8f3fe2bab03fa0cba647cce8717bec3e71da4e6a
[reactos.git] / dll / appcompat / apphelp / shimeng.c
1 /*
2 * PROJECT: ReactOS Application compatibility module
3 * LICENSE: GPL-2.0+ (https://spdx.org/licenses/GPL-2.0+)
4 * PURPOSE: Shim engine core
5 * COPYRIGHT: Copyright 2015-2018 Mark Jansen (mark.jansen@reactos.org)
6 */
7
8 #define WIN32_NO_STATUS
9 #include "ntndk.h"
10 #define IN_APPHELP
11 #include "shimlib.h"
12 #include <strsafe.h>
13 /* Make sure we don't include apphelp logging */
14 #define APPHELP_NOSDBPAPI
15 #include "apphelp.h"
16 #include "shimeng.h"
17
18
19
20 FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName);
21 BOOL WINAPI SE_IsShimDll(PVOID BaseAddress);
22
23
24 extern HMODULE g_hInstance;
25 static UNICODE_STRING g_WindowsDirectory;
26 static UNICODE_STRING g_System32Directory;
27 static UNICODE_STRING g_SxsDirectory;
28 ULONG g_ShimEngDebugLevel = 0xffffffff;
29 BOOL g_bComPlusImage = FALSE;
30 BOOL g_bShimDuringInit = FALSE;
31 BOOL g_bInternalHooksUsed = FALSE;
32 static ARRAY g_pShimInfo; /* PSHIMMODULE */
33 static ARRAY g_pHookArray; /* HOOKMODULEINFO */
34 static ARRAY g_InExclude; /* INEXCLUDE */
35
36 /* If we have setup a hook for a function, we should also redirect GetProcAddress for this function */
37 HOOKAPIEX g_IntHookEx[] =
38 {
39 {
40 "kernel32.dll", /* LibraryName */
41 "GetProcAddress", /* FunctionName */
42 StubGetProcAddress, /* ReplacementFunction*/
43 NULL, /* OriginalFunction */
44 NULL, /* pShimInfo */
45 NULL /* Unused */
46 },
47 };
48
49 static inline BOOL ARRAY_InitWorker(PARRAY Array, DWORD ItemSize)
50 {
51 Array->Data__ = NULL;
52 Array->Size__ = Array->MaxSize__ = 0;
53 Array->ItemSize__ = ItemSize;
54
55 return TRUE;
56 }
57
58 static inline BOOL ARRAY_EnsureSize(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
59 {
60 PVOID pNewData;
61 DWORD Count;
62
63 ASSERT(Array);
64 ASSERT(ItemSize == Array->ItemSize__);
65
66 if (Array->MaxSize__ > Array->Size__)
67 return TRUE;
68
69 Count = Array->Size__ + GrowWith;
70 pNewData = SeiAlloc(Count * ItemSize);
71
72 if (!pNewData)
73 {
74 SHIMENG_FAIL("Failed to allocate %d bytes\n", Count * ItemSize);
75 return FALSE;
76 }
77 Array->MaxSize__ = Count;
78
79 if (Array->Data__)
80 {
81 memcpy(pNewData, Array->Data__, Array->Size__ * ItemSize);
82 SeiFree(Array->Data__);
83 }
84 Array->Data__ = pNewData;
85
86 return TRUE;
87 }
88
89 static inline PVOID ARRAY_AppendWorker(PARRAY Array, DWORD ItemSize, DWORD GrowWith)
90 {
91 PBYTE pData;
92
93 if (!ARRAY_EnsureSize(Array, ItemSize, GrowWith))
94 return NULL;
95
96 pData = Array->Data__;
97 pData += (Array->Size__ * ItemSize);
98 Array->Size__++;
99
100 return pData;
101 }
102
103 static inline PVOID ARRAY_AtWorker(PARRAY Array, DWORD ItemSize, DWORD n)
104 {
105 PBYTE pData;
106
107 ASSERT(Array);
108 ASSERT(ItemSize == Array->ItemSize__);
109 ASSERT(n < Array->Size__);
110
111 pData = Array->Data__;
112 return pData + (n * ItemSize);
113 }
114
115
116 #define ARRAY_Init(Array, TypeOfArray) ARRAY_InitWorker((Array), sizeof(TypeOfArray))
117 #define ARRAY_Append(Array, TypeOfArray) (TypeOfArray*)ARRAY_AppendWorker((Array), sizeof(TypeOfArray), 5)
118 #define ARRAY_At(Array, TypeOfArray, at) (TypeOfArray*)ARRAY_AtWorker((Array), sizeof(TypeOfArray), at)
119 #define ARRAY_Size(Array) (Array)->Size__
120
121
122 VOID SeiInitDebugSupport(VOID)
123 {
124 static const UNICODE_STRING DebugKey = RTL_CONSTANT_STRING(L"SHIMENG_DEBUG_LEVEL");
125 UNICODE_STRING DebugValue;
126 NTSTATUS Status;
127 ULONG NewLevel = SEI_MSG; /* Show some basic info in the logs, unless configured different */
128 WCHAR Buffer[40];
129
130 RtlInitEmptyUnicodeString(&DebugValue, Buffer, sizeof(Buffer));
131
132 Status = RtlQueryEnvironmentVariable_U(NULL, &DebugKey, &DebugValue);
133
134 if (NT_SUCCESS(Status))
135 {
136 if (!NT_SUCCESS(RtlUnicodeStringToInteger(&DebugValue, 10, &NewLevel)))
137 NewLevel = 0;
138 }
139 g_ShimEngDebugLevel = NewLevel;
140 }
141
142
143 /**
144 * Outputs diagnostic info.
145 *
146 * @param [in] Level The level to log this message with, choose any of [SHIM_ERR,
147 * SHIM_WARN, SHIM_INFO].
148 * @param [in] FunctionName The function this log should be attributed to.
149 * @param [in] Format The format string.
150 * @param ... Variable arguments providing additional information.
151 *
152 * @return Success: TRUE Failure: FALSE.
153 */
154 BOOL WINAPIV SeiDbgPrint(SEI_LOG_LEVEL Level, PCSTR Function, PCSTR Format, ...)
155 {
156 char Buffer[512];
157 char* Current = Buffer;
158 const char* LevelStr;
159 size_t Length = sizeof(Buffer);
160 va_list ArgList;
161 HRESULT hr;
162
163 if (g_ShimEngDebugLevel == 0xffffffff)
164 SeiInitDebugSupport();
165
166 if (Level > g_ShimEngDebugLevel)
167 return FALSE;
168
169 switch (Level)
170 {
171 case SEI_MSG:
172 LevelStr = "MSG ";
173 break;
174 case SEI_FAIL:
175 LevelStr = "FAIL";
176 break;
177 case SEI_WARN:
178 LevelStr = "WARN";
179 break;
180 case SEI_INFO:
181 LevelStr = "INFO";
182 break;
183 default:
184 LevelStr = "USER";
185 break;
186 }
187
188 if (Function)
189 hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] [%s] ", LevelStr, Function);
190 else
191 hr = StringCchPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, "[%s] ", LevelStr);
192
193 if (!SUCCEEDED(hr))
194 return FALSE;
195
196 va_start(ArgList, Format);
197 hr = StringCchVPrintfExA(Current, Length, &Current, &Length, STRSAFE_NULL_ON_FAILURE, Format, ArgList);
198 va_end(ArgList);
199 if (!SUCCEEDED(hr))
200 return FALSE;
201
202 DbgPrint("%s", Buffer);
203 return TRUE;
204 }
205
206
207 PVOID SeiGetModuleFromAddress(PVOID addr)
208 {
209 PVOID hModule = NULL;
210 RtlPcToFileHeader(addr, &hModule);
211 return hModule;
212 }
213
214
215
216 /* TODO: Guard against recursive calling / calling init multiple times! */
217 VOID NotifyShims(DWORD dwReason, PVOID Info)
218 {
219 DWORD n;
220
221 for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
222 {
223 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
224 if (!pShimModule->pNotifyShims)
225 continue;
226
227 pShimModule->pNotifyShims(dwReason, Info);
228 }
229 }
230
231
232
233 VOID SeiCheckComPlusImage(PVOID BaseAddress)
234 {
235 ULONG ComSectionSize;
236 g_bComPlusImage = RtlImageDirectoryEntryToData(BaseAddress, TRUE, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &ComSectionSize) != NULL;
237
238 SHIMENG_INFO("COM+ executable %s\n", g_bComPlusImage ? "TRUE" : "FALSE");
239 }
240
241
242 PSHIMMODULE SeiGetShimModuleInfo(PVOID BaseAddress)
243 {
244 DWORD n;
245
246 for (n = 0; n < ARRAY_Size(&g_pShimInfo); ++n)
247 {
248 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, n);
249
250 if (pShimModule->BaseAddress == BaseAddress)
251 return pShimModule;
252 }
253 return NULL;
254 }
255
256 PSHIMMODULE SeiCreateShimModuleInfo(PCWSTR DllName, PVOID BaseAddress)
257 {
258 static const ANSI_STRING GetHookAPIs = RTL_CONSTANT_STRING("GetHookAPIs");
259 static const ANSI_STRING NotifyShims = RTL_CONSTANT_STRING("NotifyShims");
260 PSHIMMODULE* pData, Data;
261 PVOID pGetHookAPIs, pNotifyShims;
262
263 if (!NT_SUCCESS(LdrGetProcedureAddress(BaseAddress, (PANSI_STRING)&GetHookAPIs, 0, &pGetHookAPIs)) ||
264 !NT_SUCCESS(LdrGetProcedureAddress(BaseAddress, (PANSI_STRING)&NotifyShims, 0, &pNotifyShims)))
265 {
266 SHIMENG_WARN("Failed to resolve entry points for %S\n", DllName);
267 return NULL;
268 }
269
270 pData = ARRAY_Append(&g_pShimInfo, PSHIMMODULE);
271 if (!pData)
272 return NULL;
273
274 *pData = SeiAlloc(sizeof(SHIMMODULE));
275
276 Data = *pData;
277
278 RtlCreateUnicodeString(&Data->Name, DllName);
279 Data->BaseAddress = BaseAddress;
280
281 Data->pGetHookAPIs = pGetHookAPIs;
282 Data->pNotifyShims = pNotifyShims;
283
284 ARRAY_Init(&Data->EnabledShims, PSHIMINFO);
285
286 return Data;
287 }
288
289 PSHIMINFO SeiAppendHookInfo(PSHIMMODULE pShimModuleInfo, PHOOKAPIEX pHookApi, DWORD dwHookCount, PCWSTR ShimName)
290 {
291 PSHIMINFO* pData, Data;
292
293 pData = ARRAY_Append(&pShimModuleInfo->EnabledShims, PSHIMINFO);
294 if (!pData)
295 return NULL;
296
297 *pData = SeiAlloc(sizeof(SHIMINFO));
298 Data = *pData;
299
300 if (!Data)
301 return NULL;
302
303 Data->ShimName = SdbpStrDup(ShimName);
304 if (!Data->ShimName)
305 return NULL;
306
307 Data->pHookApi = pHookApi;
308 Data->dwHookCount = dwHookCount;
309 Data->pShimModule = pShimModuleInfo;
310 ARRAY_Init(&Data->InExclude, INEXCLUDE);
311 return Data;
312 }
313
314 PHOOKMODULEINFO SeiFindHookModuleInfo(PUNICODE_STRING ModuleName, PVOID BaseAddress)
315 {
316 DWORD n;
317
318 if (ModuleName == NULL && BaseAddress == NULL)
319 {
320 BaseAddress = NtCurrentPeb()->ImageBaseAddress;
321 }
322
323 for (n = 0; n < ARRAY_Size(&g_pHookArray); ++n)
324 {
325 PHOOKMODULEINFO pModuleInfo = ARRAY_At(&g_pHookArray, HOOKMODULEINFO, n);
326
327 if (BaseAddress && BaseAddress == pModuleInfo->BaseAddress)
328 return pModuleInfo;
329
330 if (!BaseAddress && RtlEqualUnicodeString(ModuleName, &pModuleInfo->Name, TRUE))
331 return pModuleInfo;
332 }
333
334 return NULL;
335 }
336
337 PHOOKMODULEINFO SeiFindHookModuleInfoForImportDescriptor(PBYTE DllBase, PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor)
338 {
339 UNICODE_STRING DllName;
340 PVOID DllHandle;
341 NTSTATUS Success;
342
343 if (!RtlCreateUnicodeStringFromAsciiz(&DllName, (PCSZ)(DllBase + ImportDescriptor->Name)))
344 {
345 SHIMENG_FAIL("Unable to convert dll name to unicode\n");
346 return NULL;
347 }
348
349 Success = LdrGetDllHandle(NULL, NULL, &DllName, &DllHandle);
350 RtlFreeUnicodeString(&DllName);
351
352 if (!NT_SUCCESS(Success))
353 {
354 SHIMENG_FAIL("Unable to get module handle for %wZ\n", &DllName);
355 return NULL;
356 }
357
358 return SeiFindHookModuleInfo(NULL, DllHandle);
359 }
360
361 static LPCWSTR SeiGetStringPtr(PDB pdb, TAGID tag, TAG type)
362 {
363 TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
364 if (tagEntry == TAGID_NULL)
365 return NULL;
366
367 return SdbGetStringTagPtr(pdb, tagEntry);
368 }
369
370 static DWORD SeiGetDWORD(PDB pdb, TAGID tag, TAG type)
371 {
372 TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
373 if (tagEntry == TAGID_NULL)
374 return 0;
375
376 return SdbReadDWORDTag(pdb, tagEntry, 0);
377 }
378
379 static QWORD SeiGetQWORD(PDB pdb, TAGID tag, TAG type)
380 {
381 TAGID tagEntry = SdbFindFirstTag(pdb, tag, type);
382 if (tagEntry == TAGID_NULL)
383 return 0;
384
385 return SdbReadQWORDTag(pdb, tagEntry, 0);
386 }
387
388 static VOID SeiAddShim(TAGREF trShimRef, PARRAY pShimRef)
389 {
390 TAGREF* Data;
391
392 Data = ARRAY_Append(pShimRef, TAGREF);
393 if (!Data)
394 return;
395
396 *Data = trShimRef;
397 }
398
399 static VOID SeiAddFlag(PDB pdb, TAGID tiFlagRef, PFLAGINFO pFlagInfo)
400 {
401 ULARGE_INTEGER Flag;
402
403 /* Resolve the FLAG_REF to the real FLAG node */
404 TAGID FlagTag = SeiGetDWORD(pdb, tiFlagRef, TAG_FLAG_TAGID);
405
406 if (FlagTag == TAGID_NULL)
407 return;
408
409 pFlagInfo->AppCompatFlags.QuadPart |= SeiGetQWORD(pdb, FlagTag, TAG_FLAG_MASK_KERNEL);
410 pFlagInfo->AppCompatFlagsUser.QuadPart |= SeiGetQWORD(pdb, FlagTag, TAG_FLAG_MASK_USER);
411 Flag.QuadPart = SeiGetQWORD(pdb, FlagTag, TAG_FLAG_PROCESSPARAM);
412 pFlagInfo->ProcessParameters_Flags |= Flag.LowPart;
413 }
414
415 /* Propagate layers to child processes */
416 static VOID SeiSetLayerEnvVar(LPCWSTR wszLayer)
417 {
418 NTSTATUS Status;
419 UNICODE_STRING VarName = RTL_CONSTANT_STRING(L"__COMPAT_LAYER");
420 UNICODE_STRING Value;
421
422 RtlInitUnicodeString(&Value, wszLayer);
423
424 Status = RtlSetEnvironmentVariable(NULL, &VarName, &Value);
425 if (NT_SUCCESS(Status))
426 SHIMENG_INFO("Set env var %wZ=%wZ\n", &VarName, &Value);
427 else
428 SHIMENG_FAIL("Failed to set %wZ: 0x%x\n", &VarName, Status);
429 }
430
431 #define MAX_LAYER_LENGTH 256
432
433 /* Translate all Exe and Layer entries to Shims, and propagate all layers */
434 static VOID SeiBuildShimRefArray(HSDB hsdb, SDBQUERYRESULT* pQuery, PARRAY pShimRef, PFLAGINFO pFlagInfo)
435 {
436 WCHAR wszLayerEnvVar[MAX_LAYER_LENGTH] = { 0 };
437 DWORD n;
438
439 for (n = 0; n < pQuery->dwExeCount; ++n)
440 {
441 PDB pdb;
442 TAGID tag;
443 if (SdbTagRefToTagID(hsdb, pQuery->atrExes[n], &pdb, &tag))
444 {
445 LPCWSTR ExeName = SeiGetStringPtr(pdb, tag, TAG_NAME);
446 TAGID ShimRef = SdbFindFirstTag(pdb, tag, TAG_SHIM_REF);
447 TAGID FlagRef = SdbFindFirstTag(pdb, tag, TAG_FLAG_REF);
448
449 if (ExeName)
450 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Exe(%S))\n", ExeName);
451
452 while (ShimRef != TAGID_NULL)
453 {
454 TAGREF trShimRef;
455 if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
456 SeiAddShim(trShimRef, pShimRef);
457
458 ShimRef = SdbFindNextTag(pdb, tag, ShimRef);
459 }
460
461 while (FlagRef != TAGID_NULL)
462 {
463 SeiAddFlag(pdb, FlagRef, pFlagInfo);
464
465 FlagRef = SdbFindNextTag(pdb, tag, FlagRef);
466 }
467 }
468 }
469
470
471 for (n = 0; n < pQuery->dwLayerCount; ++n)
472 {
473 PDB pdb;
474 TAGID tag;
475 if (SdbTagRefToTagID(hsdb, pQuery->atrLayers[n], &pdb, &tag))
476 {
477 LPCWSTR LayerName = SeiGetStringPtr(pdb, tag, TAG_NAME);
478 TAGID ShimRef = SdbFindFirstTag(pdb, tag, TAG_SHIM_REF);
479 TAGID FlagRef = SdbFindFirstTag(pdb, tag, TAG_FLAG_REF);
480
481 if (LayerName)
482 {
483 HRESULT hr;
484 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Layer(%S))\n", LayerName);
485 if (wszLayerEnvVar[0])
486 StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), L" ");
487 hr = StringCchCatW(wszLayerEnvVar, ARRAYSIZE(wszLayerEnvVar), LayerName);
488 if (!SUCCEEDED(hr))
489 {
490 SHIMENG_FAIL("Unable to append %S\n", LayerName);
491 }
492 }
493
494 while (ShimRef != TAGID_NULL)
495 {
496 TAGREF trShimRef;
497 if (SdbTagIDToTagRef(hsdb, pdb, ShimRef, &trShimRef))
498 SeiAddShim(trShimRef, pShimRef);
499
500 ShimRef = SdbFindNextTag(pdb, tag, ShimRef);
501 }
502
503 while (FlagRef != TAGID_NULL)
504 {
505 SeiAddFlag(pdb, FlagRef, pFlagInfo);
506
507 FlagRef = SdbFindNextTag(pdb, tag, FlagRef);
508 }
509 }
510 }
511 if (wszLayerEnvVar[0])
512 SeiSetLayerEnvVar(wszLayerEnvVar);
513 }
514
515 /* Given the hooks from one shim, find the relevant modules and store the combination of module + hook */
516 VOID SeiAddHooks(PHOOKAPIEX hooks, DWORD dwHookCount, PSHIMINFO pShim)
517 {
518 DWORD n, j;
519 UNICODE_STRING UnicodeModName;
520 WCHAR Buf[512];
521
522 RtlInitEmptyUnicodeString(&UnicodeModName, Buf, sizeof(Buf));
523
524 for (n = 0; n < dwHookCount; ++n)
525 {
526 ANSI_STRING AnsiString;
527 PVOID DllHandle;
528 PHOOKAPIEX hook = hooks + n;
529 PHOOKAPIEX* pHookApi;
530 PHOOKMODULEINFO HookModuleInfo;
531
532 RtlInitAnsiString(&AnsiString, hook->LibraryName);
533 if (!NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeModName, &AnsiString, FALSE)))
534 {
535 SHIMENG_FAIL("Unable to convert %s to Unicode\n", hook->LibraryName);
536 continue;
537 }
538
539 RtlInitAnsiString(&AnsiString, hook->FunctionName);
540 if (NT_SUCCESS(LdrGetDllHandle(NULL, 0, &UnicodeModName, &DllHandle)))
541 {
542 PVOID ProcAddress;
543
544
545 if (!NT_SUCCESS(LdrGetProcedureAddress(DllHandle, &AnsiString, 0, &ProcAddress)))
546 {
547 SHIMENG_FAIL("Unable to retrieve %s!%s\n", hook->LibraryName, hook->FunctionName);
548 continue;
549 }
550
551 HookModuleInfo = SeiFindHookModuleInfo(NULL, DllHandle);
552 hook->OriginalFunction = ProcAddress;
553 }
554 else
555 {
556 HookModuleInfo = SeiFindHookModuleInfo(&UnicodeModName, NULL);
557 DllHandle = NULL;
558 }
559
560 if (!HookModuleInfo)
561 {
562 HookModuleInfo = ARRAY_Append(&g_pHookArray, HOOKMODULEINFO);
563 if (!HookModuleInfo)
564 continue;
565
566 HookModuleInfo->BaseAddress = DllHandle;
567 ARRAY_Init(&HookModuleInfo->HookApis, PHOOKAPIEX);
568 RtlCreateUnicodeString(&HookModuleInfo->Name, UnicodeModName.Buffer);
569 }
570
571 hook->pShimInfo = pShim;
572
573 for (j = 0; j < ARRAY_Size(&HookModuleInfo->HookApis); ++j)
574 {
575 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, j);
576 int CmpResult = strcmp(hook->FunctionName, HookApi->FunctionName);
577 if (CmpResult == 0)
578 {
579 /* Multiple hooks on one function? --> use ApiLink */
580 SHIMENG_FAIL("Multiple hooks on one API is not yet supported!\n");
581 ASSERT(0);
582 }
583 }
584 pHookApi = ARRAY_Append(&HookModuleInfo->HookApis, PHOOKAPIEX);
585 *pHookApi = hook;
586 }
587 }
588
589 typedef FARPROC(WINAPI* GETPROCADDRESSPROC)(HINSTANCE, LPCSTR);
590
591 /* Check if we should fake the return from GetProcAddress (because we also redirected the iat for this module) */
592 FARPROC WINAPI StubGetProcAddress(HINSTANCE hModule, LPCSTR lpProcName)
593 {
594 char szOrdProcName[10] = "";
595 LPCSTR lpPrintName = lpProcName;
596 PVOID Addr = _ReturnAddress();
597 PHOOKMODULEINFO HookModuleInfo;
598 FARPROC proc = ((GETPROCADDRESSPROC)g_IntHookEx[0].OriginalFunction)(hModule, lpProcName);
599
600 if ((DWORD_PTR)lpProcName <= MAXUSHORT)
601 {
602 sprintf(szOrdProcName, "#%Iu", (DWORD_PTR)lpProcName);
603 lpPrintName = szOrdProcName;
604 }
605
606 Addr = SeiGetModuleFromAddress(Addr);
607 if (SE_IsShimDll(Addr))
608 {
609 SHIMENG_MSG("Not touching GetProcAddress for shim dll (%p!%s)", hModule, lpPrintName);
610 return proc;
611 }
612
613 SHIMENG_INFO("(GetProcAddress(%p!%s) => %p\n", hModule, lpPrintName, proc);
614
615 HookModuleInfo = SeiFindHookModuleInfo(NULL, hModule);
616
617 /* FIXME: Ordinal not yet supported */
618 if (HookModuleInfo && HIWORD(lpProcName))
619 {
620 DWORD n;
621 for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
622 {
623 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
624 int CmpResult = strcmp(lpProcName, HookApi->FunctionName);
625 if (CmpResult == 0)
626 {
627 SHIMENG_MSG("Redirecting %p to %p\n", proc, HookApi->ReplacementFunction);
628 proc = HookApi->ReplacementFunction;
629 break;
630 }
631 }
632 }
633
634 return proc;
635 }
636
637 /* Walk all shim modules / enabled shims, and add their hooks */
638 VOID SeiResolveAPIs(VOID)
639 {
640 DWORD mod, n;
641
642 /* Enumerate all Shim modules */
643 for (mod = 0; mod < ARRAY_Size(&g_pShimInfo); ++mod)
644 {
645 PSHIMMODULE pShimModule = *ARRAY_At(&g_pShimInfo, PSHIMMODULE, mod);
646 DWORD dwShimCount = ARRAY_Size(&pShimModule->EnabledShims);
647
648 /* Enumerate all Shims */
649 for (n = 0; n < dwShimCount; ++n)
650 {
651 PSHIMINFO pShim = *ARRAY_At(&pShimModule->EnabledShims, PSHIMINFO, n);
652
653 PHOOKAPIEX hooks = pShim->pHookApi;
654 DWORD dwHookCount = pShim->dwHookCount;
655
656 SeiAddHooks(hooks, dwHookCount, pShim);
657 }
658 }
659 }
660
661 /* If we hooked something, we should also redirect GetProcAddress */
662 VOID SeiAddInternalHooks(DWORD dwNumHooks)
663 {
664 if (dwNumHooks == 0)
665 {
666 g_bInternalHooksUsed = FALSE;
667 return;
668 }
669
670 SeiAddHooks(g_IntHookEx, ARRAYSIZE(g_IntHookEx), NULL);
671 g_bInternalHooksUsed = TRUE;
672 }
673
674 /* Patch one function in the iat */
675 VOID SeiPatchNewImport(PIMAGE_THUNK_DATA FirstThunk, PHOOKAPIEX HookApi, PLDR_DATA_TABLE_ENTRY LdrEntry)
676 {
677 ULONG OldProtection = 0;
678 PVOID Ptr;
679 SIZE_T Size;
680 NTSTATUS Status;
681
682 SHIMENG_INFO("Hooking API \"%s!%s\" for DLL \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, &LdrEntry->BaseDllName);
683
684 Ptr = &FirstThunk->u1.Function;
685 Size = sizeof(FirstThunk->u1.Function);
686 Status = NtProtectVirtualMemory(NtCurrentProcess(), &Ptr, &Size, PAGE_EXECUTE_READWRITE, &OldProtection);
687
688 if (!NT_SUCCESS(Status))
689 {
690 SHIMENG_FAIL("Unable to unprotect 0x%p\n", &FirstThunk->u1.Function);
691 return;
692 }
693
694 SHIMENG_INFO("changing 0x%p to 0x%p\n", FirstThunk->u1.Function, HookApi->ReplacementFunction);
695 #ifdef _WIN64
696 FirstThunk->u1.Function = (ULONGLONG)HookApi->ReplacementFunction;
697 #else
698 FirstThunk->u1.Function = (DWORD)HookApi->ReplacementFunction;
699 #endif
700
701 Size = sizeof(FirstThunk->u1.Function);
702 Status = NtProtectVirtualMemory(NtCurrentProcess(), &Ptr, &Size, OldProtection, &OldProtection);
703
704 if (!NT_SUCCESS(Status))
705 {
706 SHIMENG_WARN("Unable to reprotect 0x%p\n", &FirstThunk->u1.Function);
707 }
708 }
709
710
711 PINEXCLUDE SeiFindInExclude(PARRAY InExclude, PCUNICODE_STRING DllName)
712 {
713 DWORD n;
714
715 for (n = 0; n < ARRAY_Size(InExclude); ++n)
716 {
717 PINEXCLUDE InEx = ARRAY_At(InExclude, INEXCLUDE, n);
718
719 if (RtlEqualUnicodeString(&InEx->Module, DllName, TRUE))
720 return InEx;
721 }
722
723 return NULL;
724 }
725
726 BOOL SeiIsExcluded(PLDR_DATA_TABLE_ENTRY LdrEntry, PHOOKAPIEX HookApi)
727 {
728 PSHIMINFO pShimInfo = HookApi->pShimInfo;
729 PINEXCLUDE InExclude;
730 BOOL IsExcluded = FALSE;
731
732 if (!pShimInfo)
733 {
734 /* Internal hook, do not exclude it */
735 return FALSE;
736 }
737
738 /* By default, everything from System32 or WinSxs is excluded */
739 if (RtlPrefixUnicodeString(&g_System32Directory, &LdrEntry->FullDllName, TRUE) ||
740 RtlPrefixUnicodeString(&g_SxsDirectory, &LdrEntry->FullDllName, TRUE))
741 IsExcluded = TRUE;
742
743 InExclude = SeiFindInExclude(&pShimInfo->InExclude, &LdrEntry->BaseDllName);
744 if (InExclude)
745 {
746 /* If it is on the 'exclude' list, bail out */
747 if (!InExclude->Include)
748 {
749 SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it on in the exclude list.\n",
750 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
751
752 return TRUE;
753 }
754 /* If it is on the 'include' list, override System32 / Winsxs check. */
755 if (IsExcluded)
756 {
757 SHIMENG_INFO("Module '%wZ' included for shim %S, API '%s!%s', because it is on the include list.\n",
758 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
759
760 }
761 IsExcluded = FALSE;
762 }
763
764 if (IsExcluded)
765 {
766 SHIMENG_INFO("Module '%wZ' excluded for shim %S, API '%s!%s', because it is in System32/WinSXS.\n",
767 &LdrEntry->BaseDllName, pShimInfo->ShimName, HookApi->LibraryName, HookApi->FunctionName);
768 }
769
770 return IsExcluded;
771 }
772
773 VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude)
774 {
775 PINEXCLUDE InExclude;
776 UNICODE_STRING ModuleNameU;
777 RtlInitUnicodeString(&ModuleNameU, ModuleName);
778
779 InExclude = SeiFindInExclude(dest, &ModuleNameU);
780 if (InExclude)
781 {
782 InExclude->Include = IsInclude;
783 return;
784 }
785
786 InExclude = ARRAY_Append(dest, INEXCLUDE);
787 if (InExclude)
788 {
789 PCWSTR ModuleNameCopy = SdbpStrDup(ModuleName);
790 RtlInitUnicodeString(&InExclude->Module, ModuleNameCopy);
791 InExclude->Include = IsInclude;
792 }
793 }
794
795 /* Read the INEXCLUD tags from a given parent tag */
796 VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest)
797 {
798 TAGID InExcludeTag;
799
800 InExcludeTag = SdbFindFirstTag(pdb, parent, TAG_INEXCLUD);
801
802 while (InExcludeTag != TAGID_NULL)
803 {
804 PCWSTR ModuleName;
805 TAGID ModuleTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_MODULE);
806 TAGID IncludeTag = SdbFindFirstTag(pdb, InExcludeTag, TAG_INCLUDE);
807
808 ModuleName = SdbGetStringTagPtr(pdb, ModuleTag);
809 if (ModuleName)
810 {
811 SeiAppendInExclude(dest, ModuleName, IncludeTag != TAGID_NULL);
812 }
813 else
814 {
815 SHIMENG_WARN("INEXCLUDE without Module: 0x%x\n", InExcludeTag);
816 }
817
818 InExcludeTag = SdbFindNextTag(pdb, parent, InExcludeTag);
819 }
820 }
821
822 VOID SeiBuildGlobalInclExclList(HSDB hsdb)
823 {
824 PDB pdb;
825 TAGREF tr = TAGREF_ROOT;
826 TAGID root, db, library;
827
828 if (!SdbTagRefToTagID(hsdb, tr, &pdb, &root))
829 {
830 SHIMENG_WARN("Unable to resolve database root\n");
831 return;
832 }
833 db = SdbFindFirstTag(pdb, root, TAG_DATABASE);
834 if (db == TAGID_NULL)
835 {
836 SHIMENG_WARN("Unable to resolve database\n");
837 return;
838 }
839 library = SdbFindFirstTag(pdb, db, TAG_LIBRARY);
840 if (library == TAGID_NULL)
841 {
842 SHIMENG_WARN("Unable to resolve library\n");
843 return;
844 }
845
846 SeiReadInExclude(pdb, library, &g_InExclude);
847 }
848
849 VOID SeiBuildInclExclList(PDB pdb, TAGID ShimTag, PSHIMINFO pShimInfo)
850 {
851 DWORD n;
852
853 /* First duplicate the global in/excludes */
854 for (n = 0; n < ARRAY_Size(&g_InExclude); ++n)
855 {
856 PINEXCLUDE InEx = ARRAY_At(&g_InExclude, INEXCLUDE, n);
857 SeiAppendInExclude(&pShimInfo->InExclude, InEx->Module.Buffer, InEx->Include);
858 }
859
860 /* Now read this shim's in/excludes (possibly overriding the global ones) */
861 SeiReadInExclude(pdb, ShimTag, &pShimInfo->InExclude);
862 }
863
864 /* Given one loaded module, redirect (hook) all functions from the iat that are registered by shims */
865 VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry)
866 {
867 ULONG Size;
868 PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
869 PBYTE DllBase = LdrEntry->DllBase;
870
871 if (SE_IsShimDll(DllBase) || g_hInstance == LdrEntry->DllBase)
872 {
873 SHIMENG_INFO("Skipping shim module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
874 return;
875 }
876
877 if (LdrEntry->Flags & LDRP_COMPAT_DATABASE_PROCESSED)
878 {
879 SHIMENG_INFO("Skipping module 0x%p \"%wZ\" because it was already processed\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
880 return;
881 }
882
883 ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size);
884 if (!ImportDescriptor)
885 {
886 SHIMENG_INFO("Skipping module 0x%p \"%wZ\" due to no iat found\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
887 return;
888 }
889
890 SHIMENG_INFO("Hooking module 0x%p \"%wZ\"\n", LdrEntry->DllBase, &LdrEntry->BaseDllName);
891
892 for ( ;ImportDescriptor->Name && ImportDescriptor->OriginalFirstThunk; ImportDescriptor++)
893 {
894 PHOOKMODULEINFO HookModuleInfo;
895
896 /* Do we have hooks for this module? */
897 HookModuleInfo = SeiFindHookModuleInfoForImportDescriptor(DllBase, ImportDescriptor);
898
899 if (HookModuleInfo)
900 {
901 PIMAGE_THUNK_DATA OriginalThunk, FirstThunk;
902 DWORD n;
903
904 for (n = 0; n < ARRAY_Size(&HookModuleInfo->HookApis); ++n)
905 {
906 DWORD dwFound = 0;
907 PHOOKAPIEX HookApi = *ARRAY_At(&HookModuleInfo->HookApis, PHOOKAPIEX, n);
908
909 /* Check if this module should be excluded from being hooked (system32/winsxs, global or shim exclude) */
910 if (SeiIsExcluded(LdrEntry, HookApi))
911 {
912 continue;
913 }
914
915 OriginalThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->OriginalFirstThunk);
916 FirstThunk = (PIMAGE_THUNK_DATA)(DllBase + ImportDescriptor->FirstThunk);
917
918 /* Walk all imports */
919 for (;OriginalThunk->u1.AddressOfData && FirstThunk->u1.Function; OriginalThunk++, FirstThunk++)
920 {
921 if (!IMAGE_SNAP_BY_ORDINAL32(OriginalThunk->u1.AddressOfData))
922 {
923 PIMAGE_IMPORT_BY_NAME ImportName;
924
925 ImportName = (PIMAGE_IMPORT_BY_NAME)(DllBase + OriginalThunk->u1.AddressOfData);
926 if (!strcmp((PCSTR)ImportName->Name, HookApi->FunctionName))
927 {
928 SeiPatchNewImport(FirstThunk, HookApi, LdrEntry);
929
930 /* Sadly, iat does not have to be sorted, and can even contain duplicate entries. */
931 dwFound++;
932 }
933 }
934 else
935 {
936 SHIMENG_FAIL("Ordinals not yet supported\n");
937 ASSERT(0);
938 }
939 }
940
941 if (dwFound != 1)
942 {
943 /* One entry not found. */
944 if (!dwFound)
945 SHIMENG_INFO("Entry \"%s!%s\" not found for \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, &LdrEntry->BaseDllName);
946 else
947 SHIMENG_INFO("Entry \"%s!%s\" found %d times for \"%wZ\"\n", HookApi->LibraryName, HookApi->FunctionName, dwFound, &LdrEntry->BaseDllName);
948 }
949 }
950 }
951 }
952
953 /* Mark this module as processed. */
954 LdrEntry->Flags |= LDRP_COMPAT_DATABASE_PROCESSED;
955 }
956
957
958 VOID PatchNewModules(PPEB Peb)
959 {
960 PLIST_ENTRY ListHead, ListEntry;
961 PLDR_DATA_TABLE_ENTRY LdrEntry;
962
963 ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
964 ListEntry = ListHead->Flink;
965
966 while (ListHead != ListEntry)
967 {
968 LdrEntry = CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
969 SeiHookImports(LdrEntry);
970
971 ListEntry = ListEntry->Flink;
972 }
973 }
974
975
976 VOID SeiInitPaths(VOID)
977 {
978 #define SYSTEM32 L"\\system32"
979 #define WINSXS L"\\winsxs"
980
981 PWSTR WindowsDirectory = SdbpStrDup(SharedUserData->NtSystemRoot);
982 RtlInitUnicodeString(&g_WindowsDirectory, WindowsDirectory);
983
984 g_System32Directory.MaximumLength = g_WindowsDirectory.Length + SdbpStrsize(SYSTEM32);
985 g_System32Directory.Buffer = SdbpAlloc(g_System32Directory.MaximumLength);
986 RtlCopyUnicodeString(&g_System32Directory, &g_WindowsDirectory);
987 RtlAppendUnicodeToString(&g_System32Directory, SYSTEM32);
988
989 g_SxsDirectory.MaximumLength = g_WindowsDirectory.Length + SdbpStrsize(WINSXS);
990 g_SxsDirectory.Buffer = SdbpAlloc(g_SxsDirectory.MaximumLength);
991 RtlCopyUnicodeString(&g_SxsDirectory, &g_WindowsDirectory);
992 RtlAppendUnicodeToString(&g_SxsDirectory, WINSXS);
993
994 #undef SYSTEM32
995 #undef WINSXS
996 }
997
998 VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery)
999 {
1000 DWORD n;
1001 ARRAY ShimRefArray;
1002 DWORD dwTotalHooks = 0;
1003 FLAGINFO ShimFlags;
1004
1005 PPEB Peb = NtCurrentPeb();
1006
1007 /* We should only be called once! */
1008 ASSERT(g_pShimInfo.ItemSize__ == 0);
1009
1010 ARRAY_Init(&ShimRefArray, TAGREF);
1011 ARRAY_Init(&g_pShimInfo, PSHIMMODULE);
1012 ARRAY_Init(&g_pHookArray, HOOKMODULEINFO);
1013 ARRAY_Init(&g_InExclude, INEXCLUDE);
1014 RtlZeroMemory(&ShimFlags, sizeof(ShimFlags));
1015
1016 SeiInitPaths();
1017
1018 SeiCheckComPlusImage(Peb->ImageBaseAddress);
1019
1020 /* TODO:
1021 if (pQuery->trApphelp)
1022 SeiDisplayAppHelp(?pQuery->trApphelp?);
1023 */
1024
1025 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(ExePath(%wZ))\n", ProcessImage);
1026 SeiBuildShimRefArray(hsdb, pQuery, &ShimRefArray, &ShimFlags);
1027 if (ShimFlags.AppCompatFlags.QuadPart)
1028 {
1029 SeiDbgPrint(SEI_MSG, NULL, "Using KERNEL apphack flags 0x%I64x\n", ShimFlags.AppCompatFlags.QuadPart);
1030 Peb->AppCompatFlags.QuadPart |= ShimFlags.AppCompatFlags.QuadPart;
1031 }
1032 if (ShimFlags.AppCompatFlagsUser.QuadPart)
1033 {
1034 SeiDbgPrint(SEI_MSG, NULL, "Using USER apphack flags 0x%I64x\n", ShimFlags.AppCompatFlagsUser.QuadPart);
1035 Peb->AppCompatFlagsUser.QuadPart |= ShimFlags.AppCompatFlagsUser.QuadPart;
1036 }
1037 if (ShimFlags.ProcessParameters_Flags)
1038 {
1039 SeiDbgPrint(SEI_MSG, NULL, "Using ProcessParameters flags 0x%x\n", ShimFlags.ProcessParameters_Flags);
1040 Peb->ProcessParameters->Flags |= ShimFlags.ProcessParameters_Flags;
1041 }
1042 SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(Complete)\n");
1043
1044 SHIMENG_INFO("Got %d shims\n", ARRAY_Size(&ShimRefArray));
1045 SeiBuildGlobalInclExclList(hsdb);
1046
1047 /* Walk all shims referenced (in layers + exes), and load their modules */
1048 for (n = 0; n < ARRAY_Size(&ShimRefArray); ++n)
1049 {
1050 PDB pdb;
1051 TAGID ShimRef;
1052
1053 TAGREF tr = *ARRAY_At(&ShimRefArray, TAGREF, n);
1054
1055 if (SdbTagRefToTagID(hsdb, tr, &pdb, &ShimRef))
1056 {
1057 LPCWSTR ShimName, DllName, CommandLine = NULL;
1058 TAGID ShimTag;
1059 WCHAR FullNameBuffer[MAX_PATH];
1060 UNICODE_STRING UnicodeDllName;
1061 PVOID BaseAddress;
1062 PSHIMMODULE pShimModuleInfo = NULL;
1063 ANSI_STRING AnsiCommandLine = RTL_CONSTANT_STRING("");
1064 PSHIMINFO pShimInfo = NULL;
1065 PHOOKAPIEX pHookApi;
1066 DWORD dwHookCount;
1067
1068 ShimName = SeiGetStringPtr(pdb, ShimRef, TAG_NAME);
1069 if (!ShimName)
1070 {
1071 SHIMENG_FAIL("Failed to retrieve the name for 0x%x\n", tr);
1072 continue;
1073 }
1074
1075 CommandLine = SeiGetStringPtr(pdb, ShimRef, TAG_COMMAND_LINE);
1076 if (CommandLine && *CommandLine)
1077 {
1078 RtlInitUnicodeString(&UnicodeDllName, CommandLine);
1079 if (NT_SUCCESS(RtlUnicodeStringToAnsiString(&AnsiCommandLine, &UnicodeDllName, TRUE)))
1080 {
1081 SHIMENG_INFO("COMMAND LINE %s for %S", AnsiCommandLine.Buffer, ShimName);
1082 }
1083 else
1084 {
1085 AnsiCommandLine.Buffer = "";
1086 CommandLine = NULL;
1087 }
1088 }
1089
1090 ShimTag = SeiGetDWORD(pdb, ShimRef, TAG_SHIM_TAGID);
1091 if (!ShimTag)
1092 {
1093 SHIMENG_FAIL("Failed to resolve %S to a shim\n", ShimName);
1094 continue;
1095 }
1096
1097 if (!SUCCEEDED(SdbGetAppPatchDir(NULL, FullNameBuffer, ARRAYSIZE(FullNameBuffer))))
1098 {
1099 SHIMENG_WARN("Failed to get the AppPatch dir\n");
1100 continue;
1101 }
1102
1103 DllName = SeiGetStringPtr(pdb, ShimTag, TAG_DLLFILE);
1104 if (DllName == NULL ||
1105 !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), L"\\")) ||
1106 !SUCCEEDED(StringCchCatW(FullNameBuffer, ARRAYSIZE(FullNameBuffer), DllName)))
1107 {
1108 SHIMENG_WARN("Failed to build a full path for %S\n", ShimName);
1109 continue;
1110 }
1111
1112 RtlInitUnicodeString(&UnicodeDllName, FullNameBuffer);
1113 if (NT_SUCCESS(LdrGetDllHandle(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1114 {
1115 /* This shim dll was already loaded, let's find it */
1116 pShimModuleInfo = SeiGetShimModuleInfo(BaseAddress);
1117 }
1118 else if (!NT_SUCCESS(LdrLoadDll(NULL, NULL, &UnicodeDllName, &BaseAddress)))
1119 {
1120 SHIMENG_WARN("Failed to load %wZ for %S\n", &UnicodeDllName, ShimName);
1121 continue;
1122 }
1123 /* No shim module found (or we just loaded it) */
1124 if (!pShimModuleInfo)
1125 {
1126 pShimModuleInfo = SeiCreateShimModuleInfo(DllName, BaseAddress);
1127 if (!pShimModuleInfo)
1128 {
1129 SHIMENG_FAIL("Failed to allocate ShimInfo for %S\n", DllName);
1130 continue;
1131 }
1132 }
1133
1134 SHIMENG_INFO("Shim DLL 0x%p \"%wZ\" loaded\n", BaseAddress, &UnicodeDllName);
1135 SHIMENG_INFO("Using SHIM \"%S!%S\"\n", DllName, ShimName);
1136
1137 /* Ask this shim what hooks it needs (and pass along the commandline) */
1138 pHookApi = pShimModuleInfo->pGetHookAPIs(AnsiCommandLine.Buffer, ShimName, &dwHookCount);
1139 SHIMENG_INFO("GetHookAPIs returns %d hooks for DLL \"%wZ\" SHIM \"%S\"\n", dwHookCount, &UnicodeDllName, ShimName);
1140 if (dwHookCount)
1141 pShimInfo = SeiAppendHookInfo(pShimModuleInfo, pHookApi, dwHookCount, ShimName);
1142
1143 /* If this shim has hooks, create the include / exclude lists */
1144 if (pShimInfo)
1145 SeiBuildInclExclList(pdb, ShimTag, pShimInfo);
1146
1147 if (CommandLine && *CommandLine)
1148 RtlFreeAnsiString(&AnsiCommandLine);
1149
1150 dwTotalHooks += dwHookCount;
1151 }
1152 }
1153
1154 SeiAddInternalHooks(dwTotalHooks);
1155 SeiResolveAPIs();
1156 PatchNewModules(Peb);
1157 }
1158
1159
1160 /* Load the database + unpack the shim data (if this process is allowed) */
1161 BOOL SeiGetShimData(PUNICODE_STRING ProcessImage, PVOID pShimData, HSDB* pHsdb, SDBQUERYRESULT* pQuery)
1162 {
1163 static const UNICODE_STRING ForbiddenShimmingApps[] = {
1164 RTL_CONSTANT_STRING(L"ntsd.exe"),
1165 RTL_CONSTANT_STRING(L"windbg.exe"),
1166 #if WINVER >= 0x600
1167 RTL_CONSTANT_STRING(L"slsvc.exe"),
1168 #endif
1169 };
1170 static const UNICODE_STRING BackSlash = RTL_CONSTANT_STRING(L"\\");
1171 static const UNICODE_STRING ForwdSlash = RTL_CONSTANT_STRING(L"/");
1172 UNICODE_STRING ProcessName;
1173 USHORT Back, Forward;
1174 HSDB hsdb;
1175 DWORD n;
1176
1177 if (!NT_SUCCESS(RtlFindCharInUnicodeString(RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END, ProcessImage, &BackSlash, &Back)))
1178 Back = 0;
1179
1180 if (!NT_SUCCESS(RtlFindCharInUnicodeString(RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END, ProcessImage, &ForwdSlash, &Forward)))
1181 Forward = 0;
1182
1183 if (Back < Forward)
1184 Back = Forward;
1185
1186 if (Back)
1187 Back += sizeof(WCHAR);
1188
1189 ProcessName.Buffer = ProcessImage->Buffer + Back / sizeof(WCHAR);
1190 ProcessName.Length = ProcessImage->Length - Back;
1191 ProcessName.MaximumLength = ProcessImage->MaximumLength - Back;
1192
1193 for (n = 0; n < ARRAYSIZE(ForbiddenShimmingApps); ++n)
1194 {
1195 if (RtlEqualUnicodeString(&ProcessName, ForbiddenShimmingApps + n, TRUE))
1196 {
1197 SHIMENG_MSG("Not shimming %wZ\n", ForbiddenShimmingApps + n);
1198 return FALSE;
1199 }
1200 }
1201
1202 /* We should probably load all db's here, but since we do not support that yet... */
1203 hsdb = SdbInitDatabase(HID_DOS_PATHS | SDB_DATABASE_MAIN_SHIM, NULL);
1204 if (hsdb)
1205 {
1206 if (SdbUnpackAppCompatData(hsdb, ProcessImage->Buffer, pShimData, pQuery))
1207 {
1208 *pHsdb = hsdb;
1209 return TRUE;
1210 }
1211 SdbReleaseDatabase(hsdb);
1212 }
1213 return FALSE;
1214 }
1215
1216
1217
1218 VOID NTAPI SE_InstallBeforeInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
1219 {
1220 HSDB hsdb = NULL;
1221 SDBQUERYRESULT QueryResult = { { 0 } };
1222 SHIMENG_INFO("(%wZ, %p)\n", ProcessImage, pShimData);
1223
1224 if (!SeiGetShimData(ProcessImage, pShimData, &hsdb, &QueryResult))
1225 {
1226 SHIMENG_FAIL("Failed to get shim data\n");
1227 return;
1228 }
1229
1230 g_bShimDuringInit = TRUE;
1231 SeiInit(ProcessImage, hsdb, &QueryResult);
1232 g_bShimDuringInit = FALSE;
1233
1234 SdbReleaseDatabase(hsdb);
1235 }
1236
1237 VOID NTAPI SE_InstallAfterInit(PUNICODE_STRING ProcessImage, PVOID pShimData)
1238 {
1239 NotifyShims(SHIM_NOTIFY_ATTACH, NULL);
1240 }
1241
1242 VOID NTAPI SE_ProcessDying(VOID)
1243 {
1244 SHIMENG_MSG("()\n");
1245 NotifyShims(SHIM_NOTIFY_DETACH, NULL);
1246 }
1247
1248 VOID WINAPI SE_DllLoaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
1249 {
1250 SHIMENG_INFO("%sINIT. loading DLL \"%wZ\"\n", g_bShimDuringInit ? "" : "AFTER ", &LdrEntry->BaseDllName);
1251
1252 SeiHookImports(LdrEntry);
1253
1254 NotifyShims(SHIM_REASON_DLL_LOAD, LdrEntry);
1255 }
1256
1257 VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
1258 {
1259 SHIMENG_INFO("(%p)\n", LdrEntry);
1260
1261 /* Should we unhook here? */
1262
1263 NotifyShims(SHIM_REASON_DLL_UNLOAD, LdrEntry);
1264 }
1265
1266 BOOL WINAPI SE_IsShimDll(PVOID BaseAddress)
1267 {
1268 SHIMENG_INFO("(%p)\n", BaseAddress);
1269
1270 return SeiGetShimModuleInfo(BaseAddress) != NULL;
1271 }
1272