DelayLoadLibrary.h 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225
  1. //-------------------------------------------------------------------------------------------------------
  2. // Copyright (C) Microsoft. All rights reserved.
  3. // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
  4. //-------------------------------------------------------------------------------------------------------
  5. #pragma once
  6. class DelayLoadLibrary
  7. {
  8. protected:
  9. HMODULE m_hModule;
  10. bool m_isInit;
  11. public:
  12. DelayLoadLibrary();
  13. virtual ~DelayLoadLibrary();
  14. virtual LPCTSTR GetLibraryName() const = 0;
  15. FARPROC GetFunction(__in LPCSTR lpFunctionName);
  16. void EnsureFromSystemDirOnly();
  17. bool IsAvailable();
  18. private:
  19. void Ensure(DWORD dwFlags = 0);
  20. };
  21. #if _WIN32
  22. // This needs to be delay loaded because SetThreadDescription is available only
  23. // on Win10 1607+
  24. class Kernel32Library : protected DelayLoadLibrary
  25. {
  26. private:
  27. typedef HRESULT (WINAPI *PFnSetThreadDescription)(
  28. _In_ HANDLE hThread,
  29. _In_ PCWSTR lpThreadDescription
  30. );
  31. PFnSetThreadDescription setThreadDescription;
  32. public:
  33. static Kernel32Library* Instance;
  34. Kernel32Library() : DelayLoadLibrary(),
  35. setThreadDescription(NULL)
  36. {
  37. this->EnsureFromSystemDirOnly();
  38. }
  39. LPCTSTR GetLibraryName() const;
  40. HRESULT WINAPI SetThreadDescription(
  41. _In_ HANDLE hThread,
  42. _In_ PCWSTR lpThreadDescription
  43. );
  44. };
  45. // This needs to be delay loaded because it is available on
  46. // Win8 only
  47. class NtdllLibrary : protected DelayLoadLibrary
  48. {
  49. public:
  50. // needed for InitializeObjectAttributes
  51. static const ULONG OBJ_KERNEL_HANDLE = 0x00000200;
  52. static const ULONG MAP_PROCESS = 1;
  53. typedef struct _UNICODE_STRING {
  54. USHORT Length;
  55. USHORT MaximumLength;
  56. PWSTR Buffer;
  57. } UNICODE_STRING, *PUNICODE_STRING;
  58. typedef struct _OBJECT_ATTRIBUTES {
  59. ULONG Length;
  60. HANDLE RootDirectory;
  61. PUNICODE_STRING ObjectName;
  62. ULONG Attributes;
  63. PVOID SecurityDescriptor;
  64. PVOID SecurityQualityOfService;
  65. } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
  66. typedef enum _SECTION_INHERIT {
  67. ViewShare = 1,
  68. ViewUnmap = 2
  69. } SECTION_INHERIT, *PSECTION_INHERIT;
  70. typedef _Return_type_success_(return >= 0) LONG NTSTATUS;
  71. private:
  72. #if PDATA_ENABLED
  73. typedef _Success_(return == 0) DWORD (NTAPI *PFnRtlAddGrowableFunctionTable)(_Out_ PVOID * DynamicTable,
  74. _In_reads_(MaximumEntryCount) PRUNTIME_FUNCTION FunctionTable,
  75. _In_ DWORD EntryCount,
  76. _In_ DWORD MaximumEntryCount,
  77. _In_ ULONG_PTR RangeBase,
  78. _In_ ULONG_PTR RangeEnd);
  79. PFnRtlAddGrowableFunctionTable addGrowableFunctionTable;
  80. typedef VOID (NTAPI *PFnRtlDeleteGrowableFunctionTable)(_In_ PVOID DynamicTable);
  81. PFnRtlDeleteGrowableFunctionTable deleteGrowableFunctionTable;
  82. typedef VOID (NTAPI *PFnRtlGrowFunctionTable)(_Inout_ PVOID DynamicTable, _In_ ULONG NewEntryCount);
  83. PFnRtlGrowFunctionTable growFunctionTable;
  84. #endif
  85. typedef NTSTATUS(NTAPI *PFnNtCreateSection)(
  86. _Out_ PHANDLE SectionHandle,
  87. _In_ ACCESS_MASK DesiredAccess,
  88. _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
  89. _In_opt_ PLARGE_INTEGER MaximumSize,
  90. _In_ ULONG SectionPageProtection,
  91. _In_ ULONG AllocationAttributes,
  92. _In_opt_ HANDLE FileHandle);
  93. PFnNtCreateSection createSection;
  94. typedef NTSTATUS(NTAPI *PFnNtMapViewOfSection)(
  95. _In_ HANDLE SectionHandle,
  96. _In_ HANDLE ProcessHandle,
  97. _Inout_ PVOID *BaseAddress,
  98. _In_ ULONG_PTR ZeroBits,
  99. _In_ SIZE_T CommitSize,
  100. _Inout_opt_ PLARGE_INTEGER SectionOffset,
  101. _Inout_ PSIZE_T ViewSize,
  102. _In_ SECTION_INHERIT InheritDisposition,
  103. _In_ ULONG AllocationType,
  104. _In_ ULONG Win32Protect);
  105. PFnNtMapViewOfSection mapViewOfSection;
  106. typedef NTSTATUS(NTAPI *PFnNtUnmapViewOfSection)(
  107. _In_ HANDLE ProcessHandle,
  108. _In_opt_ PVOID BaseAddress);
  109. PFnNtUnmapViewOfSection unmapViewOfSection;
  110. typedef NTSTATUS(NTAPI *PFnNtClose)(_In_ HANDLE Handle);
  111. PFnNtClose close;
  112. typedef NTSTATUS(NTAPI *PFnNtUnlockVirtualMemory)(
  113. _In_ HANDLE ProcessHandle,
  114. _Inout_ PVOID *BaseAddress,
  115. _Inout_ PSIZE_T RegionSize,
  116. _In_ ULONG MapType);
  117. PFnNtUnlockVirtualMemory unlock;
  118. public:
  119. static NtdllLibrary* Instance;
  120. NtdllLibrary() : DelayLoadLibrary(),
  121. #if PDATA_ENABLED
  122. addGrowableFunctionTable(NULL),
  123. deleteGrowableFunctionTable(NULL),
  124. growFunctionTable(NULL),
  125. #endif
  126. createSection(NULL),
  127. mapViewOfSection(NULL),
  128. unmapViewOfSection(NULL),
  129. close(NULL),
  130. unlock(nullptr)
  131. {
  132. this->EnsureFromSystemDirOnly();
  133. }
  134. LPCTSTR GetLibraryName() const;
  135. #if PDATA_ENABLED
  136. _Success_(return == 0)
  137. NTSTATUS AddGrowableFunctionTable(_Out_ PVOID * DynamicTable,
  138. _In_reads_(MaximumEntryCount) PRUNTIME_FUNCTION FunctionTable,
  139. _In_ DWORD EntryCount,
  140. _In_ DWORD MaximumEntryCount,
  141. _In_ ULONG_PTR RangeBase,
  142. _In_ ULONG_PTR RangeEnd);
  143. VOID DeleteGrowableFunctionTable(_In_ PVOID DynamicTable);
  144. VOID GrowFunctionTable(__inout PVOID DynamicTable, __in ULONG NewEntryCount);
  145. #endif
  146. // we do not have the header where this macro is defined, so implement ourselves
  147. VOID InitializeObjectAttributes(
  148. POBJECT_ATTRIBUTES InitializedAttributes,
  149. PUNICODE_STRING ObjectName,
  150. ULONG Attributes,
  151. HANDLE RootDirectory,
  152. PSECURITY_DESCRIPTOR SecurityDescriptor
  153. );
  154. NTSTATUS CreateSection(
  155. _Out_ PHANDLE SectionHandle,
  156. _In_ ACCESS_MASK DesiredAccess,
  157. _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
  158. _In_opt_ PLARGE_INTEGER MaximumSize,
  159. _In_ ULONG SectionPageProtection,
  160. _In_ ULONG AllocationAttributes,
  161. _In_opt_ HANDLE FileHandle
  162. );
  163. NTSTATUS MapViewOfSection(
  164. _In_ HANDLE SectionHandle,
  165. _In_ HANDLE ProcessHandle,
  166. _Inout_ PVOID *BaseAddress,
  167. _In_ ULONG_PTR ZeroBits,
  168. _In_ SIZE_T CommitSize,
  169. _Inout_opt_ PLARGE_INTEGER SectionOffset,
  170. _Inout_ PSIZE_T ViewSize,
  171. _In_ SECTION_INHERIT InheritDisposition,
  172. _In_ ULONG AllocationType,
  173. _In_ ULONG Win32Protect
  174. );
  175. NTSTATUS UnmapViewOfSection(
  176. _In_ HANDLE ProcessHandle,
  177. _In_opt_ PVOID BaseAddress
  178. );
  179. NTSTATUS Close(
  180. _In_ HANDLE Handle
  181. );
  182. NTSTATUS UnlockVirtualMemory(
  183. _In_ HANDLE ProcessHandle,
  184. _Inout_ PVOID *BaseAddress,
  185. _Inout_ PSIZE_T RegionSize,
  186. _In_ ULONG MapType
  187. );
  188. };
  189. #endif