Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-30 02:58:48 +00:00
Code Issues Projects Releases Packages Wiki Activity

[RTL] Implement LdrpRecordUnloadEvent

Browse source
This commit is contained in:
Mark Jansen 2020-04-18 13:53:02 +02:00
parent 7cce7b9c08
commit d5f0b2b160
No known key found for this signature in database
GPG key ID: B39240EE84BEAE8B
3 changed files with 48 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
dll/ntdll/include/ntdllp.h
View file

@ -158,6 +158,9 @@ LdrpFetchAddressOfEntryPoint(PVOID ImageBase);
VOID NTAPI
LdrpFreeUnicodeString(PUNICODE_STRING String);
VOID NTAPI
LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry);
VOID NTAPI
LdrpGetShimEngineInterface(VOID);

3
dll/ntdll/ldr/ldrapi.c
View file

@ -1449,8 +1449,7 @@ LdrUnloadDll(IN PVOID BaseAddress)
/* Get the current entry */
LdrEntry = CONTAINING_RECORD(NextEntry, LDR_DATA_TABLE_ENTRY, HashLinks);
/* FIXME: Log the Unload Event */
//LdrpRecordUnloadEvent(LdrEntry);
LdrpRecordUnloadEvent(LdrEntry);
/* Set the entry and clear it from the list */
CurrentEntry = LdrEntry;

36
sdk/lib/rtl/trace.c
View file

@ -11,6 +11,7 @@
#include <debug.h>
static RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER];
static UINT RtlpUnloadEventTraceIndex = 0;
/* FUNCTIONS ******************************************************************/
@ -22,6 +23,41 @@ RtlGetUnloadEventTrace(VOID)
return RtlpUnloadEventTrace;
}
VOID
NTAPI
LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
{
PIMAGE_NT_HEADERS NtHeaders;
UINT Sequence = RtlpUnloadEventTraceIndex++;
UINT Index = Sequence % RTL_UNLOAD_EVENT_TRACE_NUMBER;
USHORT StringLen;
DPRINT("LdrpRecordUnloadEvent(%wZ, %p - %p)\n", &LdrEntry->BaseDllName, LdrEntry->DllBase,
(ULONG_PTR)LdrEntry->DllBase + LdrEntry->SizeOfImage);
RtlpUnloadEventTrace[Index].BaseAddress = LdrEntry->DllBase;
RtlpUnloadEventTrace[Index].SizeOfImage = LdrEntry->SizeOfImage;
RtlpUnloadEventTrace[Index].Sequence = Sequence;
NtHeaders = RtlImageNtHeader(LdrEntry->DllBase);
if (NtHeaders)
{
RtlpUnloadEventTrace[Index].TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp;
RtlpUnloadEventTrace[Index].CheckSum = NtHeaders->OptionalHeader.CheckSum;
}
else
{
RtlpUnloadEventTrace[Index].TimeDateStamp = 0;
RtlpUnloadEventTrace[Index].CheckSum = 0;
}
StringLen = min(LdrEntry->BaseDllName.Length / sizeof(WCHAR), RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName));
RtlCopyMemory(RtlpUnloadEventTrace[Index].ImageName, LdrEntry->BaseDllName.Buffer, StringLen * sizeof(WCHAR));
if (StringLen < RTL_NUMBER_OF(RtlpUnloadEventTrace[Index].ImageName))
RtlpUnloadEventTrace[Index].ImageName[StringLen] = 0;
}
BOOLEAN
NTAPI
RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database,