From 93e88edbb68460acf55481b0b3d666104a2fdb83 Mon Sep 17 00:00:00 2001 From: Mark Jansen Date: Sun, 18 Nov 2018 23:18:13 +0100 Subject: [PATCH] [APPHELP] Implement SE_DynamicShim --- dll/appcompat/apphelp/apphelp.c | 2 +- dll/appcompat/apphelp/apphelp.spec | 2 +- dll/appcompat/apphelp/shimeng.c | 45 ++++++++++++++++++++++++------ 3 files changed, 39 insertions(+), 10 deletions(-) diff --git a/dll/appcompat/apphelp/apphelp.c b/dll/appcompat/apphelp/apphelp.c index bca880c35e7..fd7a069468a 100644 --- a/dll/appcompat/apphelp/apphelp.c +++ b/dll/appcompat/apphelp/apphelp.c @@ -185,7 +185,7 @@ ApphelpCheckRunAppEx( _In_ HANDLE FileHandle, _In_opt_ PVOID Unk1, _In_opt_ PVOID Unk2, - _In_opt_z_ PWCHAR ApplicationName, + _In_opt_z_ PCWSTR ApplicationName, _In_opt_ PVOID Environment, _In_opt_ USHORT ExeType, _Inout_opt_ PULONG Reason, diff --git a/dll/appcompat/apphelp/apphelp.spec b/dll/appcompat/apphelp/apphelp.spec index b2f7ba27fa0..898fb9c836e 100644 --- a/dll/appcompat/apphelp/apphelp.spec +++ b/dll/appcompat/apphelp/apphelp.spec @@ -160,7 +160,7 @@ @ stdcall SdbWriteWORDTag(ptr long long) @ stdcall SE_DllLoaded(ptr) @ stdcall SE_DllUnloaded(ptr) -@ stub SE_DynamicShim +@ stdcall SE_DynamicShim(wstr ptr ptr str ptr) @ stub SE_DynamicUnshim @ stdcall SE_InstallAfterInit(ptr ptr) @ stdcall SE_InstallBeforeInit(ptr ptr) diff --git a/dll/appcompat/apphelp/shimeng.c b/dll/appcompat/apphelp/shimeng.c index 190e17c2a72..c470ff3d8d6 100644 --- a/dll/appcompat/apphelp/shimeng.c +++ b/dll/appcompat/apphelp/shimeng.c @@ -878,7 +878,13 @@ VOID SeiAppendInExclude(PARRAY dest, PCWSTR ModuleName, BOOL IsInclude) } } -/* Read the INEXCLUD tags from a given parent tag */ +/* Read the INEXCLUD tags from a given parent tag +FIXME: + Some observed tags: + '*' with include + '$' with include, followed by '*' without include + Include list logging, referring to: (MODE: EA) +*/ VOID SeiReadInExclude(PDB pdb, TAGID parent, PARRAY dest) { TAGID InExcludeTag; @@ -1175,7 +1181,7 @@ VOID SeiResetEntryProcessed(PPEB Peb) } } -VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery) +VOID SeiInit(LPCWSTR ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery, BOOLEAN ProcessInit) { DWORD n; ARRAY ShimRefArray; @@ -1197,15 +1203,18 @@ VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery) SeiCheckComPlusImage(Peb->ImageBaseAddress); - /* Mark all modules loaded until now as 'LDRP_ENTRY_PROCESSED' so that their entrypoint is not called while we are loading shims */ - SeiSetEntryProcessed(Peb); + if (ProcessInit) + { + /* Mark all modules loaded until now as 'LDRP_ENTRY_PROCESSED' so that their entrypoint is not called while we are loading shims */ + SeiSetEntryProcessed(Peb); + } /* TODO: if (pQuery->trApphelp) SeiDisplayAppHelp(?pQuery->trApphelp?); */ - SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(ExePath(%wZ))\n", ProcessImage); + SeiDbgPrint(SEI_MSG, NULL, "ShimInfo(ExePath(%S))\n", ProcessImage); SeiBuildShimRefArray(hsdb, pQuery, &ShimRefArray, &ShimFlags); if (ShimFlags.AppCompatFlags.QuadPart) { @@ -1344,8 +1353,11 @@ VOID SeiInit(PUNICODE_STRING ProcessImage, HSDB hsdb, SDBQUERYRESULT* pQuery) SeiResolveAPIs(); PatchNewModules(Peb); - /* Remove the 'LDRP_ENTRY_PROCESSED' flag from entries we modified, so that the loader can continue to process them */ - SeiResetEntryProcessed(Peb); + if (ProcessInit) + { + /* Remove the 'LDRP_ENTRY_PROCESSED' flag from entries we modified, so that the loader can continue to process them */ + SeiResetEntryProcessed(Peb); + } } @@ -1413,7 +1425,7 @@ VOID NTAPI SE_InstallBeforeInit(PUNICODE_STRING ProcessImage, PVOID pShimData) } g_bShimDuringInit = TRUE; - SeiInit(ProcessImage, hsdb, &QueryResult); + SeiInit(ProcessImage->Buffer, hsdb, &QueryResult, TRUE); g_bShimDuringInit = FALSE; SdbReleaseDatabase(hsdb); @@ -1464,3 +1476,20 @@ BOOL WINAPI SE_IsShimDll(PVOID BaseAddress) return SeiGetShimModuleInfo(BaseAddress) != NULL; } +/* 'Private' ntdll function */ +BOOLEAN +NTAPI +LdrInitShimEngineDynamic(IN PVOID BaseAddress); + + +BOOL WINAPI SE_DynamicShim(LPCWSTR ProcessImage, HSDB hsdb, PVOID pQueryResult, LPCSTR Module, LPDWORD lpdwDynamicToken) +{ + g_bShimDuringInit = TRUE; + SeiInit(ProcessImage, hsdb, pQueryResult, FALSE); + g_bShimDuringInit = FALSE; + + LdrInitShimEngineDynamic(g_hInstance); + + return TRUE; +} +