windows-server-2003/base/ntdll/ldrapi.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    ldrapi.c

Abstract:

    This module implements the Ldr APIs that can be linked with
    an application to perform loader services. All of the APIs in
    this component are implemented in a DLL. They are not part of the
    DLL snap procedure.

Author:

    Mike O'Leary (mikeol) 23-Mar-1990

Revision History:

--*/

#include "ldrp.h"
#include "ntos.h"
#include "nt.h"
#include "ntrtl.h"
#include "nturtl.h"
#include "objidl.h"
#include <windows.h>
#include <apcompat.h>
#include <shimhapi.h>

#if defined(_WIN64)
#include <wow64t.h>
#endif // defined(_WIN64)

#define ULONG_PTR_IZE(_x) ((ULONG_PTR) (_x))
#define ULONG_PTR_IZE_SHIFT_AND_MASK(_x, _shift, _mask) ((ULONG_PTR) ((ULONG_PTR_IZE((_x)) & (_mask)) << (_shift)))

#define CHAR_BITS 8

#define LOADER_LOCK_COOKIE_TYPE_BIT_LENGTH (4)
#define LOADER_LOCK_COOKIE_TYPE_BIT_OFFSET ((CHAR_BITS * sizeof(PVOID)) - LOADER_LOCK_COOKIE_TYPE_BIT_LENGTH)
#define LOADER_LOCK_COOKIE_TYPE_BIT_MASK ((1 << LOADER_LOCK_COOKIE_TYPE_BIT_LENGTH) - 1)

#define LOADER_LOCK_COOKIE_TID_BIT_LENGTH (12)
#define LOADER_LOCK_COOKIE_TID_BIT_OFFSET (LOADER_LOCK_COOKIE_TYPE_BIT_OFFSET - LOADER_LOCK_COOKIE_TID_BIT_LENGTH)
#define LOADER_LOCK_COOKIE_TID_BIT_MASK ((1 << LOADER_LOCK_COOKIE_TID_BIT_LENGTH) - 1)

#define LOADER_LOCK_COOKIE_CODE_BIT_LENGTH (16)
#define LOADER_LOCK_COOKIE_CODE_BIT_OFFSET (0)
#define LOADER_LOCK_COOKIE_CODE_BIT_MASK ((1 << LOADER_LOCK_COOKIE_CODE_BIT_LENGTH) - 1)

#define MAKE_LOADER_LOCK_COOKIE(_type, _code) \
    ((ULONG_PTR) (ULONG_PTR_IZE_SHIFT_AND_MASK((_type), LOADER_LOCK_COOKIE_TYPE_BIT_OFFSET, LOADER_LOCK_COOKIE_TYPE_BIT_MASK) | \
                  ULONG_PTR_IZE_SHIFT_AND_MASK((HandleToUlong((NtCurrentTeb())->ClientId.UniqueThread)), LOADER_LOCK_COOKIE_TID_BIT_OFFSET, LOADER_LOCK_COOKIE_TID_BIT_MASK) | \
                  ULONG_PTR_IZE_SHIFT_AND_MASK((_code), LOADER_LOCK_COOKIE_CODE_BIT_OFFSET, LOADER_LOCK_COOKIE_CODE_BIT_MASK)))

#define EXTRACT_LOADER_LOCK_COOKIE_FIELD(_cookie, _shift, _mask) ((((ULONG_PTR) (_cookie)) >> (_shift)) & (_mask))
#define EXTRACT_LOADER_LOCK_COOKIE_TYPE(_cookie) EXTRACT_LOADER_LOCK_COOKIE_FIELD((_cookie), LOADER_LOCK_COOKIE_TYPE_BIT_OFFSET, LOADER_LOCK_COOKIE_TYPE_BIT_MASK)
#define EXTRACT_LOADER_LOCK_COOKIE_TID(_cookie) EXTRACT_LOADER_LOCK_COOKIE_FIELD((_cookie), LOADER_LOCK_COOKIE_TID_BIT_OFFSET, LOADER_LOCK_COOKIE_TID_BIT_MASK)

#define LOADER_LOCK_COOKIE_TYPE_NORMAL (0)

LONG LdrpLoaderLockAcquisitionCount;

// Note the case inconsistency is due to preserving case from earlier versions.
WCHAR DllExtension[] = L".dll";
UNICODE_STRING LdrApiDefaultExtension = RTL_CONSTANT_STRING(L".DLL");

PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine = NULL;

extern PFNSE_DLLLOADED         g_pfnSE_DllLoaded;
extern PFNSE_DLLUNLOADED       g_pfnSE_DllUnloaded;

PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION LdrpAppCompatDllRedirectionCallbackFunction = NULL;
PVOID LdrpAppCompatDllRedirectionCallbackData = NULL;
BOOLEAN LdrpShowRecursiveDllLoads;
BOOLEAN LdrpBreakOnRecursiveDllLoads;
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer;

VOID
RtlpDphDisableFaultInjection (
    );

VOID
RtlpDphEnableFaultInjection (
    );

ULONG
LdrpClearLoadInProgress(
    VOID
    );


NTSTATUS
LdrLoadDll (
    IN PCWSTR DllPath OPTIONAL,
    IN PULONG DllCharacteristics OPTIONAL,
    IN PCUNICODE_STRING DllName,
    OUT PVOID *DllHandle
    )

/*++

Routine Description:

    This function loads a DLL into the calling process address space.

Arguments:

    DllPath - Supplies the search path to be used to locate the DLL.

    DllCharacteristics - Supplies an optional DLL characteristics flag,
        that if specified is used to match against the dll being loaded.

    DllName - Supplies the name of the DLL to load.

    DllHandle - Returns a handle to the loaded DLL.

Return Value:

    NTSTATUS.

--*/
{
    NTSTATUS Status;
    WCHAR StaticRedirectedDllNameBuffer[DOS_MAX_PATH_LENGTH];
    UNICODE_STRING StaticRedirectedDllName;
    UNICODE_STRING DynamicRedirectedDllName = {0};
    ULONG LoadDllFlags = 0;
    PCUNICODE_STRING OldTopLevelDllBeingLoaded = NULL;
    PVOID LockCookie = NULL;
    PTEB Teb;

    //
    // We need to disable page heap fault injection while loader is active.
    // This is important so that we avoid lots of hits(failures) in this
    // area. The Disable/Enable function have basically zero impact on
    // performance because they just increment/decrement a lock variable
    // that is checked when an actual allocation is performed (page heap
    // needs to be enabled for that).
    //

    RtlpDphDisableFaultInjection ();

    StaticRedirectedDllName.Length = 0;
    StaticRedirectedDllName.MaximumLength = sizeof(StaticRedirectedDllNameBuffer);
    StaticRedirectedDllName.Buffer = StaticRedirectedDllNameBuffer;

    Status = RtlDosApplyFileIsolationRedirection_Ustr(
                RTL_DOS_APPLY_FILE_REDIRECTION_USTR_FLAG_RESPECT_DOT_LOCAL,
                DllName,                    // dll name to look up
                &LdrApiDefaultExtension,
                &StaticRedirectedDllName,
                &DynamicRedirectedDllName,
                (PUNICODE_STRING*)&DllName, // Result is either StaticRedirectedDllName or DynamicRedirectedDllName
                NULL,
                NULL,                       // not interested in where the filename starts
                NULL);                      // not interested in bytes required if we only had a static string
    if (NT_SUCCESS(Status)) {
        LoadDllFlags |= LDRP_LOAD_DLL_FLAG_DLL_IS_REDIRECTED;
    } else if (Status != STATUS_SXS_KEY_NOT_FOUND) {
#if DBG
        DbgPrint("%s(%wZ): RtlDosApplyFileIsolationRedirection_Ustr() failed with status %08lx\n", __FUNCTION__, DllName, Status);
#endif // DBG
        goto Exit;
    }

    LdrLockLoaderLock(LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, NULL, &LockCookie);
    OldTopLevelDllBeingLoaded = LdrpTopLevelDllBeingLoaded;

    if (OldTopLevelDllBeingLoaded) {
        if (ShowSnaps || LdrpShowRecursiveDllLoads || LdrpBreakOnRecursiveDllLoads) {
            Teb = NtCurrentTeb();

            DbgPrint(
                "[%lx,%lx] LDR: Recursive DLL load\n",
                HandleToULong(Teb->ClientId.UniqueProcess),
                HandleToULong(Teb->ClientId.UniqueThread));

            DbgPrint(
                "[%lx,%lx]   Previous DLL being loaded: \"%wZ\"\n",
                HandleToULong(Teb->ClientId.UniqueProcess),
                HandleToULong(Teb->ClientId.UniqueThread),
                OldTopLevelDllBeingLoaded);

            DbgPrint(
                "[%lx,%lx]   DLL being requested: \"%wZ\"\n",
                HandleToULong(Teb->ClientId.UniqueProcess),
                HandleToULong(Teb->ClientId.UniqueThread),
                DllName);

            if (LdrpCurrentDllInitializer != NULL) {
                DbgPrint(
                    "[%lx,%lx]   DLL whose initializer was currently running: \"%wZ\"\n",
                    HandleToULong(Teb->ClientId.UniqueProcess),
                    HandleToULong(Teb->ClientId.UniqueThread),
                    &LdrpCurrentDllInitializer->FullDllName);
            } else {
                DbgPrint(
                    "[%lx,%lx]   No DLL initializer was running\n",
                    HandleToULong(Teb->ClientId.UniqueProcess),
                    HandleToULong(Teb->ClientId.UniqueThread));
            }
        }
    }

    LdrpTopLevelDllBeingLoaded = DllName;

    __try {

        Status = LdrpLoadDll (LoadDllFlags,
                              DllPath,
                              DllCharacteristics,
                              DllName,
                              DllHandle,
                              TRUE);

        if (!NT_SUCCESS(Status)) {
            if ((Status != STATUS_NO_SUCH_FILE) &&
                (Status != STATUS_DLL_NOT_FOUND) &&
                (Status != STATUS_OBJECT_NAME_NOT_FOUND)) {

                // Dll initialization failure is common enough that we won't want to print unless snaps are turned on.
                if (ShowSnaps || (Status != STATUS_DLL_INIT_FAILED)) {
                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
                        __FUNCTION__,
                        DllName,
                        Status);
                }
            }

            __leave;
        }
        Status = STATUS_SUCCESS;
    } __finally {
        LdrpTopLevelDllBeingLoaded = OldTopLevelDllBeingLoaded;
        LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
    }

Exit:
    if (DynamicRedirectedDllName.Buffer != NULL) {
        RtlFreeUnicodeString(&DynamicRedirectedDllName);
    }

    //
    // Reenable page heap fault injection.
    //

    RtlpDphEnableFaultInjection ();

    return Status;
}


NTSTATUS
NTAPI
LdrpLoadDll (
    IN ULONG Flags OPTIONAL,
    IN PCWSTR DllPath OPTIONAL,
    IN PULONG DllCharacteristics OPTIONAL,
    IN PCUNICODE_STRING DllName,
    OUT PVOID *DllHandle,
    IN BOOLEAN RunInitRoutines
    )
{
    NTSTATUS st;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry;
    PWSTR ActualDllName;
    PWCH p, pp;
    UNICODE_STRING ActualDllNameStr;
    WCHAR FreeBuffer[LDR_MAX_PATH + 1];
    BOOLEAN Redirected;
    ULONG DllNameLength;
    const InLdrInit = LdrpInLdrInit;

    if (Flags & LDRP_LOAD_DLL_FLAG_DLL_IS_REDIRECTED) {
        Redirected = TRUE;
    }
    else {
        Redirected = FALSE;
    }

    st = STATUS_SUCCESS;

    p = DllName->Buffer;
    pp = NULL;

    while (*p) {

        switch (*p++) {
        case L'.':
            //
            // pp will point to first character after the last '.', if
            // it occurs after the last '\'.
            //

            pp = p;
            break;
            
        case L'\\':

            pp = NULL;
            break;

        default:
            NOTHING;
        }
    }

    if (DllName->Length >= sizeof(FreeBuffer)) {
        return STATUS_NAME_TOO_LONG;
    }

    ActualDllName = FreeBuffer;

    RtlCopyMemory (ActualDllName, DllName->Buffer, DllName->Length);

    if (!pp || *pp == (WCHAR)'\\') {

        //
        // No extension found (just ..\)
        //

        DllNameLength = DllName->Length + sizeof(DllExtension) - sizeof(WCHAR);
        if ((DllNameLength + sizeof(WCHAR)) >= sizeof(FreeBuffer)) {
            DbgPrintEx(
                DPFLTR_LDR_ID,
                LDR_ERROR_DPFLTR,
                "LDR: %s - Dll name missing extension; with extension added the length is too long\n"
                "   DllName: (@ %p) \"%wZ\"\n"
                "   DllName->Length: %u\n",
                __FUNCTION__,
                DllName, DllName,
                DllName->Length);

            return STATUS_NAME_TOO_LONG;
        }

        RtlCopyMemory ((PCHAR)ActualDllName+DllName->Length, DllExtension, sizeof(DllExtension));
        ActualDllNameStr.Length = (USHORT)(DllNameLength);
    } else {
        ActualDllName[DllName->Length >> 1] = UNICODE_NULL;
        ActualDllNameStr.Length = DllName->Length;
    }

    ActualDllNameStr.MaximumLength = sizeof(FreeBuffer);
    ActualDllNameStr.Buffer = ActualDllName;
    LdrDataTableEntry = NULL;

    //
    // Except during process initialization, grab loader lock and
    // Snap all links to the specified DLL.
    //

    if (!InLdrInit) {
        RtlEnterCriticalSection (&LdrpLoaderLock);
    }

    try {

        if (ShowSnaps) {
            DbgPrint("LDR: LdrLoadDll, loading %ws from %ws\n",
                ActualDllName,
                ARGUMENT_PRESENT(DllPath) ? DllPath : L""
                );
        }

        if (!LdrpCheckForLoadedDll( DllPath,
                                    &ActualDllNameStr,
                                    FALSE,
                                    Redirected,
                                    &LdrDataTableEntry)) {

            st = LdrpMapDll(DllPath,
                            ActualDllName,
                            DllCharacteristics,
                            FALSE,
                            Redirected,
                            &LdrDataTableEntry);

            if (!NT_SUCCESS(st)) {
                leave;
            }

#if defined(_X86_)

            //
            // Register dll with the stack tracing module.
            // This is used for getting reliable stack traces on X86.
            //

            RtlpStkMarkDllRange (LdrDataTableEntry);
#endif

            if (ARGUMENT_PRESENT( DllCharacteristics ) &&
                *DllCharacteristics & IMAGE_FILE_EXECUTABLE_IMAGE) {

                LdrDataTableEntry->EntryPoint = 0;
                LdrDataTableEntry->Flags &= ~LDRP_IMAGE_DLL;
            }

            //
            // walk the import descriptor table of the dll
            //

            if (LdrDataTableEntry->Flags & LDRP_IMAGE_DLL) {

                try {
                    
                    //
                    // if the image is COR-ILONLY, then don't walk the import descriptor 
                    // as it is assumed that it only imports %windir%\system32\mscoree.dll, otherwise
                    // walk the import descriptor table of the dll.
                    //

                    if ((LdrDataTableEntry->Flags & LDRP_COR_IMAGE) == 0) {
                        st = LdrpWalkImportDescriptor(
                                  DllPath,
                                  LdrDataTableEntry
                                  );
                    }
                } __except(LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
                    st = GetExceptionCode();
                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "LDR: %s - Exception %x thrown by LdrpWalkImportDescriptor\n",
                        __FUNCTION__,
                        st);
                }

                if ( LdrDataTableEntry->LoadCount != 0xffff ) {
                    LdrDataTableEntry->LoadCount += 1;
                }

                LdrpReferenceLoadedDll (LdrDataTableEntry);

                if (!NT_SUCCESS(st)) {
                    LdrDataTableEntry->EntryPoint = NULL;
                    InsertTailList(
                        &PebLdr.InInitializationOrderModuleList,
                        &LdrDataTableEntry->InInitializationOrderLinks);

                    LdrpClearLoadInProgress();

                    if (ShowSnaps) {
                        DbgPrint("LDR: Unloading %wZ due to error %x walking import descriptors\n", DllName, st);
                    }

                    LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase);
                    leave;
                }
            }
            else {
                if ( LdrDataTableEntry->LoadCount != 0xffff ) {
                    LdrDataTableEntry->LoadCount += 1;
                }
            }

            //
            // Add init routine to list
            //

            InsertTailList(&PebLdr.InInitializationOrderModuleList,
                           &LdrDataTableEntry->InInitializationOrderLinks);


            //
            // If the loader data base is not fully setup, this load was because
            // of a forwarder in the static load set. Can't run init routines
            // yet because the load counts are NOT set
            //

            if ( RunInitRoutines && LdrpLdrDatabaseIsSetup ) {

                //
                // Shim engine callback. This is the chance to patch
                // dynamically loaded modules.
                //

                if (g_pfnSE_DllLoaded != NULL) {
                    (*g_pfnSE_DllLoaded)(LdrDataTableEntry);
                }

                try {

                    st = LdrpRunInitializeRoutines (NULL);

                    if ( !NT_SUCCESS(st) ) {
                        if (ShowSnaps) {
                            DbgPrint("LDR: Unloading %wZ because either its init routine or one of its static imports failed; status = 0x%08lx", DllName, st);
                        }

                        LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase);
                    }
                }
                __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
                    st = GetExceptionCode();

                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "LDR: %s - Exception %08lx thrown running initialization routines for %wZ\n",
                        __FUNCTION__,
                        st,
                        &LdrDataTableEntry->FullDllName);

                    LdrUnloadDll((PVOID)LdrDataTableEntry->DllBase);

                    leave;
                }
            }
            else {
                st = STATUS_SUCCESS;
            }
        }
        else {

            //
            // Count it and everything that it imports.
            //

            if ( LdrDataTableEntry->Flags & LDRP_IMAGE_DLL &&
                 LdrDataTableEntry->LoadCount != 0xffff  ) {

                LdrDataTableEntry->LoadCount += 1;

                LdrpReferenceLoadedDll(LdrDataTableEntry);

                //
                // Now clear the Load in progress bits
                //

                LdrpClearLoadInProgress();
            }
            else {
                if ( LdrDataTableEntry->LoadCount != 0xffff ) {
                    LdrDataTableEntry->LoadCount += 1;
                }
            }
        }
    }
    __finally {
        if (!InLdrInit) {
            RtlLeaveCriticalSection(&LdrpLoaderLock);
        }
    }

    if (NT_SUCCESS(st)) {
        *DllHandle = (PVOID)LdrDataTableEntry->DllBase;
    }
    else {
        *DllHandle = NULL;
    }

    return st;
}


NTSTATUS
LdrGetDllHandle(
    IN PCWSTR DllPath OPTIONAL,
    IN PULONG DllCharacteristics OPTIONAL,
    IN PCUNICODE_STRING DllName,
    OUT PVOID *DllHandle
    )
{
    //
    // Preserve the old behavior.
    //

    return LdrGetDllHandleEx (LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT,
                              DllPath,
                              DllCharacteristics,
                              DllName,
                              DllHandle);
}


NTSTATUS
LdrGetDllHandleEx(
    IN ULONG Flags,
    IN PCWSTR DllPath OPTIONAL,
    IN PULONG DllCharacteristics OPTIONAL,
    IN PCUNICODE_STRING ConstDllName,
    OUT PVOID *DllHandle OPTIONAL
    )

/*++

Routine Description:

    This function locates the specified DLL and returns its handle.

Arguments:

    Flags - various bits to affect the behavior

        default: the returned handle is addrefed

        LDR_GET_DLL_HANDLE_EX_PIN - the dll will not be unloaded until
                the process exits

        LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT - the dll's reference
                count is not changed

    DllPath - Supplies the search path to be used to locate the DLL.

    DllCharacteristics - Supplies an optional DLL characteristics flag,
        that if specified is used to match against the dll being loaded.
        The currently supported flags are:

            IMAGE_FILE_EXECUTABLE_IMAGE - indicates that imported dll
                referenced by the DLL being loaded should not be followed.
                This corresponds to DONT_RESOLVE_DLL_REFERENCES

            IMAGE_FILE_SYSTEM - indicates that the DLL is a known trusted
                system component and that WinSafer sandbox checking
                should not be performed on the DLL before loading it.

    DllName - Supplies the name of the DLL to load.

    DllHandle - Returns a handle to the loaded DLL.

Return Value:

    NTSTATUS.

--*/

{
    NTSTATUS st = STATUS_ACCESS_VIOLATION;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry = NULL;
    PWCH p, pp, pEnd;
    UNICODE_STRING ActualDllNameStr = {0, 0, NULL};
    UNICODE_STRING DynamicRedirectedDllName = {0, 0, NULL};
    BOOLEAN Redirected = FALSE;
    BOOLEAN HoldingLoaderLock = FALSE;
    const BOOLEAN InLdrInit = LdrpInLdrInit;
    PVOID LockCookie = NULL;
    const ULONG ValidFlags = LDR_GET_DLL_HANDLE_EX_PIN | LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT;    
    UNICODE_STRING xDllName;
    const PUNICODE_STRING DllName = &xDllName;

    UNREFERENCED_PARAMETER (DllCharacteristics);

    xDllName = *ConstDllName;

    __try {

        if (DllHandle != NULL) {
            *DllHandle = NULL;
        }

        if (Flags & ~ValidFlags) {
            st = STATUS_INVALID_PARAMETER;
            goto Exit;
        }

        //
        // DllHandle is optional if you are pinning the .dll, otherwise it is mandatory.
        //
        if ((DllHandle == NULL) &&
            (Flags & LDR_GET_DLL_HANDLE_EX_PIN) == 0) {

            st = STATUS_INVALID_PARAMETER;
            goto Exit;
        }

        if ((Flags & LDR_GET_DLL_HANDLE_EX_PIN) &&
            (Flags & LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT)) {

            st = STATUS_INVALID_PARAMETER;
            goto Exit;
        }

        //
        // Grab Ldr lock
        //

        if (!InLdrInit) {
            st = LdrLockLoaderLock(0, NULL, &LockCookie);
            if (!NT_SUCCESS(st)) {
                goto Exit;
            }
            HoldingLoaderLock = TRUE;
        }

        st = RtlDosApplyFileIsolationRedirection_Ustr(
                    RTL_DOS_APPLY_FILE_REDIRECTION_USTR_FLAG_RESPECT_DOT_LOCAL,
                    DllName,
                    &LdrApiDefaultExtension,
                    NULL,
                    &DynamicRedirectedDllName,
                    (PUNICODE_STRING*)&DllName,
                    NULL,
                    NULL,
                    NULL);
        if (NT_SUCCESS(st)) {
            Redirected = TRUE;
        } else if (st != STATUS_SXS_KEY_NOT_FOUND) {
            // Something unusual and bad happened.
            __leave;
        }

        st = STATUS_DLL_NOT_FOUND;

        if ( LdrpGetModuleHandleCache ) {
            if (Redirected) {
                if (((LdrpGetModuleHandleCache->Flags & LDRP_REDIRECTED) != 0) &&
                    RtlEqualUnicodeString(DllName, &LdrpGetModuleHandleCache->FullDllName, TRUE)) {

                    LdrDataTableEntry = LdrpGetModuleHandleCache;
                    st = STATUS_SUCCESS;
                    goto Exit;
                }
            } else {
                // Not redirected...
                if (((LdrpGetModuleHandleCache->Flags & LDRP_REDIRECTED) == 0) &&
                    RtlEqualUnicodeString(DllName, &LdrpGetModuleHandleCache->BaseDllName, TRUE)) {

                    LdrDataTableEntry = LdrpGetModuleHandleCache;
                    st = STATUS_SUCCESS;
                    goto Exit;
                }
            }
        }

        p = DllName->Buffer;
        pEnd = p + (DllName->Length / sizeof(WCHAR));

        pp = NULL;

        while (p != pEnd) {
            switch (*p++) {
            case L'.':
                //
                // pp will point to the first character after the last 
                // '.', if it occurs after the last '\'.
                //

                pp = p;
                break;

            case L'\\':

                pp = NULL;
                break;

            default:
                NOTHING;
            }
        }

        if ((pp == NULL) || (*pp == L'\\') || (*pp == L'/')) {

            //
            // The max length here must include the null-termination, but the length itself
            // should not.  NB that sizeof(DllExtension) will include the size for the
            // terminating UNICODE_NULL
            //
            ActualDllNameStr.MaximumLength = DllName->Length + sizeof(DllExtension);
            ActualDllNameStr.Length = ActualDllNameStr.MaximumLength - sizeof(WCHAR);

            ActualDllNameStr.Buffer = RtlAllocateHeap(RtlProcessHeap(), 0, ActualDllNameStr.MaximumLength);
            if (ActualDllNameStr.Buffer == NULL) {
                st = STATUS_NO_MEMORY;
                goto Exit;
            }

            //
            // Copy the name and the default extension onto the string  This magically null-terminates,
            // as DllExtension includes the unicode null character.
            //
            RtlCopyMemory(ActualDllNameStr.Buffer, DllName->Buffer, DllName->Length);
            RtlCopyMemory(((PCHAR)ActualDllNameStr.Buffer) + DllName->Length, DllExtension, sizeof(DllExtension));

        } else {

            //
            // Trim the trailing dot
            //
            if ((DllName->Length != 0) && (DllName->Buffer[(DllName->Length / sizeof(WCHAR)) - 1] == L'.')) {
                DllName->Length -= sizeof(WCHAR);
            }

            //
            // Size the buffer, allocate - set the max length to include the NULL character
            //
            ActualDllNameStr.MaximumLength = DllName->Length + sizeof(WCHAR);
            ActualDllNameStr.Length = DllName->Length;
            ActualDllNameStr.Buffer = RtlAllocateHeap(RtlProcessHeap(), 0, ActualDllNameStr.MaximumLength);
            if (ActualDllNameStr.Buffer == NULL) {
                st = STATUS_NO_MEMORY;
                goto Exit;
            }


            //
            // Copy data into it
            //
            RtlCopyMemory(ActualDllNameStr.Buffer, DllName->Buffer, DllName->Length);  

            //
            // And null-terminate by hand
            //
            ActualDllNameStr.Buffer[ActualDllNameStr.Length / sizeof(WCHAR)] = UNICODE_NULL;

        }

        
        //
        // Check the LdrTable to see if Dll has already been loaded
        // into this image.
        //
        if (ShowSnaps) {
            DbgPrint(
                "LDR: LdrGetDllHandle, searching for %wZ from %ws\n",
                &ActualDllNameStr,
                ARGUMENT_PRESENT(DllPath) ? (DllPath == (PWSTR)1 ? L"" : DllPath) : L""
                );
        }

        //
        // sort of a hack, but done to speed up GetModuleHandle. kernel32
        // now does a two pass call here to avoid computing
        // process dll path
        //

        if (LdrpCheckForLoadedDll(DllPath,
                                  &ActualDllNameStr,
                                  (BOOLEAN)(DllPath == (PWSTR)1 ? TRUE : FALSE),
                                  Redirected,
                                  &LdrDataTableEntry)) {
            LdrpGetModuleHandleCache = LdrDataTableEntry;
            st = STATUS_SUCCESS;
            goto Exit;
        }
        LdrDataTableEntry = NULL;
        RTL_SOFT_ASSERT(st == STATUS_DLL_NOT_FOUND);
Exit:
        ASSERT((LdrDataTableEntry != NULL) == NT_SUCCESS(st));

        if (LdrDataTableEntry != NULL && NT_SUCCESS(st)) {

            //
            // It's standard gross procedure to put the check for 0xffff,
            // and the updates of the root LoadCount outside the
            // call to LdrpUpdateLoadCount..
            //

            if (LdrDataTableEntry->LoadCount != 0xffff) {

                if ((Flags & LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT) != 0) {
                    // nothing
                }
                else {
                    if (Flags & LDR_GET_DLL_HANDLE_EX_PIN) {
                        LdrDataTableEntry->LoadCount = 0xffff;
                        LdrpPinLoadedDll(LdrDataTableEntry);
                    }
                    else {
                        LdrDataTableEntry->LoadCount++;
                        LdrpReferenceLoadedDll(LdrDataTableEntry);
                    }
                    LdrpClearLoadInProgress();
                }
            }
            if (DllHandle != NULL) {
                *DllHandle = (PVOID)LdrDataTableEntry->DllBase;
            }
        }
    } __finally {
        if (DynamicRedirectedDllName.Buffer != NULL) {
            RtlFreeUnicodeString(&DynamicRedirectedDllName);
        }

        if (ActualDllNameStr.Buffer != NULL) {
            RtlFreeHeap(RtlProcessHeap(), 0, (PVOID)ActualDllNameStr.Buffer);
            ActualDllNameStr.Buffer = NULL;
        }

        if (HoldingLoaderLock) {
            LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
            HoldingLoaderLock = FALSE;
        }
    }
    return st;
}


NTSTATUS
LdrDisableThreadCalloutsForDll (
    IN PVOID DllHandle
    )

/*++

Routine Description:

    This function disables thread attach and detach notification
    for the specified DLL.

Arguments:

    DllHandle - Supplies a handle to the DLL to disable.

Return Value:

    NTSTATUS.

--*/

{
    NTSTATUS st = STATUS_SUCCESS;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry = NULL;
    const BOOLEAN InLdrInit = LdrpInLdrInit;
    BOOL HoldingLoaderLock = FALSE;
    PVOID LockCookie = NULL;

    if ( LdrpShutdownInProgress ) {
        return STATUS_SUCCESS;
        }

    try {

        if ( InLdrInit == FALSE ) {
            st = LdrLockLoaderLock(0, NULL, &LockCookie);
            if (!NT_SUCCESS(st))
                goto Exit;
            HoldingLoaderLock = TRUE;
            }

        if (LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)) {
            if ( LdrDataTableEntry->TlsIndex ) {
                st = STATUS_DLL_NOT_FOUND;
                }
            else {
                LdrDataTableEntry->Flags |= LDRP_DONT_CALL_FOR_THREADS;
                }
            }
Exit:
        ;
    }
    finally {
        if (HoldingLoaderLock) {
            LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
            HoldingLoaderLock = FALSE;
            }
        }
    return st;
}

ULONG LdrpUnloadIndex = 0;
RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER];


NTSYSAPI
PRTL_UNLOAD_EVENT_TRACE
NTAPI
RtlGetUnloadEventTrace (
    VOID
    )
{
    return RtlpUnloadEventTrace;
}


VOID
LdrpRecordUnloadEvent (
    IN PLDR_DATA_TABLE_ENTRY LdrDataTableEntry
    )
/*++

Routine Description:

    This function records in a ring buffer the last few dll unloads

Arguments:

    LdrDataTableEntry - The ldr entry for this dll

Return Value:

    None.

--*/
{
    ULONG Seq, i, Len;
    PVOID BaseAddress;
    PIMAGE_NT_HEADERS NtHeaders;

    Seq = LdrpUnloadIndex++;
    i = Seq % RTL_UNLOAD_EVENT_TRACE_NUMBER;

    BaseAddress = LdrDataTableEntry->DllBase;
    RtlpUnloadEventTrace[i].Sequence    = Seq;
    RtlpUnloadEventTrace[i].BaseAddress = BaseAddress;
    RtlpUnloadEventTrace[i].SizeOfImage = LdrDataTableEntry->SizeOfImage;

    Len = LdrDataTableEntry->BaseDllName.Length;
    if (Len > sizeof (RtlpUnloadEventTrace[i].ImageName)) {
        Len = sizeof (RtlpUnloadEventTrace[i].ImageName);
    }
    RtlCopyMemory (RtlpUnloadEventTrace[i].ImageName,
                   LdrDataTableEntry->BaseDllName.Buffer,
                   Len);
    if (Len < sizeof (RtlpUnloadEventTrace[i].ImageName)) {
        RtlpUnloadEventTrace[i].ImageName[Len/sizeof (WCHAR)] = L'\0';
    }

    NtHeaders = RtlImageNtHeader (BaseAddress);
    if (NtHeaders != NULL) {
        RtlpUnloadEventTrace[i].TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp;
        RtlpUnloadEventTrace[i].CheckSum      = NtHeaders->OptionalHeader.CheckSum;
    } else {
        RtlpUnloadEventTrace[i].TimeDateStamp = 0;
        RtlpUnloadEventTrace[i].CheckSum      = 0;
    }
}


NTSTATUS
LdrUnloadDll (
    IN PVOID DllHandle
    )

/*++

Routine Description:

    This function unloads the DLL from the specified process

Arguments:

    DllHandle - Supplies a handle to the DLL to unload.

Return Value:

    NTSTATUS.

--*/

{
    NTSTATUS st;
    PPEB Peb;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry;
    PLDR_DATA_TABLE_ENTRY Entry;
    PDLL_INIT_ROUTINE InitRoutine;
    LIST_ENTRY LocalUnloadHead;
    PLIST_ENTRY Next;
    ULONG Cor20HeaderSize;
    PIMAGE_COR20_HEADER *Cor20Header;
    PRTL_PATCH_HEADER RundownPatchList = NULL;

    Peb = NtCurrentPeb();
    st = STATUS_SUCCESS;

    //
    // Grab Peb lock and decrement reference count of all affected DLLs
    //

    if (!LdrpInLdrInit) {
        RtlEnterCriticalSection(&LdrpLoaderLock);
    }

    try {

        LdrpActiveUnloadCount += 1;

        if (LdrpShutdownInProgress) {
            goto leave_finally;
        }

        if (!LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)) {
            st = STATUS_DLL_NOT_FOUND;
            goto leave_finally;
        }

        //
        // Now that we have the data table entry, unload it
        //

        if (LdrDataTableEntry->LoadCount != 0xffff) {
            LdrDataTableEntry->LoadCount -= 1;
            if (LdrDataTableEntry->Flags & LDRP_IMAGE_DLL) {
                RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME Frame = { sizeof(Frame), RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER };

                RtlActivateActivationContextUnsafeFast(&Frame, LdrDataTableEntry->EntryPointActivationContext);
                __try {
                    LdrpDereferenceLoadedDll(LdrDataTableEntry);
                } __finally {
                    RtlDeactivateActivationContextUnsafeFast(&Frame);
                }
            }
        } else {

            //
            // if the load count is 0xffff, then we do not need to recurse
            // through this DLL's import table.
            //
            // Additionally, we don't have to scan more LoadCount == 0
            // modules since nothing could have happened as a result of a free on this
            // DLL.

            goto leave_finally;
        }

        //
        // Now process init routines and then in a second pass, unload
        // DLLs
        //

        if (ShowSnaps) {
            DbgPrint("LDR: UNINIT LIST\n");
        }

        if (LdrpActiveUnloadCount == 1) {
            InitializeListHead(&LdrpUnloadHead);
        }

        //
        // Go in reverse order initialization order and build
        // the unload list
        //

        Next = PebLdr.InInitializationOrderModuleList.Blink;
        while ( Next != &PebLdr.InInitializationOrderModuleList) {
            LdrDataTableEntry
                = (PLDR_DATA_TABLE_ENTRY)
                  (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,InInitializationOrderLinks));

            Next = Next->Blink;
            LdrDataTableEntry->Flags &= ~LDRP_UNLOAD_IN_PROGRESS;

            if (LdrDataTableEntry->LoadCount == 0) {

                if (ShowSnaps) {
                      DbgPrint("          (%d) [%ws] %ws (%lx) deinit %lx\n",
                              LdrpActiveUnloadCount,
                              LdrDataTableEntry->BaseDllName.Buffer,
                              LdrDataTableEntry->FullDllName.Buffer,
                              (ULONG)LdrDataTableEntry->LoadCount,
                              LdrDataTableEntry->EntryPoint
                              );
                }

                Entry = LdrDataTableEntry;

                //
                // Shim engine callback. Remove it from the shim list of hooked modules
                //

                if (g_pfnSE_DllUnloaded != NULL) {
                    (*g_pfnSE_DllUnloaded)(Entry);
                }

                RemoveEntryList(&Entry->InInitializationOrderLinks);
                RemoveEntryList(&Entry->InMemoryOrderLinks);
                RemoveEntryList(&Entry->HashLinks);

                if ( LdrpActiveUnloadCount > 1 ) {
                    LdrpLoadedDllHandleCache = NULL;
                    Entry->InMemoryOrderLinks.Flink = NULL;
                }
                InsertTailList(&LdrpUnloadHead,&Entry->HashLinks);
            }
        }
        //
        // End of new code
        //

        //
        // We only do init routine call's and module free's at the top level,
        // so if the active count is > 1, just return
        //

        if (LdrpActiveUnloadCount > 1 ) {
            goto leave_finally;
        }

        //
        // Now that the unload list is built, walk through the unload
        // list in order and call the init routine. The dll must remain
        // on the InLoadOrderLinks so that the pctoheader stuff will
        // still work
        //

        InitializeListHead(&LocalUnloadHead);
        Entry = NULL;
        Next = LdrpUnloadHead.Flink;
        while ( Next != &LdrpUnloadHead ) {
top:
            if ( Entry ) {

#if defined(_AMD64_) || defined(_IA64_)


                RtlRemoveInvertedFunctionTable(&LdrpInvertedFunctionTable,
                                               Entry->DllBase);

#endif

                RemoveEntryList(&(Entry->InLoadOrderLinks));
                Entry = NULL;
                Next = LdrpUnloadHead.Flink;
                if (Next == &LdrpUnloadHead ) {
                    goto bottom;
                }
            }
            LdrDataTableEntry
                = (PLDR_DATA_TABLE_ENTRY)
                  (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,HashLinks));

            LdrpRecordUnloadEvent (LdrDataTableEntry);

            //
            // Remove dll from the global unload list and place
            // on the local unload list. This is because the global list
            // can change during the callout to the init routine
            //

            Entry = LdrDataTableEntry;
            LdrpLoadedDllHandleCache = NULL;
            Entry->InMemoryOrderLinks.Flink = NULL;

            RemoveEntryList(&Entry->HashLinks);
            InsertTailList(&LocalUnloadHead,&Entry->HashLinks);

            //
            // If the function has an init routine, call it.
            //

            InitRoutine = (PDLL_INIT_ROUTINE)(ULONG_PTR)LdrDataTableEntry->EntryPoint;

            if (InitRoutine && (LdrDataTableEntry->Flags & LDRP_PROCESS_ATTACH_CALLED) ) {
                try {
                    if (ShowSnaps) {
                        DbgPrint("LDR: Calling deinit %lx\n",InitRoutine);
                    }

                    LDRP_ACTIVATE_ACTIVATION_CONTEXT(LdrDataTableEntry);

                    LdrpCallInitRoutine(InitRoutine,
                                        LdrDataTableEntry->DllBase,
                                        DLL_PROCESS_DETACH,
                                        NULL);

                    LDRP_DEACTIVATE_ACTIVATION_CONTEXT();

#if defined(_AMD64_) || defined(_IA64_)


                    RtlRemoveInvertedFunctionTable(&LdrpInvertedFunctionTable,
                                                   Entry->DllBase);

#endif

                    RemoveEntryList(&Entry->InLoadOrderLinks);
                    Entry = NULL;
                    Next = LdrpUnloadHead.Flink;
                }
                except(LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)){
                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "LDR: %s - exception %08lx caught while sending DLL_PROCESS_DETACH\n",
                        __FUNCTION__,
                        GetExceptionCode());

                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "   Dll Name: %wZ\n",
                        &LdrDataTableEntry->FullDllName);

                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "   InitRoutine: %p\n",
                        InitRoutine);

                    goto top;
                }
            } else {

#if defined(_AMD64_) || defined(_IA64_)


                RtlRemoveInvertedFunctionTable(&LdrpInvertedFunctionTable,
                                               Entry->DllBase);

#endif

                RemoveEntryList(&(Entry->InLoadOrderLinks));
                Entry = NULL;
                Next = LdrpUnloadHead.Flink;
            }
        }
bottom:

        //
        // Now, go through the modules and unmap them
        //

        Next = LocalUnloadHead.Flink;
        while ( Next != &LocalUnloadHead ) {
            LdrDataTableEntry
                = (PLDR_DATA_TABLE_ENTRY)
                  (CONTAINING_RECORD(Next,LDR_DATA_TABLE_ENTRY,HashLinks));

            Next = Next->Flink;
            Entry = LdrDataTableEntry;

            //
            // Notify verifier that a dll will be unloaded.
            //
            // Now that we called the all the init routines with `detach' 
            // there is no excuse if we find a live CS in that region.
            //
            // Note: gdi32.dll's critical sections are deleted only on
            // user32.dll'd DllMain( DLL_PROCESS_DETACH ) so we cannot 
            // do this check for leaked critical sections prior to this point.
            //

            if (Peb->NtGlobalFlag & FLG_APPLICATION_VERIFIER) {
                AVrfDllUnloadNotification (LdrDataTableEntry);
            }

            //
            // Unmap this DLL.
            //

            if (ShowSnaps) {
                  DbgPrint("LDR: Unmapping [%ws]\n",
                          LdrDataTableEntry->BaseDllName.Buffer
                          );
            }

            Cor20Header =  RtlImageDirectoryEntryToData(Entry->DllBase,
                                                        TRUE,
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR,
                                                        &Cor20HeaderSize);
            if (Cor20Header != NULL) {
                LdrpCorUnloadImage(Entry->DllBase);
            }
            if (!(Entry->Flags & LDRP_COR_OWNS_UNMAP)) {
                st = NtUnmapViewOfSection(NtCurrentProcess(),Entry->DllBase);
                ASSERT(NT_SUCCESS(st));
            }

            LdrUnloadAlternateResourceModule(Entry->DllBase);

            LdrpSendDllNotifications (Entry,
                                      LDR_DLL_NOTIFICATION_REASON_UNLOADED,
                                      (LdrpShutdownInProgress ? LDR_DLL_UNLOADED_FLAG_PROCESS_TERMINATION : 0));

            //
            //  See if we have hotpatch information and push each hotpatch block
            //  to the rundown list
            //

            while (Entry->PatchInformation) {

                PRTL_PATCH_HEADER PatchHead = Entry->PatchInformation;
                Entry->PatchInformation = PatchHead->NextPatch;

                PatchHead->NextPatch = RundownPatchList;
                RundownPatchList = PatchHead;
            }

            LdrpFinalizeAndDeallocateDataTableEntry(Entry);

            if ( Entry == LdrpGetModuleHandleCache ) {
                LdrpGetModuleHandleCache = NULL;
            }
        }

leave_finally:;
    }
    finally {
        LdrpActiveUnloadCount -= 1;
        if (!LdrpInLdrInit) {
            RtlLeaveCriticalSection(&LdrpLoaderLock);
        }
    }

    if ( RundownPatchList ) {

        LdrpRundownHotpatchList( RundownPatchList );
    }

    return st;
}


NTSTATUS
LdrGetProcedureAddress (
    IN PVOID DllHandle,
    IN CONST ANSI_STRING* ProcedureName OPTIONAL,
    IN ULONG ProcedureNumber OPTIONAL,
    OUT PVOID *ProcedureAddress
    )
{
    return LdrpGetProcedureAddress(DllHandle,ProcedureName,ProcedureNumber,ProcedureAddress,TRUE);
}


NTSTATUS
LdrpGetProcedureAddress (
    IN PVOID DllHandle,
    IN CONST ANSI_STRING* ProcedureName OPTIONAL,
    IN ULONG ProcedureNumber OPTIONAL,
    OUT PVOID *ProcedureAddress,
    IN BOOLEAN RunInitRoutines
    )

/*++

Routine Description:

    This function locates the address of the specified procedure in the
    specified DLL and returns its address.

Arguments:

    DllHandle - Supplies a handle to the DLL that the address is being
        looked up in.

    ProcedureName - Supplies that address of a string that contains the
        name of the procedure to lookup in the DLL.  If this argument is
        not specified, then the ProcedureNumber is used.

    ProcedureNumber - Supplies the procedure number to lookup.  If
        ProcedureName is specified, then this argument is ignored.
        Otherwise, it specifies the procedure ordinal number to locate
        in the DLL.

    ProcedureAddress - Returns the address of the procedure found in
        the DLL.

Return Value:

    NTSTATUS.

--*/

{
    NTSTATUS st;
    UCHAR FunctionNameBuffer[64];
    ULONG cb, ExportSize;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry;
    IMAGE_THUNK_DATA Thunk;
    PVOID ImageBase;
    PIMAGE_IMPORT_BY_NAME FunctionName;
    PCIMAGE_EXPORT_DIRECTORY ExportDirectory;
    PLIST_ENTRY Next;

    if (ShowSnaps) {
        DbgPrint("LDR: LdrGetProcedureAddress by ");
    }

    RtlZeroMemory( &Thunk, sizeof( Thunk ) );

    FunctionName = NULL;
    if ( ARGUMENT_PRESENT(ProcedureName) ) {

        if (ShowSnaps) {
            DbgPrint("NAME - %s\n", ProcedureName->Buffer);
        }

        cb = ProcedureName->Length + FIELD_OFFSET(IMAGE_IMPORT_BY_NAME, Name) +
                sizeof( UCHAR );
        if (cb > MAXUSHORT) {
            return STATUS_NAME_TOO_LONG;
        }

        if (cb > sizeof( FunctionNameBuffer )) {
            FunctionName = (PIMAGE_IMPORT_BY_NAME)RtlAllocateHeap(
                                                        RtlProcessHeap(),
                                                        MAKE_TAG( TEMP_TAG ),
                                                        cb
                                                        );
            if ( !FunctionName ) {
                return STATUS_INVALID_PARAMETER;
                }
        } else {
            FunctionName = (PIMAGE_IMPORT_BY_NAME) FunctionNameBuffer;
        }

        FunctionName->Hint = 0;

        cb = ProcedureName->Length;

        RtlCopyMemory (FunctionName->Name, ProcedureName->Buffer, cb);

        FunctionName->Name[cb] = '\0';

        //
        // Make sure we don't pass in address with high bit set so we
        // can still use it as ordinal flag
        //

        ImageBase = FunctionName;
        Thunk.u1.AddressOfData = 0;

    } else {
        ImageBase = NULL;
        if (ShowSnaps) {
            DbgPrint("ORDINAL - %lx\n", ProcedureNumber);
        }

        if (ProcedureNumber) {
            Thunk.u1.Ordinal = ProcedureNumber | IMAGE_ORDINAL_FLAG;
        } else {
            return STATUS_INVALID_PARAMETER;
        }
    }

    st = STATUS_ACCESS_VIOLATION;

    if (!LdrpInLdrInit) {
        RtlEnterCriticalSection (&LdrpLoaderLock);
    }

    try {

        if (!LdrpCheckForLoadedDllHandle (DllHandle, &LdrDataTableEntry)) {
            st = STATUS_DLL_NOT_FOUND;
            leave;
        }

        ExportDirectory = (PCIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(
                           LdrDataTableEntry->DllBase,
                           TRUE,
                           IMAGE_DIRECTORY_ENTRY_EXPORT,
                           &ExportSize);

        if (!ExportDirectory) {
            st = STATUS_PROCEDURE_NOT_FOUND;
            leave;
        }

        st = LdrpSnapThunk(LdrDataTableEntry->DllBase,
                           ImageBase,
                           &Thunk,
                           &Thunk,
                           ExportDirectory,
                           ExportSize,
                           FALSE,
                           NULL);

        if (NT_SUCCESS(st) && RunInitRoutines) {

            PLDR_DATA_TABLE_ENTRY LdrInitEntry;

            //
            // Look at last entry in init order list. If entry processed
            // flag is not set, then a forwarded dll was loaded during the
            // getprocaddr call and we need to run init routines
            //

            Next = PebLdr.InInitializationOrderModuleList.Blink;

            LdrInitEntry = CONTAINING_RECORD(Next,
                                             LDR_DATA_TABLE_ENTRY,
                                             InInitializationOrderLinks);

            if ( !(LdrInitEntry->Flags & LDRP_ENTRY_PROCESSED) ) {
                
                //
                // Shim engine callback. This is the chance to patch
                // dynamically loaded modules.
                //

                try {
                    st = LdrpRunInitializeRoutines(NULL);
                }
                except(LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
                    st = GetExceptionCode();

                    DbgPrintEx(
                        DPFLTR_LDR_ID,
                        LDR_ERROR_DPFLTR,
                        "LDR: %s - Exception %x thrown by LdrpRunInitializeRoutines\n",
                        __FUNCTION__,
                        st);
                }
            }
        }

        if ( NT_SUCCESS(st) ) {
            *ProcedureAddress = (PVOID)Thunk.u1.Function;
        }
    } finally {
        if ( FunctionName && (FunctionName != (PIMAGE_IMPORT_BY_NAME) FunctionNameBuffer) ) {
            RtlFreeHeap(RtlProcessHeap(),0,FunctionName);
        }

        if (!LdrpInLdrInit) {
            RtlLeaveCriticalSection(&LdrpLoaderLock);
        }
    }
    return st;
}


NTSTATUS
NTAPI
LdrVerifyImageMatchesChecksum (
    IN HANDLE ImageFileHandle,
    IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine OPTIONAL,
    IN PVOID ImportCallbackParameter,
    OUT PUSHORT ImageCharacteristics OPTIONAL
    )
{
    NTSTATUS Status;
    HANDLE Section;
    PVOID ViewBase;
    SIZE_T ViewSize;
    IO_STATUS_BLOCK IoStatusBlock;
    FILE_STANDARD_INFORMATION StandardInfo;
    PIMAGE_SECTION_HEADER LastRvaSection;
    BOOLEAN b = FALSE;
    BOOLEAN JustDoSideEffects;

    //
    // stevewo added all sorts of side effects to this API. We want to stop
    // doing checksums for known dll's, but really want the sideeffects
    // (ImageCharacteristics write, and Import descriptor walk).
    //

    if ( (UINT_PTR) ImageFileHandle & 1 ) {
        JustDoSideEffects = TRUE;
    }
    else {
        JustDoSideEffects = FALSE;
    }

    Status = NtCreateSection (&Section,
                              SECTION_MAP_EXECUTE,
                              NULL,
                              NULL,
                              PAGE_EXECUTE,
                              SEC_COMMIT,
                              ImageFileHandle);

    if (!NT_SUCCESS(Status)) {
        return Status;
    }

    ViewBase = NULL;
    ViewSize = 0;

    Status = NtMapViewOfSection (Section,
                                 NtCurrentProcess(),
                                 (PVOID *)&ViewBase,
                                 0L,
                                 0L,
                                 NULL,
                                 &ViewSize,
                                 ViewShare,
                                 0L,
                                 PAGE_EXECUTE);

    if ( !NT_SUCCESS(Status) ) {
        NtClose(Section);
        return Status;
    }

    //
    // now the image is mapped as a data file... Calculate it's size and then
    // check it's checksum
    //

    Status = NtQueryInformationFile(
                ImageFileHandle,
                &IoStatusBlock,
                &StandardInfo,
                sizeof(StandardInfo),
                FileStandardInformation
                );

    if ( !NT_SUCCESS(Status) ) {
        NtUnmapViewOfSection(NtCurrentProcess(),ViewBase);
        NtClose(Section);
        return Status;
        }

    try {
        if ( JustDoSideEffects ) {
            b = TRUE;
            }
        else {
            b = LdrVerifyMappedImageMatchesChecksum(ViewBase,StandardInfo.EndOfFile.LowPart);
            }
        if (b && ARGUMENT_PRESENT( (ULONG_PTR)ImportCallbackRoutine )) {
            PIMAGE_NT_HEADERS NtHeaders;
            PCIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;
            ULONG ImportSize;
            PCHAR ImportName;

            //
            // Caller wants to enumerate the import descriptors while we have
            // the image mapped.  Call back to their routine for each module
            // name in the import descriptor table.
            //
            LastRvaSection = NULL;
            NtHeaders = RtlImageNtHeader( ViewBase );
            if (! NtHeaders) {
                b = FALSE;
                leave;
            }
            if (ARGUMENT_PRESENT( ImageCharacteristics )) {
                *ImageCharacteristics = NtHeaders->FileHeader.Characteristics;
                }

            ImportDescriptor = (PCIMAGE_IMPORT_DESCRIPTOR)
                RtlImageDirectoryEntryToData( ViewBase,
                                              FALSE,
                                              IMAGE_DIRECTORY_ENTRY_IMPORT,
                                              &ImportSize
                                            );
            if (ImportDescriptor != NULL) {
                while (ImportDescriptor->Name) {
                    ImportName = (PSZ)RtlImageRvaToVa( NtHeaders,
                                                       ViewBase,
                                                       ImportDescriptor->Name,
                                                       &LastRvaSection
                                                     );
                    (*ImportCallbackRoutine)( ImportCallbackParameter, ImportName );
                    ImportDescriptor += 1;
                    }
                }
            }
        }
    except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
        DbgPrintEx(
            DPFLTR_LDR_ID,
            LDR_ERROR_DPFLTR,
            "LDR: %s - caught exception %08lx while checking image checksums\n",
            __FUNCTION__,
            GetExceptionCode());

        NtUnmapViewOfSection(NtCurrentProcess(),ViewBase);
        NtClose(Section);
        return STATUS_IMAGE_CHECKSUM_MISMATCH;
        }
    NtUnmapViewOfSection(NtCurrentProcess(),ViewBase);
    NtClose(Section);
    if ( !b ) {
        Status = STATUS_IMAGE_CHECKSUM_MISMATCH;
        }
    return Status;
}


NTSTATUS 
LdrReadMemory(
    IN HANDLE Process OPTIONAL,
    IN PVOID BaseAddress,
    IN OUT PVOID Buffer,
    IN SIZE_T Size)
{
    NTSTATUS Status = STATUS_SUCCESS;

    if (ARGUMENT_PRESENT( Process )) {
        SIZE_T nRead;
        Status = NtReadVirtualMemory(Process, BaseAddress, Buffer, Size, &nRead);

        if (NT_SUCCESS( Status ) && (Size != nRead)) {
            Status = STATUS_UNSUCCESSFUL;
        }
    }
    else {
        __try {
            RtlCopyMemory(Buffer, BaseAddress, Size);
        }
        __except(LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
            DbgPrintEx(
                DPFLTR_LDR_ID,
                LDR_ERROR_DPFLTR,
                "LDR: %s - exception %08lx caught while copying %u bytes from %p to %p\n",
                __FUNCTION__,
                GetExceptionCode(),
                BaseAddress,
                Buffer);

            if (NT_SUCCESS(Status = GetExceptionCode())) {
                Status = STATUS_UNSUCCESSFUL;
            }
        }
    }
    return Status;
}


NTSTATUS 
LdrGetModuleName(
    IN HANDLE Process OPTIONAL,
    IN PCUNICODE_STRING LdrFullDllName,
    IN OUT PRTL_PROCESS_MODULE_INFORMATION ModuleInfo,
    IN BOOL Wow64Redirect)
{
    NTSTATUS Status;
    UNICODE_STRING FullDllName;
    ANSI_STRING AnsiString;
    PCHAR s;
    WCHAR Buffer[ LDR_NUMBER_OF(ModuleInfo->FullPathName) + 1];
    USHORT Length = (USHORT)min(LdrFullDllName->Length, 
                                sizeof(Buffer) - sizeof(Buffer[0]));

    Status = LdrReadMemory(Process, 
                           LdrFullDllName->Buffer, 
                           Buffer,
                           Length);

    if (!NT_SUCCESS( Status )) {
        return Status;
    }

    Buffer[LDR_NUMBER_OF(Buffer) - 1] = UNICODE_NULL;  // Ensure NULL termination
    
#if defined(_WIN64)
    if (Wow64Redirect) {
    
        C_ASSERT( WOW64_SYSTEM_DIRECTORY_U_SIZE == 
                  (sizeof(L"system32") - sizeof(WCHAR)));
                  
        // including preceding '\\' if exists
        SIZE_T System32Offset = wcslen(USER_SHARED_DATA->NtSystemRoot);
        ASSERT(System32Offset != 0);
        
        if (USER_SHARED_DATA->NtSystemRoot[System32Offset - 1] == L'\\') {
            --System32Offset;
        }

        if (!_wcsnicmp(Buffer, USER_SHARED_DATA->NtSystemRoot, System32Offset) &&
            !_wcsnicmp(Buffer + System32Offset, 
                       L"\\system32", 
                       WOW64_SYSTEM_DIRECTORY_U_SIZE / sizeof(WCHAR) + 1)) {
                       
            RtlCopyMemory(Buffer + System32Offset + 1,
                          WOW64_SYSTEM_DIRECTORY_U,
                          WOW64_SYSTEM_DIRECTORY_U_SIZE);
        }
    }
#else
    UNREFERENCED_PARAMETER (Wow64Redirect);
#endif // defined(_WIN64)
    
    FullDllName.Buffer = Buffer;
    FullDllName.Length = FullDllName.MaximumLength = Length;

    AnsiString.Buffer = (PCHAR)ModuleInfo->FullPathName;
    AnsiString.Length = 0;
    AnsiString.MaximumLength = sizeof( ModuleInfo->FullPathName );

    Status = RtlUnicodeStringToAnsiString(&AnsiString,
                                          &FullDllName,
                                          FALSE);
    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    s = AnsiString.Buffer + AnsiString.Length;
    while (s > AnsiString.Buffer && *--s) {
        if (*s == (UCHAR)OBJ_NAME_PATH_SEPARATOR) {
            s++;
            break;
        }
    }

    ModuleInfo->OffsetToFileName = (USHORT)(s - AnsiString.Buffer);
    return STATUS_SUCCESS;
}


NTSTATUS
LdrQueryProcessPeb (
    IN HANDLE Process OPTIONAL,
    IN OUT PPEB* Peb)
{
    NTSTATUS Status;
    PROCESS_BASIC_INFORMATION BasicInfo;

    if (ARGUMENT_PRESENT (Process)) {

        Status = NtQueryInformationProcess (Process, 
                                            ProcessBasicInformation,
                                            &BasicInfo,
                                            sizeof(BasicInfo),
                                            NULL);

        if (NT_SUCCESS (Status)) {
            *Peb = BasicInfo.PebBaseAddress;
        }
    }
    else {
        *Peb = NtCurrentPeb ();
        Status = STATUS_SUCCESS;
    }

    return Status;
}


NTSTATUS
LdrQueryInLoadOrderModuleList (
    IN HANDLE Process OPTIONAL,
    IN OUT PLIST_ENTRY* Head,
    IN OUT PLIST_ENTRY* InInitOrderHead OPTIONAL
    )
{
    PPEB_LDR_DATA Ldr;

    UNREFERENCED_PARAMETER (Process);

    Ldr = &PebLdr;

    *Head = &Ldr->InLoadOrderModuleList;

    if (ARGUMENT_PRESENT (InInitOrderHead)) {
        *InInitOrderHead = &Ldr->InInitializationOrderModuleList;
    }

    return STATUS_SUCCESS;
}


NTSTATUS 
LdrQueryNextListEntry (
    IN HANDLE Process OPTIONAL,
    IN PLIST_ENTRY Head,
    IN OUT PLIST_ENTRY* Tail
    )
{
    return LdrReadMemory (Process, &Head->Flink, Tail, sizeof(*Tail));
}


NTSTATUS
LdrQueryModuleInfoFromLdrEntry (
    IN HANDLE Process OPTIONAL,
    IN PRTL_PROCESS_MODULES ModuleInformation, 
    IN OUT PRTL_PROCESS_MODULE_INFORMATION ModuleInfo,
    IN PLIST_ENTRY LdrEntry,
    IN PLIST_ENTRY InitOrderList)
{
    NTSTATUS Status;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntryPtr;
    LDR_DATA_TABLE_ENTRY LdrDataTableEntry;

    UNREFERENCED_PARAMETER (ModuleInformation);

    LdrDataTableEntryPtr = CONTAINING_RECORD(LdrEntry, 
                                             LDR_DATA_TABLE_ENTRY, 
                                             InLoadOrderLinks);

    Status = LdrReadMemory(Process, 
                           LdrEntry, 
                           &LdrDataTableEntry, 
                           sizeof(LdrDataTableEntry));

    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    ModuleInfo->ImageBase = LdrDataTableEntry.DllBase;
    ModuleInfo->ImageSize = LdrDataTableEntry.SizeOfImage;
    ModuleInfo->Flags     = LdrDataTableEntry.Flags;
    ModuleInfo->LoadCount = LdrDataTableEntry.LoadCount;
    
    if (!ARGUMENT_PRESENT( Process )) {
        UINT LoopDetectorCount = 10240;  // 10K modules max
        PLIST_ENTRY Next1 = InitOrderList->Flink;

        while ( Next1 != InitOrderList ) {
            PLDR_DATA_TABLE_ENTRY Entry1 = 
                CONTAINING_RECORD(Next1,
                                  LDR_DATA_TABLE_ENTRY,
                                  InInitializationOrderLinks);

            ModuleInfo->InitOrderIndex++;

            if ((LdrDataTableEntryPtr == Entry1) ||
                (!LoopDetectorCount--)) 
            {
                break;
            }

            Next1 = Next1->Flink;
        } 
    }

    Status = LdrGetModuleName(Process, 
                              &LdrDataTableEntry.FullDllName, 
                              ModuleInfo, 
                              FALSE);

    return Status;
}


PRTL_CRITICAL_SECTION
LdrQueryModuleInfoLocalLoaderLock (
    VOID
    )
{
    PRTL_CRITICAL_SECTION LoaderLock = NULL;

    if (!LdrpInLdrInit) {
        LoaderLock = &LdrpLoaderLock;

        if (LoaderLock != NULL) {
            RtlEnterCriticalSection (LoaderLock);
        }
    }

    return LoaderLock;
}


VOID
LdrQueryModuleInfoLocalLoaderUnlock (
    IN PRTL_CRITICAL_SECTION LoaderLock
    )
{
    if (LoaderLock) {
        RtlLeaveCriticalSection(LoaderLock);
    }
}

#if defined(_WIN64)

NTSTATUS
LdrQueryProcessPeb32(
    IN HANDLE Process OPTIONAL,
    IN OUT PPEB32* Peb
    )
{
    NTSTATUS Status;
    HANDLE TargetProcess;

    if (ARGUMENT_PRESENT (Process)) {
        TargetProcess = Process;
    }
    else {
        TargetProcess = NtCurrentProcess ();
    }

    Status = NtQueryInformationProcess (TargetProcess,
                                        ProcessWow64Information,
                                        Peb,
                                        sizeof(*Peb),
                                        NULL);
    return Status;
}


NTSTATUS
LdrQueryInLoadOrderModuleList32(
    IN HANDLE Process OPTIONAL,
    IN OUT PLIST_ENTRY32 *Head,
    IN OUT PLIST_ENTRY32 *InInitOrderHead OPTIONAL
    )
{
    NTSTATUS Status;
    PPEB32 Peb;
    PPEB_LDR_DATA32 Ldr;
    ULONG32 Ptr32;

    Status = LdrQueryProcessPeb32 (Process, &Peb);

    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    if (!Peb) {

        //
        // The process isn't a WOW process.
        //

        *Head = NULL;
        return STATUS_SUCCESS;
    }

    //
    // Ldr = Peb->Ldr
    //

    Status = LdrReadMemory (Process, &Peb->Ldr, &Ptr32, sizeof(Ptr32));

    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    Ldr = (PPEB_LDR_DATA32)(ULONG_PTR) Ptr32;

    if (!Ldr) {
        *Head = NULL;
        return STATUS_SUCCESS;
    }

    *Head = &Ldr->InLoadOrderModuleList;

    if (ARGUMENT_PRESENT (InInitOrderHead)) {
        *InInitOrderHead = &Ldr->InInitializationOrderModuleList;
    }

    return Status;
}


NTSTATUS 
LdrQueryNextListEntry32 (
    IN HANDLE Process OPTIONAL,
    IN PLIST_ENTRY32 Head,
    IN OUT PLIST_ENTRY32 *Tail
    )
{
    NTSTATUS Status;
    ULONG32 Ptr32;

    Status = LdrReadMemory (Process, &Head->Flink, &Ptr32, sizeof(Ptr32));

    *Tail = (PLIST_ENTRY32)(ULONG_PTR)Ptr32;

    return Status;
}


NTSTATUS
LdrQueryModuleInfoFromLdrEntry32 (
    IN HANDLE Process OPTIONAL,
    IN PRTL_PROCESS_MODULES ModuleInformation, 
    IN OUT PRTL_PROCESS_MODULE_INFORMATION ModuleInfo,
    IN PLIST_ENTRY32 LdrEntry,
    IN PLIST_ENTRY32 InitOrderList
    )
{
    NTSTATUS Status;
    PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntryPtr;
    LDR_DATA_TABLE_ENTRY32 LdrDataTableEntry;
    UNICODE_STRING FullDllName;

    UNREFERENCED_PARAMETER (ModuleInformation);

    LdrDataTableEntryPtr = CONTAINING_RECORD(LdrEntry,
                                             LDR_DATA_TABLE_ENTRY32,
                                             InLoadOrderLinks);

    Status = LdrReadMemory (Process, 
                            LdrEntry, 
                            &LdrDataTableEntry, 
                            sizeof(LdrDataTableEntry));

    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    ModuleInfo->ImageBase = (PVOID)(ULONG_PTR) LdrDataTableEntry.DllBase;
    ModuleInfo->ImageSize = LdrDataTableEntry.SizeOfImage;
    ModuleInfo->Flags     = LdrDataTableEntry.Flags;
    ModuleInfo->LoadCount = LdrDataTableEntry.LoadCount;

    if (!ARGUMENT_PRESENT( Process )) {

        UINT LoopDetectorCount = 500;

        PLIST_ENTRY32 Next1 = (PLIST_ENTRY32)(ULONG_PTR)
            (InitOrderList->Flink);

        while (Next1 != InitOrderList) {
            PLDR_DATA_TABLE_ENTRY32 Entry1 = 
                CONTAINING_RECORD(Next1,
                                  LDR_DATA_TABLE_ENTRY32,
                                  InInitializationOrderLinks);

            ModuleInfo->InitOrderIndex++;

            if ((LdrDataTableEntryPtr == Entry1) ||
                (!LoopDetectorCount--)) 
            {
                break;
            }

            Next1 = (PLIST_ENTRY32)(ULONG_PTR)(Next1->Flink);
        }
    }

    FullDllName.Buffer = (PWSTR)(ULONG_PTR)LdrDataTableEntry.FullDllName.Buffer;
    FullDllName.Length = LdrDataTableEntry.FullDllName.Length;
    FullDllName.MaximumLength = LdrDataTableEntry.FullDllName.MaximumLength;

    Status = LdrGetModuleName(Process, &FullDllName, ModuleInfo, TRUE);

    return Status;
}


PRTL_CRITICAL_SECTION32
LdrQueryModuleInfoLocalLoaderLock32 (
    VOID
    )
{
    return NULL;
}


VOID
LdrQueryModuleInfoLocalLoaderUnlock32 (
    IN PRTL_CRITICAL_SECTION32 LoaderLock)
{
    UNREFERENCED_PARAMETER (LoaderLock);
}

#endif // defined(_WIN64)

typedef 
NTSTATUS
(*PLDR_QUERY_IN_LOAD_ORDER_MODULE_LIST)(
    IN HANDLE Process OPTIONAL,
    IN OUT PLIST_ENTRY* Head,
    IN OUT PLIST_ENTRY* InInitOrderHead OPTIONAL);

typedef NTSTATUS 
(*PLDR_QUERY_NEXT_LIST_ENTRY)(
    IN HANDLE Process OPTIONAL,
    IN PLIST_ENTRY Head,
    IN OUT PLIST_ENTRY* Tail);

typedef 
NTSTATUS
(*PLDR_QUERY_MODULE_INFO_FROM_LDR_ENTRY)(
    IN HANDLE Process OPTIONAL,
    IN PRTL_PROCESS_MODULES ModuleInformation, 
    IN OUT PRTL_PROCESS_MODULE_INFORMATION ModuleInfo,
    IN PLIST_ENTRY LdrEntry,
    IN PLIST_ENTRY InitOrderList);

typedef
PRTL_CRITICAL_SECTION
(*PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_LOCK)(VOID);

typedef
VOID
(*PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_UNLOCK)(PRTL_CRITICAL_SECTION);

static struct {
    PLDR_QUERY_IN_LOAD_ORDER_MODULE_LIST LdrQueryInLoadOrderModuleList;
    PLDR_QUERY_NEXT_LIST_ENTRY LdrQueryNextListEntry;
    PLDR_QUERY_MODULE_INFO_FROM_LDR_ENTRY LdrQueryModuleInfoFromLdrEntry;
    PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_LOCK LdrQueryModuleInfoLocalLoaderLock;
    PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_UNLOCK LdrQueryModuleInfoLocalLoaderUnlock;
} LdrQueryMethods[] = {
    { 
        LdrQueryInLoadOrderModuleList, 
        LdrQueryNextListEntry, 
        LdrQueryModuleInfoFromLdrEntry,
        LdrQueryModuleInfoLocalLoaderLock,
        LdrQueryModuleInfoLocalLoaderUnlock
    }
#if defined(_WIN64)
    ,
    { 
        (PLDR_QUERY_IN_LOAD_ORDER_MODULE_LIST)LdrQueryInLoadOrderModuleList32,
        (PLDR_QUERY_NEXT_LIST_ENTRY)LdrQueryNextListEntry32,
        (PLDR_QUERY_MODULE_INFO_FROM_LDR_ENTRY)LdrQueryModuleInfoFromLdrEntry32,
        (PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_LOCK)LdrQueryModuleInfoLocalLoaderLock32,
        (PLDR_QUERY_MODULE_INFO_LOCAL_LOADER_UNLOCK)LdrQueryModuleInfoLocalLoaderUnlock32
    }
#endif defined(_WIN64)
}; 


NTSTATUS
LdrQueryProcessModuleInformationEx(
    IN HANDLE Process OPTIONAL,
    IN ULONG_PTR Flags OPTIONAL,
    OUT PRTL_PROCESS_MODULES ModuleInformation,
    IN ULONG ModuleInformationLength,
    OUT PULONG ReturnLength OPTIONAL)
{
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
    PRTL_CRITICAL_SECTION LoaderLock = NULL;
    SIZE_T mid;

    ULONG RequiredLength = FIELD_OFFSET( RTL_PROCESS_MODULES, Modules );

    PLIST_ENTRY List;
    PLIST_ENTRY InInitOrderList;

    PRTL_PROCESS_MODULE_INFORMATION ModuleInfo;

    if (ModuleInformationLength < RequiredLength) {
        Status = STATUS_INFO_LENGTH_MISMATCH;
        ModuleInfo = NULL;
    }
    else {
        ModuleInformation->NumberOfModules = 0;
        ModuleInfo = &ModuleInformation->Modules[ 0 ];
        Status = STATUS_SUCCESS;
    }

    for (mid = 0;
         mid < (ARGUMENT_PRESENT( Flags ) ? LDR_NUMBER_OF(LdrQueryMethods) : 1);
         ++mid)
    {
        NTSTATUS Status1;
        PLIST_ENTRY Entry;

        __try {
            UINT LoopDetectorCount = 10240; // allow not more than 10K modules

            if ( !ARGUMENT_PRESENT( Process )) {
                LoaderLock = LdrQueryMethods[mid].LdrQueryModuleInfoLocalLoaderLock();
            } 

            Status1 = LdrQueryMethods[mid].LdrQueryInLoadOrderModuleList(Process, &List, &InInitOrderList);

            if (!NT_SUCCESS( Status1 )) {
                Status = Status1;
                __leave;
            }

            if (!List) {
                __leave;
            }

            Status1 = LdrQueryMethods[mid].LdrQueryNextListEntry(Process, 
                                                                 List, 
                                                                 &Entry);
            if (!NT_SUCCESS( Status1 )) {
                Status = Status1;
                __leave;
            }

            while (Entry != List) {
                if (!LoopDetectorCount--) {
                    Status = STATUS_FAIL_CHECK;
                    __leave;
                }

                RequiredLength += sizeof( RTL_PROCESS_MODULE_INFORMATION );

                if (ModuleInformationLength < RequiredLength) {
                    Status = STATUS_INFO_LENGTH_MISMATCH;
                }
                else {
                    Status1 = LdrQueryMethods[mid].LdrQueryModuleInfoFromLdrEntry(Process, 
                                                                                  ModuleInformation, 
                                                                                  ModuleInfo, 
                                                                                  Entry, InInitOrderList);

                    if (!NT_SUCCESS( Status1 )) {
                        Status = Status1;
                        __leave;
                    }

                    ModuleInfo++;
                }

                //
                // NOTICE-2002/03/15-ELi
                // This chould be non-NULL and not a valid access
                // should check ModuleInfo or ModuleInformationLength instead
                // Assuming ModuleInfo is not NULL when the code can safely
                // reference ModuleInformation->NumberOfModules
                //
                if ((ModuleInfo != NULL) && (ModuleInformation != NULL)) {
                    ModuleInformation->NumberOfModules++;
                }

                Status1 = LdrQueryMethods[mid].LdrQueryNextListEntry(Process, 
                                                                     Entry, 
                                                                     &Entry);

                if (!NT_SUCCESS( Status1 )) {
                    Status = Status1;
                    __leave;
                }

            } // while
        }
        __finally {
            if (LoaderLock) {
                LdrQueryMethods[mid].LdrQueryModuleInfoLocalLoaderUnlock(LoaderLock);
            }

            if (ARGUMENT_PRESENT( ReturnLength )) {
                *ReturnLength = RequiredLength;
            }
        }
    } // for

    return Status;
}


NTSTATUS
LdrQueryProcessModuleInformation(
    OUT PRTL_PROCESS_MODULES ModuleInformation,
    IN ULONG ModuleInformationLength,
    OUT PULONG ReturnLength OPTIONAL)
{
    return LdrQueryProcessModuleInformationEx(NULL,
                                              0,
                                              ModuleInformation,
                                              ModuleInformationLength,
                                              ReturnLength);
}


NTSTATUS
NTAPI
LdrRegisterDllNotification (
    ULONG Flags,
    PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
    PVOID Context,
    PVOID *Cookie
    )
{
    NTSTATUS Status = STATUS_SUCCESS;
    PLDRP_DLL_NOTIFICATION_BLOCK NotificationBlock = NULL;
    BOOLEAN HoldingLoaderLock = FALSE;
    const BOOLEAN InLdrInit = LdrpInLdrInit;
    PVOID LockCookie = NULL;

    __try {
        if (Cookie != NULL) {
            *Cookie = NULL;
        }

        if ((Flags != 0) ||
            (Cookie == NULL) ||
            (NotificationFunction == NULL)) {
            Status = STATUS_INVALID_PARAMETER;
            goto Exit;
        }

        NotificationBlock = (PLDRP_DLL_NOTIFICATION_BLOCK)
                RtlAllocateHeap(RtlProcessHeap(), 0, sizeof(LDRP_DLL_NOTIFICATION_BLOCK));
        if (NotificationBlock == NULL) {
            Status = STATUS_NO_MEMORY;
            goto Exit;
        }

        NotificationBlock->NotificationFunction = NotificationFunction;
        NotificationBlock->Context = Context;

        if (!InLdrInit) {
            __try {
                Status = LdrLockLoaderLock(0, NULL, &LockCookie);
                if (!NT_SUCCESS(Status)) {
                    goto Exit;
                }
                HoldingLoaderLock = TRUE;
            } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
                Status = GetExceptionCode();
                goto Exit;
            }
        }

        InsertTailList(&LdrpDllNotificationList, &NotificationBlock->Links);

        *Cookie = (PVOID) NotificationBlock;
        NotificationBlock = NULL;

        Status = STATUS_SUCCESS;
Exit:
        ;
    } __finally {
        if (HoldingLoaderLock) {
            LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
            HoldingLoaderLock = FALSE;
        }
        if (NotificationBlock != NULL) {
            RtlFreeHeap(RtlProcessHeap(), 0, NotificationBlock);
        }
    }
    return Status;
}


NTSTATUS
NTAPI
LdrUnregisterDllNotification (
    PVOID Cookie
    )
{
    PLDRP_DLL_NOTIFICATION_BLOCK NotificationBlock;
    NTSTATUS Status;
    BOOLEAN HoldingLoaderLock;
    BOOLEAN InLdrInit;
    PVOID LockCookie;

    if (Cookie == NULL) {
        return STATUS_INVALID_PARAMETER;
    }

    Status = STATUS_SUCCESS;
    HoldingLoaderLock = FALSE;
    InLdrInit = LdrpInLdrInit;
    LockCookie = NULL;

    __try {
        if (!InLdrInit) {
            __try {
                Status = LdrLockLoaderLock (0, NULL, &LockCookie);
                if (!NT_SUCCESS(Status)) {
                    goto Exit;
                }
                HoldingLoaderLock = TRUE;
            } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
                Status = GetExceptionCode();
                goto Exit;
            }
        }

        NotificationBlock = CONTAINING_RECORD(LdrpDllNotificationList.Flink, LDRP_DLL_NOTIFICATION_BLOCK, Links);

        while (&NotificationBlock->Links != &LdrpDllNotificationList) {
            if (NotificationBlock == Cookie)
                break;
            NotificationBlock = CONTAINING_RECORD(NotificationBlock->Links.Flink, LDRP_DLL_NOTIFICATION_BLOCK, Links);
        }

        if (&NotificationBlock->Links != &LdrpDllNotificationList) {
            RemoveEntryList(&NotificationBlock->Links);
            RtlFreeHeap(RtlProcessHeap(), 0, NotificationBlock);
            Status = STATUS_SUCCESS;
        } else {
            Status = STATUS_NOT_FOUND;
        }
Exit:
        ;
    } __finally {
        if (HoldingLoaderLock) {
            LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
            HoldingLoaderLock = FALSE;
        }
    }
    return Status;
}


VOID
LdrpSendDllNotifications (
    IN PLDR_DATA_TABLE_ENTRY Entry,
    IN ULONG NotificationType,
    IN ULONG Flags
    )
{
    PLIST_ENTRY Next;
    LDR_DLL_NOTIFICATION_DATA Data;

    Data.Loaded.Flags = Flags;
    Data.Loaded.FullDllName = &Entry->FullDllName;
    Data.Loaded.BaseDllName = &Entry->BaseDllName;
    Data.Loaded.DllBase = Entry->DllBase;
    Data.Loaded.SizeOfImage = Entry->SizeOfImage;

    Next = LdrpDllNotificationList.Flink;

    while (Next != &LdrpDllNotificationList) {
        PLDRP_DLL_NOTIFICATION_BLOCK Block = CONTAINING_RECORD(Next, LDRP_DLL_NOTIFICATION_BLOCK, Links);
        __try {
            (*Block->NotificationFunction)(NotificationType, &Data, Block->Context);
        } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
            // just go on to the next one...
        }
        Next = Next->Flink;
    }
}


BOOLEAN
NTAPI
RtlDllShutdownInProgress (
    VOID
    )
/*++

Routine Description:

    This routine returns the status of DLL shutdown.

Arguments:

    None

Return Value:

    BOOLEAN - TRUE: Shutdown is in progress, FALSE: Shutdown is not currently in progress.

--*/
{
    if (LdrpShutdownInProgress) {
        return TRUE;
    } else {
        return FALSE;
    }
}


NTSTATUS
NTAPI
LdrLockLoaderLock (
    ULONG Flags,
    PULONG Disposition,
    PVOID *Cookie
    )
{
    NTSTATUS Status;
    BOOLEAN InLdrInit;

    InLdrInit = LdrpInLdrInit;

    if (Disposition != NULL) {
        *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID;
    }

    if (Cookie != NULL) {
        *Cookie = NULL;
    }

    if ((Flags & ~(LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY | LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS)) != 0) {

        if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS) {
            RtlRaiseStatus(STATUS_INVALID_PARAMETER_1);
        }

        Status = STATUS_INVALID_PARAMETER_1;
        goto Exit;
    }

    if (Cookie == NULL) {
        if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS) {
            RtlRaiseStatus (STATUS_INVALID_PARAMETER_3);
        }

        Status = STATUS_INVALID_PARAMETER_3;
        goto Exit;
    }

    //
    // If you hit this assertion failure, you specified that you only wanted to
    // try acquiring the lock, but you forgot to specify a Disposition out where
    // this function could indicate whether the lock was actually acquired.
    //

    ASSERT((Disposition != NULL) || !(Flags & LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY));

    if ((Flags & LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY) &&
        (Disposition == NULL)) {

        if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS) {
            RtlRaiseStatus(STATUS_INVALID_PARAMETER_2);
        }

        Status = STATUS_INVALID_PARAMETER_2;
        goto Exit;
    }

    if (InLdrInit) {
        Status = STATUS_SUCCESS;
        goto Exit;
    }

    if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS) {
        if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY) {
            if (RtlTryEnterCriticalSection(&LdrpLoaderLock)) {
                *Cookie = (PVOID) MAKE_LOADER_LOCK_COOKIE(LOADER_LOCK_COOKIE_TYPE_NORMAL, InterlockedIncrement(&LdrpLoaderLockAcquisitionCount));
                *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED;
            } else {
                *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED;
            }
        } else {
            RtlEnterCriticalSection(&LdrpLoaderLock);
            if (Disposition != NULL) {
                *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED;
            }
            *Cookie = (PVOID) MAKE_LOADER_LOCK_COOKIE(LOADER_LOCK_COOKIE_TYPE_NORMAL, InterlockedIncrement(&LdrpLoaderLockAcquisitionCount));
        }
    } else {
        __try {
            if (Flags & LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY) {
                if (RtlTryEnterCriticalSection(&LdrpLoaderLock)) {
                    *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED;
                    *Cookie = (PVOID) MAKE_LOADER_LOCK_COOKIE(LOADER_LOCK_COOKIE_TYPE_NORMAL, InterlockedIncrement(&LdrpLoaderLockAcquisitionCount));
                } else {
                    *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED;
                }
            } else {
                RtlEnterCriticalSection(&LdrpLoaderLock);
                if (Disposition != NULL) {
                    *Disposition = LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED;
                }
                *Cookie = (PVOID) MAKE_LOADER_LOCK_COOKIE(LOADER_LOCK_COOKIE_TYPE_NORMAL, InterlockedIncrement(&LdrpLoaderLockAcquisitionCount));
            }
        } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
            Status = GetExceptionCode();
            DbgPrintEx(
                DPFLTR_LDR_ID,
                LDR_ERROR_DPFLTR,
                "LDR: %s - Caught exception %08lx\n",
                __FUNCTION__,
                Status);
            goto Exit;
        }
    }

    Status = STATUS_SUCCESS;
Exit:
    return Status;
}


NTSTATUS
NTAPI
LdrUnlockLoaderLock(
    ULONG Flags,
    PVOID CookieIn
    )
{
    NTSTATUS Status;
    const ULONG_PTR Cookie = (ULONG_PTR) CookieIn;

    if ((Flags & ~(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS)) != 0) {
        if (Flags & LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS)
            RtlRaiseStatus(STATUS_INVALID_PARAMETER_1);

        Status = STATUS_INVALID_PARAMETER_1;
        goto Exit;
    }

    if (CookieIn == NULL) {
        Status = STATUS_SUCCESS;
        goto Exit;
    }

    // A little validation on the cookie...
    if (EXTRACT_LOADER_LOCK_COOKIE_TYPE(Cookie) != LOADER_LOCK_COOKIE_TYPE_NORMAL) {
        if (Flags & LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS)
            RtlRaiseStatus(STATUS_INVALID_PARAMETER_2);

        Status = STATUS_INVALID_PARAMETER_2;
        goto Exit;
    }

    if (EXTRACT_LOADER_LOCK_COOKIE_TID(Cookie) != (HandleToUlong(NtCurrentTeb()->ClientId.UniqueThread) & LOADER_LOCK_COOKIE_TID_BIT_MASK)) {
        if (Flags & LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS)
            RtlRaiseStatus(STATUS_INVALID_PARAMETER_2);

        Status = STATUS_INVALID_PARAMETER_2;
        goto Exit;
    }

    if (Flags & LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS) {
        RtlLeaveCriticalSection(&LdrpLoaderLock);
    } else {
        __try {
            RtlLeaveCriticalSection(&LdrpLoaderLock);
        } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
            Status = GetExceptionCode();
            goto Exit;
        }
    }

    Status = STATUS_SUCCESS;
Exit:
    return Status;
}


NTSTATUS
NTAPI
LdrDoesCurrentThreadOwnLoaderLock(
    BOOLEAN *DoesOwnLock
    )
{
    NTSTATUS Status;
    PTEB Teb;

    if (DoesOwnLock != NULL)
        *DoesOwnLock = FALSE;

    if (DoesOwnLock == NULL) {
        Status = STATUS_INVALID_PARAMETER;
        goto Exit;
    }

    Teb = NtCurrentTeb();

    if (LdrpLoaderLock.OwningThread == Teb->ClientId.UniqueThread)
        *DoesOwnLock = TRUE;

    Status = STATUS_SUCCESS;
Exit:
    return Status;
}


NTSTATUS
NTAPI
LdrEnumerateLoadedModules (
    ULONG Flags,
    PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION CallbackFunction,
    PVOID Context
    )
{
    NTSTATUS Status;
    BOOLEAN LoaderLockLocked = FALSE;
    PLIST_ENTRY LoadOrderListHead = NULL;
    PLIST_ENTRY ListEntry;
    BOOLEAN StopEnumeration = FALSE;
    PVOID   LockCookie = NULL;

    if ((Flags != 0) ||
        (CallbackFunction == NULL)) {
        Status = STATUS_INVALID_PARAMETER;
        goto Exit;
    }

    Status = LdrLockLoaderLock(0, NULL, &LockCookie);
    if (!NT_SUCCESS(Status))
        goto Exit;

    LoaderLockLocked = TRUE;
    LoadOrderListHead = &PebLdr.InLoadOrderModuleList;

    ListEntry = LoadOrderListHead->Flink;

    while (ListEntry != LoadOrderListHead) {
        __try {
            (*CallbackFunction)(
                CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks),
                Context,
                &StopEnumeration);
        } __except (LdrpGenericExceptionFilter(GetExceptionInformation(), __FUNCTION__)) {
            Status = GetExceptionCode();
            goto Exit;
        }

        if (StopEnumeration)
            break;

        ListEntry = ListEntry->Flink;
    }

    Status = LdrUnlockLoaderLock(0, LockCookie);
    LoaderLockLocked = FALSE;

    if (!NT_SUCCESS(Status)) {
        goto Exit;
    }

    Status = STATUS_SUCCESS;

Exit:

    if (LoaderLockLocked) {

        NTSTATUS Status2;
                
        Status2 = LdrUnlockLoaderLock(0, LockCookie);

        ASSERT(NT_SUCCESS(Status2));
    }

    return Status;
}


NTSTATUS
NTAPI
LdrAddRefDll(
    ULONG               Flags,
    PVOID               DllHandle
    )
{
    NTSTATUS Status = STATUS_SUCCESS;
    PLDR_DATA_TABLE_ENTRY LdrDataTableEntry = NULL;
    const BOOLEAN InLdrInit = LdrpInLdrInit;
    PVOID LockCookie = NULL;
    BOOLEAN HoldingLoaderLock = FALSE;
    const ULONG ValidFlags = LDR_ADDREF_DLL_PIN;

    __try {

        if (Flags & ~ValidFlags
            ) {
            Status = STATUS_INVALID_PARAMETER;
            goto Exit;
        }
        if (!InLdrInit
            ) {
            Status = LdrLockLoaderLock(0, NULL, &LockCookie);
            if (!NT_SUCCESS(Status))
                goto Exit;
            HoldingLoaderLock = TRUE;
        }
        if (!LdrpCheckForLoadedDllHandle(DllHandle, &LdrDataTableEntry)
            ) {
            Status = STATUS_INVALID_PARAMETER;
            goto Exit;
        }
        if (!RTL_SOFT_VERIFY(LdrDataTableEntry != NULL)
            ) {
            Status = STATUS_INTERNAL_ERROR;
            goto Exit;
        }
        //
        // Gross. Everyone inlines the first part..
        //
        if (LdrDataTableEntry->LoadCount != 0xffff) {
            if (Flags & LDR_ADDREF_DLL_PIN
                ) {
                LdrDataTableEntry->LoadCount = 0xffff;
                LdrpPinLoadedDll(LdrDataTableEntry);
            } else {
                LdrDataTableEntry->LoadCount++;
                LdrpReferenceLoadedDll(LdrDataTableEntry);
            }
            LdrpClearLoadInProgress();
        }
Exit:
        if (LdrpShouldDbgPrintStatus(Status)
            ) {
            DbgPrint("LDR: "__FUNCTION__"(%p) 0x%08lx\n", DllHandle, Status);
        }
    } __finally {
        if (HoldingLoaderLock) {
            LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
            HoldingLoaderLock = FALSE;
        }
    }
    return Status;
}


VOID
NTAPI
LdrSetDllManifestProber(
    IN PLDR_MANIFEST_PROBER_ROUTINE ManifestProberRoutine
    )
{
    LdrpManifestProberRoutine = ManifestProberRoutine;
}


NTSTATUS
NTAPI
LdrSetAppCompatDllRedirectionCallback(
    IN ULONG Flags,
    IN PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION CallbackFunction,
    IN PVOID CallbackData
    )
/*++

Routine Description:

    This routine allows the application compatibility facility to set a callback
    function that it can use to redirect DLL loads wherever it wants them to go.

Arguments:

    Flags - None defined now; must be zero.

    CallbackFunction - Function pointer to function which is called to resolve
        path names prior to actually loading the DLL.

    CallbackData - PVOID value passed through to the CallbackFunction when it is
        called.

Return Value:

    NTSTATUS indicating the success/failure of the function.

--*/
{
    NTSTATUS st = STATUS_INTERNAL_ERROR;
    PVOID LockCookie = NULL;

    if (Flags != 0) {
        st = STATUS_INVALID_PARAMETER;
        goto Exit;
    }

    LdrLockLoaderLock(LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, NULL, &LockCookie);
    __try {
        LdrpAppCompatDllRedirectionCallbackFunction = CallbackFunction;
        LdrpAppCompatDllRedirectionCallbackData = CallbackData;
    } __finally {
        LdrUnlockLoaderLock(LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS, LockCookie);
    }

    st = STATUS_SUCCESS;
Exit:
    return st;
}

PTEB LdrpTopLevelDllBeingLoadedTeb=NULL;


BOOLEAN
RtlIsThreadWithinLoaderCallout (
    VOID
    )
{
    if (LdrpTopLevelDllBeingLoadedTeb == NtCurrentTeb ()) {
        return TRUE;
    } else {
        return FALSE;
    }
}