Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 01:55:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

[RTL] Implement LdrpRecordUnloadEvent

Browse source
This commit is contained in:
Mark Jansen 2020-04-18 13:53:02 +02:00
parent 7cce7b9c08
commit d5f0b2b160
No known key found for this signature in database
GPG key ID: B39240EE84BEAE8B
3 changed files with 48 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
dll/ntdll/include/ntdllp.h
View file

@ -158,6 +158,9 @@ LdrpFetchAddressOfEntryPoint(PVOID ImageBase);
VOID NTAPI
LdrpFreeUnicodeString(PUNICODE_STRING String);
VOID NTAPI
LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry);
VOID NTAPI
LdrpGetShimEngineInterface(VOID);

3
dll/ntdll/ldr/ldrapi.c
View file

@ -1449,8 +1449,7 @@ LdrUnloadDll(IN PVOID BaseAddress)
/* Get the current entry */
LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
/* FIXME: Log the Unload Event */
//LdrpRecordUnloadEvent(LdrEntry);
LdrpRecordUnloadEvent(LdrEntry);
/* Set the entry and clear it from the list */
CurrentEntry = LdrEntry;

52
sdk/lib/rtl/trace.c
View file

@ -11,6 +11,7 @@
#include <debug.h>
static RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER];
static UINT RtlpUnloadEventTraceIndex = 0;
/* FUNCTIONS ******************************************************************/
@ -22,10 +23,45 @@ RtlGetUnloadEventTrace(VOID)
return RtlpUnloadEventTrace;
}
VOID
NTAPI
LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
{
PIMAGE_NT_HEADERS NtHeaders;
UINT Sequence = RtlpUnloadEventTraceIndex++;
UINT Index = Sequence % RTL_UNLOAD_EVENT_TRACE_NUMBER;
USHORT StringLen;
DPRINT("LdrpRecordUnloadEvent(%wZ, %p - %p)\n", &LdrEntry->BaseDllName, LdrEntry->DllBase,
(ULONG_PTR)LdrEntry->DllBase + LdrEntry->SizeOfImage);
RtlpUnloadEventTrace[Index].BaseAddress = LdrEntry->DllBase;
RtlpUnloadEventTrace[Index].SizeOfImage = LdrEntry->SizeOfImage;
RtlpUnloadEventTrace[Index].Sequence = Sequence;
NtHeaders = RtlImageNtHeader(LdrEntry->DllBase);
if (NtHeaders)
{
RtlpUnloadEventTrace[Index].TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp;
RtlpUnloadEventTrace[Index].CheckSum = NtHeaders->OptionalHeader.CheckSum;
}
else
{
RtlpUnloadEventTrace[Index].TimeDateStamp = 0;
RtlpUnloadEventTrace[Index].CheckSum = 0;
}
StringLen = min(LdrEntry->BaseDllName.Length / sizeof(WCHAR), RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName));
RtlCopyMemory(RtlpUnloadEventTrace[Index].ImageName, LdrEntry->BaseDllName.Buffer, StringLen * sizeof(WCHAR));
if (StringLen < RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName))
RtlpUnloadEventTrace[Index].ImageName[StringLen] = 0;
}
BOOLEAN
NTAPI
RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database,
IN ULONG Count,
RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database,
IN ULONG Count,
IN PVOID *Trace,
OUT OPTIONAL PRTL_TRACE_BLOCK *TraceBlock)
{
@ -35,10 +71,10 @@ RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database,
PRTL_TRACE_DATABASE
NTAPI
RtlTraceDatabaseCreate(IN ULONG Buckets,
IN OPTIONAL SIZE_T MaximumSize,
IN ULONG Flags,
IN ULONG Tag,
RtlTraceDatabaseCreate(IN ULONG Buckets,
IN OPTIONAL SIZE_T MaximumSize,
IN ULONG Flags,
IN ULONG Tag,
IN OPTIONAL RTL_TRACE_HASH_FUNCTION HashFunction)
{
UNIMPLEMENTED;
@ -55,7 +91,7 @@ RtlTraceDatabaseDestroy(IN PRTL_TRACE_DATABASE Database)
BOOLEAN
NTAPI
RtlTraceDatabaseEnumerate(IN PRTL_TRACE_DATABASE Database,
RtlTraceDatabaseEnumerate(IN PRTL_TRACE_DATABASE Database,
IN PRTL_TRACE_ENUMERATE TraceEnumerate,
IN OUT PRTL_TRACE_BLOCK *TraceBlock)
{
@ -66,7 +102,7 @@ RtlTraceDatabaseEnumerate(IN PRTL_TRACE_DATABASE Database,
BOOLEAN
NTAPI
RtlTraceDatabaseFind(IN PRTL_TRACE_DATABASE Database,
RtlTraceDatabaseFind(IN PRTL_TRACE_DATABASE Database,
IN ULONG Count,
IN PVOID *Trace,
OUT OPTIONAL PRTL_TRACE_BLOCK *TraceBlock)