417 lines
8.8 KiB
C
417 lines
8.8 KiB
C
/*++ BUILD Version: 0004 // Increment this if a change has global effects
|
|
|
|
Copyright (c) 1989-1999 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
ntldr.h
|
|
|
|
Abstract:
|
|
|
|
This module implements the public interfaces of the Loader (Ldr)
|
|
subsystem. Ldr is coupled with the session manager. It is not
|
|
a separate process.
|
|
|
|
Author:
|
|
|
|
Mike O'Leary (mikeol) 22-Mar-1990
|
|
|
|
[Environment:]
|
|
|
|
optional-environment-info (e.g. kernel mode only...)
|
|
|
|
[Notes:]
|
|
|
|
optional-notes
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
|
|
|
|
#ifndef _NTLDRAPI_
|
|
#define _NTLDRAPI_
|
|
|
|
#if _MSC_VER > 1000
|
|
#pragma once
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
//
|
|
// Private flags for loader data table entries
|
|
//
|
|
|
|
#define LDRP_STATIC_LINK 0x00000002
|
|
#define LDRP_IMAGE_DLL 0x00000004
|
|
#define LDRP_LOAD_IN_PROGRESS 0x00001000
|
|
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000
|
|
#define LDRP_ENTRY_PROCESSED 0x00004000
|
|
#define LDRP_ENTRY_INSERTED 0x00008000
|
|
#define LDRP_CURRENT_LOAD 0x00010000
|
|
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
|
|
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
|
|
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
|
|
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
|
|
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000
|
|
#define LDRP_WX86_IGNORE_MACHINETYPE 0x00400000
|
|
#define LDRP_WX86_PLUGIN 0x00800000
|
|
#define LDRP_SYSTEM_MAPPED 0x01000000
|
|
#define LDRP_IMAGE_VERIFYING 0x02000000
|
|
#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000
|
|
#define LDRP_ENTRY_NATIVE 0x08000000
|
|
#define LDRP_ENTRY_XE_IMAGE 0x10000000
|
|
#define LDRP_PROCESS_ATTACH_FAILED 0x20000000
|
|
|
|
//
|
|
// Loader Data Table. Used to track DLLs loaded into an
|
|
// image.
|
|
//
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY {
|
|
LIST_ENTRY InLoadOrderLinks;
|
|
LIST_ENTRY InMemoryOrderLinks;
|
|
LIST_ENTRY InInitializationOrderLinks;
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
ULONG Flags;
|
|
USHORT LoadCount;
|
|
USHORT TlsIndex;
|
|
union {
|
|
LIST_ENTRY HashLinks;
|
|
struct {
|
|
PVOID SectionPointer;
|
|
ULONG CheckSum;
|
|
};
|
|
};
|
|
union {
|
|
struct {
|
|
ULONG TimeDateStamp;
|
|
};
|
|
struct {
|
|
PVOID LoadedImports;
|
|
};
|
|
};
|
|
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY32 {
|
|
LIST_ENTRY32 InLoadOrderLinks;
|
|
LIST_ENTRY32 InMemoryOrderLinks;
|
|
LIST_ENTRY32 InInitializationOrderLinks;
|
|
ULONG DllBase;
|
|
ULONG EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING32 FullDllName;
|
|
UNICODE_STRING32 BaseDllName;
|
|
ULONG Flags;
|
|
USHORT LoadCount;
|
|
USHORT TlsIndex;
|
|
union {
|
|
LIST_ENTRY32 HashLinks;
|
|
struct {
|
|
ULONG SectionPointer;
|
|
ULONG CheckSum;
|
|
};
|
|
};
|
|
union {
|
|
struct {
|
|
ULONG TimeDateStamp;
|
|
};
|
|
struct {
|
|
ULONG LoadedImports;
|
|
};
|
|
};
|
|
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY64 {
|
|
LIST_ENTRY64 InLoadOrderLinks;
|
|
LIST_ENTRY64 InMemoryOrderLinks;
|
|
LIST_ENTRY64 InInitializationOrderLinks;
|
|
ULONG64 DllBase;
|
|
ULONG64 EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING64 FullDllName;
|
|
UNICODE_STRING64 BaseDllName;
|
|
ULONG Flags;
|
|
USHORT LoadCount;
|
|
USHORT TlsIndex;
|
|
union {
|
|
LIST_ENTRY64 HashLinks;
|
|
struct {
|
|
ULONG64 SectionPointer;
|
|
ULONG CheckSum;
|
|
};
|
|
};
|
|
union {
|
|
struct {
|
|
ULONG TimeDateStamp;
|
|
};
|
|
struct {
|
|
ULONG64 LoadedImports;
|
|
};
|
|
};
|
|
} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;
|
|
|
|
#define DLL_PROCESS_ATTACH 1 // winnt
|
|
#define DLL_THREAD_ATTACH 2 // winnt
|
|
#define DLL_THREAD_DETACH 3 // winnt
|
|
#define DLL_PROCESS_DETACH 0 // winnt
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PDLL_INIT_ROUTINE) (
|
|
IN PVOID DllHandle,
|
|
IN ULONG Reason,
|
|
IN PCONTEXT Context OPTIONAL
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PPROCESS_STARTER_ROUTINE) (
|
|
IN PVOID RealStartAddress
|
|
);
|
|
|
|
VOID
|
|
LdrProcessStarterHelper(
|
|
IN PPROCESS_STARTER_ROUTINE ProcessStarter,
|
|
IN PVOID RealStartAddress
|
|
);
|
|
|
|
VOID
|
|
NTAPI
|
|
LdrShutdownProcess(
|
|
VOID
|
|
);
|
|
|
|
VOID
|
|
NTAPI
|
|
LdrShutdownThread(
|
|
VOID
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrLoadDll(
|
|
IN PWSTR DllPath OPTIONAL,
|
|
IN PULONG DllCharacteristics OPTIONAL,
|
|
IN PUNICODE_STRING DllName,
|
|
OUT PVOID *DllHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetDllHandle(
|
|
IN PWSTR DllPath OPTIONAL,
|
|
IN PULONG DllCharacteristics OPTIONAL,
|
|
IN PUNICODE_STRING DllName,
|
|
OUT PVOID *DllHandle
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrUnloadDll(
|
|
IN PVOID DllHandle
|
|
);
|
|
|
|
ULONG
|
|
NTAPI
|
|
LdrRelocateImage (
|
|
IN PVOID NewBase,
|
|
IN PUCHAR LoaderName,
|
|
IN ULONG Success,
|
|
IN ULONG Conflict,
|
|
IN ULONG Invalid
|
|
);
|
|
|
|
PIMAGE_BASE_RELOCATION
|
|
NTAPI
|
|
LdrProcessRelocationBlock(
|
|
IN ULONG_PTR VA,
|
|
IN ULONG SizeOfBlock,
|
|
IN PUSHORT NextOffset,
|
|
IN LONG_PTR Diff
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
LdrVerifyMappedImageMatchesChecksum (
|
|
IN PVOID BaseAddress,
|
|
IN ULONG FileLength
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(*PLDR_IMPORT_MODULE_CALLBACK)(
|
|
IN PVOID Parameter,
|
|
PCHAR ModuleName
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrVerifyImageMatchesChecksum (
|
|
IN HANDLE ImageFileHandle,
|
|
IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine OPTIONAL,
|
|
IN PVOID ImportCallbackParameter,
|
|
OUT PUSHORT ImageCharacteristics OPTIONAL
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrGetProcedureAddress(
|
|
IN PVOID DllHandle,
|
|
IN PANSI_STRING ProcedureName OPTIONAL,
|
|
IN ULONG ProcedureNumber OPTIONAL,
|
|
OUT PVOID *ProcedureAddress
|
|
);
|
|
|
|
#define LDR_RESOURCE_ID_NAME_MASK 0xFFFF0000
|
|
#define LDR_RESOURCE_ID_NAME_MINVAL 0x10000
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrFindResourceDirectory_U(
|
|
IN PVOID DllHandle,
|
|
IN PULONG_PTR ResourceIdPath,
|
|
IN ULONG ResourceIdPathLength,
|
|
OUT PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrFindResource_U(
|
|
IN PVOID DllHandle,
|
|
IN PULONG_PTR ResourceIdPath,
|
|
IN ULONG ResourceIdPathLength,
|
|
OUT PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry
|
|
);
|
|
|
|
#define LDR_MAXIMUM_RESOURCE_PATH_DEPTH 3
|
|
|
|
typedef struct _LDR_ENUM_RESOURCE_ENTRY {
|
|
union {
|
|
ULONG_PTR NameOrId;
|
|
PIMAGE_RESOURCE_DIRECTORY_STRING Name;
|
|
struct {
|
|
USHORT Id;
|
|
USHORT NameIsPresent;
|
|
};
|
|
} Path[ LDR_MAXIMUM_RESOURCE_PATH_DEPTH ];
|
|
PVOID Data;
|
|
ULONG Size;
|
|
ULONG Reserved;
|
|
} LDR_ENUM_RESOURCE_ENTRY, *PLDR_ENUM_RESOURCE_ENTRY;
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrEnumResources(
|
|
IN PVOID DllHandle,
|
|
IN PULONG_PTR ResourceIdPath,
|
|
IN ULONG ResourceIdPathLength,
|
|
IN OUT PULONG NumberOfResources,
|
|
OUT PLDR_ENUM_RESOURCE_ENTRY Resources OPTIONAL
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrAccessResource(
|
|
IN PVOID DllHandle,
|
|
IN PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,
|
|
OUT PVOID *Address OPTIONAL,
|
|
OUT PULONG Size OPTIONAL
|
|
);
|
|
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrFindEntryForAddress(
|
|
IN PVOID Address,
|
|
OUT PLDR_DATA_TABLE_ENTRY *TableEntry
|
|
);
|
|
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrDisableThreadCalloutsForDll (
|
|
IN PVOID DllHandle
|
|
);
|
|
|
|
|
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION {
|
|
HANDLE Section; // Not filled in
|
|
PVOID MappedBase;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG Flags;
|
|
USHORT LoadOrderIndex;
|
|
USHORT InitOrderIndex;
|
|
USHORT LoadCount;
|
|
USHORT OffsetToFileName;
|
|
UCHAR FullPathName[ 256 ];
|
|
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
|
|
|
|
typedef struct _RTL_PROCESS_MODULES {
|
|
ULONG NumberOfModules;
|
|
RTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];
|
|
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrQueryProcessModuleInformation(
|
|
OUT PRTL_PROCESS_MODULES ModuleInformation,
|
|
IN ULONG ModuleInformationLength,
|
|
OUT PULONG ReturnLength OPTIONAL
|
|
);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
LdrQueryImageFileExecutionOptions(
|
|
IN PUNICODE_STRING ImagePathName,
|
|
IN PWSTR OptionName,
|
|
IN ULONG Type,
|
|
OUT PVOID Buffer,
|
|
IN ULONG BufferSize,
|
|
OUT PULONG ResultSize OPTIONAL
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
LdrAlternateResourcesEnabled(
|
|
VOID
|
|
);
|
|
PVOID
|
|
NTAPI
|
|
LdrGetAlternateResourceModuleHandle(
|
|
IN PVOID Module
|
|
);
|
|
|
|
PVOID
|
|
NTAPI
|
|
LdrLoadAlternateResourceModule(
|
|
IN PVOID Module,
|
|
IN LPCWSTR PathToAlternateModule OPTIONAL
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
LdrUnloadAlternateResourceModule(
|
|
IN PVOID Module
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
LdrFlushAlternateResourceModules(
|
|
VOID
|
|
);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif // _NTLDR_
|