You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2394 lines
73 KiB
2394 lines
73 KiB
/*++
|
|
|
|
Copyright (c) 1989-2000 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
sdbapi.c
|
|
|
|
Abstract:
|
|
|
|
BUGBUG: This module implements ...
|
|
|
|
Author:
|
|
|
|
dmunsil created sometime in 1999
|
|
|
|
Revision History:
|
|
|
|
several people contributed (vadimb, clupu, ...)
|
|
|
|
--*/
|
|
|
|
#include "sdbp.h"
|
|
#include "initguid.h"
|
|
|
|
DEFINE_GUID(GUID_SYSMAIN_SDB, 0x11111111, 0x1111, 0x1111, 0x11, 0x11, 0x11, 0x11, \
|
|
0x11, 0x11, 0x11, 0x11);
|
|
DEFINE_GUID(GUID_APPHELP_SDB, 0x22222222, 0x2222, 0x2222, 0x22, 0x22, 0x22, 0x22, \
|
|
0x22, 0x22, 0x22, 0x22);
|
|
DEFINE_GUID(GUID_SYSTEST_SDB, 0x33333333, 0x3333, 0x3333, 0x33, 0x33, 0x33, 0x33, \
|
|
0x33, 0x33, 0x33, 0x33);
|
|
DEFINE_GUID(GUID_DRVMAIN_SDB, 0xF9AB2228, 0x3312, 0x4A73, 0xB6, 0xF9, 0x93, 0x6D, \
|
|
0x70, 0xE1, 0x12, 0xEF);
|
|
DEFINE_GUID(GUID_MSIMAIN_SDB, 0xD8FF6D16, 0x6A3A, 0x468A, 0x8B, 0x44, 0x01, 0x71, \
|
|
0x4D, 0xDC, 0x49, 0xEA);
|
|
|
|
#define SYSTEM32_VAR TEXT("%system32%")
|
|
#define SYSTEM32_VAR_LEN (sizeof(SYSTEM32_VAR)/sizeof(SYSTEM32_VAR[0]) - 1)
|
|
#define SYSTEM32_VAR_VALUE_NOT_IA3264 TEXT("%systemroot%\\system32")
|
|
#define SYSTEM32_VAR_VALUE_IA3264 TEXT("%systemroot%\\syswow64")
|
|
// since system32 and syswow64 happen to have the same length, we just define one len for both of them.
|
|
#define SYSTEM32_VAR_VALUE_LEN (sizeof(SYSTEM32_VAR_VALUE_IA3264)/sizeof(SYSTEM32_VAR_VALUE_IA3264[0]) - 1)
|
|
|
|
#ifdef _DEBUG_SPEW
|
|
|
|
//
|
|
// Shim Debug output support
|
|
//
|
|
int g_iShimDebugLevel = SHIM_DEBUG_UNINITIALIZED;
|
|
|
|
DBGLEVELINFO g_rgDbgLevelInfo[DEBUG_LEVELS] = {
|
|
{ "Err", sdlError },
|
|
{ "Warn", sdlWarning },
|
|
{ "Fail", sdlFail },
|
|
{ "Info", sdlInfo }
|
|
};
|
|
|
|
PCH g_szDbgLevelUser = "User";
|
|
|
|
#endif // _DEBUG_SPEW
|
|
|
|
|
|
BOOL
|
|
SdbpInitializeSearchDBContext(
|
|
PSEARCHDBCONTEXT pContext
|
|
);
|
|
|
|
|
|
#if defined(KERNEL_MODE) && defined(ALLOC_PRAGMA)
|
|
#pragma alloc_text(PAGE, ShimExceptionHandler)
|
|
#pragma alloc_text(PAGE, SdbpCreateSearchDBContext)
|
|
#pragma alloc_text(PAGE, SdbpInitializeSearchDBContext)
|
|
#pragma alloc_text(PAGE, SdbpReleaseSearchDBContext)
|
|
#pragma alloc_text(PAGE, SdbpCheckForMatch)
|
|
#pragma alloc_text(PAGE, SdbpSearchDB)
|
|
#pragma alloc_text(PAGE, SdbpCreateSearchDBContext)
|
|
#pragma alloc_text(PAGE, SdbGetDatabaseMatch)
|
|
#pragma alloc_text(PAGE, SdbQueryData)
|
|
#pragma alloc_text(PAGE, SdbQueryDataEx)
|
|
#pragma alloc_text(PAGE, SdbReadEntryInformation)
|
|
#pragma alloc_text(PAGE, PrepareFormatForUnicode)
|
|
#pragma alloc_text(PAGE, ShimDbgPrint)
|
|
#endif
|
|
|
|
#if DBG
|
|
const BOOL g_bDBG = TRUE;
|
|
#else
|
|
const BOOL g_bDBG = FALSE;
|
|
#endif
|
|
|
|
//
|
|
// Exception handler
|
|
//
|
|
|
|
ULONG
|
|
ShimExceptionHandler(
|
|
PEXCEPTION_POINTERS pexi,
|
|
char* szFile,
|
|
DWORD dwLine
|
|
)
|
|
{
|
|
#ifndef KERNEL_MODE // in kmode exceptions won't work anyway
|
|
|
|
DBGPRINT((sdlError,
|
|
"ShimExceptionHandler",
|
|
"Shim Exception %#x in module \"%hs\", line %d, at address %#p. flags:%#x. !exr %#p !cxr %#p",
|
|
pexi->ExceptionRecord->ExceptionCode,
|
|
szFile,
|
|
dwLine,
|
|
CONTEXT_TO_PROGRAM_COUNTER(pexi->ContextRecord),
|
|
pexi->ExceptionRecord->ExceptionFlags,
|
|
pexi->ExceptionRecord,
|
|
pexi->ContextRecord));
|
|
|
|
//
|
|
// Special-case stack overflow exception which is likely to occur due to
|
|
// low memory conditions during stress. The process is dead anyway so we
|
|
// will not handle this exception.
|
|
//
|
|
if (pexi->ExceptionRecord->ExceptionCode == EXCEPTION_STACK_OVERFLOW) {
|
|
return EXCEPTION_CONTINUE_SEARCH;
|
|
}
|
|
|
|
#if DBG
|
|
SDB_BREAK_POINT();
|
|
#endif // DBG
|
|
|
|
#endif // KERNEL_MODE
|
|
|
|
UNREFERENCED_PARAMETER(pexi);
|
|
UNREFERENCED_PARAMETER(szFile);
|
|
UNREFERENCED_PARAMETER(dwLine);
|
|
|
|
return EXCEPTION_EXECUTE_HANDLER;
|
|
}
|
|
|
|
BOOL
|
|
SdbpResolveAndSplitPath(
|
|
IN DWORD dwFlags, // context flags (SEARCHDBF_NO_LFN in particular)
|
|
IN LPCTSTR szFullPath, // a full UNC or DOS path & filename, "c:\foo\myfile.ext"
|
|
OUT LPTSTR szDir, // the drive and dir portion of the filename "c:\foo\"
|
|
OUT LPTSTR szName, // the filename portion "myfile"
|
|
IN DWORD cchNameSize, // size of szName (in characters)
|
|
OUT LPTSTR szExt, // the extension portion ".ext"
|
|
IN DWORD cchExtSize // size of szExt (in characters)
|
|
)
|
|
/*++
|
|
Return: TRUE on success, FALSE otherwise.
|
|
|
|
Desc: This function takes a full path and splits it into pieces ala splitpath,
|
|
but also converts short file names to long names.
|
|
NOTE: The caller is responsible for allocating enough space
|
|
for the passed-in strings to take any portion of the path.
|
|
For safety, allocate at least MAX_PATH WCHARS for each piece.
|
|
--*/
|
|
{
|
|
TCHAR* szCursor;
|
|
TCHAR szLongFileName[MAX_PATH + 1];
|
|
|
|
assert(szFullPath && szDir && szName && szExt);
|
|
|
|
//
|
|
// Parse the directory.
|
|
//
|
|
szDir[0] = _T('\0');
|
|
|
|
szCursor = _tcsrchr(szFullPath, _T('\\')); // last backslash please
|
|
if (szCursor == NULL) {
|
|
szCursor = (LPTSTR)szFullPath;
|
|
} else {
|
|
_tcsncpy(szDir, szFullPath, szCursor - szFullPath + 1);
|
|
szDir[szCursor - szFullPath + 1] = _T('\0');
|
|
}
|
|
|
|
#ifndef KERNEL_MODE
|
|
|
|
//
|
|
// Make sure we're using the long filename
|
|
//
|
|
if (dwFlags & SEARCHDBF_NO_LFN) {
|
|
assert(_tcslen(szCursor) < CHARCOUNT(szLongFileName));
|
|
StringCchCopy(szLongFileName, CHARCOUNT(szLongFileName), szCursor);
|
|
} else {
|
|
if (!SdbpGetLongFileName(szFullPath, szLongFileName, CHARCOUNT(szLongFileName))) {
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
#else // KERNEL_MODE
|
|
|
|
UNREFERENCED_PARAMETER(dwFlags);
|
|
|
|
//
|
|
// When we are in kernel mode, our file name is always considered to be "long".
|
|
// At this point szCursor points to the last '\\' or to the beginning of the name.
|
|
//
|
|
if (*szCursor == _T('\\')) {
|
|
++szCursor;
|
|
}
|
|
|
|
//
|
|
// Make sure that we have enough room for the name.
|
|
//
|
|
assert(wcslen(szCursor) < CHARCOUNT(szLongFileName));
|
|
StringCchCopy(szLongFileName, CHARCOUNT(szLongFileName), szCursor);
|
|
|
|
#endif // KERNEL_MODE
|
|
|
|
//
|
|
// Parse name & extension
|
|
//
|
|
szExt[0] = _T('\0');
|
|
szName[0] = _T('\0');
|
|
|
|
//
|
|
// Within the long file name find the last dot
|
|
//
|
|
szCursor = _tcsrchr(szLongFileName, _T('.'));
|
|
|
|
if (szCursor != NULL) {
|
|
_tcsncpy(szName, szLongFileName, szCursor - szLongFileName);
|
|
szName[szCursor-szLongFileName] = _T('\0');
|
|
StringCchCopy(szExt, cchExtSize, szCursor);
|
|
} else {
|
|
StringCchCopy(szName, cchNameSize, szLongFileName);
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
BOOL
|
|
SdbpCreateSearchDBContext(
|
|
PSEARCHDBCONTEXT pContext,
|
|
LPCTSTR szPath,
|
|
LPCTSTR szModuleName,
|
|
LPCTSTR pEnvironment
|
|
)
|
|
/*++
|
|
Return: TRUE - search db context was successfully created
|
|
|
|
Desc: This function creates context for searching the database, in particular, the
|
|
context is initalized with the path of probable local database location,
|
|
executable path is broken down into containing directory and the filename part.
|
|
--*/
|
|
{
|
|
int nLen;
|
|
DWORD dwPathLen;
|
|
BOOL bReturn = FALSE;
|
|
TCHAR* szDirectory = NULL;
|
|
TCHAR* szExt = NULL;
|
|
TCHAR* szFullName = NULL;
|
|
TCHAR* szFileName = NULL;
|
|
TCHAR* szModule = NULL;
|
|
|
|
assert(NULL != szPath);
|
|
assert(NULL != pContext);
|
|
|
|
dwPathLen = (DWORD)_tcslen(szPath);
|
|
|
|
//
|
|
// Allocate enough to guarantee our strings will not overflow
|
|
//
|
|
szDirectory = SdbAlloc((dwPathLen + 1) * sizeof(TCHAR));
|
|
szFullName = SdbAlloc((_MAX_PATH + 1) * sizeof(TCHAR));
|
|
|
|
if (szModuleName) {
|
|
nLen = (int)_tcslen(szModuleName) + 1;
|
|
szModule = SdbAlloc(nLen * sizeof(TCHAR));
|
|
if (!szModule) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCreateSearchDBContext",
|
|
"Unable to allocate memory for szModule.\n"));
|
|
goto out;
|
|
}
|
|
StringCchCopy(szModule, nLen, szModuleName);
|
|
}
|
|
|
|
STACK_ALLOC(szExt, (_MAX_PATH + 1) * sizeof(TCHAR));
|
|
STACK_ALLOC(szFileName, (_MAX_PATH + 1) * sizeof(TCHAR));
|
|
|
|
if (!szDirectory || !szExt || !szFullName || !szFileName || !pContext) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCreateSearchDBContext",
|
|
"Unable to allocate memory for strings.\n"));
|
|
goto out;
|
|
}
|
|
|
|
if (!SdbpResolveAndSplitPath(pContext->dwFlags,
|
|
szPath,
|
|
szDirectory,
|
|
szFileName,
|
|
_MAX_PATH + 1,
|
|
szExt,
|
|
_MAX_PATH + 1)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCreateSearchDBContext",
|
|
"Unable to parse executable path for \"%s\".\n",
|
|
szPath));
|
|
goto out;
|
|
}
|
|
|
|
StringCchCopy(szFullName, _MAX_PATH + 1, szFileName);
|
|
StringCchCat(szFullName, _MAX_PATH + 1, szExt);
|
|
|
|
pContext->pEnvironment = pEnvironment;
|
|
pContext->szDir = szDirectory;
|
|
pContext->szName = szFullName; // fullname (filename + ext)
|
|
pContext->szModuleName = szModule;
|
|
|
|
//
|
|
// We do not retain szExt (don't need it)
|
|
//
|
|
// Calculate this later -- implied by RtlZeroMemory statement above
|
|
//
|
|
pContext->pSearchParts = NULL;
|
|
pContext->szProcessHistory = NULL;
|
|
|
|
bReturn = TRUE;
|
|
|
|
out:
|
|
if (szExt != NULL) {
|
|
STACK_FREE(szExt);
|
|
}
|
|
|
|
if (szFileName != NULL) {
|
|
STACK_FREE(szFileName);
|
|
}
|
|
|
|
if (!bReturn) {
|
|
|
|
if (szDirectory != NULL) {
|
|
SdbFree(szDirectory);
|
|
}
|
|
if (szFullName != NULL) {
|
|
SdbFree(szFullName);
|
|
}
|
|
|
|
if (szModule != NULL) {
|
|
SdbFree(szModule);
|
|
}
|
|
}
|
|
|
|
return bReturn;
|
|
}
|
|
|
|
|
|
BOOL
|
|
SdbpInitializeSearchDBContext(
|
|
PSEARCHDBCONTEXT pContext
|
|
)
|
|
/*++
|
|
Return: TRUE - the context was successfully initialized with the process history
|
|
which was broken down into the separate search paths
|
|
|
|
Desc: This function prepares search context for use, obtaining and parsing process
|
|
history into separate paths. The array of these search paths is used then
|
|
by the caller to inquire about matching files that might be present in one
|
|
of the these places.
|
|
In Kernel mode use SEARCHDBF_NO_PROCESS_HISTORY flag within context
|
|
it will include only the current exe path into the process history
|
|
--*/
|
|
{
|
|
BOOL bSuccess = TRUE;
|
|
LPTSTR pszProcessHistory = NULL;
|
|
|
|
if (pContext->pSearchParts != NULL) {
|
|
return TRUE;
|
|
}
|
|
|
|
if (pContext->dwFlags & SEARCHDBF_NO_PROCESS_HISTORY) {
|
|
|
|
pszProcessHistory = pContext->szProcessHistory;
|
|
|
|
if (pszProcessHistory == NULL) {
|
|
|
|
DWORD DirLen = (DWORD)_tcslen(pContext->szDir);
|
|
DWORD NameLen = (DWORD)_tcslen(pContext->szName);
|
|
|
|
//
|
|
// We create a temporary process history
|
|
//
|
|
pContext->szProcessHistory = SdbAlloc((DirLen + NameLen + 1) * sizeof(TCHAR));
|
|
|
|
if (pContext->szProcessHistory == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpInitializeSearchDBContext",
|
|
"Failed to allocate buffer %d bytes\n",
|
|
(DirLen + NameLen + 1) * sizeof(TCHAR)));
|
|
return FALSE;
|
|
}
|
|
|
|
pszProcessHistory = pContext->szProcessHistory;
|
|
|
|
RtlMoveMemory(pszProcessHistory, pContext->szDir, DirLen * sizeof(TCHAR));
|
|
RtlMoveMemory(pszProcessHistory + DirLen, pContext->szName, NameLen * sizeof(TCHAR));
|
|
|
|
*(pszProcessHistory + DirLen + NameLen) = TEXT('\0');
|
|
}
|
|
|
|
//
|
|
// When we are here -- we either have a process history or we just
|
|
// created it consisting of a single search item
|
|
//
|
|
|
|
} else {
|
|
|
|
#ifndef KERNEL_MODE
|
|
if (pContext->szProcessHistory == NULL) {
|
|
|
|
pContext->szProcessHistory = GetProcessHistory(pContext->pEnvironment,
|
|
pContext->szDir,
|
|
pContext->szName);
|
|
if (pContext->szProcessHistory == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpInitializeSearchDBContext",
|
|
"Failed to retrieve process history\n"));
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
pszProcessHistory = pContext->szProcessHistory;
|
|
#else
|
|
//
|
|
// This is the case with KERNEL_MODE. YOU HAVE TO SET SEARCHDBF_NO_PROCESS_HISTORY
|
|
//
|
|
assert(FALSE);
|
|
pszProcessHistory = NULL;
|
|
#endif
|
|
}
|
|
|
|
//
|
|
// At this point pszProcessHistory is NOT NULL
|
|
//
|
|
assert(pszProcessHistory != NULL);
|
|
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpInitializeSearchDBContext",
|
|
"Using Process History: \"%s\"\n",
|
|
pszProcessHistory));
|
|
|
|
bSuccess = SdbpCreateSearchPathPartsFromPath(pszProcessHistory, &pContext->pSearchParts);
|
|
|
|
if (bSuccess) {
|
|
pContext->dwFlags |= SEARCHDBF_INITIALIZED;
|
|
}
|
|
|
|
return bSuccess;
|
|
}
|
|
|
|
void
|
|
SdbpReleaseSearchDBContext(
|
|
PSEARCHDBCONTEXT pContext
|
|
)
|
|
/*++
|
|
Return: void
|
|
|
|
Desc: Resets search DB context, frees memory allocated for each of the
|
|
temporary buffers.
|
|
--*/
|
|
{
|
|
if (pContext == NULL) {
|
|
return;
|
|
}
|
|
|
|
if (pContext->szProcessHistory != NULL) {
|
|
SdbFree(pContext->szProcessHistory);
|
|
pContext->szProcessHistory = NULL;
|
|
}
|
|
|
|
if (pContext->pSearchParts != NULL) {
|
|
SdbFree(pContext->pSearchParts);
|
|
pContext->pSearchParts = NULL;
|
|
}
|
|
|
|
if (pContext->szDir != NULL) {
|
|
SdbFree(pContext->szDir);
|
|
pContext->szDir = NULL;
|
|
}
|
|
|
|
if (pContext->szName != NULL) {
|
|
SdbFree(pContext->szName);
|
|
pContext->szName = NULL;
|
|
}
|
|
|
|
if (pContext->szModuleName != NULL) {
|
|
SdbFree(pContext->szModuleName);
|
|
pContext->szModuleName = NULL;
|
|
}
|
|
}
|
|
|
|
BOOL
|
|
SdbpIsExeEntryEnabled(
|
|
IN PDB pdb,
|
|
IN TAGID tiExe,
|
|
OUT GUID* pGUID,
|
|
OUT DWORD* pdwFlags
|
|
)
|
|
{
|
|
TAGID tiExeID;
|
|
BOOL fSuccess = FALSE;
|
|
|
|
//
|
|
// Get the EXE's GUID
|
|
//
|
|
tiExeID = SdbFindFirstTag(pdb, tiExe, TAG_EXE_ID);
|
|
|
|
if (tiExeID == TAGID_NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpIsExeEntryEnabled",
|
|
"Failed to read TAG_EXE_ID for tiExe 0x%x !\n",
|
|
tiExe));
|
|
goto error;
|
|
}
|
|
|
|
if (!SdbReadBinaryTag(pdb, tiExeID, (PBYTE)pGUID, sizeof(GUID))) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpIsExeEntryEnabled",
|
|
"Failed to read the GUID for tiExe 0x%x !\n",
|
|
tiExe));
|
|
goto error;
|
|
}
|
|
|
|
if (!SdbGetEntryFlags(pGUID, pdwFlags)) {
|
|
DBGPRINT((sdlWarning,
|
|
"SdbpIsExeEntryEnabled",
|
|
"No flags for tiExe 0x%lx\n",
|
|
tiExe));
|
|
|
|
*pdwFlags = 0;
|
|
} else {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpIsExeEntryEnabled",
|
|
"Retrieved flags for this app 0x%x.\n",
|
|
*pdwFlags));
|
|
}
|
|
|
|
if (!(*pdwFlags & SHIMREG_DISABLE_SHIM)) {
|
|
fSuccess = TRUE;
|
|
}
|
|
|
|
error:
|
|
|
|
return fSuccess;
|
|
}
|
|
|
|
#define EXTRA_BUF_SPACE (16 * sizeof(TCHAR))
|
|
|
|
//
|
|
// Matching an entry:
|
|
//
|
|
// 1. We check whether each file exists by calling SdbGetFileInfo
|
|
// 2. Each file's info is stored in FILEINFOCHAINITEM (allocated on the stack) - such as pointer
|
|
// to the actual FILEINFO structure (stored in file attribute cache) and tiMatch denoting
|
|
// the entry in the database for a given MATCHING_FILE
|
|
// 3. After we have verified that all the matching files do exist -- we proceed to walk the
|
|
// chain of FILEINFOCHAINITEM structures and call SdbCheckAllAttributes to check on all the
|
|
// other attributes of the file
|
|
// 4. Cleanup: File attribute cache is destroyed when the database is closed via call to
|
|
// SdbCleanupAttributeMgr
|
|
// 5. No cleanup is needed for FILEINFOCHAINITEM structures (they are allocated on the stack and
|
|
// just "go away")
|
|
//
|
|
//
|
|
|
|
typedef struct tagFILEINFOCHAINITEM {
|
|
PVOID pFileInfo; // pointer to the actual FILEINFO
|
|
// structure (from attribute cache)
|
|
TAGID tiMatch; // matching entry in the database
|
|
|
|
struct tagFILEINFOCHAINITEM* pNextItem; // pointer to the next matching file
|
|
|
|
} FILEINFOCHAINITEM, *PFILEINFOCHAINITEM;
|
|
|
|
|
|
BOOL
|
|
SdbpCheckForMatch(
|
|
IN HSDB hSDB, // context ptr
|
|
IN PDB pdb, // pdb to get match criteria from
|
|
IN TAGID tiExe, // TAGID of exe record to get match criteria from
|
|
IN PSEARCHDBCONTEXT pContext, // search db context (includes name/path)
|
|
OUT PMATCHMODE pMatchMode, // the match mode of this EXE
|
|
OUT GUID* pGUID,
|
|
OUT DWORD* pdwFlags
|
|
)
|
|
/*++
|
|
Return: TRUE if match is good, FALSE if this EXE doesn't match.
|
|
|
|
Desc: Given an EXE tag and a name and dir, checks the DB for MATCHING_FILE
|
|
tags, and checks all the matching info available for each the
|
|
files listed. If all the files check out, returns TRUE. If any of
|
|
the files don't exist, or don't match on one of the given
|
|
criteria, returns FALSE.
|
|
--*/
|
|
{
|
|
BOOL bReturn = FALSE;
|
|
BOOL bMatchLogicNot = FALSE;
|
|
BOOL bAllAttributesMatch = FALSE;
|
|
TAGID tiMatch;
|
|
TCHAR* szTemp = NULL;
|
|
LONG nFullPathBufSize = 0;
|
|
LONG nFullPathReqBufSize = 0;
|
|
LPTSTR szFullPath = NULL;
|
|
LPTSTR szPathInSystem32 = NULL;
|
|
LONG i;
|
|
LONG NameLen = (LONG)_tcslen(pContext->szName);
|
|
LONG MatchFileLen;
|
|
PSEARCHPATHPARTS pSearchPath;
|
|
PSEARCHPATHPART pSearchPathPart;
|
|
PFILEINFOCHAINITEM pFileInfoItem = NULL;
|
|
PFILEINFOCHAINITEM pFileInfoItemList = NULL; // holds the list of matching files
|
|
// which were found
|
|
PFILEINFOCHAINITEM pFileInfoItemNext; // holds the next item in the list
|
|
PVOID pFileInfo = NULL; // points to the current file's
|
|
// information structure
|
|
BOOL bDisableAttributeCache = FALSE; // will be set according to search
|
|
|
|
TAGID tiName, tiTemp, tiMatchLogicNot;
|
|
TCHAR* szMatchFile = NULL;
|
|
HANDLE hFileHandle; // handle for the file we're checking, optimization
|
|
LPVOID pImageBase; // pointer to the image
|
|
DWORD dwImageSize = 0;
|
|
WORD wDefaultMatchMode;
|
|
|
|
//
|
|
// Check context's flags
|
|
//
|
|
if (pContext->dwFlags & SEARCHDBF_NO_ATTRIBUTE_CACHE) {
|
|
bDisableAttributeCache = TRUE;
|
|
}
|
|
|
|
//
|
|
// Loop through matching criteria.
|
|
//
|
|
tiMatch = SdbFindFirstTag(pdb, tiExe, TAG_MATCHING_FILE);
|
|
|
|
while (tiMatch != TAGID_NULL) {
|
|
|
|
tiMatchLogicNot = SdbFindFirstTag(pdb, tiMatch, TAG_MATCH_LOGIC_NOT);
|
|
bMatchLogicNot = (tiMatchLogicNot != TAGID_NULL);
|
|
|
|
tiName = SdbFindFirstTag(pdb, tiMatch, TAG_NAME);
|
|
|
|
if (!tiName) {
|
|
goto out;
|
|
}
|
|
|
|
szTemp = SdbGetStringTagPtr(pdb, tiName);
|
|
|
|
if (szTemp == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"Failed to get the string from the database.\n"));
|
|
goto out;
|
|
}
|
|
|
|
if (szTemp[0] == TEXT('*')) {
|
|
//
|
|
// This is a signal that we should use the exe name.
|
|
//
|
|
szMatchFile = pContext->szName;
|
|
MatchFileLen = NameLen;
|
|
hFileHandle = pContext->hMainFile;
|
|
pImageBase = pContext->pImageBase;
|
|
dwImageSize = pContext->dwImageSize;
|
|
|
|
} else {
|
|
|
|
szMatchFile = szTemp;
|
|
MatchFileLen = (LONG)_tcslen(szMatchFile);
|
|
hFileHandle = INVALID_HANDLE_VALUE;
|
|
pImageBase = NULL;
|
|
}
|
|
|
|
//
|
|
// When searching for files, we look in all process' exe directories,
|
|
// starting with the current process and working backwards through the process
|
|
// tree.
|
|
//
|
|
|
|
//
|
|
// See that the context is good...
|
|
//
|
|
if (!(pContext->dwFlags & SEARCHDBF_INITIALIZED)) {
|
|
|
|
if (!SdbpInitializeSearchDBContext(pContext)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"Failed to initialize SEARCHDBCONTEXT.\n"));
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
pSearchPath = pContext->pSearchParts;
|
|
|
|
assert(pSearchPath != NULL);
|
|
|
|
for (i = 0; i < (LONG)pSearchPath->PartCount && NULL == pFileInfo; ++i) {
|
|
|
|
pSearchPathPart = &pSearchPath->Parts[i];
|
|
|
|
//
|
|
// There are two ways to specify a matching file: A relative path
|
|
// from the EXE, or an absolute path. To specify an absolute path,
|
|
// an environment variable (like "%systemroot%") must be used
|
|
// as the base of the path. Therefore, we check for the first character
|
|
// of the matching file to be % and if so, we assume that it is an
|
|
// absolute path.
|
|
//
|
|
#ifndef KERNEL_MODE
|
|
if (szMatchFile[0] == TEXT('%')) {
|
|
|
|
//
|
|
// Too bad there isn't a %system32% enviorment variable so we add an
|
|
// internal variable called %system32% that you can use to specify
|
|
// the system32 directory at the beginning of an absolute path.
|
|
//
|
|
if (_tcsnicmp(szMatchFile, TEXT("%system32%"), SYSTEM32_VAR_LEN) == 0) {
|
|
|
|
PSDBCONTEXT pSdbContext = (PSDBCONTEXT)hSDB;
|
|
DWORD dwPathInSystem32 = MatchFileLen + SYSTEM32_VAR_VALUE_LEN - SYSTEM32_VAR_LEN;
|
|
|
|
szPathInSystem32 = SdbAlloc((dwPathInSystem32 + 1) * sizeof(TCHAR));
|
|
|
|
if (!szPathInSystem32) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"Unable to allocate memory for path in %system32%.\n"));
|
|
goto out;
|
|
}
|
|
|
|
//
|
|
// Subsitute %system32% with %systemroot%\system32 or %systemroot%\syswow64.
|
|
//
|
|
if (pSdbContext->dwRuntimePlatform == PROCESSOR_ARCHITECTURE_IA32_ON_WIN64) {
|
|
StringCchCopy(szPathInSystem32, dwPathInSystem32 + 1, SYSTEM32_VAR_VALUE_IA3264);
|
|
} else {
|
|
StringCchCopy(szPathInSystem32, dwPathInSystem32 + 1, SYSTEM32_VAR_VALUE_NOT_IA3264);
|
|
}
|
|
|
|
StringCchCat(szPathInSystem32, dwPathInSystem32 + 1, szMatchFile + SYSTEM32_VAR_LEN);
|
|
|
|
szMatchFile = szPathInSystem32;
|
|
}
|
|
|
|
//
|
|
// Absolute path. Contains environment variables, get expanded size.
|
|
//
|
|
nFullPathReqBufSize = SdbExpandEnvironmentStrings(szMatchFile, NULL, 0);
|
|
|
|
} else
|
|
#endif // KERNEL_MODE
|
|
{
|
|
//
|
|
// Relative path. Determine size of full path.
|
|
//
|
|
nFullPathReqBufSize = (pSearchPathPart->PartLength + MatchFileLen + 1) * sizeof(TCHAR);
|
|
}
|
|
|
|
if (nFullPathBufSize < nFullPathReqBufSize) {
|
|
//
|
|
// Need to realloc the buffer.
|
|
//
|
|
if (szFullPath == NULL) {
|
|
nFullPathBufSize = _MAX_PATH * sizeof(TCHAR);
|
|
|
|
if (nFullPathReqBufSize >= nFullPathBufSize) {
|
|
nFullPathBufSize = nFullPathReqBufSize + EXTRA_BUF_SPACE;
|
|
}
|
|
} else {
|
|
STACK_FREE(szFullPath);
|
|
nFullPathBufSize = nFullPathReqBufSize + EXTRA_BUF_SPACE;
|
|
}
|
|
|
|
STACK_ALLOC(szFullPath, nFullPathBufSize);
|
|
}
|
|
|
|
if (szFullPath == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"Failed to allocate %d bytes for FullPath.\n",
|
|
nFullPathBufSize));
|
|
goto out;
|
|
}
|
|
|
|
#ifndef KERNEL_MODE
|
|
if (szMatchFile[0] == TEXT('%')) {
|
|
//
|
|
// Absolute Path. Path contains environment variables, expand it.
|
|
//
|
|
if (!SdbExpandEnvironmentStrings(szMatchFile, szFullPath, nFullPathBufSize)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"SdbExpandEnvironmentStrings failed to expand strings for %s.\n",
|
|
szMatchFile));
|
|
goto out;
|
|
}
|
|
|
|
} else
|
|
#endif // KERNEL_MODE
|
|
{
|
|
//
|
|
// Relative path. Concatenate EXE directory with specified relative path.
|
|
//
|
|
RtlMoveMemory(szFullPath,
|
|
pSearchPathPart->pszPart,
|
|
pSearchPathPart->PartLength * sizeof(TCHAR));
|
|
|
|
RtlMoveMemory(szFullPath + pSearchPathPart->PartLength,
|
|
szMatchFile,
|
|
(MatchFileLen + 1) * sizeof(TCHAR));
|
|
}
|
|
|
|
pFileInfo = SdbGetFileInfo(hSDB,
|
|
szFullPath,
|
|
hFileHandle,
|
|
pImageBase,
|
|
dwImageSize, // this will be set ONLY if pImageBase != NULL
|
|
bDisableAttributeCache);
|
|
|
|
//
|
|
// This is not a bug, attributes are cleaned up when the database
|
|
// context is released.
|
|
//
|
|
}
|
|
|
|
if (pFileInfo == NULL && !bMatchLogicNot) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpCheckForMatch",
|
|
"Matching file \"%s\" not found.\n",
|
|
szMatchFile));
|
|
goto out;
|
|
}
|
|
|
|
if (szPathInSystem32) {
|
|
SdbFree(szPathInSystem32);
|
|
szPathInSystem32 = NULL;
|
|
}
|
|
|
|
//
|
|
// Create and store a new FILEINFOITEM on the stack
|
|
//
|
|
STACK_ALLOC(pFileInfoItem, sizeof(*pFileInfoItem));
|
|
|
|
if (pFileInfoItem == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckForMatch",
|
|
"Failed to allocate %d bytes for FILEINFOITEM\n",
|
|
sizeof(*pFileInfoItem)));
|
|
goto out;
|
|
}
|
|
|
|
pFileInfoItem->pFileInfo = pFileInfo;
|
|
pFileInfoItem->tiMatch = tiMatch;
|
|
pFileInfoItem->pNextItem = pFileInfoItemList;
|
|
pFileInfoItemList = pFileInfoItem;
|
|
|
|
//
|
|
// We have the matching file.
|
|
// Remember where it is for the second pass when we check all the file attributes.
|
|
//
|
|
tiMatch = SdbFindNextTag(pdb, tiExe, tiMatch);
|
|
|
|
//
|
|
// Reset the file matching. we don't touch this file again for now, it's info
|
|
// is safely linked in pFileInfoItemList
|
|
//
|
|
pFileInfo = NULL;
|
|
}
|
|
|
|
//
|
|
// We are still here. That means all the matching files have been found.
|
|
// Check all the other attributes using fileinfoitemlist information.
|
|
//
|
|
|
|
pFileInfoItem = pFileInfoItemList;
|
|
|
|
while (pFileInfoItem != NULL) {
|
|
|
|
tiMatchLogicNot = SdbFindFirstTag(pdb, pFileInfoItem->tiMatch, TAG_MATCH_LOGIC_NOT);
|
|
bMatchLogicNot = (tiMatchLogicNot != TAGID_NULL);
|
|
|
|
if (pFileInfoItem->pFileInfo != NULL) {
|
|
bAllAttributesMatch = SdbpCheckAllAttributes(hSDB,
|
|
pdb,
|
|
pFileInfoItem->tiMatch,
|
|
pFileInfoItem->pFileInfo);
|
|
} else {
|
|
bAllAttributesMatch = FALSE;
|
|
}
|
|
|
|
if (bAllAttributesMatch && bMatchLogicNot) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpCheckForMatch",
|
|
"All attributes match, but LOGIC=\"NOT\" was used which negates the match.\n"));
|
|
goto out;
|
|
}
|
|
|
|
if (!bAllAttributesMatch && !bMatchLogicNot) {
|
|
//
|
|
// Debug output happened inside SdbpCheckAllAttributes, no
|
|
// need for further spew here.
|
|
//
|
|
goto out;
|
|
}
|
|
|
|
//
|
|
// Advance to the next item.
|
|
//
|
|
pFileInfoItem = pFileInfoItem->pNextItem;
|
|
}
|
|
|
|
//
|
|
// It's a match! get the match mode
|
|
//
|
|
if (pMatchMode) {
|
|
|
|
//
|
|
// Important: depending on a particular database, we may use a different mode if
|
|
// there is match mode tag
|
|
//
|
|
// For Custom DB: default is the all-additive mode
|
|
// For Main DB: default is normal mode
|
|
//
|
|
|
|
#ifndef KERNEL_MODE
|
|
wDefaultMatchMode = SdbpIsMainPDB(hSDB, pdb) ? MATCHMODE_DEFAULT_MAIN :
|
|
MATCHMODE_DEFAULT_CUSTOM;
|
|
#else // KERNEL_MODE
|
|
wDefaultMatchMode = MATCHMODE_DEFAULT_MAIN;
|
|
#endif // KERNEL_MODE
|
|
|
|
tiTemp = SdbFindFirstTag(pdb, tiExe, TAG_MATCH_MODE);
|
|
|
|
if (tiTemp) {
|
|
pMatchMode->dwMatchMode = SdbReadWORDTag(pdb, tiTemp, wDefaultMatchMode);
|
|
} else {
|
|
pMatchMode->dwMatchMode = wDefaultMatchMode;
|
|
}
|
|
}
|
|
|
|
bReturn = TRUE;
|
|
|
|
out:
|
|
|
|
if (szPathInSystem32) {
|
|
SdbFree(szPathInSystem32);
|
|
szPathInSystem32 = NULL;
|
|
}
|
|
|
|
pFileInfoItem = pFileInfoItemList;
|
|
|
|
while (pFileInfoItem != NULL) {
|
|
|
|
pFileInfoItemNext = pFileInfoItem->pNextItem;
|
|
|
|
if (pFileInfoItem->pFileInfo != NULL && bDisableAttributeCache) {
|
|
SdbFreeFileInfo(pFileInfoItem->pFileInfo);
|
|
}
|
|
|
|
STACK_FREE(pFileInfoItem);
|
|
pFileInfoItem = pFileInfoItemNext;
|
|
}
|
|
|
|
if (szFullPath != NULL) {
|
|
STACK_FREE(szFullPath);
|
|
}
|
|
|
|
if (bReturn) {
|
|
//
|
|
// One last matching criteria: verify the entry is not disabled.
|
|
//
|
|
bReturn = SdbpIsExeEntryEnabled(pdb, tiExe, pGUID, pdwFlags);
|
|
}
|
|
|
|
return bReturn;
|
|
}
|
|
|
|
typedef enum _ADDITIVE_MODE {
|
|
AM_NORMAL,
|
|
AM_ADDITIVE_ONLY,
|
|
AM_NO_ADDITIVE
|
|
} ADDITIVE_MODE, *PADDITIVE_MODE;
|
|
|
|
LPCTSTR
|
|
SdbpFormatMatchModeType(
|
|
DWORD dwMatchMode
|
|
)
|
|
{
|
|
LPCTSTR pszMatchMode;
|
|
|
|
switch (dwMatchMode) {
|
|
|
|
case MATCH_ADDITIVE:
|
|
pszMatchMode = _T("Additive");
|
|
break;
|
|
|
|
case MATCH_EXCLUSIVE:
|
|
pszMatchMode = _T("Exclusive");
|
|
break;
|
|
|
|
case MATCH_NORMAL:
|
|
pszMatchMode = _T("Normal");
|
|
break;
|
|
|
|
default:
|
|
pszMatchMode = _T("Unknown");
|
|
break;
|
|
}
|
|
|
|
return pszMatchMode;
|
|
}
|
|
|
|
LPCTSTR
|
|
SdbpFormatMatchMode(
|
|
PMATCHMODE pMatchMode
|
|
)
|
|
{
|
|
static TCHAR szMatchMode[MAX_PATH];
|
|
|
|
LPTSTR pszMatchMode = szMatchMode;
|
|
int nChars = CHARCOUNT(szMatchMode);
|
|
|
|
StringCchPrintf(pszMatchMode,
|
|
nChars,
|
|
_T("0x%.2x%.2x [Mode: %s"),
|
|
pMatchMode->Flags,
|
|
pMatchMode->Type,
|
|
SdbpFormatMatchModeType(pMatchMode->Type));
|
|
|
|
return szMatchMode;
|
|
}
|
|
|
|
/*++
|
|
SdbpCheckExe
|
|
|
|
Checks a particular instance of an application in an SDB against for a match
|
|
Information on the file is passed through pContext parameter
|
|
|
|
result is returned in ptiExes
|
|
|
|
--*/
|
|
|
|
BOOL
|
|
SdbpCheckExe(
|
|
IN HSDB hSDB, //
|
|
IN PDB pdb, //
|
|
IN TAGID tiExe, // tag for an exe in the database
|
|
IN OUT PDWORD pdwNumExes, // returns (and passes in) the number of accumulated exe matches
|
|
IN OUT PSEARCHDBCONTEXT pContext, // information about the file which we match against
|
|
IN ADDITIVE_MODE eMode, // target Match mode, we filter entries based on this parameter
|
|
IN BOOL bDebug, // debug flag
|
|
OUT PMATCHMODE pMatchMode, // returns match mode used if success
|
|
OUT TAGID* ptiExes, // returns another entry in array of matched exes
|
|
OUT GUID* pGUID, // matched exe id
|
|
OUT DWORD* pdwFlags // matched exe flags
|
|
)
|
|
{
|
|
BOOL bSuccess = FALSE;
|
|
TAGID tiAppName = TAGID_NULL;
|
|
LPTSTR szAppName = NULL;
|
|
LPCTSTR pszMatchMode = NULL;
|
|
MATCHMODE MatchMode;
|
|
#ifndef KERNEL_MODE
|
|
TAGID tiRuntimePlatform;
|
|
DWORD dwRuntimePlatform;
|
|
TAGID tiOSSKU;
|
|
DWORD dwOSSKU;
|
|
TAGID tiSP;
|
|
DWORD dwSPMask;
|
|
#endif
|
|
|
|
//
|
|
// For debug purposes we'd like to know the name of the app, which
|
|
// is more useful when the exe name is, say, AUTORUN.EXE or SETUP.EXE
|
|
//
|
|
tiAppName = SdbFindFirstTag(pdb, tiExe, TAG_APP_NAME);
|
|
|
|
if (tiAppName != TAGID_NULL) {
|
|
szAppName = SdbGetStringTagPtr(pdb, tiAppName);
|
|
}
|
|
|
|
MatchMode.dwMatchMode = MATCHMODE_DEFAULT_MAIN;
|
|
|
|
DBGPRINT((sdlInfo, "SdbpCheckExe", "---------\n"));
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpCheckExe",
|
|
"Index entry found for App: \"%s\" Exe: \"%s\"\n",
|
|
szAppName,
|
|
pContext->szName));
|
|
|
|
#ifndef KERNEL_MODE
|
|
|
|
//
|
|
// Check whether this exe is good for this platform first.
|
|
//
|
|
tiRuntimePlatform = SdbFindFirstTag(pdb, tiExe, TAG_RUNTIME_PLATFORM);
|
|
|
|
if (tiRuntimePlatform) {
|
|
dwRuntimePlatform = SdbReadDWORDTag(pdb, tiRuntimePlatform, RUNTIME_PLATFORM_ANY);
|
|
|
|
//
|
|
// Check for the platform match
|
|
//
|
|
if (!SdbpCheckRuntimePlatform(hSDB, szAppName, dwRuntimePlatform)) {
|
|
//
|
|
// Not the right platform. Debug spew would have occured in SdbpCheckRuntimePlatform
|
|
//
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
tiOSSKU = SdbFindFirstTag(pdb, tiExe, TAG_OS_SKU);
|
|
|
|
if (tiOSSKU) {
|
|
|
|
dwOSSKU = SdbReadDWORDTag(pdb, tiOSSKU, OS_SKU_ALL);
|
|
|
|
if (dwOSSKU != OS_SKU_ALL) {
|
|
|
|
PSDBCONTEXT pDBContext = (PSDBCONTEXT)hSDB;
|
|
|
|
//
|
|
// Check for the OS SKU match
|
|
//
|
|
if (!(dwOSSKU & pDBContext->dwOSSKU)) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpCheckExe",
|
|
"OS SKU Mismatch for \"%s\" Database(0x%lx) vs 0x%lx\n",
|
|
(szAppName ? szAppName : TEXT("Unknown")),
|
|
dwOSSKU,
|
|
pDBContext->dwOSSKU));
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
|
|
tiSP = SdbFindFirstTag(pdb, tiExe, TAG_OS_SERVICE_PACK);
|
|
|
|
if (tiSP) {
|
|
dwSPMask = SdbReadDWORDTag(pdb, tiSP, 0xFFFFFFFF);
|
|
|
|
if (dwSPMask != 0xFFFFFFFF) {
|
|
|
|
PSDBCONTEXT pDBContext = (PSDBCONTEXT)hSDB;
|
|
|
|
//
|
|
// Check for the OS SKU match
|
|
//
|
|
if (!(dwSPMask & pDBContext->dwSPMask)) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpCheckExe",
|
|
"OS SP Mismatch for \"%s\" Database(0x%lx) vs 0x%lx\n",
|
|
(szAppName ? szAppName : TEXT("Unknown")),
|
|
dwSPMask,
|
|
pDBContext->dwSPMask));
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
#endif // KERNEL_MODE
|
|
|
|
if (!SdbpCheckForMatch(hSDB, pdb, tiExe, pContext, &MatchMode, pGUID, pdwFlags)) {
|
|
goto out;
|
|
}
|
|
|
|
if (eMode == AM_ADDITIVE_ONLY && MatchMode.Type != MATCH_ADDITIVE) {
|
|
goto out;
|
|
}
|
|
|
|
if (eMode == AM_NO_ADDITIVE && MatchMode.Type == MATCH_ADDITIVE) {
|
|
goto out;
|
|
}
|
|
|
|
pszMatchMode = SdbpFormatMatchMode(&MatchMode);
|
|
|
|
//
|
|
// If we're in debug mode, don't actually put the ones we find on the
|
|
// list, just put up an error.
|
|
//
|
|
if (bDebug) {
|
|
|
|
//
|
|
// We are in debug mode, do not add the match
|
|
//
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckExe",
|
|
"-----------------------------------------------------\n"));
|
|
|
|
DBGPRINT((sdlError|sdlLogShimViewer,
|
|
"SdbpCheckExe",
|
|
"!!!! Multiple matches! App: '%s', Exe: '%s', Mode: %s\n",
|
|
hSDB, // so that the pipe would use hPipe if needed
|
|
szAppName,
|
|
pContext->szName,
|
|
pszMatchMode));
|
|
|
|
DBGPRINT((sdlError,
|
|
"SdbpCheckExe",
|
|
"-----------------------------------------------------\n"));
|
|
|
|
} else {
|
|
|
|
DBGPRINT((sdlWarning|sdlLogShimViewer,
|
|
"SdbpCheckExe",
|
|
"++++ Successful match for App: '%s', Exe: '%s', Mode: %s\n",
|
|
hSDB,
|
|
szAppName,
|
|
pContext->szName,
|
|
pszMatchMode));
|
|
|
|
//
|
|
// If this is an exclusive match, kill anything we've found up to now
|
|
//
|
|
if (MatchMode.Type == MATCH_EXCLUSIVE) {
|
|
RtlZeroMemory(ptiExes, sizeof(TAGID) * SDB_MAX_EXES);
|
|
*pdwNumExes = 0;
|
|
}
|
|
|
|
//
|
|
// Save this match on the list
|
|
//
|
|
ptiExes[*pdwNumExes] = tiExe;
|
|
(*pdwNumExes)++;
|
|
|
|
bSuccess = TRUE;
|
|
}
|
|
|
|
out:
|
|
//
|
|
// In case of success, return match mode information
|
|
//
|
|
|
|
if (bSuccess && pMatchMode != NULL) {
|
|
pMatchMode->dwMatchMode = MatchMode.dwMatchMode;
|
|
}
|
|
|
|
return bSuccess;
|
|
}
|
|
|
|
|
|
DWORD
|
|
SdbpSearchDB(
|
|
IN HSDB hSDB,
|
|
IN PDB pdb, // pdb to search in
|
|
IN TAG tiSearchTag, // OPTIONAL - target tag (TAG_EXE or TAG_APPHELP_EXE)
|
|
IN PSEARCHDBCONTEXT pContext,
|
|
OUT TAGID* ptiExes, // caller needs to provide array of size SDB_MAX_EXES
|
|
OUT GUID* pLastExeGUID,
|
|
OUT DWORD* pLastExeFlags,
|
|
OUT PMATCHMODE pMatchMode // reason why we stopped scanning
|
|
)
|
|
/*++
|
|
Return: TAGID of found EXE record, TAGID_NULL if not found.
|
|
|
|
Desc: This function searches a given shimDB for any EXEs with the given filename.
|
|
If it finds one, it checks all the MATCHING_FILE records by
|
|
calling SdbpCheckForMatch.
|
|
If any EXEs are found, the number of EXEs found is returned in ptiExes.
|
|
If not, it returns 0.
|
|
|
|
when we get the matching mode out of the particular exe -- it is checked
|
|
to see whether we need to continue and then this matching mode is returned
|
|
|
|
It will never return more than SDB_MAX_EXES EXE entries.
|
|
|
|
Debug Output is controlled by three factors
|
|
-- a global one (controlled via the ifdef DBG), TRUE on checked builds
|
|
-- a pipe handle in hSDB which is activated when we init the context
|
|
-- a local variable that is set when we are in one of the conditions above
|
|
when the variable bDebug is set -- we do not actually store the matches
|
|
|
|
--*/
|
|
{
|
|
TAGID tiDatabase, tiExe;
|
|
FIND_INFO FindInfo;
|
|
TAGID tiAppName = TAGID_NULL;
|
|
TCHAR* szAppName = _T("(unknown)");
|
|
BOOL bUsingIndex = FALSE;
|
|
DWORD dwNumExes = 0;
|
|
DWORD i;
|
|
BOOL bDebug = FALSE;
|
|
BOOL bMultiple = FALSE;
|
|
BOOL bSuccess = FALSE;
|
|
MATCHMODE MatchMode; // internal match mode
|
|
MATCHMODE MatchModeExe;
|
|
|
|
tiDatabase = TAGID_NULL;
|
|
|
|
#ifndef KERNEL_MODE
|
|
|
|
if (pMatchMode) {
|
|
MatchMode.dwMatchMode = pMatchMode->dwMatchMode;
|
|
} else {
|
|
MatchMode.dwMatchMode = SdbpIsMainPDB(hSDB, pdb) ? MATCHMODE_DEFAULT_MAIN :
|
|
MATCHMODE_DEFAULT_CUSTOM;
|
|
}
|
|
#else // KERNEL_MODE
|
|
|
|
MatchMode.dwMatchMode = MATCHMODE_DEFAULT_MAIN;
|
|
|
|
#endif
|
|
|
|
if (!tiSearchTag) {
|
|
tiSearchTag = TAG_EXE;
|
|
}
|
|
|
|
//
|
|
// ADDITIVE MATCHES -- wildcards
|
|
//
|
|
if (tiSearchTag == TAG_EXE && SdbIsIndexAvailable(pdb, TAG_EXE, TAG_WILDCARD_NAME)) {
|
|
|
|
tiExe = SdbpFindFirstIndexedWildCardTag(pdb,
|
|
TAG_EXE,
|
|
TAG_WILDCARD_NAME,
|
|
pContext->szName,
|
|
&FindInfo);
|
|
|
|
while (tiExe != TAGID_NULL) {
|
|
|
|
bSuccess = SdbpCheckExe(hSDB,
|
|
pdb,
|
|
tiExe,
|
|
&dwNumExes,
|
|
pContext,
|
|
AM_ADDITIVE_ONLY, // match mode we request for this db
|
|
bDebug,
|
|
&MatchModeExe, // this is the matched tag from the db
|
|
ptiExes,
|
|
pLastExeGUID,
|
|
pLastExeFlags);
|
|
|
|
if (bSuccess) {
|
|
|
|
if (bDebug) {
|
|
bMultiple = TRUE; // if bDebug is set -- we already seen a match
|
|
} else {
|
|
|
|
//
|
|
// We got a match, update the state and make decision on whether to continue
|
|
//
|
|
MatchMode = MatchModeExe;
|
|
|
|
if (MatchModeExe.Type != MATCH_ADDITIVE) {
|
|
bDebug = (g_bDBG || SDBCONTEXT_IS_INSTRUMENTED(hSDB));
|
|
if (!bDebug) {
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
tiExe = SdbpFindNextIndexedWildCardTag(pdb, &FindInfo);
|
|
}
|
|
}
|
|
|
|
//
|
|
// Normal EXEs
|
|
//
|
|
bUsingIndex = SdbIsIndexAvailable(pdb, tiSearchTag, TAG_NAME);
|
|
|
|
if (bUsingIndex) {
|
|
|
|
//
|
|
// Look in the index.
|
|
//
|
|
tiExe = SdbFindFirstStringIndexedTag(pdb,
|
|
tiSearchTag,
|
|
TAG_NAME,
|
|
pContext->szName,
|
|
&FindInfo);
|
|
|
|
if (tiExe == TAGID_NULL) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpSearchDB",
|
|
"SdbFindFirstStringIndexedTag failed to locate exe: \"%s\".\n",
|
|
pContext->szName));
|
|
}
|
|
|
|
} else {
|
|
|
|
//
|
|
// Searching without an index...
|
|
//
|
|
DBGPRINT((sdlInfo, "SdbpSearchDB", "Searching database with no index.\n"));
|
|
|
|
//
|
|
// First get the DATABASE
|
|
//
|
|
tiDatabase = SdbFindFirstTag(pdb, TAGID_ROOT, TAG_DATABASE);
|
|
|
|
if (tiDatabase != TAGID_NULL) {
|
|
DBGPRINT((sdlError, "SdbpSearchDB", "No DATABASE tag found.\n"));
|
|
goto out;
|
|
}
|
|
|
|
//
|
|
// Then get the first EXE.
|
|
//
|
|
tiExe = SdbFindFirstNamedTag(pdb, tiDatabase, tiSearchTag, TAG_NAME, pContext->szName);
|
|
}
|
|
|
|
while (tiExe != TAGID_NULL) {
|
|
|
|
bSuccess = SdbpCheckExe(hSDB,
|
|
pdb,
|
|
tiExe,
|
|
&dwNumExes,
|
|
pContext,
|
|
AM_NORMAL,
|
|
bDebug,
|
|
&MatchModeExe,
|
|
ptiExes,
|
|
pLastExeGUID,
|
|
pLastExeFlags);
|
|
|
|
if (bSuccess) {
|
|
|
|
if (bDebug) {
|
|
|
|
bMultiple = TRUE; // if bDebug is set -- we already seen a match
|
|
|
|
} else {
|
|
|
|
//
|
|
// We got a match, update the state and make decision on whether to continue
|
|
// if we're not additive, we may go into debug mode
|
|
//
|
|
MatchMode = MatchModeExe;
|
|
|
|
if (MatchModeExe.Type != MATCH_ADDITIVE) {
|
|
bDebug = (g_bDBG || SDBCONTEXT_IS_INSTRUMENTED(hSDB));
|
|
if (!bDebug) {
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (bUsingIndex) {
|
|
tiExe = SdbFindNextStringIndexedTag(pdb, &FindInfo);
|
|
} else {
|
|
tiExe = SdbpFindNextNamedTag(pdb, tiDatabase, tiExe, TAG_NAME, pContext->szName);
|
|
}
|
|
}
|
|
|
|
#ifndef KERNEL_MODE
|
|
//
|
|
// Now we search by module name, if one is available
|
|
// this case falls into 16-bit flags category
|
|
//
|
|
if (tiSearchTag == TAG_EXE && pContext->szModuleName) {
|
|
|
|
bUsingIndex = SdbIsIndexAvailable(pdb, tiSearchTag, TAG_16BIT_MODULE_NAME);
|
|
|
|
if (bUsingIndex) {
|
|
|
|
//
|
|
// Look in the index.
|
|
//
|
|
tiExe = SdbFindFirstStringIndexedTag(pdb,
|
|
tiSearchTag,
|
|
TAG_16BIT_MODULE_NAME,
|
|
pContext->szModuleName,
|
|
&FindInfo);
|
|
|
|
if (tiExe == TAGID_NULL) {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbpSearchDB",
|
|
"SdbFindFirstStringIndexedTag failed to locate exe (MODNAME): \"%s\".\n",
|
|
pContext->szModuleName));
|
|
}
|
|
|
|
} else {
|
|
|
|
//
|
|
// Searching without an index...
|
|
//
|
|
DBGPRINT((sdlInfo, "SdbpSearchDB", "Searching database with no index.\n"));
|
|
|
|
//
|
|
// First get the DATABASE
|
|
//
|
|
tiDatabase = SdbFindFirstTag(pdb, TAGID_ROOT, TAG_DATABASE);
|
|
|
|
if (tiDatabase != TAGID_NULL) {
|
|
DBGPRINT((sdlError, "SdbpSearchDB", "No DATABASE tag found.\n"));
|
|
goto out;
|
|
}
|
|
|
|
//
|
|
// Then get the first EXE.
|
|
//
|
|
tiExe = SdbFindFirstNamedTag(pdb,
|
|
tiDatabase,
|
|
tiSearchTag,
|
|
TAG_16BIT_MODULE_NAME,
|
|
pContext->szModuleName);
|
|
}
|
|
|
|
while (tiExe != TAGID_NULL) {
|
|
|
|
bSuccess = SdbpCheckExe(hSDB,
|
|
pdb,
|
|
tiExe,
|
|
&dwNumExes,
|
|
pContext,
|
|
AM_NORMAL,
|
|
bDebug,
|
|
&MatchModeExe,
|
|
ptiExes,
|
|
pLastExeGUID,
|
|
pLastExeFlags);
|
|
|
|
if (bSuccess) {
|
|
if (bDebug) {
|
|
bMultiple = TRUE; // if bDebug is set -- we already seen a match
|
|
} else {
|
|
|
|
//
|
|
// We got a match, update the state and make decision on whether to continue
|
|
//
|
|
MatchMode = MatchModeExe;
|
|
|
|
if (MatchModeExe.Type != MATCH_ADDITIVE) {
|
|
bDebug = (g_bDBG || SDBCONTEXT_IS_INSTRUMENTED(hSDB));
|
|
if (!bDebug) {
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (bUsingIndex) {
|
|
tiExe = SdbFindNextStringIndexedTag(pdb, &FindInfo);
|
|
} else {
|
|
tiExe = SdbpFindNextNamedTag(pdb,
|
|
tiDatabase,
|
|
tiExe,
|
|
TAG_16BIT_MODULE_NAME,
|
|
pContext->szModuleName);
|
|
}
|
|
}
|
|
}
|
|
#endif // KERNEL_MODE
|
|
|
|
//
|
|
// Now check for wild-card non-additive exes.
|
|
//
|
|
if (tiSearchTag == TAG_EXE && SdbIsIndexAvailable(pdb, TAG_EXE, TAG_WILDCARD_NAME)) {
|
|
|
|
tiExe = SdbpFindFirstIndexedWildCardTag(pdb,
|
|
TAG_EXE,
|
|
TAG_WILDCARD_NAME,
|
|
pContext->szName,
|
|
&FindInfo);
|
|
|
|
while (tiExe != TAGID_NULL) {
|
|
|
|
bSuccess = SdbpCheckExe(hSDB,
|
|
pdb,
|
|
tiExe,
|
|
&dwNumExes,
|
|
pContext,
|
|
AM_NO_ADDITIVE,
|
|
bDebug,
|
|
&MatchModeExe,
|
|
ptiExes,
|
|
pLastExeGUID,
|
|
pLastExeFlags);
|
|
|
|
if (bSuccess) {
|
|
|
|
if (bDebug) {
|
|
bMultiple = TRUE; // if bDebug is set -- we already seen a match
|
|
} else {
|
|
|
|
//
|
|
// we got a match, update the state and make decision on whether to continue
|
|
//
|
|
MatchMode = MatchModeExe;
|
|
|
|
if (MatchModeExe.Type != MATCH_ADDITIVE) {
|
|
bDebug = (g_bDBG || SDBCONTEXT_IS_INSTRUMENTED(hSDB));
|
|
if (!bDebug) {
|
|
goto out;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
tiExe = SdbpFindNextIndexedWildCardTag(pdb, &FindInfo);
|
|
}
|
|
}
|
|
|
|
out:
|
|
//
|
|
// Now report the final resolution of the match.
|
|
//
|
|
for (i = 0; i < dwNumExes; ++i) {
|
|
|
|
tiAppName = SdbFindFirstTag(pdb, ptiExes[i], TAG_APP_NAME);
|
|
|
|
if (tiAppName != TAGID_NULL) {
|
|
szAppName = SdbGetStringTagPtr(pdb, tiAppName);
|
|
} else {
|
|
szAppName = _T("(Unknown)");
|
|
}
|
|
|
|
DBGPRINT((sdlWarning,
|
|
"SdbpSearchDB",
|
|
"--------------------------------------------------------\n"));
|
|
|
|
DBGPRINT((sdlWarning|sdlLogShimViewer,
|
|
"SdbpSearchDB",
|
|
"+ Final match is App: \"%s\", exe: \"%s\".\n",
|
|
hSDB,
|
|
szAppName,
|
|
pContext->szName));
|
|
|
|
DBGPRINT((sdlWarning,
|
|
"SdbpSearchDB",
|
|
"--------------------------------------------------------\n"));
|
|
}
|
|
|
|
if (bMultiple) {
|
|
DBGPRINT((sdlError,
|
|
"SdbpSearchDB",
|
|
"--------------------------------------------------------\n"));
|
|
|
|
DBGPRINT((sdlError|sdlLogShimViewer,
|
|
"SdbpSearchDB",
|
|
"!!!!!!! Multiple non-additive matches. !!!!!\n",
|
|
hSDB));
|
|
|
|
DBGPRINT((sdlError,
|
|
"SdbpSearchDB",
|
|
"--------------------------------------------------------\n"));
|
|
}
|
|
|
|
if (pMatchMode != NULL) {
|
|
pMatchMode->dwMatchMode = MatchMode.dwMatchMode;
|
|
}
|
|
|
|
return dwNumExes;
|
|
}
|
|
|
|
TAGREF
|
|
SdbGetDatabaseMatch(
|
|
IN HSDB hSDB,
|
|
IN LPCTSTR szPath,
|
|
IN HANDLE FileHandle OPTIONAL,
|
|
IN LPVOID pImageBase OPTIONAL,
|
|
IN DWORD dwImageSize OPTIONAL
|
|
)
|
|
/*++
|
|
Return: BUGBUG: ?
|
|
|
|
Desc: BUGBUG: ?
|
|
--*/
|
|
{
|
|
SEARCHDBCONTEXT Context;
|
|
PSDBCONTEXT pSdbContext = (PSDBCONTEXT)hSDB;
|
|
TAGID tiExe = TAGID_NULL;
|
|
TAGID atiExes[SDB_MAX_EXES];
|
|
TAGREF trExe = TAGREF_NULL;
|
|
DWORD dwNumExes = 0;
|
|
GUID guid;
|
|
DWORD dwFlags = 0;
|
|
|
|
assert(pSdbContext->pdbMain && szPath);
|
|
|
|
RtlZeroMemory(&Context, sizeof(Context)); // do this so that we don't trip later
|
|
RtlZeroMemory(atiExes, sizeof(atiExes));
|
|
|
|
Context.dwFlags |= (SEARCHDBF_NO_PROCESS_HISTORY | SEARCHDBF_NO_ATTRIBUTE_CACHE);
|
|
|
|
if (FileHandle != INVALID_HANDLE_VALUE || pImageBase != NULL) {
|
|
Context.dwFlags |= SEARCHDBF_NO_LFN;
|
|
}
|
|
|
|
Context.hMainFile = FileHandle; // used to optimize attribute retrieval
|
|
Context.pImageBase = pImageBase; // this will be used and not a file handle
|
|
Context.dwImageSize = dwImageSize; // size of the image
|
|
|
|
DBGPRINT((sdlInfo, "SdbGetDatabaseMatch", "Looking for \"%s\"\n", szPath));
|
|
|
|
//
|
|
// Create search db context, no process history needed.
|
|
//
|
|
if (!SdbpCreateSearchDBContext(&Context, szPath, NULL, NULL)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbGetDatabaseMatch",
|
|
"Failed to create search DB context.\n"));
|
|
goto out;
|
|
}
|
|
|
|
//
|
|
// We will be searching the main db
|
|
//
|
|
dwNumExes = SdbpSearchDB(pSdbContext,
|
|
pSdbContext->pdbMain,
|
|
TAG_EXE,
|
|
&Context,
|
|
atiExes,
|
|
&guid,
|
|
&dwFlags,
|
|
NULL);
|
|
//
|
|
// Convert to TAGREF
|
|
//
|
|
if (dwNumExes) {
|
|
|
|
//
|
|
// Always use the last exe in the list, as it will be the most specific
|
|
//
|
|
tiExe = atiExes[dwNumExes - 1];
|
|
|
|
if (!SdbTagIDToTagRef(hSDB, pSdbContext->pdbMain, tiExe, &trExe)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbGetDatabaseMatch",
|
|
"Failed to convert tagid to tagref\n"));
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
out:
|
|
|
|
SdbpReleaseSearchDBContext(&Context);
|
|
|
|
return trExe;
|
|
}
|
|
|
|
|
|
DWORD
|
|
SdbQueryData(
|
|
IN HSDB hSDB, // database handle
|
|
IN TAGREF trExe, // tagref of the matching exe
|
|
IN LPCTSTR lpszDataName, // if this is null, will try to return all the policy names
|
|
OUT LPDWORD lpdwDataType, // pointer to data type (REG_SZ, REG_BINARY, etc)
|
|
OUT LPVOID lpBuffer, // buffer to fill with information
|
|
IN OUT LPDWORD lpdwBufferSize // pointer to buffer size
|
|
)
|
|
{
|
|
return SdbQueryDataEx(hSDB, trExe, lpszDataName, lpdwDataType, lpBuffer, lpdwBufferSize, NULL);
|
|
}
|
|
|
|
|
|
DWORD
|
|
SdbQueryDataExTagID(
|
|
IN PDB pdb, // database handle
|
|
IN TAGID tiExe, // tagref of the matching exe
|
|
IN LPCTSTR lpszDataName, // if this is null, will try to return all the policy names
|
|
OUT LPDWORD lpdwDataType, // pointer to data type (REG_SZ, REG_BINARY, etc)
|
|
OUT LPVOID lpBuffer, // buffer to fill with information
|
|
IN OUT LPDWORD lpcbBufferSize, // pointer to buffer size (in bytes)
|
|
OUT TAGID* ptiData // optional pointer to the retrieved data tag
|
|
)
|
|
/*++
|
|
Return: Error code or ERROR_SUCCESS if successful
|
|
|
|
Desc: See complete description with sample code
|
|
in doc subdirectory
|
|
--*/
|
|
{
|
|
TAGID tiData;
|
|
TAGID tiParent;
|
|
TAGID tiName;
|
|
TAGID tiValue;
|
|
TAGID tiValueType;
|
|
DWORD cbSize;
|
|
DWORD dwValueType;
|
|
LPCTSTR pszName;
|
|
LPTSTR pszNameBuffer = NULL;
|
|
LPTSTR pSlash;
|
|
LPTSTR pchBuffer;
|
|
DWORD dwData;
|
|
TAG tData;
|
|
ULONGLONG ullData;
|
|
LPVOID lpValue;
|
|
DWORD Status = ERROR_NOT_SUPPORTED; // have it initialized
|
|
int nLen;
|
|
int cchRemaining;
|
|
|
|
if (lpszDataName == NULL) {
|
|
|
|
if (lpcbBufferSize == NULL) {
|
|
Status = ERROR_INVALID_PARAMETER;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
cbSize = 0;
|
|
|
|
tiData = SdbFindFirstTag(pdb, tiExe, TAG_DATA);
|
|
if (!tiData) {
|
|
//
|
|
// Bad entry.
|
|
//
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x does not appear to have data\n",
|
|
tiExe));
|
|
|
|
Status = ERROR_INTERNAL_DB_CORRUPTION;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
while (tiData) {
|
|
|
|
//
|
|
// Pass one: Calculate the size needed.
|
|
//
|
|
tiName = SdbFindFirstTag(pdb, tiData, TAG_NAME);
|
|
|
|
if (!tiName) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x does not contain a name tag\n",
|
|
tiData));
|
|
Status = ERROR_INTERNAL_DB_CORRUPTION;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
pszName = SdbGetStringTagPtr(pdb, tiName);
|
|
|
|
if (!pszName) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x contains NULL name\n",
|
|
tiName));
|
|
Status = ERROR_INTERNAL_DB_CORRUPTION;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
cbSize += (DWORD)(_tcslen(pszName) + 1) * sizeof(*pszName);
|
|
|
|
tiData = SdbFindNextTag(pdb, tiExe, tiData);
|
|
}
|
|
|
|
cbSize += sizeof(*pszName); // for the final 0
|
|
|
|
//
|
|
// We are done, compare the size.
|
|
//
|
|
if (lpBuffer == NULL || *lpcbBufferSize < cbSize) {
|
|
*lpcbBufferSize = cbSize;
|
|
Status = ERROR_INSUFFICIENT_BUFFER;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// lpBuffer != NULL here and there is enough room
|
|
//
|
|
pchBuffer = (LPTSTR)lpBuffer;
|
|
|
|
tiData = SdbFindFirstTag(pdb, tiExe, TAG_DATA);
|
|
|
|
while (tiData) {
|
|
|
|
tiName = SdbFindFirstTag(pdb, tiData, TAG_NAME);
|
|
|
|
if (tiName) {
|
|
pszName = SdbGetStringTagPtr(pdb, tiName);
|
|
|
|
if (pszName) {
|
|
StringCchCopy(pchBuffer, *lpcbBufferSize / sizeof(TCHAR), pszName);
|
|
|
|
cchRemaining = (int)_tcslen(pchBuffer) + 1;
|
|
pchBuffer += cchRemaining;
|
|
*lpcbBufferSize -= (cchRemaining * sizeof(TCHAR));
|
|
}
|
|
}
|
|
|
|
tiData = SdbFindNextTag(pdb, tiExe, tiData);
|
|
}
|
|
|
|
//
|
|
// The buffer has been filled, terminate.
|
|
//
|
|
*pchBuffer++ = TEXT('\0');
|
|
|
|
//
|
|
// Save the size written to the buffer
|
|
//
|
|
*lpcbBufferSize = (DWORD)((ULONG_PTR)pchBuffer - (ULONG_PTR)lpBuffer);
|
|
|
|
//
|
|
// Save data type
|
|
//
|
|
if (lpdwDataType != NULL) {
|
|
*lpdwDataType = REG_MULTI_SZ;
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
//
|
|
// In this case we allow the query to proceed if
|
|
// the buffer is null and lpcbBufferSize is not null or lpBufferSize is not null
|
|
//
|
|
if (lpBuffer == NULL && lpcbBufferSize == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"One of lpBuffer or lpcbBufferSize should not be null\n"));
|
|
Status = ERROR_INVALID_PARAMETER;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// Expect the name to be in format "name1\name2..."
|
|
//
|
|
nLen = (int)_tcslen(lpszDataName) + 1;
|
|
STACK_ALLOC(pszNameBuffer, nLen * sizeof(*pszNameBuffer));
|
|
|
|
if (pszNameBuffer == NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"Cannot allocate temporary buffer for parsing the name \"%s\"\n",
|
|
lpszDataName));
|
|
Status = ERROR_NOT_ENOUGH_MEMORY;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
tiParent = tiExe;
|
|
tiData = TAGID_NULL;
|
|
|
|
do {
|
|
pSlash = _tcschr(lpszDataName, TEXT('\\'));
|
|
|
|
if (pSlash == NULL) {
|
|
StringCchCopy(pszNameBuffer, nLen, lpszDataName);
|
|
lpszDataName = NULL;
|
|
} else {
|
|
_tcsncpy(pszNameBuffer, lpszDataName, pSlash - lpszDataName);
|
|
pszNameBuffer[pSlash - lpszDataName] = TEXT('\0');
|
|
lpszDataName = pSlash + 1; // go to the next char
|
|
}
|
|
|
|
tiData = SdbFindFirstNamedTag(pdb, tiParent, TAG_DATA, TAG_NAME, pszNameBuffer);
|
|
tiParent = tiData;
|
|
|
|
} while (lpszDataName != NULL && *lpszDataName != TEXT('\0') && tiData != TAGID_NULL);
|
|
|
|
if (!tiData) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"The entry \"%s\" not found\n",
|
|
pszNameBuffer));
|
|
Status = ERROR_NOT_FOUND;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// Looks like we found the entry, query value type
|
|
//
|
|
dwValueType = REG_NONE;
|
|
|
|
tiValueType = SdbFindFirstTag(pdb, tiData, TAG_DATA_VALUETYPE);
|
|
|
|
if (!tiValueType) {
|
|
DBGPRINT((sdlWarning,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x does not have valuetype information\n",
|
|
tiData));
|
|
} else {
|
|
dwValueType = SdbReadDWORDTag(pdb, tiValueType, REG_NONE);
|
|
}
|
|
|
|
cbSize = 0;
|
|
lpValue = NULL;
|
|
|
|
if (dwValueType != REG_NONE) {
|
|
|
|
//
|
|
// Find data tag
|
|
//
|
|
cbSize = 0;
|
|
|
|
switch (dwValueType) {
|
|
|
|
case REG_SZ:
|
|
//
|
|
// string data
|
|
//
|
|
tData = TAG_DATA_STRING;
|
|
break;
|
|
|
|
case REG_DWORD:
|
|
tData = TAG_DATA_DWORD;
|
|
break;
|
|
|
|
case REG_QWORD:
|
|
tData = TAG_DATA_QWORD;
|
|
break;
|
|
|
|
case REG_BINARY:
|
|
tData = TAG_DATA_BITS;
|
|
break;
|
|
|
|
default:
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x contains bad valuetype information 0x%x\n",
|
|
tiData,
|
|
dwValueType));
|
|
Status = ERROR_INTERNAL_DB_CORRUPTION;
|
|
goto ErrHandle;
|
|
break;
|
|
}
|
|
|
|
tiValue = SdbFindFirstTag(pdb, tiData, tData);
|
|
|
|
//
|
|
// Find what the data size is if needed
|
|
//
|
|
if (!tiValue) {
|
|
|
|
DBGPRINT((sdlWarning,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x contains no value\n",
|
|
tiData));
|
|
Status = ERROR_NOT_FOUND;
|
|
goto ErrHandle;
|
|
|
|
}
|
|
|
|
//
|
|
// For those who have no size quite yet...
|
|
// (binary and a string)
|
|
//
|
|
switch (dwValueType) {
|
|
|
|
case REG_SZ:
|
|
pchBuffer = SdbGetStringTagPtr(pdb, tiValue);
|
|
|
|
if (pchBuffer == NULL) {
|
|
DBGPRINT((sdlWarning,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x contains bad string value 0x%x\n",
|
|
tiData,
|
|
tiValue));
|
|
Status = ERROR_NOT_FOUND;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
cbSize = (DWORD)(_tcslen(pchBuffer) + 1) * sizeof(*pchBuffer);
|
|
lpValue = (LPVOID)pchBuffer;
|
|
break;
|
|
|
|
case REG_BINARY:
|
|
cbSize = SdbGetTagDataSize(pdb, tiValue); // binary tag
|
|
lpValue = SdbpGetMappedTagData(pdb, tiValue);
|
|
|
|
if (lpValue == NULL) {
|
|
DBGPRINT((sdlWarning,
|
|
"SdbQueryDataExTagID",
|
|
"The entry 0x%x contains bad binary value 0x%x\n",
|
|
tiData,
|
|
tiValue));
|
|
Status = ERROR_NOT_FOUND;
|
|
goto ErrHandle;
|
|
}
|
|
break;
|
|
|
|
case REG_DWORD:
|
|
dwData = SdbReadDWORDTag(pdb, tiValue, 0);
|
|
cbSize = sizeof(dwData);
|
|
lpValue = (LPVOID)&dwData;
|
|
break;
|
|
|
|
case REG_QWORD:
|
|
ullData = SdbReadQWORDTag(pdb, tiValue, 0);
|
|
cbSize = sizeof(ullData);
|
|
lpValue = (LPVOID)&ullData;
|
|
break;
|
|
}
|
|
|
|
//
|
|
// At this point we have everything we need to get the pointer to data.
|
|
//
|
|
}
|
|
|
|
//
|
|
// Fix the output params and exit.
|
|
//
|
|
Status = ERROR_SUCCESS;
|
|
|
|
if (cbSize == 0) {
|
|
goto SkipCopy;
|
|
}
|
|
|
|
if (lpBuffer == NULL || (lpcbBufferSize != NULL && *lpcbBufferSize < cbSize)) {
|
|
Status = ERROR_INSUFFICIENT_BUFFER;
|
|
goto SkipCopy;
|
|
}
|
|
|
|
//
|
|
// Buffer size checked out, now if buffer exists -- copy
|
|
//
|
|
if (lpBuffer != NULL) {
|
|
RtlMoveMemory(lpBuffer, lpValue, cbSize);
|
|
}
|
|
|
|
SkipCopy:
|
|
|
|
if (lpcbBufferSize) {
|
|
*lpcbBufferSize = cbSize;
|
|
}
|
|
|
|
if (lpdwDataType) {
|
|
*lpdwDataType = dwValueType;
|
|
}
|
|
|
|
if (ptiData) {
|
|
*ptiData = tiData;
|
|
}
|
|
|
|
ErrHandle:
|
|
|
|
if (pszNameBuffer != NULL) {
|
|
STACK_FREE(pszNameBuffer);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
DWORD
|
|
SdbQueryDataEx(
|
|
IN HSDB hSDB, // database handle
|
|
IN TAGREF trExe, // tagref of the matching exe
|
|
IN LPCTSTR lpszDataName, // if this is null, will try to return all the policy names
|
|
OUT LPDWORD lpdwDataType, // pointer to data type (REG_SZ, REG_BINARY, etc)
|
|
OUT LPVOID lpBuffer, // buffer to fill with information
|
|
IN OUT LPDWORD lpdwBufferSize, // pointer to buffer size
|
|
OUT TAGREF* ptrData // optional pointer to the retrieved data tag
|
|
)
|
|
{
|
|
BOOL bSuccess;
|
|
PDB pdb = NULL;
|
|
TAGID tiExe = TAGID_NULL;
|
|
TAGID tiData = TAGID_NULL;
|
|
NTSTATUS Status;
|
|
|
|
bSuccess = SdbTagRefToTagID(hSDB, trExe, &pdb, &tiExe);
|
|
|
|
if (!bSuccess) {
|
|
DBGPRINT((sdlError,
|
|
"SdbQueryDataEx",
|
|
"Failed to convert tagref 0x%x to tagid\n",
|
|
trExe));
|
|
Status = ERROR_INVALID_PARAMETER;
|
|
goto ErrHandle;
|
|
}
|
|
|
|
Status = SdbQueryDataExTagID(pdb,
|
|
tiExe,
|
|
lpszDataName,
|
|
lpdwDataType,
|
|
lpBuffer,
|
|
lpdwBufferSize,
|
|
&tiData);
|
|
//
|
|
// See that we convert the output param
|
|
//
|
|
if (ptrData != NULL && NT_SUCCESS(Status)) {
|
|
if (!SdbTagIDToTagRef(hSDB, pdb, tiData, ptrData)) {
|
|
Status = ERROR_INVALID_DATA;
|
|
}
|
|
}
|
|
|
|
ErrHandle:
|
|
|
|
return Status;
|
|
}
|
|
|
|
BOOL
|
|
SdbReadEntryInformation(
|
|
IN HSDB hSDB,
|
|
IN TAGREF trExe,
|
|
OUT PSDBENTRYINFO pEntryInfo
|
|
)
|
|
/*++
|
|
Return: BUGBUG: ?
|
|
|
|
Desc: BUGBUG: ?
|
|
--*/
|
|
{
|
|
BOOL bSuccess = FALSE;
|
|
TAGID tiExe;
|
|
TAGID tiData;
|
|
TAGID tiExeID;
|
|
PDB pdb;
|
|
SDBENTRYINFO EntryInfo;
|
|
|
|
RtlZeroMemory(&EntryInfo, sizeof(EntryInfo));
|
|
|
|
bSuccess = SdbTagRefToTagID(hSDB, trExe, &pdb, &tiExe);
|
|
|
|
if (!bSuccess) {
|
|
DBGPRINT((sdlError,
|
|
"SdbReadEntryInformation",
|
|
"Failed to convert tagref 0x%x to tagid\n",
|
|
trExe));
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// Get the EXE's ID
|
|
//
|
|
tiExeID = SdbFindFirstTag(pdb, tiExe, TAG_EXE_ID);
|
|
|
|
if (tiExeID == TAGID_NULL) {
|
|
DBGPRINT((sdlError,
|
|
"SdbReadEntryInformation",
|
|
"Failed to read TAG_EXE_ID for tiExe 0x%x !\n",
|
|
tiExe));
|
|
goto ErrHandle;
|
|
}
|
|
|
|
bSuccess = SdbReadBinaryTag(pdb,
|
|
tiExeID,
|
|
(PBYTE)&EntryInfo.guidID,
|
|
sizeof(EntryInfo.guidID));
|
|
if (!bSuccess) {
|
|
DBGPRINT((sdlError,
|
|
"SdbReadEntryInformation",
|
|
"Failed to read GUID referenced by 0x%x\n",
|
|
tiExeID));
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// Get the database id
|
|
//
|
|
if (!SdbGetDatabaseID(pdb, &EntryInfo.guidDB)) {
|
|
DBGPRINT((sdlError,
|
|
"SdbReadEntryInformation",
|
|
"Failed to read GUID of the database\n"));
|
|
goto ErrHandle;
|
|
}
|
|
|
|
//
|
|
// Retrieve entry flags as referenced by the registry
|
|
//
|
|
if (!SdbGetEntryFlags(&EntryInfo.guidID, &EntryInfo.dwFlags)) {
|
|
DBGPRINT((sdlWarning,
|
|
"SdbReadEntryInformation",
|
|
"No flags for tiExe 0x%x\n",
|
|
tiExe));
|
|
|
|
EntryInfo.dwFlags = 0;
|
|
} else {
|
|
DBGPRINT((sdlInfo,
|
|
"SdbReadEntryInformation",
|
|
"Retrieved flags for this app 0x%x.\n",
|
|
EntryInfo.dwFlags));
|
|
}
|
|
|
|
//
|
|
// Read the data tags
|
|
//
|
|
tiData = SdbFindFirstTag(pdb, tiExe, TAG_DATA);
|
|
|
|
EntryInfo.tiData = tiData;
|
|
|
|
if (tiData == TAGID_NULL) {
|
|
//
|
|
// This is not a data entry
|
|
//
|
|
DBGPRINT((sdlWarning,
|
|
"SdbReadEntryInformation",
|
|
"Entry tiExe 0x%x does not contain TAG_DATA.\n",
|
|
tiExe));
|
|
}
|
|
|
|
if (pEntryInfo != NULL) {
|
|
RtlMoveMemory(pEntryInfo, &EntryInfo, sizeof(*pEntryInfo));
|
|
}
|
|
|
|
bSuccess = TRUE;
|
|
|
|
ErrHandle:
|
|
|
|
return bSuccess;
|
|
}
|
|
|
|
|
|
//
|
|
// We may be compiled UNICODE or ANSI
|
|
// If we are compiled UNICODE we need to use UNICODE sprintf and convert
|
|
// the result back to ANSI for output with DbgPrint. This is accomplished
|
|
// by %ls format in DbgPrint. Format and Function name are always passed
|
|
// in as ANSI though. TCHAR strings are formatted just with %s
|
|
//
|
|
|
|
void
|
|
PrepareFormatForUnicode(
|
|
PCH fmtUnicode,
|
|
PCH format,
|
|
DWORD cbSize // sizeof fmtUnicode (in bytes)
|
|
)
|
|
{
|
|
PCH pfmt;
|
|
CHAR ch;
|
|
size_t nch;
|
|
long width;
|
|
PCH pend;
|
|
|
|
StringCchCopyA(fmtUnicode, cbSize, format);
|
|
pfmt = fmtUnicode;
|
|
|
|
while('\0' != (ch = *pfmt++)) {
|
|
if (ch == '%') {
|
|
|
|
if (*pfmt == '%') {
|
|
continue;
|
|
}
|
|
|
|
//
|
|
// Skip the characters that relate to - + 0 ' ' #
|
|
//
|
|
nch = strspn(pfmt, "-+0 #");
|
|
pfmt += nch;
|
|
|
|
//
|
|
// Parse the width.
|
|
//
|
|
if (*pfmt == '*') {
|
|
//
|
|
// Parameter defines the width
|
|
//
|
|
++pfmt;
|
|
} else {
|
|
//
|
|
// See whether we have width
|
|
//
|
|
if (isdigit(*pfmt)) {
|
|
pend = NULL;
|
|
width = atol(pfmt);
|
|
|
|
while (isdigit(*pfmt)) {
|
|
++pfmt;
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now we can have: .precision
|
|
//
|
|
if (*pfmt == '.') {
|
|
++pfmt;
|
|
width = atol(pfmt);
|
|
|
|
while (isdigit(*pfmt)) {
|
|
++pfmt;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now is the format (one of: h, l, L, I64)
|
|
//
|
|
ch = *pfmt;
|
|
pend = strchr("hlLNFw", ch);
|
|
if (pend != NULL) {
|
|
++pfmt; // move past the modifier char
|
|
} else {
|
|
if (ch == 'I' && !strncpy(pfmt, "I64", 3)) {
|
|
pfmt += 3;
|
|
}
|
|
}
|
|
|
|
//
|
|
// We should have a type character here.
|
|
//
|
|
if (*pfmt == 's') {
|
|
//
|
|
// Convert to UPPER, making it UNICODE string with ansi vsnprintf
|
|
//
|
|
*pfmt = 'S';
|
|
}
|
|
|
|
//
|
|
// Move past the format char if we are not at the end
|
|
//
|
|
if (*pfmt != '\0') {
|
|
++pfmt;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|