legacytard-association/progwrp
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
progwrp/dllmain.c
caca 5ac6e113e2 upload
2025-12-13 23:37:26 +01:00

781 lines
22 KiB
C
Raw Permalink Blame History

// dllmain.cpp : Defines the entry point for the DLL application.
#include "progwrp.h"
#include "export.h"
#include "implementations.h"
volatile BOOLEAN g_InitCompleted = FALSE;
HANDLE hProcessClose;
#define LoadFuncPfn(x, y) pfnFunc = NULL; RtlInitAnsiString(&ansi_str, #y); LdrGetProcedureAddress(x, &ansi_str, 0, &pfnFunc); \
if (pfnFunc) { g_pfn_##y = pfnFunc;} else { g_pfn_##y = (pfnFunc_generic)Implementation_##y;}
#define LoadFuncPfnLite(x, y) RtlInitAnsiString(&ansi_str, #y); LdrGetProcedureAddress(x, &ansi_str, 0, &pfnFunc); g_pfn_##y = pfnFunc;
// This macro above covers the cases where functions are "completely" missing. But what about when functions are "partially" missing?
// (i.e. missing flags, etc.)
// In the context of this DLL, we may have three different states: fully-functional function, partially-implemented function and
// completely-missing function. We don't know at the init process if flags are missing or not. So if the function is partially implemented,
// we can try calling the original function, test for an invalid parameter error, and then try the "missing bit".
// The option to completely replace functions should also be available.
void InitPtrs_kernel32()
{
UNICODE_STRING kernel32s;
HMODULE kernel32 = NULL;
RtlInitUnicodeString(&kernel32s, L"kernel32.dll");
if(!LdrLoadDll(NULL, 0, &kernel32s, &kernel32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(kernel32, GetMaximumProcessorCount);
LoadFuncPfn(kernel32, GetMaximumProcessorGroupCount);
LoadFuncPfn(kernel32, GetLogicalProcessorInformationEx);
LoadFuncPfn(kernel32, GetThreadGroupAffinity);
LoadFuncPfn(kernel32, GetCurrentProcessorNumber);
LoadFuncPfn(kernel32, PowerCreateRequest);
LoadFuncPfn(kernel32, PowerSetRequest);
LoadFuncPfn(kernel32, PowerClearRequest);
LoadFuncPfn(kernel32, ResolveLocaleName);
LoadFuncPfn(kernel32, EnumSystemLocalesEx);
LoadFuncPfn(kernel32, GetCurrencyFormatEx);
LoadFuncPfn(kernel32, GetDateFormatEx);
LoadFuncPfn(kernel32, GetDynamicTimeZoneInformation);
LoadFuncPfn(kernel32, GetLocaleInfoEx);
LoadFuncPfn(kernel32, GetNumberFormatEx);
LoadFuncPfn(kernel32, GetTimeFormatEx);
LoadFuncPfn(kernel32, GetUserDefaultLocaleName);
LoadFuncPfn(kernel32, LCIDToLocaleName);
LoadFuncPfn(kernel32, LocaleNameToLCID);
LoadFuncPfn(kernel32, TryAcquireSRWLockExclusive); // These functions can be loaded independently of the "real"
LoadFuncPfn(kernel32, TryAcquireSRWLockShared); // SRW lock functions because they are compatible
LoadFuncPfn(kernel32, AcquireSRWLockExclusive);
if(g_pfn_AcquireSRWLockExclusive != (pfnFunc_generic)Implementation_AcquireSRWLockExclusive &&
g_pfn_TryAcquireSRWLockExclusive == (pfnFunc_generic)Implementation_TryAcquireSRWLockExclusive)
// If the real AcquireSRWLockExclusive is available but not TryAcquireSRWLockExclusive,
// load the "Vista" versions of the try acquire SRW lock functions
{
g_pfn_TryAcquireSRWLockExclusive = (pfnFunc_generic)Implementation_TryAcquireSRWLockExclusive_Vista;
g_pfn_TryAcquireSRWLockShared = (pfnFunc_generic)Implementation_TryAcquireSRWLockShared_Vista;
g_pfn_GetLogicalProcessorInformationEx = (pfnFunc_generic)Implementation_GetLogicalProcessorInformationEx;
}
LoadFuncPfn(kernel32, AcquireSRWLockShared);
LoadFuncPfn(kernel32, ReleaseSRWLockExclusive);
LoadFuncPfn(kernel32, ReleaseSRWLockShared);
LoadFuncPfn(kernel32, InitializeSRWLock);
LoadFuncPfn(kernel32, SleepConditionVariableSRW);
LoadFuncPfn(kernel32, SleepConditionVariableCS);
LoadFuncPfn(kernel32, WakeConditionVariable);
LoadFuncPfn(kernel32, WakeAllConditionVariable);
LoadFuncPfn(kernel32, InitializeConditionVariable);
LoadFuncPfn(kernel32, InitOnceExecuteOnce);
LoadFuncPfn(kernel32, InitOnceBeginInitialize);
LoadFuncPfn(kernel32, InitOnceComplete);
LoadFuncPfn(kernel32, InitOnceInitialize);
LoadFuncPfn(kernel32, CreateWaitableTimerExW);
LoadFuncPfn(kernel32, InitializeCriticalSectionEx);
LoadFuncPfn(kernel32, DecodePointer);
LoadFuncPfn(kernel32, EncodePointer);
LoadFuncPfn(kernel32, WerRegisterRuntimeExceptionModule);
LoadFuncPfn(kernel32, CreateRemoteThreadEx);
g_pfn_FindFirstFileExW = (pfnFunc_generic)Implementation_FindFirstFileExW;
LoadFuncPfn(kernel32, CancelIoEx);
LoadFuncPfn(kernel32, GetFinalPathNameByHandleW);
LoadFuncPfn(kernel32, SetFileInformationByHandle);
LoadFuncPfn(kernel32, DeleteProcThreadAttributeList);
LoadFuncPfn(kernel32, UpdateProcThreadAttribute);
LoadFuncPfn(kernel32, InitializeProcThreadAttributeList);
LoadFuncPfn(kernel32, QueryFullProcessImageNameA);
LoadFuncPfn(kernel32, QueryFullProcessImageNameW);
LoadFuncPfn(kernel32, QueryProcessCycleTime);
LoadFuncPfn(kernel32, QueryThreadCycleTime);
LoadFuncPfn(kernel32, GetProductInfo);
LoadFuncPfn(kernel32, GetThreadId);
LoadFuncPfn(kernel32, GetNamedPipeClientProcessId);
LoadFuncPfn(kernel32, GetNamedPipeServerProcessId);
LoadFuncPfn(kernel32, GetThreadPreferredUILanguages);
LoadFuncPfn(kernel32, GetFileInformationByHandleEx);
LoadFuncPfn(kernel32, Wow64GetThreadContext);
LoadFuncPfn(kernel32, FlsAlloc);
LoadFuncPfn(kernel32, FlsFree);
//LoadFuncPfn(kernel32, FlsGetValue);
g_pfn_FlsGetValue = (pfnFunc_generic)Implementation_FlsGetValue;
LoadFuncPfn(kernel32, FlsSetValue);
LoadFuncPfn(kernel32, IsThreadAFiber);
LoadFuncPfn(kernel32, ConvertThreadToFiberEx);
LoadFuncPfn(kernel32, GetProcessId);
LoadFuncPfn(kernel32, AddVectoredExceptionHandler);
LoadFuncPfn(kernel32, RemoveVectoredExceptionHandler);
LoadFuncPfn(kernel32, AttachConsole);
LoadFuncPfn(kernel32, WTSGetActiveConsoleSessionId);
LoadFuncPfn(kernel32, CheckRemoteDebuggerPresent);
LoadFuncPfn(kernel32, CreateMemoryResourceNotification);
LoadFuncPfn(kernel32, GetGeoInfoW);
LoadFuncPfn(kernel32, GetLogicalProcessorInformation);
LoadFuncPfn(kernel32, GetModuleHandleExA);
LoadFuncPfn(kernel32, GetModuleHandleExW);
LoadFuncPfn(kernel32, GetNativeSystemInfo);
LoadFuncPfn(kernel32, GetProcessHandleCount);
LoadFuncPfn(kernel32, GetUserGeoID);
LoadFuncPfn(kernel32, GetVolumePathNamesForVolumeNameW);
LoadFuncPfn(kernel32, InitializeSListHead);
LoadFuncPfn(kernel32, InterlockedFlushSList);
LoadFuncPfn(kernel32, InterlockedPushEntrySList);
LoadFuncPfn(kernel32, IsProcessInJob);
LoadFuncPfn(kernel32, IsWow64Process);
LoadFuncPfn(kernel32, SetDllDirectoryW);
LoadFuncPfn(kernel32, TzSpecificLocalTimeToSystemTime);
LoadFuncPfn(kernel32, ConvertFiberToThread);
LoadFuncPfn(kernel32, PrefetchVirtualMemory);
LoadFuncPfn(kernel32, GetFirmwareType);
LoadFuncPfn(kernel32, GetPackagePathByFullName);
LoadFuncPfn(kernel32, GetPackagesByPackageFamily);
LoadFuncPfn(kernel32, LCMapStringEx);
LoadFuncPfn(kernel32, DuplicateHandle);
if(LOBYTE(GetVersion()) > 5 || LOBYTE(GetVersion() == 5) && LOBYTE(GetVersion() >> 8) >= 2)
{
pfnFunc = NULL; RtlInitAnsiString(&ansi_str, "CreateFiberEx"); LdrGetProcedureAddress(kernel32, &ansi_str, 0, &pfnFunc);
g_pfn_CreateFiberEx = pfnFunc;
pfnFunc = NULL; RtlInitAnsiString(&ansi_str, "SwitchToFiber"); LdrGetProcedureAddress(kernel32, &ansi_str, 0, &pfnFunc);
g_pfn_SwitchToFiber = pfnFunc;
}
else
{
g_pfn_CreateFiberEx = (pfnFunc_generic)Implementation_CreateFiberEx;
// g_pfn_SwitchToFiber = (pfnFunc_generic)Implementation_SwitchToFiber;
pfnFunc = NULL; RtlInitAnsiString(&ansi_str, "SwitchToFiber"); LdrGetProcedureAddress(kernel32, &ansi_str, 0, &pfnFunc);
g_pfn_SwitchToFiber = pfnFunc;
}
LoadFuncPfn(kernel32, SetProcessDEPPolicy);
LoadFuncPfn(kernel32, InterlockedPopEntrySList);
LoadFuncPfn(kernel32, HeapSetInformation);
g_pfn_GetProcAddress = (pfnFunc_generic)Implementation_GetProcAddress;
g_pfn_LoadLibraryW = (pfnFunc_generic)Implementation_LoadLibraryW;
g_pfn_LoadLibraryA = (pfnFunc_generic)Implementation_LoadLibraryA;
g_pfn_LoadLibraryExW = (pfnFunc_generic)Implementation_LoadLibraryExW;
g_pfn_LoadLibraryExA = (pfnFunc_generic)Implementation_LoadLibraryExA;
if (LOBYTE(GetVersion()) < 6)
{
g_pfn_DuplicateHandle = (pfnFunc_generic)Implementation_DuplicateHandle;
}
LoadFuncPfn(kernel32, DiscardVirtualMemory);
}
return;
}
void InitPtrs_shell32()
{
UNICODE_STRING shell32s;
HMODULE shell32 = NULL;
RtlInitUnicodeString(&shell32s, L"shell32.dll");
if(!LdrLoadDll(NULL, 0, &shell32s, &shell32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(shell32, SHGetPropertyStoreForWindow);
LoadFuncPfn(shell32, SHGetKnownFolderPath);
LoadFuncPfn(shell32, SHQueryUserNotificationState);
}
return;
}
void InitPtrs_ntdll()
{
UNICODE_STRING ntdlls;
HMODULE ntdll = NULL;
RtlInitUnicodeString(&ntdlls, L"ntdll.dll");
if(!LdrLoadDll(NULL, 0, &ntdlls, &ntdll))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(ntdll, NtOpenKeyEx);
LoadFuncPfn(ntdll, RtlGetLastNtStatus);
RtlInitAnsiString(&ansi_str, "wcsstr");
pfnFunc = NULL;
LdrGetProcedureAddress(ntdll, &ansi_str, 0, &pfnFunc);
g_wcsstr = pfnFunc;
RtlInitAnsiString(&ansi_str, "strstr");
pfnFunc = NULL;
LdrGetProcedureAddress(ntdll, &ansi_str, 0, &pfnFunc);
g_strstr = pfnFunc;
}
return;
}
void InitPtrs_psapi()
{
UNICODE_STRING psapis;
HMODULE psapi = NULL;
RtlInitUnicodeString(&psapis, L"psapi.dll");
if(!LdrLoadDll(NULL, 0, &psapis, &psapi))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(psapi, GetModuleInformation);
LoadFuncPfn(psapi, GetProcessMemoryInfo);
LoadFuncPfn(psapi, QueryWorkingSetEx);
LoadFuncPfn(psapi, GetPerformanceInfo);
}
}
void InitPtrs_user32()
{
UNICODE_STRING user32s;
HMODULE user32 = NULL;
UNICODE_STRING shcores;
HMODULE shcore = NULL;
RtlInitUnicodeString(&user32s, L"user32.dll");
RtlInitUnicodeString(&shcores, L"SHCore.dll");
LdrLoadDll(NULL, 0, &shcores, &shcore);
if(!LdrLoadDll(NULL, 0, &user32s, &user32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(user32, RegisterTouchWindow);
LoadFuncPfn(user32, GetDisplayConfigBufferSizes);
LoadFuncPfn(user32, CloseTouchInputHandle);
LoadFuncPfn(user32, GetGestureInfo);
LoadFuncPfn(user32, DisplayConfigGetDeviceInfo);
LoadFuncPfn(user32, DisplayConfigSetDeviceInfo);
LoadFuncPfn(user32, QueryDisplayConfig);
LoadFuncPfn(user32, SetProcessDPIAware);
LoadFuncPfn(user32, RegisterPowerSettingNotification);
LoadFuncPfn(user32, UnregisterPowerSettingNotification);
LoadFuncPfn(shcore, GetDpiForMonitor);
LoadFuncPfn(user32, GetLayeredWindowAttributes);
LoadFuncPfn(user32, GetRawInputDeviceInfoW);
LoadFuncPfn(user32, PrintWindow);
LoadFuncPfn(user32, DefRawInputProc);
LoadFuncPfn(user32, GetRawInputDeviceList);
LoadFuncPfn(user32, RegisterRawInputDevices);
LoadFuncPfn(user32, UnhookWindowsHookEx);
LoadFuncPfn(user32, RegisterPointerDeviceNotifications);
LoadFuncPfn(user32, GetPointerDevices);
LoadFuncPfn(user32, GetPointerDevice);
g_pfn_SystemParametersInfoW = (pfnFunc_generic)Implementation_SystemParametersInfoW;
//g_pfn_RegisterClassExW = (pfnFunc_generic)Implementation_RegisterClassExW;
}
return;
}
void InitPtrs_dbghelp()
{
UNICODE_STRING dbghelps;
HMODULE dbghelp = NULL;
RtlInitUnicodeString(&dbghelps, L"dbghelp.dll");
if(!LdrLoadDll(NULL, 0, &dbghelps, &dbghelp))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(dbghelp, SymGetSearchPathW);
LoadFuncPfn(dbghelp, SymSetSearchPathW);
}
return;
}
void InitPtrs_ws2_32()
{
UNICODE_STRING ws2_32s;
HMODULE ws2_32 = NULL;
RtlInitUnicodeString(&ws2_32s, L"ws2_32.dll");
if(!LdrLoadDll(NULL, 0, &ws2_32s, &ws2_32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(ws2_32, inet_ntop);
LoadFuncPfn(ws2_32, freeaddrinfo);
LoadFuncPfn(ws2_32, getaddrinfo);
}
return;
}
void InitPtrs_iphlpapi()
{
UNICODE_STRING iphlpapis;
HMODULE iphlpapi = NULL;
RtlInitUnicodeString(&iphlpapis, L"iphlpapi.dll");
if(!LdrLoadDll(NULL, 0, &iphlpapis, &iphlpapi))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(iphlpapi, FreeMibTable);
LoadFuncPfn(iphlpapi, GetIfTable2);
LoadFuncPfn(iphlpapi, CancelIPChangeNotify);
LoadFuncPfn(iphlpapi, GetAdaptersAddresses);
}
return;
}
void InitPtrs_advapi32()
{
UNICODE_STRING advapi32s;
HMODULE advapi32 = NULL;
RtlInitUnicodeString(&advapi32s, L"advapi32.dll");
if(!LdrLoadDll(NULL, 0, &advapi32s, &advapi32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(advapi32, AddMandatoryAce);
LoadFuncPfn(advapi32, EventRegister);
LoadFuncPfn(advapi32, EventSetInformation);
LoadFuncPfn(advapi32, EventUnregister);
LoadFuncPfn(advapi32, EventWrite);
LoadFuncPfn(advapi32, EventWriteTransfer);
LoadFuncPfn(advapi32, RegDeleteKeyExW);
LoadFuncPfn(advapi32, RegGetValueW);
LoadFuncPfn(advapi32, SystemFunction036);
}
return;
}
void InitPtrs_wevtapi()
{
UNICODE_STRING wevtapis;
HMODULE wevtapi = NULL;
RtlInitUnicodeString(&wevtapis, L"wevtapi.dll");
// This is slightly different; the DLL was not always in Windows, so we won't verify that it exists.
LdrLoadDll(NULL, 0, &wevtapis, &wevtapi);
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(wevtapi, EvtQuery);
LoadFuncPfn(wevtapi, EvtCreateRenderContext);
LoadFuncPfn(wevtapi, EvtNext);
LoadFuncPfn(wevtapi, EvtRender);
LoadFuncPfn(wevtapi, EvtClose);
return;
}
void InitPtrs_dwmapi()
{
UNICODE_STRING dwmapis;
HMODULE dwmapi = NULL;
RtlInitUnicodeString(&dwmapis, L"dwmapi.dll");
LdrLoadDll(NULL, 0, &dwmapis, &dwmapi);
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(dwmapi, DwmSetWindowAttribute);
LoadFuncPfn(dwmapi, DwmGetWindowAttribute);
LoadFuncPfn(dwmapi, DwmGetCompositionTimingInfo);
LoadFuncPfn(dwmapi, DwmExtendFrameIntoClientArea);
LoadFuncPfn(dwmapi, DwmDefWindowProc);
return;
}
void InitPtrs_setupapi()
{
UNICODE_STRING setupapis;
HMODULE setupapi = NULL;
RtlInitUnicodeString(&setupapis, L"setupapi.dll");
if(!LdrLoadDll(NULL, 0, &setupapis, &setupapi))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(setupapi, SetupDiGetDevicePropertyW);
}
return;
}
void InitPtrs_dxgi()
{
UNICODE_STRING dxgis;
HMODULE dxgi = NULL;
RtlInitUnicodeString(&dxgis, L"dxgi.dll");
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LdrLoadDll(NULL, 0, &dxgis, &dxgi);
LoadFuncPfn(dxgi, CreateDXGIFactory);
LoadFuncPfn(dxgi, CreateDXGIFactory1);
return;
}
void InitPtrs_usp10()
{
UNICODE_STRING usp10s;
HMODULE usp10 = NULL;
RtlInitUnicodeString(&usp10s, L"usp10.dll");
if(!LdrLoadDll(NULL, 0, &usp10s, &usp10))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(usp10, ScriptItemize);
}
return;
}
void InitPtrs_pdh()
{
UNICODE_STRING pdhs;
HMODULE pdh = NULL;
RtlInitUnicodeString(&pdhs, L"pdh.dll");
if(!LdrLoadDll(NULL, 0, &pdhs, &pdh))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(pdh, PdhAddEnglishCounterW);
}
return;
}
void InitPtrs_powrprof()
{
UNICODE_STRING powrprofs;
HMODULE powrprof = NULL;
RtlInitUnicodeString(&powrprofs, L"powrprof.dll");
if(!LdrLoadDll(NULL, 0, &powrprofs, &powrprof))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(powrprof, PowerDeterminePlatformRole);
}
return;
}
void InitPtrs_wtsapi32()
{
UNICODE_STRING wtsapi32s;
HMODULE wtsapi32 = NULL;
RtlInitUnicodeString(&wtsapi32s, L"wtsapi32.dll");
if(!LdrLoadDll(NULL, 0, &wtsapi32s, &wtsapi32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(wtsapi32, WTSRegisterSessionNotification);
LoadFuncPfn(wtsapi32, WTSUnRegisterSessionNotification);
}
return;
}
void InitPtrs_crypt32()
{
UNICODE_STRING crypt32s;
HMODULE crypt32 = NULL;
RtlInitUnicodeString(&crypt32s, L"crypt32.dll");
if (!LdrLoadDll(NULL, 0, &crypt32s, &crypt32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(crypt32, CryptProtectMemory);
LoadFuncPfn(crypt32, CryptUnprotectMemory);
}
return;
}
void InitPtrs_bcryptprimitives()
{
UNICODE_STRING bcryptprimitivess;
HMODULE bcryptprimitives = NULL;
RtlInitUnicodeString(&bcryptprimitivess, L"bcryptprimitives.dll");
// if(!LdrLoadDll(NULL, 0, &bcryptprimitivess, &bcryptprimitives))
// {
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
g_pfn_ProcessPrng = g_pfn_SystemFunction036;
// }
return;
}
void InitPtrs_uxtheme()
{
UNICODE_STRING uxthemes;
HMODULE uxtheme = NULL;
RtlInitUnicodeString(&uxthemes, L"uxtheme.dll");
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LdrLoadDll(NULL, 0, &uxthemes, &uxtheme);
LoadFuncPfn(uxtheme, CloseThemeData);
LoadFuncPfn(uxtheme, OpenThemeData);
LoadFuncPfn(uxtheme, GetThemePartSize);
LoadFuncPfn(uxtheme, DrawThemeBackground);
LoadFuncPfn(uxtheme, GetThemeBackgroundContentRect);
return;
}
void InitPtrs_ole32()
{
UNICODE_STRING ole32s;
HMODULE ole32 = NULL;
RtlInitUnicodeString(&ole32s, L"ole32.dll");
if(!LdrLoadDll(NULL, 0, &ole32s, &ole32))
{
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(ole32, CoRegisterInitializeSpy);
LoadFuncPfn(ole32, CoRevokeInitializeSpy);
}
return;
}
void InitPtrs_combase()
{
UNICODE_STRING combases;
HMODULE combase = NULL;
RtlInitUnicodeString(&combases, L"combase.dll");
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LdrLoadDll(NULL, 0, &combases, &combase);
LoadFuncPfn(combase, WindowsCreateString);
LoadFuncPfn(combase, WindowsGetStringRawBuffer);
LoadFuncPfn(combase, WindowsDeleteString);
LoadFuncPfn(combase, RoGetActivationFactory);
LoadFuncPfn(combase, RoActivateInstance);
LoadFuncPfn(combase, WindowsCreateStringReference);
return;
}
void InitPtrs_dwrite()
{
UNICODE_STRING dwrites;
HMODULE dwrite = NULL;
RtlInitUnicodeString(&dwrites, L"dwrite.dll");
ANSI_STRING ansi_str;
PVOID pfnFunc = NULL;
LoadFuncPfn(dwrite, DWriteCreateFactory);
return;
}
typedef enum _SEMAPHORE_INFORMATION_CLASS {
SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;
typedef struct _SEMAPHORE_BASIC_INFORMATION {
ULONG CurrentCount;
ULONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySemaphore(
HANDLE SemaphoreHandle,
SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
PVOID SemaphoreInformation,
ULONG SemaphoreInformationLength,
PULONG ReturnLength);
typedef struct _OBJECT_BASIC_INFORMATION {
ULONG Attributes;
ACCESS_MASK GrantedAccess;
ULONG HandleCount;
ULONG PointerCount;
ULONG PagedPoolCharge;
ULONG NonPagedPoolCharge;
ULONG Reserved [3];
ULONG NameInfoSize;
ULONG TypeInfoSize;
ULONG SecurityDescriptorSize;
LARGE_INTEGER CreationTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
typedef struct _THREAD_BASIC_INFORMATION {
NTSTATUS ExitStatus;
PVOID TebBaseAddress;
CLIENT_ID ClientId;
KAFFINITY AffinityMask;
KPRIORITY Priority;
KPRIORITY BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
ULONG g_CoreTlsEntries = 0;
ULONG GetCoreTlsEntriesCount()
{
return g_CoreTlsEntries;
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
WCHAR AppDataDir [MAX_PATH];
WCHAR AppDataDir_Exist [MAX_PATH];
DWORD tid;
PTEB_CUSTOM Teb;
PLDR_DATA_TABLE_ENTRY DataTableEntry, DataTableEntryInit;
LONG i;
PULONG_PTR ThreadLocalStoragePointer;
Teb = (PTEB_CUSTOM)NtCurrentTeb();
if(!InterlockedCompareExchange(&g_InitCompleted, 1, 0))
{
// g_hFile = CreateFileA(
// "tls_log.txt", // File path
// GENERIC_WRITE, // Desired access
// 0, // Share mode
// NULL, // Security attributes
// CREATE_ALWAYS, // Creation disposition
// FILE_ATTRIBUTE_NORMAL, // Flags and attributes
// NULL // Template file handle
// );
if (Teb->ThreadLocalStoragePointer)
{
ThreadLocalStoragePointer = (PULONG_PTR)Teb->ThreadLocalStoragePointer;
while (*ThreadLocalStoragePointer > 0 && !(*ThreadLocalStoragePointer % 4))
// Make sure only valid pointers are counted, and not padding that can also bookend the list of pointers
{
++g_CoreTlsEntries;
++ThreadLocalStoragePointer;
}
}
InitializeCriticalSection(&SrwSharedCs);
InitializeCriticalSection(&SrwSharedCs2);
MutexInitOnce = CreateMutexW(NULL, FALSE, NULL);
g_SRWEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
g_hkProgwrp = 0;
InitPtrs_kernel32();
InitPtrs_shell32();
InitPtrs_ntdll();
InitPtrs_user32();
InitPtrs_psapi();
InitPtrs_dbghelp();
InitPtrs_ws2_32();
InitPtrs_iphlpapi();
InitPtrs_advapi32();
InitPtrs_wevtapi();
InitPtrs_dwmapi();
InitPtrs_setupapi();
InitPtrs_dxgi();
InitPtrs_usp10();
InitPtrs_pdh();
InitPtrs_wtsapi32();
InitPtrs_powrprof();
InitPtrs_bcryptprimitives();
InitPtrs_uxtheme();
InitPtrs_ole32();
InitPtrs_combase();
InitPtrs_dwrite();
InitPtrs_crypt32();
GetEnvironmentVariableW(L"LOCALAPPDATA", AppDataDir_Exist, MAX_PATH);
if(GetLastError() == ERROR_ENVVAR_NOT_FOUND)
{
SHGetFolderPathW(NULL, CSIDL_APPDATA, NULL, 0, AppDataDir);
SetEnvironmentVariableW(L"LOCALAPPDATA", AppDataDir);
}
MutexRegistry = CreateMutexA(NULL, TRUE, NULL);
TIMECAPS tc;
if (LOBYTE(GetVersion()) < 6) {
timeGetDevCaps(&tc, sizeof(TIMECAPS));
timeBeginPeriod(tc.wPeriodMin);
}
}
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
for (i = 0; i < TlsBasesCount; i++)
{
TLSInit_DllMain_ThreadAttach_Internal(TlsBases[i], NULL);
}
if (!Teb->SystemReserved1[0x34])
Teb->SystemReserved1[0x34] = CreateEventA(NULL, FALSE, FALSE, NULL);
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Reference in New Issue View Git Blame Copy Permalink