You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2755 lines
78 KiB
2755 lines
78 KiB
/*++
|
|
|
|
Copyright (c) 1990 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
support.c
|
|
|
|
Abstract:
|
|
|
|
This module implements various conversion routines
|
|
that transform Win32 parameters into NT parameters.
|
|
|
|
Author:
|
|
|
|
Mark Lucovsky (markl) 20-Sep-1990
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
#include "basedll.h"
|
|
#if defined(BUILD_WOW6432)
|
|
#include "wow64reg.h"
|
|
#include <wow64t.h>
|
|
#endif
|
|
|
|
PCLDR_DATA_TABLE_ENTRY BasepExeLdrEntry = NULL;
|
|
|
|
// N.B. These are the registry values we check for SafeDllSearchMode,
|
|
// and MUST match the entries in BasepDllSearchPaths
|
|
typedef enum {
|
|
BasepCurrentDirUninitialized = -1,
|
|
BasepCurrentDirAtStart = 0,
|
|
BasepCurrentDirAfterSystem32 = 1,
|
|
MaxBasepCurrentDir
|
|
} BASEP_CURDIR_PLACEMENT;
|
|
|
|
#define BASEP_DEFAULT_DLL_CURDIR_PLACEMENT (BasepCurrentDirAfterSystem32)
|
|
|
|
#define BASEP_VALID_CURDIR_PLACEMENT_P(c) (BasepCurrentDirUninitialized < (c) \
|
|
&& (c) < MaxBasepCurrentDir)
|
|
|
|
LONG BasepDllCurrentDirPlacement = BasepCurrentDirUninitialized;
|
|
|
|
typedef enum {
|
|
BasepSearchPathEnd, // end of path
|
|
BasepSearchPathDlldir, // use the dll dir; fallback to nothing
|
|
BasepSearchPathAppdir, // use the exe dir; fallback to base exe dir
|
|
BasepSearchPathDefaultDirs, // use the default system dirs
|
|
BasepSearchPathEnvPath, // use %PATH%
|
|
BasepSearchPathCurdir, // use "."
|
|
MaxBasepSearchPath
|
|
} BASEP_SEARCH_PATH_ELEMENT;
|
|
|
|
// N.B. The ordering of these must match the definitions for
|
|
// BASEP_CURDIR_PLACEMENT.
|
|
static const BASEP_SEARCH_PATH_ELEMENT BasepDllSearchPaths[MaxBasepCurrentDir][7] =
|
|
{
|
|
{
|
|
// BasepCurrentDirAtStart
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathCurdir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
},
|
|
{
|
|
// BasepCurrentDirAfterSystem32
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathCurdir,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
}
|
|
};
|
|
|
|
|
|
POBJECT_ATTRIBUTES
|
|
BaseFormatObjectAttributes(
|
|
OUT POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN PSECURITY_ATTRIBUTES SecurityAttributes,
|
|
IN PUNICODE_STRING ObjectName
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function transforms a Win32 security attributes structure into
|
|
an NT object attributes structure. It returns the address of the
|
|
resulting structure (or NULL if SecurityAttributes was not
|
|
specified).
|
|
|
|
Arguments:
|
|
|
|
ObjectAttributes - Returns an initialized NT object attributes
|
|
structure that contains a superset of the information provided
|
|
by the security attributes structure.
|
|
|
|
SecurityAttributes - Supplies the address of a security attributes
|
|
structure that needs to be transformed into an NT object
|
|
attributes structure.
|
|
|
|
ObjectName - Supplies a name for the object relative to the
|
|
BaseNamedObjectDirectory object directory.
|
|
|
|
Return Value:
|
|
|
|
NULL - A value of null should be used to mimic the behavior of the
|
|
specified SecurityAttributes structure.
|
|
|
|
NON-NULL - Returns the ObjectAttributes value. The structure is
|
|
properly initialized by this function.
|
|
|
|
--*/
|
|
|
|
{
|
|
HANDLE RootDirectory;
|
|
ULONG Attributes;
|
|
PVOID SecurityDescriptor;
|
|
|
|
if ( ARGUMENT_PRESENT(SecurityAttributes) ||
|
|
ARGUMENT_PRESENT(ObjectName) ) {
|
|
|
|
if ( SecurityAttributes ) {
|
|
Attributes = (SecurityAttributes->bInheritHandle ? OBJ_INHERIT : 0);
|
|
SecurityDescriptor = SecurityAttributes->lpSecurityDescriptor;
|
|
}
|
|
else {
|
|
Attributes = 0;
|
|
SecurityDescriptor = NULL;
|
|
}
|
|
|
|
if ( ARGUMENT_PRESENT(ObjectName) ) {
|
|
Attributes |= OBJ_OPENIF;
|
|
RootDirectory = BaseGetNamedObjectDirectory();
|
|
}
|
|
else {
|
|
RootDirectory = NULL;
|
|
}
|
|
|
|
InitializeObjectAttributes(
|
|
ObjectAttributes,
|
|
ObjectName,
|
|
Attributes,
|
|
RootDirectory,
|
|
SecurityDescriptor
|
|
);
|
|
return ObjectAttributes;
|
|
}
|
|
else {
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
PLARGE_INTEGER
|
|
BaseFormatTimeOut(
|
|
OUT PLARGE_INTEGER TimeOut,
|
|
IN DWORD Milliseconds
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function translates a Win32 style timeout to an NT relative
|
|
timeout value.
|
|
|
|
Arguments:
|
|
|
|
TimeOut - Returns an initialized NT timeout value that is equivalent
|
|
to the Milliseconds parameter.
|
|
|
|
Milliseconds - Supplies the timeout value in milliseconds. A value
|
|
of -1 indicates indefinite timeout.
|
|
|
|
Return Value:
|
|
|
|
|
|
NULL - A value of null should be used to mimic the behavior of the
|
|
specified Milliseconds parameter.
|
|
|
|
NON-NULL - Returns the TimeOut value. The structure is properly
|
|
initialized by this function.
|
|
|
|
--*/
|
|
|
|
{
|
|
if ( (LONG) Milliseconds == -1 ) {
|
|
return( NULL );
|
|
}
|
|
TimeOut->QuadPart = UInt32x32To64( Milliseconds, 10000 );
|
|
TimeOut->QuadPart *= -1;
|
|
return TimeOut;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
BaseCreateStack(
|
|
IN HANDLE Process,
|
|
IN SIZE_T StackSize,
|
|
IN SIZE_T MaximumStackSize,
|
|
OUT PINITIAL_TEB InitialTeb
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function creates a stack for the specified process.
|
|
|
|
Arguments:
|
|
|
|
Process - Supplies a handle to the process that the stack will
|
|
be allocated within.
|
|
|
|
StackSize - An optional parameter, that if specified, supplies
|
|
the initial commit size for the stack.
|
|
|
|
MaximumStackSize - Supplies the maximum size for the new threads stack.
|
|
If this parameter is not specified, then the reserve size of the
|
|
current images stack descriptor is used.
|
|
|
|
InitialTeb - Returns a populated InitialTeb that contains
|
|
the stack size and limits.
|
|
|
|
Return Value:
|
|
|
|
TRUE - A stack was successfully created.
|
|
|
|
FALSE - The stack counld not be created.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
PCH Stack;
|
|
BOOLEAN GuardPage;
|
|
SIZE_T RegionSize;
|
|
ULONG OldProtect;
|
|
SIZE_T ImageStackSize, ImageStackCommit;
|
|
PIMAGE_NT_HEADERS NtHeaders;
|
|
PPEB Peb;
|
|
ULONG PageSize;
|
|
|
|
Peb = NtCurrentPeb();
|
|
|
|
BaseStaticServerData = BASE_SHARED_SERVER_DATA;
|
|
PageSize = BASE_SYSINFO.PageSize;
|
|
|
|
//
|
|
// If the stack size was not supplied, then use the sizes from the
|
|
// image header.
|
|
//
|
|
|
|
NtHeaders = RtlImageNtHeader(Peb->ImageBaseAddress);
|
|
if (!NtHeaders) {
|
|
return STATUS_INVALID_IMAGE_FORMAT;
|
|
}
|
|
ImageStackSize = NtHeaders->OptionalHeader.SizeOfStackReserve;
|
|
ImageStackCommit = NtHeaders->OptionalHeader.SizeOfStackCommit;
|
|
|
|
if ( !MaximumStackSize ) {
|
|
MaximumStackSize = ImageStackSize;
|
|
}
|
|
if (!StackSize) {
|
|
StackSize = ImageStackCommit;
|
|
}
|
|
else {
|
|
|
|
//
|
|
// Now Compute how much additional stack space is to be
|
|
// reserved. This is done by... If the StackSize is <=
|
|
// Reserved size in the image, then reserve whatever the image
|
|
// specifies. Otherwise, round up to 1Mb.
|
|
//
|
|
|
|
if ( StackSize >= MaximumStackSize ) {
|
|
MaximumStackSize = ROUND_UP(StackSize, (1024*1024));
|
|
}
|
|
}
|
|
|
|
//
|
|
// Align the stack size to a page boundry and the reserved size
|
|
// to an allocation granularity boundry.
|
|
//
|
|
|
|
StackSize = ROUND_UP( StackSize, PageSize );
|
|
|
|
MaximumStackSize = ROUND_UP(
|
|
MaximumStackSize,
|
|
BASE_SYSINFO.AllocationGranularity
|
|
);
|
|
|
|
//
|
|
// Enforce a minimal stack commit if there is a PEB setting
|
|
// for this.
|
|
//
|
|
|
|
{
|
|
SIZE_T MinimumStackCommit;
|
|
|
|
MinimumStackCommit = NtCurrentPeb()->MinimumStackCommit;
|
|
|
|
if (MinimumStackCommit != 0 && StackSize < MinimumStackCommit) {
|
|
StackSize = MinimumStackCommit;
|
|
}
|
|
|
|
//
|
|
// Recheck and realign reserve size
|
|
//
|
|
|
|
if ( StackSize >= MaximumStackSize ) {
|
|
MaximumStackSize = ROUND_UP (StackSize, (1024*1024));
|
|
}
|
|
|
|
StackSize = ROUND_UP (StackSize, PageSize);
|
|
MaximumStackSize = ROUND_UP (MaximumStackSize, BASE_SYSINFO.AllocationGranularity);
|
|
}
|
|
|
|
#if !defined (_IA64_)
|
|
|
|
//
|
|
// Reserve address space for the stack
|
|
//
|
|
|
|
Stack = NULL;
|
|
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
0,
|
|
&MaximumStackSize,
|
|
MEM_RESERVE,
|
|
PAGE_READWRITE
|
|
);
|
|
#else
|
|
|
|
//
|
|
// Take RseStack into consideration.
|
|
// RSE stack has same size as memory stack, has same StackBase,
|
|
// has a guard page at the end, and grows upwards towards higher
|
|
// memory addresses
|
|
//
|
|
|
|
//
|
|
// Reserve address space for the two stacks
|
|
//
|
|
{
|
|
SIZE_T TotalStackSize = MaximumStackSize * 2;
|
|
|
|
Stack = NULL;
|
|
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
0,
|
|
&TotalStackSize,
|
|
MEM_RESERVE,
|
|
PAGE_READWRITE
|
|
);
|
|
}
|
|
|
|
#endif // IA64
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return Status;
|
|
}
|
|
|
|
InitialTeb->OldInitialTeb.OldStackBase = NULL;
|
|
InitialTeb->OldInitialTeb.OldStackLimit = NULL;
|
|
InitialTeb->StackAllocationBase = Stack;
|
|
InitialTeb->StackBase = Stack + MaximumStackSize;
|
|
|
|
#if defined (_IA64_)
|
|
InitialTeb->OldInitialTeb.OldBStoreLimit = NULL;
|
|
#endif //IA64
|
|
|
|
Stack += MaximumStackSize - StackSize;
|
|
if (MaximumStackSize > StackSize) {
|
|
Stack -= PageSize;
|
|
StackSize += PageSize;
|
|
GuardPage = TRUE;
|
|
}
|
|
else {
|
|
GuardPage = FALSE;
|
|
}
|
|
|
|
//
|
|
// Commit the initially valid portion of the stack
|
|
//
|
|
|
|
#if !defined(_IA64_)
|
|
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
0,
|
|
&StackSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
#else
|
|
{
|
|
//
|
|
// memory and rse stacks are expected to be contiguous
|
|
// reserver virtual memory for both stack at once
|
|
//
|
|
SIZE_T NewCommittedStackSize = StackSize * 2;
|
|
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
0,
|
|
&NewCommittedStackSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
}
|
|
|
|
#endif //IA64
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
|
|
//
|
|
// If the commit fails, then delete the address space for the stack
|
|
//
|
|
|
|
RegionSize = 0;
|
|
NtFreeVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
&RegionSize,
|
|
MEM_RELEASE
|
|
);
|
|
|
|
return Status;
|
|
}
|
|
|
|
InitialTeb->StackLimit = Stack;
|
|
|
|
#if defined(_IA64_)
|
|
InitialTeb->BStoreLimit = Stack + 2 * StackSize;
|
|
#endif
|
|
|
|
//
|
|
// if we have space, create a guard page.
|
|
//
|
|
|
|
if (GuardPage) {
|
|
RegionSize = PageSize;
|
|
Status = NtProtectVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
&RegionSize,
|
|
PAGE_GUARD | PAGE_READWRITE,
|
|
&OldProtect
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return Status;
|
|
}
|
|
InitialTeb->StackLimit = (PVOID)((PUCHAR)InitialTeb->StackLimit + RegionSize);
|
|
|
|
#if defined(_IA64_)
|
|
//
|
|
// additional code to Create RSE stack guard page
|
|
//
|
|
Stack = ((PCH)InitialTeb->StackBase) + StackSize - PageSize;
|
|
RegionSize = PageSize;
|
|
Status = NtProtectVirtualMemory(
|
|
Process,
|
|
(PVOID *)&Stack,
|
|
&RegionSize,
|
|
PAGE_GUARD | PAGE_READWRITE,
|
|
&OldProtect
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return Status;
|
|
}
|
|
InitialTeb->BStoreLimit = (PVOID)Stack;
|
|
|
|
#endif // IA64
|
|
|
|
}
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
VOID
|
|
BaseThreadStart(
|
|
IN LPTHREAD_START_ROUTINE lpStartAddress,
|
|
IN LPVOID lpParameter
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function is called to start a Win32 thread. Its purpose
|
|
is to call the thread, and if the thread returns, to terminate
|
|
the thread and delete its stack.
|
|
|
|
Arguments:
|
|
|
|
lpStartAddress - Supplies the starting address of the new thread. The
|
|
address is logically a procedure that never returns and that
|
|
accepts a single 32-bit pointer argument.
|
|
|
|
lpParameter - Supplies a single parameter value passed to the thread.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
try {
|
|
|
|
//
|
|
// test for fiber start or new thread
|
|
//
|
|
|
|
//
|
|
// WARNING WARNING DO NOT CHANGE INIT OF NtTib.Version. There is
|
|
// external code depending on this initialization !
|
|
//
|
|
if ( NtCurrentTeb()->NtTib.Version == OS2_VERSION ) {
|
|
if ( !BaseRunningInServerProcess ) {
|
|
CsrNewThread();
|
|
}
|
|
}
|
|
ExitThread((lpStartAddress)(lpParameter));
|
|
}
|
|
except(UnhandledExceptionFilter( GetExceptionInformation() )) {
|
|
if ( !BaseRunningInServerProcess ) {
|
|
ExitProcess(GetExceptionCode());
|
|
}
|
|
else {
|
|
ExitThread(GetExceptionCode());
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID
|
|
BaseProcessStart(
|
|
PPROCESS_START_ROUTINE lpStartAddress
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function is called to start a Win32 process. Its purpose is to
|
|
call the initial thread of the process, and if the thread returns,
|
|
to terminate the thread and delete its stack.
|
|
|
|
Arguments:
|
|
|
|
lpStartAddress - Supplies the starting address of the new thread. The
|
|
address is logically a procedure that never returns.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
try {
|
|
#if defined(BUILD_WOW6432)
|
|
void Report32bitAppLaunching ( );
|
|
Report32bitAppLaunching ();
|
|
#endif
|
|
NtSetInformationThread( NtCurrentThread(),
|
|
ThreadQuerySetWin32StartAddress,
|
|
&lpStartAddress,
|
|
sizeof( lpStartAddress )
|
|
);
|
|
ExitThread((lpStartAddress)());
|
|
}
|
|
except(UnhandledExceptionFilter( GetExceptionInformation() )) {
|
|
if ( !BaseRunningInServerProcess ) {
|
|
ExitProcess(GetExceptionCode());
|
|
}
|
|
else {
|
|
ExitThread(GetExceptionCode());
|
|
}
|
|
}
|
|
}
|
|
|
|
VOID
|
|
BaseFreeStackAndTerminate(
|
|
IN PVOID OldStack,
|
|
IN DWORD ExitCode
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This API is called during thread termination to delete a thread's
|
|
stack and then terminate.
|
|
|
|
Arguments:
|
|
|
|
OldStack - Supplies the address of the stack to free.
|
|
|
|
ExitCode - Supplies the termination status that the thread
|
|
is to exit with.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
SIZE_T Zero;
|
|
PVOID BaseAddress;
|
|
|
|
#if defined (WX86)
|
|
PWX86TIB Wx86Tib;
|
|
PTEB Teb;
|
|
#endif
|
|
|
|
Zero = 0;
|
|
BaseAddress = OldStack;
|
|
|
|
Status = NtFreeVirtualMemory(
|
|
NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&Zero,
|
|
MEM_RELEASE
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
#if defined (WX86)
|
|
Teb = NtCurrentTeb();
|
|
if (Teb && (Wx86Tib = Wx86CurrentTib())) {
|
|
BaseAddress = Wx86Tib->DeallocationStack;
|
|
Zero = 0;
|
|
Status = NtFreeVirtualMemory(
|
|
NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&Zero,
|
|
MEM_RELEASE
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
|
|
if (Teb->Wx86Thread.DeallocationCpu) {
|
|
BaseAddress = Teb->Wx86Thread.DeallocationCpu;
|
|
Zero = 0;
|
|
Status = NtFreeVirtualMemory(
|
|
NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&Zero,
|
|
MEM_RELEASE
|
|
);
|
|
ASSERT(NT_SUCCESS(Status));
|
|
}
|
|
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// Don't worry, no commenting precedent has been set by SteveWo. this
|
|
// comment was added by an innocent bystander.
|
|
//
|
|
// NtTerminateThread will return if this thread is the last one in
|
|
// the process. So ExitProcess will only be called if that is the
|
|
// case.
|
|
//
|
|
|
|
NtTerminateThread(NULL,(NTSTATUS)ExitCode);
|
|
ExitProcess(ExitCode);
|
|
}
|
|
|
|
|
|
|
|
#if defined(WX86) || defined(_AXP64_)
|
|
|
|
NTSTATUS
|
|
BaseCreateWx86Tib(
|
|
HANDLE Process,
|
|
HANDLE Thread,
|
|
ULONG InitialPc,
|
|
ULONG CommittedStackSize,
|
|
ULONG MaximumStackSize,
|
|
BOOLEAN EmulateInitialPc
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This API is called to create a Wx86Tib for Wx86 emulated threads
|
|
|
|
Arguments:
|
|
|
|
|
|
Process - Target Process
|
|
|
|
Thread - Target Thread
|
|
|
|
|
|
Parameter - Supplies the thread's parameter.
|
|
|
|
InitialPc - Supplies an initial program counter value.
|
|
|
|
StackSize - BaseCreateStack parameters
|
|
|
|
MaximumStackSize - BaseCreateStack parameters
|
|
|
|
BOOLEAN
|
|
|
|
Return Value:
|
|
|
|
NtStatus from mem allocations
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
PTEB Teb;
|
|
ULONG Size, SizeWx86Tib;
|
|
PVOID TargetWx86Tib;
|
|
PIMAGE_NT_HEADERS NtHeaders;
|
|
WX86TIB Wx86Tib;
|
|
INITIAL_TEB InitialTeb;
|
|
THREAD_BASIC_INFORMATION ThreadInfo;
|
|
|
|
|
|
Status = NtQueryInformationThread(
|
|
Thread,
|
|
ThreadBasicInformation,
|
|
&ThreadInfo,
|
|
sizeof( ThreadInfo ),
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status)) {
|
|
return Status;
|
|
}
|
|
|
|
Teb = ThreadInfo.TebBaseAddress;
|
|
|
|
|
|
//
|
|
// if stack size not supplied, get from current image
|
|
//
|
|
NtHeaders = RtlImageNtHeader(NtCurrentPeb()->ImageBaseAddress);
|
|
if (!NtHeaders) {
|
|
return STATUS_INVALID_IMAGE_FORMAT;
|
|
}
|
|
if (!MaximumStackSize) {
|
|
MaximumStackSize = (ULONG)NtHeaders->OptionalHeader.SizeOfStackReserve;
|
|
}
|
|
if (!CommittedStackSize) {
|
|
CommittedStackSize = (ULONG)NtHeaders->OptionalHeader.SizeOfStackCommit;
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Increase stack size for Wx86Tib, which sits at the top of the stack.
|
|
//
|
|
|
|
//
|
|
// x86 Borland C++ 4.1 (and perhaps other versions) Rudely assumes that
|
|
// it can use the top of the stack. Even tho this is completly bogus,
|
|
// leave some space on the top of the stack, to avoid problems.
|
|
//
|
|
SizeWx86Tib = sizeof(WX86TIB) + 16;
|
|
|
|
SizeWx86Tib = ROUND_UP(SizeWx86Tib, sizeof(ULONG));
|
|
Size = (ULONG)ROUND_UP_TO_PAGES(SizeWx86Tib + 4096);
|
|
if (CommittedStackSize < 1024 * 1024) { // 1 MB
|
|
CommittedStackSize += Size;
|
|
}
|
|
if (MaximumStackSize < 1024 * 1024 * 16) { // 10 MB
|
|
MaximumStackSize += Size;
|
|
}
|
|
|
|
if (MaximumStackSize < 256 * 1024) {
|
|
// Enforce a minimum stack size of 256k since the CPU emulator
|
|
// grabs several pages of the x86 stack for itself
|
|
MaximumStackSize = 256 * 1024;
|
|
}
|
|
|
|
Status = BaseCreateStack( Process,
|
|
CommittedStackSize,
|
|
MaximumStackSize,
|
|
&InitialTeb
|
|
);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
return Status;
|
|
}
|
|
|
|
|
|
//
|
|
// Fill in the Teb->Vdm with pWx86Tib
|
|
//
|
|
TargetWx86Tib = (PVOID)((ULONG_PTR)InitialTeb.StackBase - SizeWx86Tib);
|
|
Status = NtWriteVirtualMemory(Process,
|
|
&Teb->Vdm,
|
|
&TargetWx86Tib,
|
|
sizeof(TargetWx86Tib),
|
|
NULL
|
|
);
|
|
|
|
|
|
if (NT_SUCCESS(Status)) {
|
|
|
|
//
|
|
// Write the initial Wx86Tib information
|
|
//
|
|
RtlZeroMemory(&Wx86Tib, sizeof(WX86TIB));
|
|
Wx86Tib.Size = sizeof(WX86TIB);
|
|
Wx86Tib.InitialPc = InitialPc;
|
|
Wx86Tib.InitialSp = (ULONG)((ULONG_PTR)TargetWx86Tib);
|
|
Wx86Tib.StackBase = (VOID * POINTER_32) InitialTeb.StackBase;
|
|
Wx86Tib.StackLimit = (VOID * POINTER_32) InitialTeb.StackLimit;
|
|
Wx86Tib.DeallocationStack = (VOID * POINTER_32) InitialTeb.StackAllocationBase;
|
|
Wx86Tib.EmulateInitialPc = EmulateInitialPc;
|
|
|
|
Status = NtWriteVirtualMemory(Process,
|
|
TargetWx86Tib,
|
|
&Wx86Tib,
|
|
sizeof(WX86TIB),
|
|
NULL
|
|
);
|
|
}
|
|
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseFreeThreadStack(Process, NULL, &InitialTeb);
|
|
}
|
|
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
#endif
|
|
|
|
|
|
VOID
|
|
BaseFreeThreadStack(
|
|
HANDLE hProcess,
|
|
HANDLE hThread,
|
|
PINITIAL_TEB InitialTeb
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Deletes a thread's stack
|
|
|
|
Arguments:
|
|
|
|
Process - Target process
|
|
|
|
Thread - Target thread OPTIONAL
|
|
|
|
InitialTeb - stack paremeters
|
|
|
|
|
|
Return Value:
|
|
|
|
VOID
|
|
|
|
|
|
--*/
|
|
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
DWORD dwStackSize;
|
|
SIZE_T stStackSize;
|
|
PVOID BaseAddress;
|
|
|
|
stStackSize = 0;
|
|
dwStackSize = 0;
|
|
BaseAddress = InitialTeb->StackAllocationBase;
|
|
NtFreeVirtualMemory( hProcess,
|
|
&BaseAddress,
|
|
&stStackSize,
|
|
MEM_RELEASE
|
|
);
|
|
|
|
#if defined (WX86)
|
|
|
|
if (hThread) {
|
|
PTEB Teb;
|
|
PWX86TIB pWx86Tib;
|
|
WX86TIB Wx86Tib;
|
|
THREAD_BASIC_INFORMATION ThreadInfo;
|
|
|
|
Status = NtQueryInformationThread(
|
|
hThread,
|
|
ThreadBasicInformation,
|
|
&ThreadInfo,
|
|
sizeof( ThreadInfo ),
|
|
NULL
|
|
);
|
|
|
|
Teb = ThreadInfo.TebBaseAddress;
|
|
if (!NT_SUCCESS(Status) || !Teb) {
|
|
return;
|
|
}
|
|
|
|
Status = NtReadVirtualMemory(
|
|
hProcess,
|
|
&Teb->Vdm,
|
|
&pWx86Tib,
|
|
sizeof(pWx86Tib),
|
|
NULL
|
|
);
|
|
if (!NT_SUCCESS(Status) || !pWx86Tib) {
|
|
return;
|
|
}
|
|
|
|
Status = NtReadVirtualMemory(
|
|
hProcess,
|
|
pWx86Tib,
|
|
&Wx86Tib,
|
|
sizeof(Wx86Tib),
|
|
NULL
|
|
);
|
|
|
|
if (NT_SUCCESS(Status) && Wx86Tib.Size == sizeof(WX86TIB)) {
|
|
|
|
// release the wx86tib stack
|
|
dwStackSize = 0;
|
|
stStackSize = 0;
|
|
BaseAddress = Wx86Tib.DeallocationStack;
|
|
NtFreeVirtualMemory(hProcess,
|
|
&BaseAddress,
|
|
&stStackSize,
|
|
MEM_RELEASE
|
|
);
|
|
|
|
// set Teb->Vdm = NULL;
|
|
dwStackSize = 0;
|
|
Status = NtWriteVirtualMemory(
|
|
hProcess,
|
|
&Teb->Vdm,
|
|
&dwStackSize,
|
|
sizeof(pWx86Tib),
|
|
NULL
|
|
);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
}
|
|
|
|
#if defined(BUILD_WOW6432)
|
|
|
|
typedef HANDLE (WINAPI* __imp_RegisterEventSourceWType) (HANDLE, PWCHAR );
|
|
typedef HANDLE (WINAPI* __imp_DeregisterEventSourceType) (HANDLE);
|
|
typedef HANDLE (WINAPI* __imp_ReportEventType)(
|
|
HANDLE hEventLog, // handle to event log
|
|
WORD wType, // event type
|
|
WORD wCategory, // event category
|
|
DWORD dwEventID, // event identifier
|
|
PVOID lpUserSid, // user security identifier
|
|
WORD wNumStrings, // number of strings to merge
|
|
DWORD dwDataSize, // size of binary data
|
|
PWCHAR *lpStrings, // array of strings to merge
|
|
LPVOID lpRawData // binary data buffer
|
|
);
|
|
|
|
|
|
void
|
|
Wow64LogMessageInEventLogger(
|
|
PWCHAR *szMsg
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function logs an event into the application log.
|
|
|
|
Arguments:
|
|
|
|
szMsg - event-log message pointer.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
--*/
|
|
|
|
{
|
|
|
|
HMODULE hMod;
|
|
HANDLE h;
|
|
__imp_RegisterEventSourceWType __imp_RegisterEventSourceW;
|
|
__imp_DeregisterEventSourceType __imp_DeregisterEventSource;
|
|
__imp_ReportEventType __imp_ReportEvent;
|
|
|
|
|
|
hMod =LoadLibraryW (L"advapi32.dll");
|
|
|
|
if (hMod != NULL) {
|
|
|
|
__imp_RegisterEventSourceW = (__imp_RegisterEventSourceWType)GetProcAddress (hMod, "RegisterEventSourceW");
|
|
__imp_DeregisterEventSource = (__imp_DeregisterEventSourceType)GetProcAddress (hMod, "DeregisterEventSource");
|
|
__imp_ReportEvent = (__imp_ReportEventType)GetProcAddress (hMod, "ReportEventW");
|
|
|
|
if ((__imp_RegisterEventSourceW != NULL) &&
|
|
(__imp_DeregisterEventSource != NULL) &&
|
|
(__imp_ReportEvent != NULL)) {
|
|
|
|
h = __imp_RegisterEventSourceW (NULL, L"Wow64 Emulation Layer");
|
|
|
|
if (h != NULL) {
|
|
|
|
if (!__imp_ReportEvent (
|
|
h, // event log handle
|
|
EVENTLOG_INFORMATION_TYPE, // EVENTLOG_WARNING_TYPE
|
|
0, // category zero
|
|
EVENT_WOW64_RUNNING32BIT_APPLICATION , // event identifier
|
|
NULL, // no user security identifier
|
|
1, // one substitution string
|
|
0, // no data
|
|
szMsg, // pointer to string array
|
|
NULL)) { // pointer to data
|
|
|
|
DbgPrint ("Wow64-EventLog: Couldn't report event - %lx\n", GetLastError ());
|
|
}
|
|
|
|
__imp_DeregisterEventSource (h);
|
|
}
|
|
}
|
|
|
|
FreeLibrary (hMod);
|
|
}
|
|
}
|
|
|
|
void
|
|
Report32bitAppLaunching ()
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is called whenever a 32-bit is launched on win64 (inside Wow64). It will
|
|
check to see if application loggin is enabled, and if so, will log an event to the
|
|
application log.
|
|
|
|
Arguments:
|
|
|
|
None.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
--*/
|
|
|
|
{
|
|
|
|
|
|
const static UNICODE_STRING KeyName = RTL_CONSTANT_STRING (L"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\wow64\\config");
|
|
static UNICODE_STRING ValueName = RTL_CONSTANT_STRING (L"LogAppLaunchingEvent");
|
|
static OBJECT_ATTRIBUTES ObjA = RTL_CONSTANT_OBJECT_ATTRIBUTES (&KeyName, OBJ_CASE_INSENSITIVE);
|
|
|
|
WCHAR Buffer [MAX_PATH];
|
|
const PWCHAR Msg [2] = {Buffer, NULL};
|
|
PWCHAR pAppName;
|
|
HKEY hKey;
|
|
PUNICODE_STRING ImageName;
|
|
PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation;
|
|
NTSTATUS Status;
|
|
PPEB Peb;
|
|
PWSTR PtrToCopy;
|
|
DWORD CopyLength;
|
|
|
|
|
|
Status = NtOpenKey (&hKey, KEY_READ | KEY_WOW64_64KEY, &ObjA);
|
|
|
|
if (NT_SUCCESS(Status)) {
|
|
|
|
KeyValueInformation = (PKEY_VALUE_PARTIAL_INFORMATION)Buffer;
|
|
|
|
Status = NtQueryValueKey(
|
|
hKey,
|
|
&ValueName,
|
|
KeyValuePartialInformation,
|
|
KeyValueInformation,
|
|
sizeof (Buffer),
|
|
&CopyLength
|
|
);
|
|
NtClose (hKey);
|
|
|
|
if ((NT_SUCCESS (Status)) &&
|
|
(KeyValueInformation->Type == REG_DWORD) &&
|
|
(KeyValueInformation->DataLength == sizeof (DWORD))) {
|
|
|
|
if (*(LONG *)KeyValueInformation->Data == 0x1) {
|
|
|
|
Peb = NtCurrentPeb ();
|
|
PtrToCopy = NULL;
|
|
|
|
if (Peb->ProcessParameters != NULL) {
|
|
|
|
ImageName = &Peb->ProcessParameters->ImagePathName;
|
|
|
|
ASSERT (ImageName->Buffer != NULL);
|
|
if (ImageName->Length > (sizeof (Buffer) - sizeof (UNICODE_NULL))) {
|
|
|
|
CopyLength = (sizeof (Buffer) - sizeof (UNICODE_NULL));
|
|
PtrToCopy = (PWSTR)((PSTR)ImageName->Buffer + (ImageName->Length - sizeof (Buffer)) + sizeof (UNICODE_NULL));
|
|
} else {
|
|
|
|
CopyLength = ImageName->Length;
|
|
PtrToCopy = ImageName->Buffer;
|
|
}
|
|
|
|
if ( CopyLength){
|
|
RtlCopyMemory (Buffer, PtrToCopy, CopyLength);
|
|
Buffer [(CopyLength >> 1)] = UNICODE_NULL;
|
|
} else swprintf (Buffer, L"PID=%d",NtCurrentTeb()->ClientId.UniqueProcess);
|
|
}
|
|
Wow64LogMessageInEventLogger ((PWCHAR *)Msg);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
typedef struct _ENVIRONMENT_THUNK_TABLE
|
|
{
|
|
WCHAR *Native;
|
|
|
|
WCHAR *X86;
|
|
|
|
WCHAR *FakeName;
|
|
|
|
} ENVIRONMENT_THUNK_TABLE, *PENVIRONMENT_THUNK_TABLE;
|
|
|
|
ENVIRONMENT_THUNK_TABLE ProgramFilesEnvironment[] =
|
|
{
|
|
{
|
|
L"ProgramFiles",
|
|
L"ProgramFiles(x86)",
|
|
L"ProgramW6432"
|
|
},
|
|
{
|
|
L"CommonProgramFiles",
|
|
L"CommonProgramFiles(x86)",
|
|
L"CommonProgramW6432"
|
|
},
|
|
{
|
|
L"PROCESSOR_ARCHITECTURE",
|
|
L"PROCESSOR_ARCHITECTURE",
|
|
L"PROCESSOR_ARCHITEW6432"
|
|
}
|
|
};
|
|
|
|
|
|
NTSTATUS
|
|
Wow64pThunkEnvironmentVariables (
|
|
IN OUT PVOID *Environment
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is called when we are about to create a 64-bit process for
|
|
a 32-bit process. It thunks back the ProgramFiles environment
|
|
variables so that they point to the native directory.
|
|
|
|
This routine must stay in sync with what's in \base\wow64\wow64\init.c.
|
|
|
|
Arguments:
|
|
|
|
Environment - Address of pointer of environment variable to thunk.
|
|
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS.
|
|
--*/
|
|
|
|
{
|
|
UNICODE_STRING Name, Value;
|
|
WCHAR Buffer [ MAX_PATH ];
|
|
NTSTATUS NtStatus;
|
|
ULONG i=0;
|
|
|
|
while (i < (sizeof(ProgramFilesEnvironment) / sizeof(ProgramFilesEnvironment[0]))) {
|
|
|
|
RtlInitUnicodeString (&Name, ProgramFilesEnvironment[i].FakeName);
|
|
|
|
Value.Length = 0;
|
|
Value.MaximumLength = sizeof (Buffer);
|
|
Value.Buffer = Buffer;
|
|
|
|
NtStatus = RtlQueryEnvironmentVariable_U (*Environment,
|
|
&Name,
|
|
&Value
|
|
);
|
|
|
|
if (NT_SUCCESS (NtStatus)) {
|
|
|
|
RtlSetEnvironmentVariable (Environment,
|
|
&Name,
|
|
NULL
|
|
);
|
|
|
|
RtlInitUnicodeString (&Name, ProgramFilesEnvironment[i].Native);
|
|
|
|
NtStatus = RtlSetEnvironmentVariable (Environment,
|
|
&Name,
|
|
&Value
|
|
);
|
|
}
|
|
|
|
if (!NT_SUCCESS (NtStatus)) {
|
|
break;
|
|
}
|
|
i++;
|
|
}
|
|
|
|
return NtStatus;
|
|
}
|
|
#endif
|
|
|
|
|
|
BOOL
|
|
BasePushProcessParameters(
|
|
DWORD dwFlags,
|
|
HANDLE Process,
|
|
PPEB NewPeb,
|
|
LPCWSTR ApplicationPathName,
|
|
LPCWSTR CurrentDirectory,
|
|
LPCWSTR CommandLine,
|
|
LPVOID Environment,
|
|
LPSTARTUPINFOW lpStartupInfo,
|
|
DWORD dwCreationFlags,
|
|
BOOL bInheritHandles,
|
|
DWORD dwSubsystem,
|
|
PVOID pAppCompatData,
|
|
DWORD cbAppCompatData
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function allocates a process parameters record and
|
|
formats it. The parameter record is then written into the
|
|
address space of the specified process.
|
|
|
|
Arguments:
|
|
|
|
dwFlags - bitmask of flags to affect the behavior of
|
|
BasePushProcessParameters.
|
|
|
|
BASE_PUSH_PROCESS_PARAMETERS_FLAG_APP_MANIFEST_PRESENT
|
|
Set to indicate that an application manifest was found/used
|
|
for the given executable.
|
|
|
|
Process - Supplies a handle to the process that is to get the
|
|
parameters.
|
|
|
|
Peb - Supplies the address of the new processes PEB.
|
|
|
|
ApplicationPathName - Supplies the application path name for the
|
|
process.
|
|
|
|
CurrentDirectory - Supplies an optional current directory for the
|
|
process. If not specified, then the current directory is used.
|
|
|
|
CommandLine - Supplies a command line for the new process.
|
|
|
|
Environment - Supplies an optional environment variable list for the
|
|
process. If not specified, then the current processes arguments
|
|
are passed.
|
|
|
|
lpStartupInfo - Supplies the startup information for the processes
|
|
main window.
|
|
|
|
dwCreationFlags - Supplies creation flags for the process
|
|
|
|
bInheritHandles - TRUE if child process inherited handles from parent
|
|
|
|
dwSubsystem - if non-zero, then value will be stored in child process
|
|
PEB. Only non-zero for separate VDM applications, where the child
|
|
process has NTVDM.EXE subsystem type, not the 16-bit application
|
|
type, which is what we want.
|
|
|
|
pAppCompatData - data that is needed for appcompat backend
|
|
cbAppCompatData - data size in bytes
|
|
|
|
Return Value:
|
|
|
|
TRUE - The operation was successful.
|
|
|
|
FALSE - The operation Failed.
|
|
|
|
--*/
|
|
|
|
|
|
{
|
|
BOOL bStatus;
|
|
UNICODE_STRING ImagePathName;
|
|
UNICODE_STRING CommandLineString;
|
|
UNICODE_STRING CurrentDirString;
|
|
UNICODE_STRING DllPath;
|
|
UNICODE_STRING WindowTitle;
|
|
UNICODE_STRING DesktopInfo;
|
|
UNICODE_STRING ShellInfo;
|
|
UNICODE_STRING RuntimeInfo;
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
PRTL_USER_PROCESS_PARAMETERS ParametersInNewProcess;
|
|
ULONG ParameterLength, EnvironmentLength;
|
|
SIZE_T RegionSize;
|
|
PWCHAR s;
|
|
NTSTATUS Status;
|
|
WCHAR FullPathBuffer[MAX_PATH+5];
|
|
WCHAR *fp;
|
|
DWORD Rvalue;
|
|
LPWSTR DllPathData;
|
|
LPVOID pAppCompatDataInNewProcess;
|
|
BOOLEAN PebLocked = FALSE;
|
|
PPEB Peb;
|
|
|
|
#if defined(BUILD_WOW6432)
|
|
ULONG_PTR Peb32;
|
|
PVOID TempEnvironment = NULL;
|
|
#endif
|
|
|
|
|
|
Peb = NtCurrentPeb ();
|
|
|
|
Rvalue = GetFullPathNameW(ApplicationPathName,MAX_PATH+4,FullPathBuffer,&fp);
|
|
if ( Rvalue == 0 || Rvalue > MAX_PATH+4 ) {
|
|
DllPathData = BaseComputeProcessDllPath( ApplicationPathName,
|
|
Environment);
|
|
if (!DllPathData) {
|
|
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
|
|
return FALSE;
|
|
}
|
|
RtlInitUnicodeString( &DllPath, DllPathData );
|
|
RtlInitUnicodeString( &ImagePathName, ApplicationPathName );
|
|
} else {
|
|
DllPathData = BaseComputeProcessDllPath( FullPathBuffer,
|
|
Environment);
|
|
if ( !DllPathData ) {
|
|
SetLastError(ERROR_NOT_ENOUGH_MEMORY);
|
|
return FALSE;
|
|
}
|
|
RtlInitUnicodeString( &DllPath, DllPathData );
|
|
RtlInitUnicodeString( &ImagePathName, FullPathBuffer );
|
|
}
|
|
|
|
RtlInitUnicodeString( &CommandLineString, CommandLine );
|
|
|
|
RtlInitUnicodeString( &CurrentDirString, CurrentDirectory );
|
|
|
|
if ( lpStartupInfo->lpDesktop ) {
|
|
RtlInitUnicodeString( &DesktopInfo, lpStartupInfo->lpDesktop );
|
|
} else {
|
|
RtlInitUnicodeString( &DesktopInfo, L"");
|
|
}
|
|
|
|
if ( lpStartupInfo->lpReserved ) {
|
|
RtlInitUnicodeString( &ShellInfo, lpStartupInfo->lpReserved );
|
|
} else {
|
|
RtlInitUnicodeString( &ShellInfo, L"");
|
|
}
|
|
|
|
RuntimeInfo.Buffer = (PWSTR)lpStartupInfo->lpReserved2;
|
|
RuntimeInfo.Length = lpStartupInfo->cbReserved2;
|
|
RuntimeInfo.MaximumLength = RuntimeInfo.Length;
|
|
|
|
if (NULL == pAppCompatData) {
|
|
cbAppCompatData = 0;
|
|
}
|
|
|
|
if ( lpStartupInfo->lpTitle ) {
|
|
RtlInitUnicodeString( &WindowTitle, lpStartupInfo->lpTitle );
|
|
} else {
|
|
RtlInitUnicodeString( &WindowTitle, ApplicationPathName );
|
|
}
|
|
|
|
Status = RtlCreateProcessParameters( &ProcessParameters,
|
|
&ImagePathName,
|
|
&DllPath,
|
|
(ARGUMENT_PRESENT(CurrentDirectory) ? &CurrentDirString : NULL),
|
|
&CommandLineString,
|
|
Environment,
|
|
&WindowTitle,
|
|
&DesktopInfo,
|
|
&ShellInfo,
|
|
&RuntimeInfo
|
|
);
|
|
|
|
if (!NT_SUCCESS( Status )) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if ( !bInheritHandles ) {
|
|
ProcessParameters->CurrentDirectory.Handle = NULL;
|
|
}
|
|
|
|
try {
|
|
if (Environment == NULL) {
|
|
PebLocked = TRUE;
|
|
RtlAcquirePebLock ();
|
|
Environment = Peb->ProcessParameters->Environment;
|
|
} else {
|
|
Environment = ProcessParameters->Environment;
|
|
}
|
|
if (s = Environment) {
|
|
while (s[0] != L'\0' || s[1] != L'\0') {
|
|
s++;
|
|
}
|
|
s += 2;
|
|
|
|
EnvironmentLength = (ULONG)((PUCHAR)s - (PUCHAR)Environment);
|
|
|
|
ProcessParameters->Environment = NULL;
|
|
RegionSize = EnvironmentLength;
|
|
Status = NtAllocateVirtualMemory( Process,
|
|
(PVOID *)&ProcessParameters->Environment,
|
|
0,
|
|
&RegionSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
|
|
#if defined(BUILD_WOW6432)
|
|
|
|
//
|
|
// Let's try and thunk back some environment variables if we are about to
|
|
// launch a 64-bit process
|
|
//
|
|
|
|
Status = NtQueryInformationProcess (Process,
|
|
ProcessWow64Information,
|
|
&Peb32,
|
|
sizeof (Peb32),
|
|
NULL
|
|
);
|
|
|
|
if (NT_SUCCESS (Status) && (Peb32 == 0)) {
|
|
|
|
RegionSize = EnvironmentLength;
|
|
|
|
Status = NtAllocateVirtualMemory (NtCurrentProcess(),
|
|
&TempEnvironment,
|
|
0,
|
|
&RegionSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
|
|
if (NT_SUCCESS (Status)) {
|
|
|
|
try {
|
|
|
|
RtlCopyMemory (TempEnvironment,
|
|
Environment,
|
|
EnvironmentLength
|
|
);
|
|
} except (EXCEPTION_EXECUTE_HANDLER) {
|
|
Status = GetExceptionCode ();
|
|
}
|
|
|
|
if (NT_SUCCESS (Status)) {
|
|
|
|
//
|
|
// Thunk back special environment variables so that they won't be inherited
|
|
// for 64-bit processes
|
|
//
|
|
|
|
Status = Wow64pThunkEnvironmentVariables (&TempEnvironment);
|
|
|
|
if (NT_SUCCESS (Status)) {
|
|
Environment = TempEnvironment;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
|
|
Status = NtWriteVirtualMemory( Process,
|
|
ProcessParameters->Environment,
|
|
Environment,
|
|
EnvironmentLength,
|
|
NULL
|
|
);
|
|
|
|
if (PebLocked) {
|
|
RtlReleasePebLock ();
|
|
PebLocked = FALSE;
|
|
}
|
|
|
|
#if defined(BUILD_WOW6432)
|
|
|
|
if (TempEnvironment != NULL) {
|
|
|
|
RegionSize = 0;
|
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
|
&TempEnvironment,
|
|
&RegionSize,
|
|
MEM_RELEASE
|
|
);
|
|
}
|
|
#endif
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Push the parameters into the new process
|
|
//
|
|
|
|
ProcessParameters->StartingX = lpStartupInfo->dwX;
|
|
ProcessParameters->StartingY = lpStartupInfo->dwY;
|
|
ProcessParameters->CountX = lpStartupInfo->dwXSize;
|
|
ProcessParameters->CountY = lpStartupInfo->dwYSize;
|
|
ProcessParameters->CountCharsX = lpStartupInfo->dwXCountChars;
|
|
ProcessParameters->CountCharsY = lpStartupInfo->dwYCountChars;
|
|
ProcessParameters->FillAttribute = lpStartupInfo->dwFillAttribute;
|
|
ProcessParameters->WindowFlags = lpStartupInfo->dwFlags;
|
|
ProcessParameters->ShowWindowFlags = lpStartupInfo->wShowWindow;
|
|
|
|
if (lpStartupInfo->dwFlags & (STARTF_USESTDHANDLES | STARTF_USEHOTKEY | STARTF_HASSHELLDATA)) {
|
|
ProcessParameters->StandardInput = lpStartupInfo->hStdInput;
|
|
ProcessParameters->StandardOutput = lpStartupInfo->hStdOutput;
|
|
ProcessParameters->StandardError = lpStartupInfo->hStdError;
|
|
}
|
|
|
|
if (dwCreationFlags & DETACHED_PROCESS) {
|
|
ProcessParameters->ConsoleHandle = (HANDLE)CONSOLE_DETACHED_PROCESS;
|
|
} else if (dwCreationFlags & CREATE_NEW_CONSOLE) {
|
|
ProcessParameters->ConsoleHandle = (HANDLE)CONSOLE_NEW_CONSOLE;
|
|
} else if (dwCreationFlags & CREATE_NO_WINDOW) {
|
|
ProcessParameters->ConsoleHandle = (HANDLE)CONSOLE_CREATE_NO_WINDOW;
|
|
} else {
|
|
ProcessParameters->ConsoleHandle = Peb->ProcessParameters->ConsoleHandle;
|
|
if (!(lpStartupInfo->dwFlags & (STARTF_USESTDHANDLES | STARTF_USEHOTKEY | STARTF_HASSHELLDATA))) {
|
|
if (bInheritHandles ||
|
|
CONSOLE_HANDLE( Peb->ProcessParameters->StandardInput )
|
|
) {
|
|
ProcessParameters->StandardInput =
|
|
Peb->ProcessParameters->StandardInput;
|
|
}
|
|
if (bInheritHandles ||
|
|
CONSOLE_HANDLE( Peb->ProcessParameters->StandardOutput )
|
|
) {
|
|
ProcessParameters->StandardOutput =
|
|
Peb->ProcessParameters->StandardOutput;
|
|
}
|
|
if (bInheritHandles ||
|
|
CONSOLE_HANDLE( Peb->ProcessParameters->StandardError )
|
|
) {
|
|
ProcessParameters->StandardError =
|
|
Peb->ProcessParameters->StandardError;
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// CREATE_NEW_PROCESS_GROUP, in the absence of CREATE_NEW_CONSOLE,
|
|
// means that CTRL+C events should be ignored. This is solely for
|
|
// appcompat.
|
|
//
|
|
if ((dwCreationFlags & CREATE_NEW_PROCESS_GROUP) != 0 &&
|
|
(dwCreationFlags & CREATE_NEW_CONSOLE) == 0) {
|
|
ProcessParameters->ConsoleFlags |= CONSOLE_IGNORE_CTRL_C;
|
|
}
|
|
|
|
ProcessParameters->Flags |=
|
|
(Peb->ProcessParameters->Flags & RTL_USER_PROC_DISABLE_HEAP_DECOMMIT);
|
|
ParameterLength = ProcessParameters->Length;
|
|
|
|
if (dwFlags & BASE_PUSH_PROCESS_PARAMETERS_FLAG_APP_MANIFEST_PRESENT)
|
|
ProcessParameters->Flags |= RTL_USER_PROC_APP_MANIFEST_PRESENT;
|
|
|
|
//
|
|
// Allocate memory in the new process to push the parameters
|
|
//
|
|
|
|
ParametersInNewProcess = NULL;
|
|
RegionSize = ParameterLength;
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID *)&ParametersInNewProcess,
|
|
0,
|
|
&RegionSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
ParameterLength = (ULONG)RegionSize;
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
ProcessParameters->MaximumLength = ParameterLength;
|
|
|
|
if ( dwCreationFlags & PROFILE_USER ) {
|
|
ProcessParameters->Flags |= RTL_USER_PROC_PROFILE_USER;
|
|
}
|
|
|
|
if ( dwCreationFlags & PROFILE_KERNEL ) {
|
|
ProcessParameters->Flags |= RTL_USER_PROC_PROFILE_KERNEL;
|
|
}
|
|
|
|
if ( dwCreationFlags & PROFILE_SERVER ) {
|
|
ProcessParameters->Flags |= RTL_USER_PROC_PROFILE_SERVER;
|
|
}
|
|
|
|
//
|
|
// Push the parameters
|
|
//
|
|
|
|
Status = NtWriteVirtualMemory(
|
|
Process,
|
|
ParametersInNewProcess,
|
|
ProcessParameters,
|
|
ProcessParameters->Length,
|
|
NULL
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
|
|
//
|
|
// Make the processes PEB point to the parameters.
|
|
//
|
|
|
|
Status = NtWriteVirtualMemory(
|
|
Process,
|
|
&NewPeb->ProcessParameters,
|
|
&ParametersInNewProcess,
|
|
sizeof( ParametersInNewProcess ),
|
|
NULL
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
|
|
|
|
//
|
|
// allocate and write appcompat data for the new process
|
|
//
|
|
|
|
pAppCompatDataInNewProcess = NULL;
|
|
if ( NULL != pAppCompatData ) {
|
|
RegionSize = cbAppCompatData;
|
|
Status = NtAllocateVirtualMemory(
|
|
Process,
|
|
(PVOID*)&pAppCompatDataInNewProcess,
|
|
0,
|
|
&RegionSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
|
|
//
|
|
// write the data itself
|
|
//
|
|
Status = NtWriteVirtualMemory(
|
|
Process,
|
|
pAppCompatDataInNewProcess,
|
|
pAppCompatData,
|
|
cbAppCompatData,
|
|
NULL
|
|
);
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
}
|
|
|
|
//
|
|
// save the pointer to appcompat data in peb
|
|
//
|
|
Status = NtWriteVirtualMemory(
|
|
Process,
|
|
&NewPeb->pShimData,
|
|
&pAppCompatDataInNewProcess,
|
|
sizeof( pAppCompatDataInNewProcess ),
|
|
NULL
|
|
);
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
BaseSetLastNTError(Status);
|
|
bStatus = FALSE;
|
|
leave;
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Set subsystem type in PEB if requested by caller. Ignore error
|
|
//
|
|
|
|
if (dwSubsystem != 0) {
|
|
NtWriteVirtualMemory(
|
|
Process,
|
|
&NewPeb->ImageSubsystem,
|
|
&dwSubsystem,
|
|
sizeof( NewPeb->ImageSubsystem ),
|
|
NULL
|
|
);
|
|
}
|
|
bStatus = TRUE;
|
|
} finally {
|
|
if (PebLocked) {
|
|
RtlReleasePebLock ();
|
|
}
|
|
RtlFreeHeap (RtlProcessHeap(), 0,DllPath.Buffer);
|
|
if ( ProcessParameters ) {
|
|
RtlDestroyProcessParameters(ProcessParameters);
|
|
}
|
|
}
|
|
|
|
return bStatus;
|
|
}
|
|
|
|
LPCWSTR
|
|
BasepEndOfDirName(
|
|
IN LPCWSTR FileName
|
|
)
|
|
{
|
|
LPCWSTR FileNameEnd,
|
|
FileNameFirstWhack = wcschr(FileName, L'\\');
|
|
|
|
if (FileNameFirstWhack) {
|
|
|
|
FileNameEnd = wcsrchr(FileNameFirstWhack, L'\\');
|
|
ASSERT(FileNameEnd);
|
|
|
|
if (FileNameEnd == FileNameFirstWhack)
|
|
FileNameEnd++;
|
|
|
|
} else {
|
|
FileNameEnd = NULL;
|
|
}
|
|
|
|
return FileNameEnd;
|
|
}
|
|
|
|
VOID
|
|
BasepLocateExeLdrEntry(
|
|
IN PCLDR_DATA_TABLE_ENTRY Entry,
|
|
IN PVOID Context,
|
|
IN OUT BOOLEAN *StopEnumeration
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function is a LDR_LOADED_MODULE_ENUMBERATION_CALLBACK_FUNCTION
|
|
which locates the exe's loader data table entry.
|
|
|
|
Arguments:
|
|
|
|
Entry - the entry currently being enumerated.
|
|
|
|
Context - the image base address (NtCurrentPeb()->ImageBaseAddress).
|
|
|
|
StopEnumeration - used to stop the enumeration.
|
|
|
|
Return Value:
|
|
|
|
None. The exe's loader data table entry, if found, is stored in
|
|
the global BasepExeLdrEntry.
|
|
|
|
--*/
|
|
|
|
{
|
|
ASSERT(Entry);
|
|
ASSERT(Context);
|
|
ASSERT(StopEnumeration);
|
|
|
|
if (BasepExeLdrEntry) {
|
|
|
|
*StopEnumeration = TRUE;
|
|
|
|
} else if (Entry->DllBase == Context) {
|
|
|
|
BasepExeLdrEntry = Entry;
|
|
*StopEnumeration = TRUE;
|
|
|
|
}
|
|
}
|
|
|
|
|
|
LPWSTR
|
|
BasepComputeProcessPath(
|
|
IN const BASEP_SEARCH_PATH_ELEMENT *Elements,
|
|
IN LPCWSTR AppName,
|
|
IN LPVOID Environment
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function computes a process path.
|
|
|
|
Arguments:
|
|
|
|
Elements - The elements to build into a path.
|
|
|
|
AppName - An optional argument that specifies the name of
|
|
the application. If this parameter is not specified,
|
|
then the current application is used.
|
|
|
|
Environment - Supplies the environment block to be used to calculate
|
|
the path variable value.
|
|
|
|
Return Value:
|
|
|
|
The return value is the value of the requested path.
|
|
|
|
--*/
|
|
|
|
{
|
|
LPCWSTR AppNameEnd;
|
|
const BASEP_SEARCH_PATH_ELEMENT *Element;
|
|
UNICODE_STRING EnvPath;
|
|
LPWSTR EnvPathBuffer = NULL;
|
|
LPWSTR PathBuffer = NULL,
|
|
PathCurrent;
|
|
ULONG PathLengthInBytes;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
__try {
|
|
|
|
// First, figure out how much space we'll need.
|
|
PathLengthInBytes = 0;
|
|
for (Element = Elements;
|
|
*Element != BasepSearchPathEnd;
|
|
Element++) {
|
|
|
|
switch (*Element) {
|
|
|
|
case BasepSearchPathCurdir:
|
|
PathLengthInBytes += 2 * sizeof(UNICODE_NULL); // .;
|
|
break;
|
|
|
|
case BasepSearchPathDlldir:
|
|
|
|
ASSERT(BaseDllDirectory.Buffer != NULL);
|
|
|
|
PathLengthInBytes += BaseDllDirectory.Length;
|
|
if (BaseDllDirectory.Length) {
|
|
PathLengthInBytes += sizeof(UNICODE_NULL);
|
|
}
|
|
|
|
break;
|
|
|
|
case BasepSearchPathAppdir:
|
|
|
|
if (AppName) {
|
|
// Try to use the passed-in appname
|
|
AppNameEnd = BasepEndOfDirName(AppName);
|
|
}
|
|
|
|
if (!AppName || !AppNameEnd) {
|
|
|
|
// We didn't have or were unable to use the passed-in
|
|
// appname -- so attempt to use the current exe's name
|
|
|
|
if (RtlGetPerThreadCurdir()
|
|
&& RtlGetPerThreadCurdir()->ImageName) {
|
|
|
|
AppName = RtlGetPerThreadCurdir()->ImageName->Buffer;
|
|
|
|
} else {
|
|
|
|
BasepCheckExeLdrEntry();
|
|
|
|
if (BasepExeLdrEntry) {
|
|
AppName = BasepExeLdrEntry->FullDllName.Buffer;
|
|
}
|
|
}
|
|
|
|
if (AppName) {
|
|
AppNameEnd = BasepEndOfDirName(AppName);
|
|
}
|
|
}
|
|
|
|
if (AppName && AppNameEnd) {
|
|
|
|
// Either we had a passed-in appname which worked, or
|
|
// we found the current exe's name and that worked.
|
|
//
|
|
// AppNameEnd points to the end of the base of the exe
|
|
// name -- so the difference is the number of
|
|
// characters in the base name, and we add one for the
|
|
// trailing semicolon / NULL.
|
|
|
|
PathLengthInBytes += ((AppNameEnd - AppName + 1)
|
|
* sizeof(UNICODE_NULL));
|
|
}
|
|
|
|
break;
|
|
|
|
case BasepSearchPathDefaultDirs:
|
|
ASSERT(! (BaseDefaultPath.Length & 1));
|
|
|
|
// We don't need an extra UNICODE_NULL here -- baseinit.c
|
|
// appends our trailing semicolon for us.
|
|
|
|
PathLengthInBytes += BaseDefaultPath.Length;
|
|
break;
|
|
|
|
case BasepSearchPathEnvPath:
|
|
|
|
if (! Environment) {
|
|
RtlAcquirePebLock();
|
|
}
|
|
|
|
__try {
|
|
EnvPath.MaximumLength = 0;
|
|
|
|
Status = RtlQueryEnvironmentVariable_U(Environment,
|
|
&BasePathVariableName,
|
|
&EnvPath);
|
|
|
|
if (Status == STATUS_BUFFER_TOO_SMALL) {
|
|
|
|
// Now that we know how much to allocate, attempt
|
|
// to alloc a buffer that's actually big enough.
|
|
|
|
EnvPath.MaximumLength = EnvPath.Length + sizeof(UNICODE_NULL);
|
|
|
|
EnvPathBuffer = RtlAllocateHeap(RtlProcessHeap(),
|
|
MAKE_TAG(TMP_TAG),
|
|
EnvPath.MaximumLength);
|
|
if (! EnvPathBuffer) {
|
|
Status = STATUS_NO_MEMORY;
|
|
__leave;
|
|
}
|
|
|
|
EnvPath.Buffer = EnvPathBuffer;
|
|
|
|
Status = RtlQueryEnvironmentVariable_U(Environment,
|
|
&BasePathVariableName,
|
|
&EnvPath);
|
|
}
|
|
} __finally {
|
|
if (! Environment) {
|
|
RtlReleasePebLock();
|
|
}
|
|
}
|
|
|
|
if (Status == STATUS_VARIABLE_NOT_FOUND) {
|
|
EnvPath.Length = 0;
|
|
Status = STATUS_SUCCESS;
|
|
} else if (! NT_SUCCESS(Status)) {
|
|
__leave;
|
|
} else {
|
|
// The final tally is the length, in bytes, of whatever
|
|
// we're using for our path, plus a character for the
|
|
// trailing whack or NULL.
|
|
ASSERT(! (EnvPath.Length & 1));
|
|
PathLengthInBytes += EnvPath.Length + sizeof(UNICODE_NULL);
|
|
}
|
|
|
|
break;
|
|
|
|
DEFAULT_UNREACHABLE;
|
|
|
|
} // switch (*Element)
|
|
} // foreach Element (Elements) -- size loop
|
|
|
|
ASSERT(PathLengthInBytes > 0);
|
|
ASSERT(! (PathLengthInBytes & 1));
|
|
|
|
// Now we have the length, in bytes, of the buffer we'll need for
|
|
// our path. Time to allocate it...
|
|
|
|
PathBuffer = RtlAllocateHeap(RtlProcessHeap(),
|
|
MAKE_TAG(TMP_TAG),
|
|
PathLengthInBytes);
|
|
|
|
if (! PathBuffer) {
|
|
Status = STATUS_NO_MEMORY;
|
|
__leave;
|
|
}
|
|
|
|
// Now go through the loop again, this time appending onto the
|
|
// PathBuffer.
|
|
|
|
PathCurrent = PathBuffer;
|
|
|
|
for (Element = Elements;
|
|
*Element != BasepSearchPathEnd;
|
|
Element++) {
|
|
|
|
switch (*Element) {
|
|
case BasepSearchPathCurdir:
|
|
ASSERT(((PathCurrent - PathBuffer + 2)
|
|
* sizeof(UNICODE_NULL))
|
|
<= PathLengthInBytes);
|
|
*PathCurrent++ = L'.';
|
|
*PathCurrent++ = L';';
|
|
break;
|
|
|
|
case BasepSearchPathDlldir:
|
|
if (BaseDllDirectory.Length) {
|
|
ASSERT((((PathCurrent - PathBuffer + 1)
|
|
* sizeof(UNICODE_NULL))
|
|
+ BaseDllDirectory.Length)
|
|
<= PathLengthInBytes);
|
|
RtlCopyMemory(PathCurrent,
|
|
BaseDllDirectory.Buffer,
|
|
BaseDllDirectory.Length);
|
|
|
|
PathCurrent += (BaseDllDirectory.Length >> 1);
|
|
*PathCurrent++ = L';';
|
|
}
|
|
|
|
break;
|
|
|
|
case BasepSearchPathAppdir:
|
|
if (AppName && AppNameEnd) {
|
|
ASSERT(((PathCurrent - PathBuffer + 1
|
|
+ (AppNameEnd - AppName))
|
|
* sizeof(UNICODE_NULL))
|
|
<= PathLengthInBytes);
|
|
RtlCopyMemory(PathCurrent,
|
|
AppName,
|
|
((AppNameEnd - AppName)
|
|
* sizeof(UNICODE_NULL)));
|
|
PathCurrent += AppNameEnd - AppName;
|
|
*PathCurrent++ = L';';
|
|
}
|
|
|
|
break;
|
|
|
|
case BasepSearchPathDefaultDirs:
|
|
ASSERT((((PathCurrent - PathBuffer)
|
|
* sizeof(UNICODE_NULL))
|
|
+ BaseDefaultPath.Length)
|
|
<= PathLengthInBytes);
|
|
RtlCopyMemory(PathCurrent,
|
|
BaseDefaultPath.Buffer,
|
|
BaseDefaultPath.Length);
|
|
PathCurrent += (BaseDefaultPath.Length >> 1);
|
|
|
|
// We don't need to add a semicolon here -- baseinit.c
|
|
// appends our trailing semicolon for us.
|
|
|
|
break;
|
|
|
|
case BasepSearchPathEnvPath:
|
|
if (EnvPath.Length) {
|
|
ASSERT((((PathCurrent - PathBuffer + 1)
|
|
* sizeof(UNICODE_NULL))
|
|
+ EnvPath.Length)
|
|
<= PathLengthInBytes);
|
|
RtlCopyMemory(PathCurrent,
|
|
EnvPath.Buffer,
|
|
EnvPath.Length);
|
|
PathCurrent += (EnvPath.Length >> 1);
|
|
*PathCurrent++ = L';';
|
|
}
|
|
break;
|
|
|
|
DEFAULT_UNREACHABLE;
|
|
|
|
} // switch (*Element)
|
|
} // foreach Element (Elements) -- append loop
|
|
|
|
// At this point, PathCurrent points just beyond PathBuffer.
|
|
// Let's assert that...
|
|
ASSERT((PathCurrent - PathBuffer) * sizeof(UNICODE_NULL)
|
|
== PathLengthInBytes);
|
|
|
|
// ... and turn the final ';' into the string terminator.
|
|
ASSERT(PathCurrent > PathBuffer);
|
|
PathCurrent[-1] = UNICODE_NULL;
|
|
|
|
} __finally {
|
|
if (EnvPathBuffer) {
|
|
RtlFreeHeap(RtlProcessHeap(),
|
|
0,
|
|
EnvPathBuffer);
|
|
}
|
|
|
|
if (PathBuffer
|
|
&& (AbnormalTermination()
|
|
|| ! NT_SUCCESS(Status))) {
|
|
RtlFreeHeap(RtlProcessHeap(),
|
|
0,
|
|
PathBuffer);
|
|
PathBuffer = NULL;
|
|
}
|
|
}
|
|
|
|
return PathBuffer;
|
|
}
|
|
|
|
LPWSTR
|
|
BaseComputeProcessDllPath(
|
|
IN LPCWSTR AppName,
|
|
IN LPVOID Environment
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function computes a process DLL path.
|
|
|
|
Arguments:
|
|
|
|
AppName - An optional argument that specifies the name of
|
|
the application. If this parameter is not specified, then the
|
|
current application is used.
|
|
|
|
Environment - Supplies the environment block to be used to calculate
|
|
the path variable value.
|
|
|
|
Return Value:
|
|
|
|
The return value is the value of the processes DLL path.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
HANDLE Key;
|
|
|
|
static UNICODE_STRING
|
|
KeyName = RTL_CONSTANT_STRING(L"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager"),
|
|
ValueName = RTL_CONSTANT_STRING(L"SafeDllSearchMode");
|
|
|
|
static OBJECT_ATTRIBUTES
|
|
ObjA = RTL_CONSTANT_OBJECT_ATTRIBUTES(&KeyName, OBJ_CASE_INSENSITIVE);
|
|
|
|
CHAR Buffer[FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data)
|
|
+ sizeof(DWORD)];
|
|
PKEY_VALUE_PARTIAL_INFORMATION Info;
|
|
ULONG ResultLength;
|
|
LONG CurrentDirPlacement,
|
|
PrevCurrentDirPlacement;
|
|
LPWSTR Result;
|
|
|
|
static const BASEP_SEARCH_PATH_ELEMENT DllDirSearchPath[] = {
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathDlldir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
};
|
|
|
|
RtlEnterCriticalSection(&BaseDllDirectoryLock);
|
|
if (BaseDllDirectory.Buffer) {
|
|
Result = BasepComputeProcessPath(DllDirSearchPath,
|
|
AppName,
|
|
Environment);
|
|
RtlLeaveCriticalSection(&BaseDllDirectoryLock);
|
|
return Result;
|
|
}
|
|
RtlLeaveCriticalSection(&BaseDllDirectoryLock);
|
|
|
|
CurrentDirPlacement = BasepDllCurrentDirPlacement;
|
|
|
|
if (CurrentDirPlacement == BasepCurrentDirUninitialized) {
|
|
|
|
Status = NtOpenKey(&Key,
|
|
KEY_QUERY_VALUE,
|
|
&ObjA);
|
|
|
|
if (! NT_SUCCESS(Status)) {
|
|
goto compute_path;
|
|
}
|
|
|
|
Info = (PKEY_VALUE_PARTIAL_INFORMATION) Buffer;
|
|
Status = NtQueryValueKey(Key,
|
|
&ValueName,
|
|
KeyValuePartialInformation,
|
|
Info,
|
|
sizeof(Buffer),
|
|
&ResultLength);
|
|
if (! NT_SUCCESS(Status)) {
|
|
goto close_key;
|
|
}
|
|
|
|
if (ResultLength != sizeof(Buffer)) {
|
|
goto close_key;
|
|
}
|
|
|
|
RtlCopyMemory(&CurrentDirPlacement,
|
|
Info->Data,
|
|
sizeof(DWORD));
|
|
|
|
close_key:
|
|
NtClose(Key);
|
|
|
|
compute_path:
|
|
if (! BASEP_VALID_CURDIR_PLACEMENT_P(CurrentDirPlacement)) {
|
|
CurrentDirPlacement = BASEP_DEFAULT_DLL_CURDIR_PLACEMENT;
|
|
}
|
|
|
|
PrevCurrentDirPlacement = InterlockedCompareExchange(&BasepDllCurrentDirPlacement,
|
|
CurrentDirPlacement,
|
|
BasepCurrentDirUninitialized);
|
|
|
|
if (PrevCurrentDirPlacement != BasepCurrentDirUninitialized) {
|
|
CurrentDirPlacement = PrevCurrentDirPlacement;
|
|
}
|
|
}
|
|
|
|
if (! BASEP_VALID_CURDIR_PLACEMENT_P(CurrentDirPlacement)) {
|
|
CurrentDirPlacement = BASEP_DEFAULT_DLL_CURDIR_PLACEMENT;
|
|
}
|
|
|
|
return BasepComputeProcessPath(BasepDllSearchPaths[CurrentDirPlacement],
|
|
AppName,
|
|
Environment);
|
|
}
|
|
|
|
LPWSTR
|
|
BaseComputeProcessSearchPath(
|
|
VOID
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function computes a process search path.
|
|
|
|
Arguments:
|
|
|
|
None
|
|
|
|
Return Value:
|
|
|
|
The return value is the value of the processes search path.
|
|
|
|
--*/
|
|
|
|
{
|
|
static const BASEP_SEARCH_PATH_ELEMENT SearchPath[] = {
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathCurdir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
};
|
|
|
|
return BasepComputeProcessPath(SearchPath,
|
|
NULL,
|
|
NULL);
|
|
}
|
|
|
|
LPWSTR
|
|
BaseComputeProcessExePath(
|
|
LPCWSTR ExeName
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function computes a process exe path.
|
|
|
|
Arguments:
|
|
|
|
ExeName - The name of the exe which will be looked for.
|
|
|
|
Return Value:
|
|
|
|
The return value is the value of the processes exe path.
|
|
|
|
--*/
|
|
|
|
{
|
|
static const BASEP_SEARCH_PATH_ELEMENT UseDotSearchPath[] = {
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathCurdir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
};
|
|
|
|
static const BASEP_SEARCH_PATH_ELEMENT NoDotSearchPath[] = {
|
|
BasepSearchPathAppdir,
|
|
BasepSearchPathDefaultDirs,
|
|
BasepSearchPathEnvPath,
|
|
BasepSearchPathEnd
|
|
};
|
|
|
|
return BasepComputeProcessPath((NeedCurrentDirectoryForExePathW(ExeName)
|
|
? UseDotSearchPath
|
|
: NoDotSearchPath),
|
|
NULL,
|
|
NULL);
|
|
}
|
|
|
|
PUNICODE_STRING
|
|
Basep8BitStringToStaticUnicodeString(
|
|
IN LPCSTR lpSourceString
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Captures and converts a 8-bit (OEM or ANSI) string into the Teb Static
|
|
Unicode String
|
|
|
|
Arguments:
|
|
|
|
lpSourceString - string in OEM or ANSI
|
|
|
|
Return Value:
|
|
|
|
Pointer to the Teb static string if conversion was successful, NULL
|
|
otherwise. If a failure occurred, the last error is set.
|
|
|
|
--*/
|
|
|
|
{
|
|
PUNICODE_STRING StaticUnicode;
|
|
ANSI_STRING AnsiString;
|
|
NTSTATUS Status;
|
|
|
|
//
|
|
// Get pointer to static per-thread string
|
|
//
|
|
|
|
StaticUnicode = &NtCurrentTeb()->StaticUnicodeString;
|
|
|
|
//
|
|
// Convert input string into unicode string
|
|
//
|
|
|
|
Status = RtlInitAnsiStringEx( &AnsiString, lpSourceString );
|
|
if( NT_SUCCESS(Status) ) {
|
|
Status = Basep8BitStringToUnicodeString( StaticUnicode, &AnsiString, FALSE );
|
|
} else {
|
|
Status = STATUS_BUFFER_OVERFLOW;
|
|
}
|
|
|
|
//
|
|
// If we couldn't convert the string
|
|
//
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
if ( Status == STATUS_BUFFER_OVERFLOW ) {
|
|
SetLastError( ERROR_FILENAME_EXCED_RANGE );
|
|
} else {
|
|
BaseSetLastNTError( Status );
|
|
}
|
|
return NULL;
|
|
} else {
|
|
return StaticUnicode;
|
|
}
|
|
}
|
|
|
|
BOOL
|
|
Basep8BitStringToDynamicUnicodeString(
|
|
OUT PUNICODE_STRING UnicodeString,
|
|
IN LPCSTR lpSourceString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Captures and converts a 8-bit (OEM or ANSI) string into a heap-allocated
|
|
UNICODE string
|
|
|
|
Arguments:
|
|
|
|
UnicodeString - location where UNICODE_STRING is stored
|
|
|
|
lpSourceString - string in OEM or ANSI
|
|
|
|
Return Value:
|
|
|
|
TRUE if string is correctly stored, FALSE if an error occurred. In the
|
|
error case, the last error is correctly set.
|
|
|
|
--*/
|
|
|
|
{
|
|
ANSI_STRING AnsiString;
|
|
NTSTATUS Status;
|
|
|
|
//
|
|
// Convert input into dynamic unicode string
|
|
//
|
|
|
|
Status = RtlInitAnsiStringEx( &AnsiString, lpSourceString );
|
|
if( NT_SUCCESS(Status) ) {
|
|
Status = Basep8BitStringToUnicodeString( UnicodeString, &AnsiString, TRUE );
|
|
} else {
|
|
Status = STATUS_BUFFER_OVERFLOW;
|
|
}
|
|
|
|
|
|
//
|
|
// If we couldn't do this, fail
|
|
//
|
|
|
|
if (!NT_SUCCESS( Status )){
|
|
if ( Status == STATUS_BUFFER_OVERFLOW ) {
|
|
SetLastError( ERROR_FILENAME_EXCED_RANGE );
|
|
} else {
|
|
BaseSetLastNTError( Status );
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
//
|
|
// Thunks for converting between ANSI/OEM and UNICODE
|
|
//
|
|
|
|
ULONG
|
|
BasepAnsiStringToUnicodeSize(
|
|
PANSI_STRING AnsiString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines the size of a UNICODE version of an ANSI string
|
|
|
|
Arguments:
|
|
|
|
AnsiString - string to examine
|
|
|
|
Return Value:
|
|
|
|
Byte size of UNICODE version of string including a trailing L'\0'.
|
|
|
|
--*/
|
|
{
|
|
return RtlAnsiStringToUnicodeSize( AnsiString );
|
|
}
|
|
|
|
|
|
|
|
ULONG
|
|
BasepOemStringToUnicodeSize(
|
|
PANSI_STRING OemString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines the size of a UNICODE version of an OEM string
|
|
|
|
Arguments:
|
|
|
|
OemString - string to examine
|
|
|
|
Return Value:
|
|
|
|
Byte size of UNICODE version of string including a trailing L'\0'.
|
|
|
|
--*/
|
|
{
|
|
return RtlOemStringToUnicodeSize( OemString );
|
|
}
|
|
|
|
|
|
|
|
ULONG
|
|
BasepUnicodeStringToOemSize(
|
|
PUNICODE_STRING UnicodeString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines the size of an OEM version of a UNICODE string
|
|
|
|
Arguments:
|
|
|
|
UnicodeString - string to examine
|
|
|
|
Return Value:
|
|
|
|
Byte size of OEM version of string including a trailing '\0'.
|
|
|
|
--*/
|
|
{
|
|
return RtlUnicodeStringToOemSize( UnicodeString );
|
|
}
|
|
|
|
|
|
|
|
ULONG
|
|
BasepUnicodeStringToAnsiSize(
|
|
PUNICODE_STRING UnicodeString
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines the size of an ANSI version of a UNICODE string
|
|
|
|
Arguments:
|
|
|
|
UnicodeString - string to examine
|
|
|
|
Return Value:
|
|
|
|
Byte size of ANSI version of string including a trailing '\0'.
|
|
|
|
--*/
|
|
{
|
|
return RtlUnicodeStringToAnsiSize( UnicodeString );
|
|
}
|
|
|
|
|
|
|
|
typedef struct _BASEP_ACQUIRE_STATE {
|
|
HANDLE Token;
|
|
PTOKEN_PRIVILEGES OldPrivileges;
|
|
PTOKEN_PRIVILEGES NewPrivileges;
|
|
ULONG Revert;
|
|
ULONG Spare;
|
|
BYTE OldPrivBuffer[ 1024 ];
|
|
} BASEP_ACQUIRE_STATE, *PBASEP_ACQUIRE_STATE;
|
|
|
|
|
|
//
|
|
// This function does the correct thing - it checks for the thread token
|
|
// before opening the process token.
|
|
//
|
|
|
|
|
|
NTSTATUS
|
|
BasepAcquirePrivilegeEx(
|
|
ULONG Privilege,
|
|
PVOID *ReturnedState
|
|
)
|
|
{
|
|
PBASEP_ACQUIRE_STATE State;
|
|
ULONG cbNeeded;
|
|
LUID LuidPrivilege;
|
|
NTSTATUS Status, Status1;
|
|
BOOL St;
|
|
|
|
//
|
|
// Make sure we have access to adjust and to get the old token privileges
|
|
//
|
|
|
|
*ReturnedState = NULL;
|
|
State = RtlAllocateHeap (RtlProcessHeap(),
|
|
MAKE_TAG( TMP_TAG ),
|
|
sizeof(BASEP_ACQUIRE_STATE) +
|
|
sizeof(TOKEN_PRIVILEGES) +
|
|
(1 - ANYSIZE_ARRAY) * sizeof(LUID_AND_ATTRIBUTES));
|
|
if (State == NULL) {
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
State->Revert = 0;
|
|
|
|
if (RtlIsImpersonating()) {
|
|
//
|
|
// We're impersonating. So make sure we use the specified
|
|
// impersonation token.
|
|
//
|
|
|
|
Status = NtOpenThreadToken (NtCurrentThread(),
|
|
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
|
|
FALSE,
|
|
&State->Token);
|
|
if (! NT_SUCCESS(Status)) {
|
|
RtlFreeHeap(RtlProcessHeap(), 0, State);
|
|
return Status;
|
|
}
|
|
} else {
|
|
//
|
|
// We're not impersonating. So make a copy of the process
|
|
// token, and impersonate that, so that we're monkeying about
|
|
// with our own privs instead of everyone's.
|
|
//
|
|
|
|
Status = RtlImpersonateSelf (SecurityDelegation);
|
|
if (!NT_SUCCESS (Status)) {
|
|
RtlFreeHeap (RtlProcessHeap(), 0, State);
|
|
return Status;
|
|
}
|
|
Status = NtOpenThreadToken (NtCurrentThread(),
|
|
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
|
|
FALSE,
|
|
&State->Token);
|
|
|
|
if (!NT_SUCCESS (Status)) {
|
|
State->Token = NULL;
|
|
Status1 = NtSetInformationThread (NtCurrentThread(),
|
|
ThreadImpersonationToken,
|
|
&State->Token,
|
|
sizeof (State->Token));
|
|
ASSERT (NT_SUCCESS (Status1));
|
|
RtlFreeHeap( RtlProcessHeap(), 0, State );
|
|
return Status;
|
|
}
|
|
|
|
State->Revert = 1;
|
|
}
|
|
|
|
State->NewPrivileges = (PTOKEN_PRIVILEGES)(State+1);
|
|
State->OldPrivileges = (PTOKEN_PRIVILEGES)(State->OldPrivBuffer);
|
|
|
|
//
|
|
// Initialize the privilege adjustment structure
|
|
//
|
|
|
|
LuidPrivilege = RtlConvertUlongToLuid(Privilege);
|
|
State->NewPrivileges->PrivilegeCount = 1;
|
|
State->NewPrivileges->Privileges[0].Luid = LuidPrivilege;
|
|
State->NewPrivileges->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
|
|
//
|
|
// Enable the privilege
|
|
//
|
|
|
|
cbNeeded = sizeof( State->OldPrivBuffer );
|
|
Status = NtAdjustPrivilegesToken (State->Token,
|
|
FALSE,
|
|
State->NewPrivileges,
|
|
cbNeeded,
|
|
State->OldPrivileges,
|
|
&cbNeeded);
|
|
|
|
|
|
|
|
if (Status == STATUS_BUFFER_TOO_SMALL) {
|
|
State->OldPrivileges = RtlAllocateHeap (RtlProcessHeap(), MAKE_TAG( TMP_TAG ), cbNeeded);
|
|
if (State->OldPrivileges == NULL) {
|
|
Status = STATUS_NO_MEMORY;
|
|
} else {
|
|
Status = NtAdjustPrivilegesToken (State->Token,
|
|
FALSE,
|
|
State->NewPrivileges,
|
|
cbNeeded,
|
|
State->OldPrivileges,
|
|
&cbNeeded);
|
|
}
|
|
}
|
|
|
|
//
|
|
// STATUS_NOT_ALL_ASSIGNED means that the privilege isn't
|
|
// in the token, so we can't proceed.
|
|
//
|
|
// This is a warning level status, so map it to an error status.
|
|
//
|
|
|
|
if (Status == STATUS_NOT_ALL_ASSIGNED) {
|
|
Status = STATUS_PRIVILEGE_NOT_HELD;
|
|
}
|
|
|
|
|
|
if (!NT_SUCCESS( Status )) {
|
|
if (State->OldPrivileges != (PTOKEN_PRIVILEGES)State->OldPrivBuffer) {
|
|
RtlFreeHeap( RtlProcessHeap(), 0, State->OldPrivileges );
|
|
}
|
|
|
|
St = CloseHandle (State->Token);
|
|
ASSERT (St);
|
|
State->Token = NULL;
|
|
if (State->Revert) {
|
|
Status1 = NtSetInformationThread (NtCurrentThread(),
|
|
ThreadImpersonationToken,
|
|
&State->Token,
|
|
sizeof (State->Token));
|
|
ASSERT (NT_SUCCESS (Status1));
|
|
}
|
|
RtlFreeHeap( RtlProcessHeap(), 0, State );
|
|
return Status;
|
|
}
|
|
|
|
*ReturnedState = State;
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
VOID
|
|
BasepReleasePrivilege(
|
|
PVOID StatePointer
|
|
)
|
|
{
|
|
BOOL St;
|
|
NTSTATUS Status;
|
|
PBASEP_ACQUIRE_STATE State = (PBASEP_ACQUIRE_STATE)StatePointer;
|
|
|
|
if (!State->Revert) {
|
|
NtAdjustPrivilegesToken (State->Token,
|
|
FALSE,
|
|
State->OldPrivileges,
|
|
0,
|
|
NULL,
|
|
NULL);
|
|
}
|
|
|
|
if (State->OldPrivileges != (PTOKEN_PRIVILEGES)State->OldPrivBuffer) {
|
|
RtlFreeHeap( RtlProcessHeap(), 0, State->OldPrivileges );
|
|
}
|
|
|
|
St = CloseHandle( State->Token );
|
|
ASSERT (St);
|
|
|
|
State->Token = NULL;
|
|
if (State->Revert) {
|
|
Status = NtSetInformationThread (NtCurrentThread(),
|
|
ThreadImpersonationToken,
|
|
&State->Token,
|
|
sizeof (State->Token));
|
|
ASSERT (NT_SUCCESS (Status));
|
|
}
|
|
RtlFreeHeap( RtlProcessHeap(), 0, State );
|
|
return;
|
|
}
|