0)
537 {
538 /* Multiple hooks on one function? --> use ApiLink */
539 SHIMENG_FAIL("Multiple hooks on one API is not yet supported!\n");
540 ASSERT(0);
541 }
542 }
543 pHookApi = ARRAY_Append(&HookModuleInfo->HookApis, PHOOKAPIEX);
544 *pHookApi = hook;
545 }
546 }
547
548 typedef FARPROC(WINAPI* GETPROCADDRESSPROC)(HINSTANCE, LPCSTR);
549
550 /* Check if we should fake the return from GetProcAddress (because we also redirected the iat for this module) */
551 FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName)
552 {
553 char szOrdProcName[10] = "";
554 LPCSTR lpPrintName = lpProcName;
555 PVOID Addr = _ReturnAddress();
556 PHOOKMODULEINFO HookModuleInfo;
557 FARPROC proc = ((GETPROCADDRESSPROC)g_IntHookEx[0].OriginalFunction)(hModule, lpProcName);
558
559 if (!HIWORD(lpProcName))
560 {
561 sprintf(szOrdProcName, "#%lu", (DWORD)lpProcName);
562 lpPrintName = szOrdProcName;
563 }
564
565 Addr = SeiGetModuleFromAddress(Addr);
566 if (SE_IsShimDll(Addr))
567 {
568 SHIMENG_MSG("Not touching GetProcAddress for shim dll (%p!%s)", hModule, lpPrintName);
569 return proc;
570 }
571
572 SHIMENG_MSG("(GetProcAddress(%p!%s) => %p\n", hModule, lpPrintName, proc);
573
574 HookModuleInfo = SeiFindHookModuleInfo(NULL, hModule);
575
576 /* FIXME: Ordinal not yet supported */
577 if (HookModuleInfo && HIWORD(lpProcName))
578 {
579 DWORD n;
580 for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
581 {
582 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
583 int CmpResult = strcmp(lpProcName, HookApi->FunctionName);
584 if (CmpResult == 0)
585 {
586 SHIMENG_MSG("Redirecting %p to %p\n", proc, HookApi->ReplacementFunction);
587 proc = HookApi->ReplacementFunction;
588 break;
589 }
590 }
591 }
592
593 return proc;
594 }
595
596 /* Walk all shim modules / enabled shims, and add their hooks */
597 VOID SeiResolveAPIs(VOID)
598 {
599 DWORD mod, n;
600
601 /* Enumerate all Shim modules */
602 for (mod = 0; mod < ARRAY_Size(&g_pShimInfo); ++mod)
603 {
604 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, mod);
605 DWORD dwShimCount = ARRAY_Size(&pShimModule->EnabledShims);
606
607 /* Enumerate all Shims */
608 for (n = 0; n < dwShimCount; ++n)
609 {
610 PSHIMINFO pShim = *ARRAY_At(&pShimModule->EnabledShims, PSHIMINFO, n);
611
612 PHOOKAPIEX hooks = pShim->pHookApi;
613 DWORD dwHookCount = pShim->dwHookCount;
614
615 SeiAddHooks(hooks, dwHookCount, pShim);
616 }
617 }
618 }
619
620 /* If we hooked something, we should also redirect GetProcAddress */
621 VOID SeiAddInternalHooks(DWORD dwNumHooks)
622 {
623 if (dwNumHooks == 0)
624 {
625 g_bInternalHooksUsed = FALSE;
626 return;
627 }
628
629 SeiAddHooks(g_IntHookEx, ARRAYSIZE(g_IntHookEx), NULL);
630 g_bInternalHooksUsed = TRUE;
631 }
632
633 /* Patch one function in the iat */
634 VOID SeiPatchNewImport(PIMAGE_THUNK_DATA FirstThunk, PHOOKAPIEX HookApi, PLDR_DATA_TABLE_ENTRY LdrEntry)
635 {
636 ULONG OldProtection = 0;
637 PVOID Ptr;
638 ULONG Size;
639 NTSTATUS Status;
640
641 SHIMENG_INFO("Hooking API \"%s!%s\" for DLL \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, &LdrEntry->BaseDllName);
642
643 Ptr = &FirstThunk->u1.Function;
644 Size = sizeof(FirstThunk->u1.Function);
645 Status = NtProtectVirtualMemory(NtCurrentProcess(), &Ptr, &Size, PAGE_EXECUTE_READWRITE, &OldProtection);
646
647 if (!NT_SUCCESS(Status))
648 {
649 SHIMENG_FAIL("Unable to unprotect 0x%p\n", &FirstThunk->u1.Function);
650 return;
651 }
652
653 SHIMENG_INFO("changing 0x%p to 0x%p\n", FirstThunk->u1.Function, HookApi->ReplacementFunction);
654 #ifdef _WIN64
655 FirstThunk->u1.Function = (ULONGLONG)HookApi->ReplacementFunction;
656 #else
657 FirstThunk->u1.Function = (DWORD)HookApi->ReplacementFunction;
658 #endif
659
660 Size = sizeof(FirstThunk->u1.Function);
661 Status = NtProtectVirtualMemory(NtCurrentProcess(), &Ptr, &Size, OldProtection, &OldProtection);
662
663 if (!NT_SUCCESS(Status))
664 {
665 SHIMENG_WARN("Unable to reprotect 0x%p\n", &FirstThunk->u1.Function);
666 }
667 }
668
669
670 PINEXCLUDE SeiFindInExclude(PARRAY InExclude, PCUNICODE_STRING DllName)
671 {
672 DWORD n;
673
674 for (n = 0; n < ARRAY_Size(InExclude); ++n)
675 {
676 PINEXCLUDE InEx = ARRAY_At(InExclude, INEXCLUDE, n);
677
678 if (RtlEqualUnicodeString(&InEx->Module, DllName, TRUE))
679 return InEx;
680 }
681
682 return NULL;
683 }
684
685 BOOL SeiIsExcluded(PLDR_DATA_TABLE_ENTRY LdrEntry, PHOOKAPIEX HookApi)
686 {
687 PSHIMINFO pShimInfo = HookApi->pShimInfo;
688 PINEXCLUDE InExclude;
689 BOOL IsExcluded = FALSE;
690
691 if (!pShimInfo)
692 {
693 /* Internal hook, do not exclude it */
694 return FALSE;
695 }
696
697 /* By default, everything from System32 or WinSxs is excluded */
698 if (RtlPrefixUnicodeString(&g_System32Directory, &LdrEntry->FullDllName, TRUE) ||
699 RtlPrefixUnicodeString(&g_SxsDirectory, &LdrEntry->FullDllName, TRUE))
700 IsExcluded = TRUE;
701
702 InExclude = SeiFindInExclude(&pShimInfo->InExclude, &LdrEntry->BaseDllName);
703 if (InExclude)
704 {
705 /* If it is on the 'exclude' list, bail out */
706 if (!InExclude->Include)
707 {
708 SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it on in the exclude list.\n",
709 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
710
711 return TRUE;
712 }
713 /* If it is on the 'include' list, override System32 / Winsxs check. */
714 if (IsExcluded)
715 {
716 SHIMENG_INFO("Module '%wZ' included for shim %S, API '%s!%s', because it is on the include list.\n",
717 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
718
719 }
720 IsExcluded = FALSE;
721 }
722
723 if (IsExcluded)
724 {
725 SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it is in System32/WinSXS.\n",
726 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
727 }
728
729 return IsExcluded;
730 }
731
732 VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
733 {
734 PINEXCLUDE InExclude;
735 UNICODE_STRING ModuleNameU;
736 RtlInitUnicodeString(&ModuleNameU, ModuleName);
737
738 InExclude = SeiFindInExclude(dest, &ModuleNameU);
739 if (InExclude)
740 {
741 InExclude->Include = IsInclude;
742 return;
743 }
744
745 InExclude = ARRAY_Append(dest, INEXCLUDE);
746 if (InExclude)
747 {
748 PCWSTR ModuleNameCopy = SdbpStrDup(ModuleName);
749 RtlInitUnicodeString(&InExclude->Module, ModuleNameCopy);
750 InExclude->Include = IsInclude;
751 }
752 }
753
754 /* Read the INEXCLUD tags from a given parent tag */
755 VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest)
756 {
757 TAGID InExcludeTag;
758
759 InExcludeTag = SdbFindFirstTag(pdb, parent, TAG_INEXCLUD);
760
761 while (InExcludeTag != TAGID_NULL)
762 {
763 PCWSTR ModuleName;
764 TAGID ModuleTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_MODULE);
765 TAGID IncludeTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_INCLUDE);
766
767 ModuleName = SdbGetStringTagPtr(pdb, ModuleTag);
768 if (ModuleName)
769 {
770 SeiAppendInExclude(dest, ModuleName, IncludeTag != TAGID_NULL);
771 }
772 else
773 {
774 SHIMENG_WARN("INEXCLUDE without Module: 0x%x\n", InExcludeTag);
775 }
776
777 InExcludeTag = SdbFindNextTag(pdb, parent, InExcludeTag);
778 }
779 }
780
781 VOID SeiBuildGlobalInclExclList(HSDB hsdb)
782 {
783 PDB pdb;
784 TAGREF tr = TAGREF_ROOT;
785 TAGID root, db, library;
786
787 if (!SdbTagRefToTagID(hsdb, tr, &pdb, &root))
788 {
789 SHIMENG_WARN("Unable to resolve database root\n");
790 return;
791 }
792 db = SdbFindFirstTag(pdb, root, TAG_DATABASE);
793 if (db == TAGID_NULL)
794 {
795 SHIMENG_WARN("Unable to resolve database\n");
796 return;
797 }
798 library = SdbFindFirstTag(pdb, db, TAG_LIBRARY);
799 if (library == TAGID_NULL)
800 {
801 SHIMENG_WARN("Unable to resolve library\n");
802 return;
803 }
804
805 SeiReadInExclude(pdb, library, &g_InExclude);
806 }
807
808 VOID SeiBuildInclExclList(PDB pdb, TAGID ShimTag, PSHIMINFO pShimInfo)
809 {
810 DWORD n;
811
812 /* First duplicate the global in/excludes */
813 for (n = 0; n < ARRAY_Size(&g_InExclude); ++n)
814 {
815 PINEXCLUDE InEx = ARRAY_At(&g_InExclude, INEXCLUDE, n);
816 SeiAppendInExclude(&pShimInfo->InExclude, InEx->Module.Buffer, InEx->Include);
817 }
818
819 /* Now read this shim's in/excludes (possibly overriding the global ones) */
820 SeiReadInExclude(pdb, ShimTag, &pShimInfo->InExclude);
821 }
822
823 /* Given one loaded module, redirect (hook) all functions from the iat that are registered by shims */
824 VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry)
825 {
826 ULONG Size;
827 PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
828 PBYTE DllBase = LdrEntry->DllBase;
829
830 if (SE_IsShimDll(DllBase) || g_hInstance == LdrEntry->DllBase)
831 {
832 SHIMENG_INFO("Skipping shim module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
833 return;
834 }
835
836 if (LdrEntry->Flags & LDRP_COMPAT_DATABASE_PROCESSED)
837 {
838 SHIMENG_INFO("Skipping module 0x%p \"%wZ\" because it was already processed\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
839 return;
840 }
841
842 ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size);
843 if (!ImportDescriptor)
844 {
845 SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
846 return;
847 }
848
849 SHIMENG_INFO("Hooking module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
850
851 for ( ;ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
852 {
853 PHOOKMODULEINFO HookModuleInfo;
854
855 /* Do we have hooks for this module? */
856 HookModuleInfo = SeiFindHookModuleInfoForImportDescriptor(DllBase, ImportDescriptor);
857
858 if (HookModuleInfo)
859 {
860 PIMAGE_THUNK_DATA OriginalThunk, FirstThunk;
861 DWORD n;
862
863 for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
864 {
865 DWORD dwFound = 0;
866 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
867
868 /* Check if this module should be excluded from being hooked (system32/winsxs, global or shim exclude) */
869 if (SeiIsExcluded(LdrEntry, HookApi))
870 {
871 continue;
872 }
873
874 OriginalThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->OriginalFirstThunk);
875 FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
876
877 /* Walk all imports */
878 for (;OriginalThunk->u1.AddressOfData && FirstThunk->u1.Function; OriginalThunk++, FirstThunk++)
879 {
880 if (!IMAGE_SNAP_BY_ORDINAL32(OriginalThunk->u1.AddressOfData))
881 {
882 PIMAGE_IMPORT_BY_NAME ImportName;
883
884 ImportName = (PIMAGE_IMPORT_BY_NAME)(DllBase + OriginalThunk->u1.AddressOfData);
885 if (!strcmp((PCSTR)ImportName->Name, HookApi->FunctionName))
886 {
887 SeiPatchNewImport(FirstThunk, HookApi, LdrEntry);
888
889 /* Sadly, iat does not have to be sorted, and can even contain duplicate entries. */
890 dwFound++;
891 }
892 }
893 else
894 {
895 SHIMENG_FAIL("Ordinals not yet supported\n");
896 ASSERT(0);
897 }
898 }
899
900 if (dwFound != 1)
901 {
902 /* One entry not found. */
903 if (!dwFound)
904 SHIMENG_INFO("Entry \"%s!%s\" not found for \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, &LdrEntry->BaseDllName);
905 else
906 SHIMENG_INFO("Entry \"%s!%s\" found %d times for \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, dwFound, &LdrEntry->BaseDllName);
907 }
908 }
909 }
910 }
911
912 /* Mark this module as processed. */
913 LdrEntry->Flags |= LDRP_COMPAT_DATABASE_PROCESSED;
914 }
915
916
917 VOID PatchNewModules(PPEB Peb)
918 {
919 PLIST_ENTRY ListHead, ListEntry;
920 PLDR_DATA_TABLE_ENTRY LdrEntry;
921
922 ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
923 ListEntry = ListHead->Flink;
924
925 while (ListHead != ListEntry)
926 {
927 LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
928 SeiHookImports(LdrEntry);
929
930 ListEntry = ListEntry->Flink;
931 }
932 }
933
934
935 VOID SeiInitPaths(VOID)
936 {
937 #define SYSTEM32 L"\\system32"
938 #define WINSXS L"\\winsxs"
939
940 PWSTR WindowsDirectory = SdbpStrDup(SharedUserData->NtSystemRoot);
941 RtlInitUnicodeString(&g_WindowsDirectory, WindowsDirectory);
942
943 g_System32Directory.MaximumLength = g_WindowsDirectory.Length + SdbpStrsize(SYSTEM32);
944 g_System32Directory.Buffer = SdbpAlloc(g_System32Directory.MaximumLength);
945 RtlCopyUnicodeString(&g_System32Directory, &g_WindowsDirectory);
946 RtlAppendUnicodeToString(&g_System32Directory, SYSTEM32);
947
948 g_SxsDirectory.MaximumLength = g_WindowsDirectory.Length + SdbpStrsize(WINSXS);
949 g_SxsDirectory.Buffer = SdbpAlloc(g_SxsDirectory.MaximumLength);
950 RtlCopyUnicodeString(&g_SxsDirectory, &g_WindowsDirectory);
951 RtlAppendUnicodeToString(&g_SxsDirectory, WINSXS);
952
953 #undef SYSTEM32
954 #undef WINSXS
955 }
956
957 /*
958 Level(INFO) Using USER apphack flags 0x2080000
959 */
960
961 VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery)
962 {
963 DWORD n;
964 ARRAY ShimRefArray;
965 DWORD dwTotalHooks = 0;
966
967 PPEB Peb = NtCurrentPeb();
968
969 /* We should only be called once! */
970 ASSERT(g_pShimInfo.ItemSize__ == 0);
971
972 ARRAY_Init(&ShimRefArray, TAGREF);
973 ARRAY_Init(&g_pShimInfo, PSHIMMODULE);
974 ARRAY_Init(&g_pHookArray, HOOKMODULEINFO);
975 ARRAY_Init(&g_InExclude, INEXCLUDE);
976
977 SeiInitPaths();
978
979 SeiCheckComPlusImage(Peb->ImageBaseAddress);
980
981 /* TODO:
982 if (pQuery->trApphelp)
983 SeiDisplayAppHelp(?pQuery->trApphelp?);
984 */
985
986 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(ExePath(%wZ))\n", ProcessImage);
987 SeiBuildShimRefArray(hsdb, pQuery, &ShimRefArray);
988 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Complete)\n");
989
990 SHIMENG_INFO("Got %d shims\n", ARRAY_Size(&ShimRefArray));
991 SeiBuildGlobalInclExclList(hsdb);
992
993 /* Walk all shims referenced (in layers + exes), and load their modules */
994 for (n = 0; n < ARRAY_Size(&ShimRefArray); ++n)
995 {
996 PDB pdb;
997 TAGID ShimRef;
998
999 TAGREF tr = *ARRAY_At(&ShimRefArray, TAGREF, n);
1000
1001 if (SdbTagRefToTagID(hsdb, tr, &pdb, &ShimRef))
1002 {
1003 LPCWSTR ShimName, DllName, CommandLine = NULL;
1004 TAGID ShimTag;
1005 WCHAR FullNameBuffer[MAX_PATH];
1006 UNICODE_STRING UnicodeDllName;
1007 PVOID BaseAddress;
1008 PSHIMMODULE pShimModuleInfo = NULL;
1009 ANSI_STRING AnsiCommandLine = RTL_CONSTANT_STRING("");
1010 PSHIMINFO pShimInfo = NULL;
1011 PHOOKAPIEX pHookApi;
1012 DWORD dwHookCount;
1013
1014 ShimName = SeiGetStringPtr(pdb, ShimRef, TAG_NAME);
1015 if (!ShimName)
1016 {
1017 SHIMENG_FAIL("Failed to retrieve the name for 0x%x\n", tr);
1018 continue;
1019 }
1020
1021 CommandLine = SeiGetStringPtr(pdb, ShimRef, TAG_COMMAND_LINE);
1022 if (CommandLine && *CommandLine)
1023 {
1024 RtlInitUnicodeString(&UnicodeDllName, CommandLine);
1025 if (NT_SUCCESS(RtlUnicodeStringToAnsiString(&AnsiCommandLine, &UnicodeDllName, TRUE)))
1026 {
1027 SHIMENG_INFO("COMMAND LINE %s for %S", AnsiCommandLine.Buffer, ShimName);
1028 }
1029 else
1030 {
1031 AnsiCommandLine.Buffer = "";
1032 CommandLine = NULL;
1033 }
1034 }
1035
1036 ShimTag = SeiGetDWORD(pdb, ShimRef, TAG_SHIM_TAGID);
1037 if (!ShimTag)
1038 {
1039 SHIMENG_FAIL("Failed to resolve %S to a shim\n", ShimName);
1040 continue;
1041 }
1042
1043 if (!SdbGetAppPatchDir(NULL, FullNameBuffer, ARRAYSIZE(FullNameBuffer)))
1044 {
1045 SHIMENG_WARN("Failed to get the AppPatch dir\n");
1046 continue;
1047 }
1048
1049 DllName = SeiGetStringPtr(pdb, ShimTag, TAG_DLLFILE);
1050 if (DllName == NULL ||
1051 !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), L"\\")) ||
1052 !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), DllName)))
1053 {
1054 SHIMENG_WARN("Failed to build a full path for %S\n", ShimName);
1055 continue;
1056 }
1057
1058 RtlInitUnicodeString(&UnicodeDllName, FullNameBuffer);
1059 if (NT_SUCCESS(LdrGetDllHandle(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1060 {
1061 /* This shim dll was already loaded, let's find it */
1062 pShimModuleInfo = SeiGetShimModuleInfo(BaseAddress);
1063 }
1064 else if (!NT_SUCCESS(LdrLoadDll(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1065 {
1066 SHIMENG_WARN("Failed to load %wZ for %S\n", &UnicodeDllName, ShimName);
1067 continue;
1068 }
1069 /* No shim module found (or we just loaded it) */
1070 if (!pShimModuleInfo)
1071 {
1072 pShimModuleInfo = SeiCreateShimModuleInfo(DllName, BaseAddress);
1073 if (!pShimModuleInfo)
1074 {
1075 SHIMENG_FAIL("Failed to allocate ShimInfo for %S\n", DllName);
1076 continue;
1077 }
1078 }
1079
1080 SHIMENG_INFO("Shim DLL 0x%p \"%wZ\" loaded\n", BaseAddress, &UnicodeDllName);
1081 SHIMENG_INFO("Using SHIM \"%S!%S\"\n", DllName, ShimName);
1082
1083 /* Ask this shim what hooks it needs (and pass along the commandline) */
1084 pHookApi = pShimModuleInfo->pGetHookAPIs(AnsiCommandLine.Buffer, ShimName, &dwHookCount);
1085 SHIMENG_INFO("GetHookAPIs returns %d hooks for DLL \"%wZ\" SHIM \"%S\"\n", dwHookCount, &UnicodeDllName, ShimName);
1086 if (dwHookCount)
1087 pShimInfo = SeiAppendHookInfo(pShimModuleInfo, pHookApi, dwHookCount, ShimName);
1088
1089 /* If this shim has hooks, create the include / exclude lists */
1090 if (pShimInfo)
1091 SeiBuildInclExclList(pdb, ShimTag, pShimInfo);
1092
1093 if (CommandLine && *CommandLine)
1094 RtlFreeAnsiString(&AnsiCommandLine);
1095
1096 dwTotalHooks += dwHookCount;
1097 }
1098 }
1099
1100 SeiAddInternalHooks(dwTotalHooks);
1101 SeiResolveAPIs();
1102 PatchNewModules(Peb);
1103 }
1104
1105
1106 /* Load the database + unpack the shim data (if this process is allowed) */
1107 BOOL SeiGetShimData(PUNICODE_STRING ProcessImage, PVOID pShimData, HSDB* pHsdb, SDBQUERYRESULT* pQuery)
1108 {
1109 static const UNICODE_STRING ForbiddenShimmingApps[] = {
1110 RTL_CONSTANT_STRING(L"ntsd.exe"),
1111 RTL_CONSTANT_STRING(L"windbg.exe"),
1112 #if WINVER >= 0x600
1113 RTL_CONSTANT_STRING(L"slsvc.exe"),
1114 #endif
1115 };
1116 static const UNICODE_STRING BackSlash = RTL_CONSTANT_STRING(L"\\");
1117 static const UNICODE_STRING ForwdSlash = RTL_CONSTANT_STRING(L"/");
1118 UNICODE_STRING ProcessName;
1119 USHORT Back, Forward;
1120 HSDB hsdb;
1121 DWORD n;
1122
1123 if (!NT_SUCCESS(RtlFindCharInUnicodeString(RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END, ProcessImage, &BackSlash, &Back)))
1124 Back = 0;
1125
1126 if (!NT_SUCCESS(RtlFindCharInUnicodeString(RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END, ProcessImage, &ForwdSlash, &Forward)))
1127 Forward = 0;
1128
1129 if (Back < Forward)
1130 Back = Forward;
1131
1132 if (Back)
1133 Back += sizeof(WCHAR);
1134
1135 ProcessName.Buffer = ProcessImage->Buffer + Back / sizeof(WCHAR);
1136 ProcessName.Length = ProcessImage->Length - Back;
1137 ProcessName.MaximumLength = ProcessImage->MaximumLength - Back;
1138
1139 for (n = 0; n < ARRAYSIZE(ForbiddenShimmingApps); ++n)
1140 {
1141 if (RtlEqualUnicodeString(&ProcessName, ForbiddenShimmingApps + n, TRUE))
1142 {
1143 SHIMENG_MSG("Not shimming %wZ\n", ForbiddenShimmingApps + n);
1144 return FALSE;
1145 }
1146 }
1147
1148 /* We should probably load all db's here, but since we do not support that yet... */
1149 hsdb = SdbInitDatabase(HID_DOS_PATHS | SDB_DATABASE_MAIN_SHIM, NULL);
1150 if (hsdb)
1151 {
1152 if (SdbUnpackAppCompatData(hsdb, ProcessImage->Buffer, pShimData, pQuery))
1153 {
1154 *pHsdb = hsdb;
1155 return TRUE;
1156 }
1157 SdbReleaseDatabase(hsdb);
1158 }
1159 return FALSE;
1160 }
1161
1162
1163
1164 VOID NTAPI SE_InstallBeforeInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
1165 {
1166 HSDB hsdb = NULL;
1167 SDBQUERYRESULT QueryResult = { { 0 } };
1168 SHIMENG_MSG("(%wZ, %p)\n", ProcessImage, pShimData);
1169
1170 if (!SeiGetShimData(ProcessImage, pShimData, &hsdb, &QueryResult))
1171 {
1172 SHIMENG_FAIL("Failed to get shim data\n");
1173 return;
1174 }
1175
1176 g_bShimDuringInit = TRUE;
1177 SeiInit(ProcessImage, hsdb, &QueryResult);
1178 g_bShimDuringInit = FALSE;
1179
1180 SdbReleaseDatabase(hsdb);
1181 }
1182
1183 VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
1184 {
1185 NotifyShims(SHIM_NOTIFY_ATTACH, NULL);
1186 }
1187
1188 VOID NTAPI SE_ProcessDying(VOID)
1189 {
1190 SHIMENG_MSG("()\n");
1191 NotifyShims(SHIM_NOTIFY_DETACH, NULL);
1192 }
1193
1194 VOID WINAPI SE_DllLoaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
1195 {
1196 SHIMENG_INFO("%sINIT. loading DLL \"%wZ\"\n", g_bShimDuringInit ? "" : "AFTER ", &LdrEntry->BaseDllName);
1197
1198 SeiHookImports(LdrEntry);
1199
1200 NotifyShims(SHIM_REASON_DLL_LOAD, LdrEntry);
1201 }
1202
1203 VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
1204 {
1205 SHIMENG_INFO("(%p)\n", LdrEntry);
1206
1207 /* Should we unhook here? */
1208
1209 NotifyShims(SHIM_REASON_DLL_UNLOAD, LdrEntry);
1210 }
1211
1212 BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
1213 {
1214 SHIMENG_INFO("(%p)\n", BaseAddress);
1215
1216 return SeiGetShimModuleInfo(BaseAddress) != NULL;
1217 }
1218