windows-xp/Source/XPSP1/NT/windows/appcompat/shims/verifier/securitychecks.cpp

/*++

 Copyright (c) 2001 Microsoft Corporation

 Module Name:

   SecurityChecks.cpp

 Abstract:

   This AppVerifier shim hooks CreateProcess, CreateProcessAsUser,
   and WinExec and checks to see if some conditions exist that
   might allow trojan horse behavior to occur.
   
 Notes:

   This is a general purpose shim.

 History:

   12/13/2001   rparsons    Created

--*/

#include "precomp.h"

IMPLEMENT_SHIM_BEGIN(SecurityChecks)
#include "ShimHookMacro.h"

//
// verifier log entries
//
BEGIN_DEFINE_VERIFIER_LOG(SecurityChecks)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_BADARGUMENTS)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WINEXEC)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_NULL_DACL)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WORLDWRITE_DACL)
END_DEFINE_VERIFIER_LOG(SecurityChecks)

INIT_VERIFIER_LOG(SecurityChecks);

APIHOOK_ENUM_BEGIN
    APIHOOK_ENUM_ENTRY(CreateProcessA)
    APIHOOK_ENUM_ENTRY(CreateProcessW)
    APIHOOK_ENUM_ENTRY(CreateProcessAsUserA)
    APIHOOK_ENUM_ENTRY(CreateProcessAsUserW)
    APIHOOK_ENUM_ENTRY(WinExec)

	APIHOOK_ENUM_ENTRY(CreateFileA)	
	APIHOOK_ENUM_ENTRY(CreateFileW)
	APIHOOK_ENUM_ENTRY(CreateDesktopA)	
	APIHOOK_ENUM_ENTRY(CreateDesktopW)	
	APIHOOK_ENUM_ENTRY(CreateWindowStationA)
	APIHOOK_ENUM_ENTRY(CreateWindowStationW)
    
    APIHOOK_ENUM_ENTRY(RegCreateKeyExA)
    APIHOOK_ENUM_ENTRY(RegCreateKeyExW)
    APIHOOK_ENUM_ENTRY(RegSaveKeyA)
    APIHOOK_ENUM_ENTRY(RegSaveKeyW)
    APIHOOK_ENUM_ENTRY(RegSaveKeyExA)
    APIHOOK_ENUM_ENTRY(RegSaveKeyExW)

    APIHOOK_ENUM_ENTRY(CreateFileMappingA)
    APIHOOK_ENUM_ENTRY(CreateFileMappingW)
    APIHOOK_ENUM_ENTRY(CreateJobObjectA)
    APIHOOK_ENUM_ENTRY(CreateJobObjectW)
    APIHOOK_ENUM_ENTRY(CreateThread)
    APIHOOK_ENUM_ENTRY(CreateRemoteThread)

    APIHOOK_ENUM_ENTRY(CreateDirectoryA)
    APIHOOK_ENUM_ENTRY(CreateDirectoryW)
    APIHOOK_ENUM_ENTRY(CreateDirectoryExA)
    APIHOOK_ENUM_ENTRY(CreateDirectoryExW)
    APIHOOK_ENUM_ENTRY(CreateHardLinkA)
    APIHOOK_ENUM_ENTRY(CreateHardLinkW)
    APIHOOK_ENUM_ENTRY(CreateMailslotA)
    APIHOOK_ENUM_ENTRY(CreateMailslotW)
    APIHOOK_ENUM_ENTRY(CreateNamedPipeA)
    APIHOOK_ENUM_ENTRY(CreateNamedPipeW)
    APIHOOK_ENUM_ENTRY(CreatePipe)
    APIHOOK_ENUM_ENTRY(CreateMutexA)
    APIHOOK_ENUM_ENTRY(CreateMutexW)
    APIHOOK_ENUM_ENTRY(CreateSemaphoreA)
    APIHOOK_ENUM_ENTRY(CreateSemaphoreW)
    APIHOOK_ENUM_ENTRY(CreateWaitableTimerA)
    APIHOOK_ENUM_ENTRY(CreateWaitableTimerW)

    //APIHOOK_ENUM_ENTRY(ClusterRegCreateKey)
    //APIHOOK_ENUM_ENTRY(CreateNtmsMediaPoolA)
    //APIHOOK_ENUM_ENTRY(CreateNtmsMediaPoolW)

APIHOOK_ENUM_END

BYTE g_ajSidBuffer[SECURITY_MAX_SID_SIZE];
PSID g_pWorldSid = NULL;

WCHAR g_wszWinDir[MAX_PATH];
DWORD g_dwWinDirLen = 0;

void
InitWorldSid(
    void
    )
{
    DWORD dwSidSize = sizeof(g_ajSidBuffer);

    if (CreateWellKnownSid(WinWorldSid, NULL, g_ajSidBuffer, &dwSidSize)) {
        g_pWorldSid = g_ajSidBuffer;
    } else {
        g_pWorldSid = NULL;
    }
}

void
CheckSecurityDescriptor(
    PSECURITY_DESCRIPTOR    pSecurityDescriptor,
    LPCWSTR                 szCaller,
    LPCWSTR                 szParam,
    LPCWSTR                 szName
    )
{
    BOOL                    bDaclPresent = FALSE;
    BOOL                    bDaclDefaulted = FALSE;
    PACL                    pDacl = NULL;

    if (!pSecurityDescriptor || !szName || !szName[0]) {
        //
        // there's no attributes, so they get the default, which is fine,
        // or the object doesn't have a name, so it can't be highjacked
        //
        return;
    }

    if (GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pDacl, &bDaclDefaulted)) {
        if (bDaclPresent) {
            if (!pDacl) {
                //
                // we have a NULL dacl -- log a problem
                //
                VLOG(VLOG_LEVEL_ERROR,
                     VLOG_SECURITYCHECKS_NULL_DACL,
                     "Called %ls, and specified a NULL DACL in %ls for object '%ls.'",
                     szCaller,
                     szParam,
                     szName);
                return;
            }

            if (!g_pWorldSid) {
                //
                // we never were able to get the world Sid
                //
                return;
            }

            for (DWORD i = 0; i < pDacl->AceCount; ++i) {
                PACE_HEADER     pAceHeader = NULL;
                PSID            pSID;
                ACCESS_MASK     dwAccessMask;

                if (!GetAce(pDacl, i, (LPVOID*)&pAceHeader)) {
                    continue;
                }

                //
                // if it's not some form of ACCESS_ALLOWED ACE, we aren't interested
                //
                if (pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE) {

                    pSID = &(((PACCESS_ALLOWED_ACE)pAceHeader)->SidStart);
                    dwAccessMask = ((PACCESS_ALLOWED_ACE)pAceHeader)->Mask;

                } else if (pAceHeader->AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE) {

                    PACCESS_ALLOWED_OBJECT_ACE pAAOAce = (PACCESS_ALLOWED_OBJECT_ACE)pAceHeader;

                    //
                    // who the heck came up with this system? The Sid starts at a different place
                    // depending on the flags. Anyone ever heard of multiple structs? Sigh.
                    //
                    if ((pAAOAce->Flags & ACE_OBJECT_TYPE_PRESENT) && (pAAOAce->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)) {

                        pSID = &(pAAOAce->SidStart);

                    } else if ((pAAOAce->Flags & ACE_OBJECT_TYPE_PRESENT) || (pAAOAce->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)){

                        pSID = (PSID)&(pAAOAce->InheritedObjectType);

                    } else {

                        pSID = (PSID)&(pAAOAce->ObjectType);
                    }

                    dwAccessMask = ((PACCESS_ALLOWED_OBJECT_ACE)pAceHeader)->Mask;

                } else {
                    continue;
                }

                //
                // check the validity of the SID, just to be safe
                //
                if (!IsValidSid(pSID)) {

                    continue;
                }


                //
                // if the SID is the world, and the access mask allows WRITE_DAC and WRITE_OWNER, we have a problem
                //
                if ((dwAccessMask & (WRITE_DAC | WRITE_OWNER)) && EqualSid(pSID, g_pWorldSid)) {
                    VLOG(VLOG_LEVEL_ERROR,
                         VLOG_SECURITYCHECKS_WORLDWRITE_DACL,
                         "Called %ls, and specified a DACL with WRITE_DAC and/or WRITE_OWNER for WORLD in %ls for object '%ls.'",
                         szCaller,
                         szParam,
                         szName);
                    return;
                }

            }

        }

    }

}

void
CheckSecurityAttributes(
    LPSECURITY_ATTRIBUTES   pSecurityAttrib,
    LPCWSTR                 szCaller,
    LPCWSTR                 szParam,
    LPCWSTR                 szName
    )
{
    PSECURITY_DESCRIPTOR    pSecurityDescriptor = NULL;

    if (!pSecurityAttrib) {
        //
        // there's no attributes, so they get the default, which is fine
        //
        return;
    }

    pSecurityDescriptor = (PSECURITY_DESCRIPTOR)pSecurityAttrib->lpSecurityDescriptor;

    CheckSecurityDescriptor(pSecurityDescriptor, szCaller, szParam, szName);
}

void
CheckCreateProcess(
    LPCWSTR		pwszApplicationName,
    LPCWSTR		pwszCommandLine,
    LPCWSTR		pwszCaller
    )
{
    //
    // if applicationname is non-null, there's no problem
    //
    if (pwszApplicationName) {
        return;
    }

    //
    // if there's no command line, there's a problem, but not one we want to solve
    //
    if (!pwszCommandLine) {
        return;
    }

    //
    // if there are no spaces, no problem
    //
    LPWSTR pSpaceLoc = wcschr(pwszCommandLine, L' ');
    if (!pSpaceLoc) {
        return;
    }

    //
    // if the beginning of the command line is quoted, no problem
    //
    if (pwszCommandLine[0] == L'\"') {
        return;
    }

    //
    // if the phrase '.exe ' appears before the first space, we'll call that good
    //
    LPWSTR pExeLoc = wcsistr(pwszCommandLine, L".exe ");
    if (pExeLoc && pExeLoc < pSpaceLoc) {
        return;
    }

    //
    // if the first part of the command line is windir, we'll call that good
    //
    if (g_dwWinDirLen && _wcsnicmp(pwszCommandLine, g_wszWinDir, g_dwWinDirLen) == 0) {
        return;
    }


	if (_wcsicmp(pwszCaller, L"winexec") == 0) {
		VLOG(VLOG_LEVEL_ERROR,
			 VLOG_SECURITYCHECKS_BADARGUMENTS,
			 "Called %ls with command line '%ls'. The command line has spaces, and the exe name is not in quotes.",
			 pwszCaller,
			 pwszCommandLine);
    } else {
		VLOG(VLOG_LEVEL_ERROR,
			 VLOG_SECURITYCHECKS_BADARGUMENTS,
			 "Called %ls with command line '%ls'. The lpApplicationName argument is NULL, lpCommandLine has spaces, and the exe name is not in quotes.",
			 pwszCaller,
			 pwszCommandLine);
    }
}

void
CheckForNoPathInFileName(
    LPCWSTR  pwszFilePath,
    LPCWSTR  pwszCaller
    )
{
    if (!pwszFilePath || !pwszCaller) {
        return;
    }

    //
    // skip quotes and space if necessary
    //
    DWORD dwBegin = 0;
    while (pwszFilePath[dwBegin] == L'\"' || pwszFilePath[dwBegin] == L' ') {
        dwBegin++;
    }

    //
    // if there's nothing left of the string, get out
    //
    if (!pwszFilePath[dwBegin] || !pwszFilePath[dwBegin + 1]) {
        return;
    }

    //
    // check for DOS (x:...) and UNC (\\...) full paths
    //
    if (pwszFilePath[dwBegin + 1] == L':' || (pwszFilePath[dwBegin] == L'\\' && pwszFilePath[dwBegin + 1] == L'\\')) {
        //
        // full path
        //
        return;
    }

    VLOG(VLOG_LEVEL_ERROR,
         VLOG_SECURITYCHECKS_BADARGUMENTS,
         "Called '%ls' with '%ls' specified. Use a full path to the file to ensure that you get the executable you want, and not a malicious exe with the same name.",
         pwszCaller,
         pwszFilePath);
}

BOOL 
APIHOOK(CreateProcessA)(
    LPCSTR                lpApplicationName,
    LPSTR                 lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes, 
    LPSECURITY_ATTRIBUTES lpThreadAttributes, 
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPCSTR                lpCurrentDirectory,
    LPSTARTUPINFOA        lpStartupInfo, 
    LPPROCESS_INFORMATION lpProcessInformation 
    )
{
    LPWSTR pwszApplicationName = ToUnicode(lpApplicationName);
    LPWSTR pwszCommandLine = ToUnicode(lpCommandLine);

    CheckCreateProcess(pwszApplicationName, pwszCommandLine, L"CreateProcess");

    if (pwszApplicationName) {
        CheckForNoPathInFileName(pwszApplicationName, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", pwszApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", pwszApplicationName);
    } else {
        CheckForNoPathInFileName(pwszCommandLine, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", pwszCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", pwszCommandLine);
    }

    if (pwszApplicationName) {
        free(pwszApplicationName);
        pwszApplicationName = NULL;
    }
    if (pwszCommandLine) {
        free(pwszCommandLine);
        pwszCommandLine = NULL;
    }

    return ORIGINAL_API(CreateProcessA)(lpApplicationName,
                                        lpCommandLine,
                                        lpProcessAttributes,
                                        lpThreadAttributes,
                                        bInheritHandles,
                                        dwCreationFlags,
                                        lpEnvironment,
                                        lpCurrentDirectory,
                                        lpStartupInfo,
                                        lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessW)(
    LPCWSTR               lpApplicationName,
    LPWSTR                lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPWSTR                lpCurrentDirectory,
    LPSTARTUPINFOW        lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    )
{
    CheckCreateProcess(lpApplicationName, lpCommandLine, L"CreateProcess");

    if (lpApplicationName) {
        CheckForNoPathInFileName(lpApplicationName, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", lpApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", lpApplicationName);
    } else {
        CheckForNoPathInFileName(lpCommandLine, L"CreateProcess");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", lpCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", lpCommandLine);
    }


    return ORIGINAL_API(CreateProcessW)(lpApplicationName,
                                        lpCommandLine,
                                        lpProcessAttributes,
                                        lpThreadAttributes,
                                        bInheritHandles,
                                        dwCreationFlags,
                                        lpEnvironment,
                                        lpCurrentDirectory,
                                        lpStartupInfo,
                                        lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessAsUserA)(
    HANDLE                hToken,
    LPCSTR                lpApplicationName,
    LPSTR                 lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes, 
    LPSECURITY_ATTRIBUTES lpThreadAttributes, 
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPCSTR                lpCurrentDirectory,
    LPSTARTUPINFOA        lpStartupInfo, 
    LPPROCESS_INFORMATION lpProcessInformation 
    )
{
    LPWSTR pwszApplicationName = ToUnicode(lpApplicationName);
    LPWSTR pwszCommandLine = ToUnicode(lpCommandLine);

    CheckCreateProcess(pwszApplicationName, pwszCommandLine, L"CreateProcessAsUser");

    if (pwszApplicationName) {
        CheckForNoPathInFileName(pwszApplicationName, L"CreateProcessAsUser");

        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", pwszApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", pwszApplicationName);
    } else {
        CheckForNoPathInFileName(pwszCommandLine, L"CreateProcessAsUser");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", pwszCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", pwszCommandLine);
    }

    if (pwszApplicationName) {
        free(pwszApplicationName);
        pwszApplicationName = NULL;
    }
    if (pwszCommandLine) {
        free(pwszCommandLine);
        pwszCommandLine = NULL;
    }

    return ORIGINAL_API(CreateProcessAsUserA)(hToken,
                                              lpApplicationName,
                                              lpCommandLine,
                                              lpProcessAttributes,    
                                              lpThreadAttributes,
                                              bInheritHandles,
                                              dwCreationFlags,
                                              lpEnvironment,
                                              lpCurrentDirectory,
                                              lpStartupInfo,
                                              lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessAsUserW)(
    HANDLE                hToken,
    LPCWSTR               lpApplicationName,
    LPWSTR                lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPWSTR                lpCurrentDirectory,
    LPSTARTUPINFOW        lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    )
{
    CheckCreateProcess(lpApplicationName, lpCommandLine, L"CreateProcessAsUser");

    if (lpApplicationName) {
        CheckForNoPathInFileName(lpApplicationName, L"CreateProcessAsUser");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", lpApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", lpApplicationName);
    } else {
        CheckForNoPathInFileName(lpCommandLine, L"CreateProcessAsUser");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", lpCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", lpCommandLine);
    }

    return ORIGINAL_API(CreateProcessAsUserW)(hToken,
                                              lpApplicationName,
                                              lpCommandLine,
                                              lpProcessAttributes,
                                              lpThreadAttributes,
                                              bInheritHandles,
                                              dwCreationFlags,
                                              lpEnvironment,
                                              lpCurrentDirectory,
                                              lpStartupInfo,
                                              lpProcessInformation);
}

UINT 
APIHOOK(WinExec)(
    LPCSTR lpCmdLine, 
    UINT   uCmdShow 
    )
{
    LPWSTR pwszCmdLine = ToUnicode(lpCmdLine);

    VLOG(VLOG_LEVEL_ERROR, VLOG_SECURITYCHECKS_WINEXEC, "Called WinExec.");

    CheckForNoPathInFileName(pwszCmdLine, L"WinExec");

    CheckCreateProcess(NULL, pwszCmdLine, L"WinExec");

    if (pwszCmdLine) {
        free(pwszCmdLine);
        pwszCmdLine = NULL;
    }

    return ORIGINAL_API(WinExec)(lpCmdLine, uCmdShow);
}


HANDLE
APIHOOK(CreateFileA)(
    LPCSTR                lpFileName,            // file name
    DWORD                 dwDesiredAccess,       // access mode
    DWORD                 dwShareMode,           // share mode
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  // SD
    DWORD                 dwCreationDisposition, // how to create
    DWORD                 dwFlagsAndAttributes,  // file attributes
    HANDLE                hTemplateFile          // handle to template file
    )
{
    LPWSTR pwszName = ToUnicode(lpFileName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateFile", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateFileA)(lpFileName,
                                     dwDesiredAccess,
                                     dwShareMode,
                                     lpSecurityAttributes,
                                     dwCreationDisposition,
                                     dwFlagsAndAttributes,
                                     hTemplateFile);

}


HANDLE
APIHOOK(CreateFileW)(
    LPCWSTR               lpFileName,            // file name
    DWORD                 dwDesiredAccess,       // access mode
    DWORD                 dwShareMode,           // share mode
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  // SD
    DWORD                 dwCreationDisposition, // how to create
    DWORD                 dwFlagsAndAttributes,  // file attributes
    HANDLE                hTemplateFile          // handle to template file
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateFile", L"lpSecurityAttributes", lpFileName);
    
    return ORIGINAL_API(CreateFileW)(lpFileName,
                                     dwDesiredAccess,
                                     dwShareMode,
                                     lpSecurityAttributes,
                                     dwCreationDisposition,
                                     dwFlagsAndAttributes,
                                     hTemplateFile);
}


HDESK 
APIHOOK(CreateDesktopA)(
    LPCSTR lpszDesktop,          // name of new desktop
    LPCSTR lpszDevice,           // reserved; must be NULL
    LPDEVMODEA pDevmode,         // reserved; must be NULL
    DWORD dwFlags,               // desktop interaction
    ACCESS_MASK dwDesiredAccess, // access of returned handle
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    LPWSTR pwszName = ToUnicode(lpszDesktop);

    CheckSecurityAttributes(lpsa, L"CreateDesktop", L"lpsa", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDesktopA)(lpszDesktop,        
                                        lpszDevice,         
                                        pDevmode,         
                                        dwFlags,              
                                        dwDesiredAccess,
                                        lpsa);
}

HDESK 
APIHOOK(CreateDesktopW)(
    LPCWSTR lpszDesktop,         // name of new desktop
    LPCWSTR lpszDevice,          // reserved; must be NULL
    LPDEVMODEW pDevmode,         // reserved; must be NULL
    DWORD dwFlags,               // desktop interaction
    ACCESS_MASK dwDesiredAccess, // access of returned handle
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    CheckSecurityAttributes(lpsa, L"CreateDesktop", L"lpsa", lpszDesktop);

    return ORIGINAL_API(CreateDesktopW)(lpszDesktop,        
                                        lpszDevice,         
                                        pDevmode,         
                                        dwFlags,              
                                        dwDesiredAccess,
                                        lpsa);
}



HWINSTA 
APIHOOK(CreateWindowStationA)(
    LPSTR lpwinsta,              // new window station name
    DWORD dwReserved,            // reserved; must be zero
    ACCESS_MASK dwDesiredAccess, // requested access
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    LPWSTR pwszName = ToUnicode(lpwinsta);

    CheckSecurityAttributes(lpsa, L"CreateWindowStation", L"lpsa", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateWindowStationA)(lpwinsta,        
                                              dwReserved,         
                                              dwDesiredAccess,
                                              lpsa);
}

HWINSTA 
APIHOOK(CreateWindowStationW)(
    LPWSTR lpwinsta,             // new window station name
    DWORD dwReserved,            // reserved; must be zero
    ACCESS_MASK dwDesiredAccess, // requested access
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    CheckSecurityAttributes(lpsa, L"CreateWindowStation", L"lpsa", lpwinsta);

    return ORIGINAL_API(CreateWindowStationW)(lpwinsta,        
                                              dwReserved,         
                                              dwDesiredAccess,
                                              lpsa);
}


LONG 
APIHOOK(RegCreateKeyExA)(
    HKEY                  hKey,                
    LPCSTR                lpSubKey,         
    DWORD                 Reserved,           
    LPSTR                 lpClass,           
    DWORD                 dwOptions,          
    REGSAM                samDesired,        
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    PHKEY                 phkResult,          
    LPDWORD               lpdwDisposition   
    )
{
    LPWSTR pwszName = ToUnicode(lpSubKey);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegCreateKeyEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegCreateKeyExA)(hKey,
                                         lpSubKey,
                                         Reserved,
                                         lpClass,
                                         dwOptions,
                                         samDesired,
                                         lpSecurityAttributes,
                                         phkResult,
                                         lpdwDisposition);
}

LONG 
APIHOOK(RegCreateKeyExW)(
    HKEY                  hKey,                
    LPCWSTR               lpSubKey,         
    DWORD                 Reserved,           
    LPWSTR                lpClass,           
    DWORD                 dwOptions,          
    REGSAM                samDesired,        
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    PHKEY                 phkResult,          
    LPDWORD               lpdwDisposition   
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegCreateKeyEx", L"lpSecurityAttributes", lpSubKey);
    
    return ORIGINAL_API(RegCreateKeyExW)(hKey,
                                         lpSubKey,
                                         Reserved,
                                         lpClass,
                                         dwOptions,
                                         samDesired,
                                         lpSecurityAttributes,
                                         phkResult,
                                         lpdwDisposition);
}

LONG 
APIHOOK(RegSaveKeyA)(
    HKEY                    hKey,                 // handle to key
    LPCSTR                  lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpFile);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKey", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegSaveKeyA)(hKey,
                                     lpFile,
                                     lpSecurityAttributes);
}

LONG 
APIHOOK(RegSaveKeyW)(
    HKEY                    hKey,                 // handle to key
    LPCWSTR                 lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKey", L"lpSecurityAttributes", lpFile);
    
    return ORIGINAL_API(RegSaveKeyW)(hKey,
                                     lpFile,
                                     lpSecurityAttributes);
}

LONG 
APIHOOK(RegSaveKeyExA)(
    HKEY                    hKey,                 // handle to key
    LPCSTR                  lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes, // SD
    DWORD                   Flags
    )
{
    LPWSTR pwszName = ToUnicode(lpFile);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKeyEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegSaveKeyExA)(hKey,
                                     lpFile,
                                     lpSecurityAttributes,
                                     Flags);
}

LONG 
APIHOOK(RegSaveKeyExW)(
    HKEY                    hKey,                 // handle to key
    LPCWSTR                 lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes, // SD
    DWORD                   Flags
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKeyEx", L"lpSecurityAttributes", lpFile);
    
    return ORIGINAL_API(RegSaveKeyExW)(hKey,
                                       lpFile,
                                       lpSecurityAttributes,
                                       Flags);
}

HANDLE 
APIHOOK(CreateFileMappingA)(
    HANDLE hFile,              
    LPSECURITY_ATTRIBUTES lpAttributes,
    DWORD flProtect,           
    DWORD dwMaximumSizeHigh,   
    DWORD dwMaximumSizeLow,    
    LPCSTR lpName             
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpAttributes, L"CreateFileMapping", L"lpAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateFileMappingA)(hFile, 
                                           lpAttributes, 
                                           flProtect, 
                                           dwMaximumSizeHigh, 
                                           dwMaximumSizeLow, 
                                           lpName);
}

HANDLE 
APIHOOK(CreateFileMappingW)(
    HANDLE hFile,              
    LPSECURITY_ATTRIBUTES lpAttributes,
    DWORD flProtect,           
    DWORD dwMaximumSizeHigh,   
    DWORD dwMaximumSizeLow,    
    LPCWSTR lpName             
    )
{
    CheckSecurityAttributes(lpAttributes, L"CreateFileMapping", L"lpAttributes", lpName);
    
    return ORIGINAL_API(CreateFileMappingW)(hFile, 
                                            lpAttributes, 
                                            flProtect, 
                                            dwMaximumSizeHigh, 
                                            dwMaximumSizeLow, 
                                            lpName);
}

HANDLE 
APIHOOK(CreateJobObjectA)(
    LPSECURITY_ATTRIBUTES   lpJobAttributes,  // SD
    LPCSTR                  lpName            // job name 
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpJobAttributes, L"CreateJobObject", L"lpJobAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateJobObjectA)(lpJobAttributes,
                                          lpName);
}

HANDLE 
APIHOOK(CreateJobObjectW)(
    LPSECURITY_ATTRIBUTES   lpJobAttributes,  // SD
    LPCWSTR                 lpName            // job name 
    )
{
    CheckSecurityAttributes(lpJobAttributes, L"CreateJobObject", L"lpJobAttributes", lpName);
    
    return ORIGINAL_API(CreateJobObjectW)(lpJobAttributes,
                                          lpName);
}


HANDLE
APIHOOK(CreateThread)(
    LPSECURITY_ATTRIBUTES   lpThreadAttributes, // SD
    SIZE_T                  dwStackSize,        // initial stack size
    LPTHREAD_START_ROUTINE  lpStartAddress,     // thread function
    LPVOID                  lpParameter,        // thread argument
    DWORD                   dwCreationFlags,    // creation option
    LPDWORD                 lpThreadId          // thread identifier
    )
{
    CheckSecurityAttributes(lpThreadAttributes, L"CreateThread", L"lpThreadAttributes", L"Unnamed thread");
    
    return ORIGINAL_API(CreateThread)(lpThreadAttributes,
                                      (DWORD)dwStackSize,
                                      lpStartAddress,
                                      lpParameter,    
                                      dwCreationFlags,
                                      lpThreadId);      
}

HANDLE 
APIHOOK(CreateRemoteThread)(
    HANDLE                  hProcess,           // handle to process
    LPSECURITY_ATTRIBUTES   lpThreadAttributes, // SD
    SIZE_T                  dwStackSize,        // initial stack size
    LPTHREAD_START_ROUTINE  lpStartAddress,     // thread function
    LPVOID                  lpParameter,        // thread argument
    DWORD                   dwCreationFlags,    // creation option
    LPDWORD                 lpThreadId          // thread identifier
    )
{
    CheckSecurityAttributes(lpThreadAttributes, L"CreateRemoteThread", L"lpThreadAttributes", L"Unnamed thread");
    
    return ORIGINAL_API(CreateRemoteThread)(hProcess, 
                                            lpThreadAttributes,
                                            dwStackSize,
                                            lpStartAddress,
                                            lpParameter,    
                                            dwCreationFlags,
                                            lpThreadId);      
}




BOOL
APIHOOK(CreateDirectoryA)(
    LPCSTR                lpPathName,           // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpPathName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectory", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDirectoryA)(lpPathName, 
                                          lpSecurityAttributes);
}


BOOL
APIHOOK(CreateDirectoryW)(
    LPCWSTR               lpPathName,           // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectory", L"lpSecurityAttributes", lpPathName);
    
    return ORIGINAL_API(CreateDirectoryW)(lpPathName, 
                                          lpSecurityAttributes);
}


BOOL
APIHOOK(CreateDirectoryExA)(
    LPCSTR                lpTemplateDirectory,   // template directory
    LPCSTR                lpNewDirectory,        // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes   // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpNewDirectory);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectoryEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDirectoryExA)(lpTemplateDirectory,
                                            lpNewDirectory,
                                            lpSecurityAttributes);

}


BOOL
APIHOOK(CreateDirectoryExW)(
    LPCWSTR               lpTemplateDirectory,  // template directory
    LPCWSTR               lpNewDirectory,       // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectoryEx", L"lpSecurityAttributes", lpNewDirectory);
    
    return ORIGINAL_API(CreateDirectoryExW)(lpTemplateDirectory,
                                            lpNewDirectory,
                                            lpSecurityAttributes);

}

BOOL 
APIHOOK(CreateHardLinkA)(
    LPCSTR                  lpFileName,          // link name name
    LPCSTR                  lpExistingFileName,  // target file name
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  
    )
{
    LPWSTR pwszName = ToUnicode(lpFileName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateHardLink", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateHardLinkA)(lpFileName,
                                         lpExistingFileName,
                                         lpSecurityAttributes);


}

BOOL 
APIHOOK(CreateHardLinkW)(
    LPCWSTR                 lpFileName,          // link name name
    LPCWSTR                 lpExistingFileName,  // target file name
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateHardLink", L"lpSecurityAttributes", lpFileName);
    
    return ORIGINAL_API(CreateHardLinkW)(lpFileName,
                                         lpExistingFileName,
                                         lpSecurityAttributes);


}


HANDLE 
APIHOOK(CreateMailslotA)(
    LPCSTR                  lpName,              // mailslot name
    DWORD                   nMaxMessageSize,     // maximum message size
    DWORD                   lReadTimeout,        // read time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes // inheritance option
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateMailslot", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateMailslotA)(lpName,
                                         nMaxMessageSize,
                                         lReadTimeout,
                                         lpSecurityAttributes);
}

HANDLE 
APIHOOK(CreateMailslotW)(
    LPCWSTR                 lpName,              // mailslot name
    DWORD                   nMaxMessageSize,     // maximum message size
    DWORD                   lReadTimeout,        // read time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes // inheritance option
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateMailslot", L"lpSecurityAttributes", lpName);
    
    return ORIGINAL_API(CreateMailslotW)(lpName,
                                         nMaxMessageSize,
                                         lReadTimeout,
                                         lpSecurityAttributes);
}


HANDLE 
APIHOOK(CreateNamedPipeA)(
    LPCSTR                  lpName,                 // pipe name
    DWORD                   dwOpenMode,             // pipe open mode
    DWORD                   dwPipeMode,             // pipe-specific modes
    DWORD                   nMaxInstances,          // maximum number of instances
    DWORD                   nOutBufferSize,         // output buffer size
    DWORD                   nInBufferSize,          // input buffer size
    DWORD                   nDefaultTimeOut,        // time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes    // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNamedPipe", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateNamedPipeA)(lpName,
                                          dwOpenMode, 
                                          dwPipeMode,
                                          nMaxInstances,      
                                          nOutBufferSize,     
                                          nInBufferSize,      
                                          nDefaultTimeOut,    
                                          lpSecurityAttributes);
}

HANDLE 
APIHOOK(CreateNamedPipeW)(
    LPCWSTR                 lpName,                 // pipe name
    DWORD                   dwOpenMode,             // pipe open mode
    DWORD                   dwPipeMode,             // pipe-specific modes
    DWORD                   nMaxInstances,          // maximum number of instances
    DWORD                   nOutBufferSize,         // output buffer size
    DWORD                   nInBufferSize,          // input buffer size
    DWORD                   nDefaultTimeOut,        // time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes    // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNamedPipe", L"lpSecurityAttributes", lpName);
    
    return ORIGINAL_API(CreateNamedPipeW)(lpName,
                                          dwOpenMode, 
                                          dwPipeMode,
                                          nMaxInstances,      
                                          nOutBufferSize,     
                                          nInBufferSize,      
                                          nDefaultTimeOut,    
                                          lpSecurityAttributes);
}

BOOL 
APIHOOK(CreatePipe)(
    PHANDLE                 hReadPipe,         // read handle
    PHANDLE                 hWritePipe,        // write handle
    LPSECURITY_ATTRIBUTES   lpPipeAttributes,  // security attributes
    DWORD                   nSize              // pipe size
    )
{
    CheckSecurityAttributes(lpPipeAttributes, L"CreatePipe", L"lpPipeAttributes", L"Unnamed pipe");
    
    return ORIGINAL_API(CreatePipe)(hReadPipe,
                                    hWritePipe,
                                    lpPipeAttributes,
                                    nSize);
}

HANDLE 
APIHOOK(CreateMutexA)(
    LPSECURITY_ATTRIBUTES lpMutexAttributes,  // SD
    BOOL bInitialOwner,                       // initial owner
    LPCSTR lpName                             // object name
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpMutexAttributes, L"CreateMutex", L"lpMutexAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateMutexA)(lpMutexAttributes,
                                      bInitialOwner,
                                      lpName);
}

HANDLE 
APIHOOK(CreateMutexW)(
    LPSECURITY_ATTRIBUTES lpMutexAttributes,  // SD
    BOOL bInitialOwner,                       // initial owner
    LPCWSTR lpName                            // object name
    )
{
    CheckSecurityAttributes(lpMutexAttributes, L"CreateMutex", L"lpMutexAttributes", lpName);
    
    return ORIGINAL_API(CreateMutexW)(lpMutexAttributes,
                                      bInitialOwner,
                                      lpName);
}

HANDLE 
APIHOOK(CreateSemaphoreA)(
    LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, // SD
    LONG lInitialCount,                          // initial count
    LONG lMaximumCount,                          // maximum count
    LPCSTR lpName                                // object name
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSemaphoreAttributes, L"CreateSemaphore", L"lpSemaphoreAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateSemaphoreA)(lpSemaphoreAttributes,
                                          lInitialCount,
                                          lMaximumCount,
                                          lpName);
}

HANDLE 
APIHOOK(CreateSemaphoreW)(
    LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, // SD
    LONG lInitialCount,                          // initial count
    LONG lMaximumCount,                          // maximum count
    LPCWSTR lpName                               // object name
    )
{
    CheckSecurityAttributes(lpSemaphoreAttributes, L"CreateSemaphore", L"lpSemaphoreAttributes", lpName);
    
    return ORIGINAL_API(CreateSemaphoreW)(lpSemaphoreAttributes,
                                          lInitialCount,
                                          lMaximumCount,
                                          lpName);
}


HANDLE
APIHOOK(CreateWaitableTimerA)(
    IN LPSECURITY_ATTRIBUTES lpTimerAttributes,
    IN BOOL bManualReset,
    IN LPCSTR lpTimerName
    )
{
    LPWSTR pwszName = ToUnicode(lpTimerName);

    CheckSecurityAttributes(lpTimerAttributes, L"CreateWaitableTimer", L"lpTimerAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateWaitableTimerA)(lpTimerAttributes,
                                              bManualReset,
                                              lpTimerName);
}

HANDLE
APIHOOK(CreateWaitableTimerW)(
    IN LPSECURITY_ATTRIBUTES lpTimerAttributes,
    IN BOOL bManualReset,
    IN LPCWSTR lpTimerName
    )
{
    CheckSecurityAttributes(lpTimerAttributes, L"CreateWaitableTimer", L"lpTimerAttributes", lpTimerName);
    
    return ORIGINAL_API(CreateWaitableTimerW)(lpTimerAttributes,
                                              bManualReset,
                                              lpTimerName);
}

#if 0
LONG 
WINAPI 
APIHOOK(ClusterRegCreateKey)(
    HKEY hKey,                                   
    LPCWSTR lpszSubKey,                          
    DWORD dwOptions,                             
    REGSAM samDesired,                           
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  
    PHKEY phkResult,                             
    LPDWORD lpdwDisposition                      
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"ClusterRegCreateKey", L"lpSecurityAttributes");
    
    return ORIGINAL_API(ClusterRegCreateKey)(hKey,
                                             lpszSubKey,
                                             dwOptions,
                                             samDesired,
                                             lpSecurityAttributes,
                                             phkResult,
                                             lpdwDisposition);
}


DWORD 
WINAPI 
APIHOOK(CreateNtmsMediaPoolA)(
    HANDLE hSession,
    LPCSTR lpPoolName,
    LPNTMS_GUID lpMediaType,
    DWORD dwAction,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    LPNTMS_GUID lpPoolId            // OUT
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNtmsMediaPool", L"lpSecurityAttributes");
    
    return ORIGINAL_API(CreateNtmsMediaPoolA)(hSession,
                                             lpPoolName,
                                             lpMediaType,
                                             dwAction,
                                             lpSecurityAttributes,
                                             lpPoolId);

}

DWORD WINAPI 
APIHOOK(CreateNtmsMediaPoolW)(
    HANDLE hSession,
    LPCWSTR lpPoolName,
    LPNTMS_GUID lpMediaType,
    DWORD dwAction,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    LPNTMS_GUID lpPoolId            // OUT
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNtmsMediaPool", L"lpSecurityAttributes");
    
    return ORIGINAL_API(CreateNtmsMediaPoolW)(hSession,
                                             lpPoolName,
                                             lpMediaType,
                                             dwAction,
                                             lpSecurityAttributes,
                                             lpPoolId);
}

#endif



SHIM_INFO_BEGIN()

    SHIM_INFO_DESCRIPTION(AVS_SECURITYCHECKS_DESC)
    SHIM_INFO_FRIENDLY_NAME(AVS_SECURITYCHECKS_FRIENDLY)
    SHIM_INFO_FLAGS(0)
    SHIM_INFO_GROUPS(0)    
    SHIM_INFO_VERSION(2, 3)
    SHIM_INFO_INCLUDE_EXCLUDE("I:*")

SHIM_INFO_END()

/*++

 Register hooked functions.

--*/
HOOK_BEGIN

    if (fdwReason == DLL_PROCESS_ATTACH) {
        DWORD dwSize;

        InitWorldSid();

        dwSize = GetSystemWindowsDirectoryW(g_wszWinDir, ARRAYSIZE(g_wszWinDir));
        if (dwSize == 0 || dwSize > ARRAYSIZE(g_wszWinDir)) {
            g_wszWinDir[0] = 0;
        }
        g_dwWinDirLen = wcslen(g_wszWinDir);
    }

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_BADARGUMENTS, 
                            AVS_SECURITYCHECKS_BADARGUMENTS,
                            AVS_SECURITYCHECKS_BADARGUMENTS_R,
                            AVS_SECURITYCHECKS_BADARGUMENTS_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WINEXEC, 
                            AVS_SECURITYCHECKS_WINEXEC,
                            AVS_SECURITYCHECKS_WINEXEC_R,
                            AVS_SECURITYCHECKS_WINEXEC_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_NULL_DACL, 
                            AVS_SECURITYCHECKS_NULL_DACL,
                            AVS_SECURITYCHECKS_NULL_DACL_R,
                            AVS_SECURITYCHECKS_NULL_DACL_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WORLDWRITE_DACL, 
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL,
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL_R,
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL_URL)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateProcessA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateProcessW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 CreateProcessAsUserA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 CreateProcessAsUserW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 WinExec)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileW)
    APIHOOK_ENTRY(USER32.DLL,                   CreateDesktopA)
    APIHOOK_ENTRY(USER32.DLL,                   CreateDesktopW)
    APIHOOK_ENTRY(USER32.DLL,                   CreateWindowStationA)
    APIHOOK_ENTRY(USER32.DLL,                   CreateWindowStationW)

    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegCreateKeyExA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegCreateKeyExW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyExA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyExW)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileMappingA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileMappingW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateJobObjectA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateJobObjectW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateThread)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateRemoteThread)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryExA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryExW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateHardLinkA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateHardLinkW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMailslotA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMailslotW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateNamedPipeA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateNamedPipeW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreatePipe)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMutexA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMutexW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateSemaphoreA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateSemaphoreW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateWaitableTimerA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateWaitableTimerW)

HOOK_END



IMPLEMENT_SHIM_END