dloadsup.h File Reference

Go to the source code of this file.

Macros
#define	_DLOAD_DLOADSUP_H
#define	DLOAD_INLINE   __inline
#define	FAST_FAIL_DLOAD_PROTECTION_FAILURE   25
#define	IMAGE_GUARD_PROTECT_DELAYLOAD_IAT   0x00001000
#define	DLOAD_ASSERT(_exp)   ((void) 0)
#define	DLOAD_UNSUPPORTED   ((HMODULE)0x1)

Typedefs
typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR	DelayloadDescriptor
typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK	FailureDllHook
typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE	FailureSystemHook
typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE _Out_ PIMAGE_THUNK_DATA	ThunkAddress
typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE _Out_ PIMAGE_THUNK_DATA _Reserved_ ULONG	Flags
typedef _In_ LPCSTR	TargetDllName

Functions
typedef	PVOID (NTAPI *ResolveDelayLoadedAPIProc)(_In_ PVOID ParentModuleBase
typedef	NTSTATUS (NTAPI *ResolveDelayLoadsFromDllProc)(_In_ PVOID ParentBase
DLOAD_INLINE BOOLEAN	DloadResolve (VOID)
DLOAD_INLINE PVOID WINAPI	Dload__delayLoadHelper2 (_In_ PCIMAGE_DELAYLOAD_DESCRIPTOR DelayloadDescriptor, _Out_ PIMAGE_THUNK_DATA ThunkAddress, _Out_ PBOOLEAN NativeHandled)
DLOAD_INLINE HRESULT WINAPI	Dload__HrLoadAllImportsForDll (_In_ LPCSTR DllName, _Out_ PBOOLEAN NativeHandled)

Variables
HMODULE	DloadKernel32
ResolveDelayLoadedAPIProc	DloadResolveDelayLoadedAPI
ResolveDelayLoadsFromDllProc	DloadResolveDelayLoadsFromDll

Macro Definition Documentation

#define _DLOAD_DLOADSUP_H

#define DLOAD_ASSERT

(

_exp

)

((void) 0)

#define DLOAD_INLINE   __inline

#define DLOAD_UNSUPPORTED   ((HMODULE)0x1)

#define FAST_FAIL_DLOAD_PROTECTION_FAILURE   25

#define IMAGE_GUARD_PROTECT_DELAYLOAD_IAT   0x00001000

Typedef Documentation

typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR DelayloadDescriptor

typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK FailureDllHook

typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE FailureSystemHook

typedef _In_ LPCSTR _Reserved_ ULONG Flags

typedef _In_ LPCSTR TargetDllName

typedef _In_ PCIMAGE_DELAYLOAD_DESCRIPTOR _In_opt_ PDELAYLOAD_FAILURE_DLL_CALLBACK _In_opt_ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE _Out_ PIMAGE_THUNK_DATA ThunkAddress

Function Documentation

DLOAD_INLINE PVOID WINAPI Dload__delayLoadHelper2	(	_In_ PCIMAGE_DELAYLOAD_DESCRIPTOR	DelayloadDescriptor,
		_Out_ PIMAGE_THUNK_DATA	ThunkAddress,
		_Out_ PBOOLEAN	NativeHandled
	)

{

    PVOID Symbol;

    if (DloadResolve() == FALSE) {
        *NativeHandled = FALSE;
        return NULL;
    }

    *NativeHandled = TRUE;

    Symbol = DloadResolveDelayLoadedAPI((PVOID)&__ImageBase,
                                        DelayloadDescriptor,
                                        (PDELAYLOAD_FAILURE_DLL_CALLBACK)__pfnDliFailureHook2,
                                        DelayLoadFailureHook,
                                        ThunkAddress,
                                        0);

    return Symbol;
}

DLOAD_INLINE HRESULT WINAPI Dload__HrLoadAllImportsForDll	(	_In_ LPCSTR	DllName,
		_Out_ PBOOLEAN	NativeHandled
	)

{

    NTSTATUS Status;

    if (DloadResolve() == FALSE) {
        *NativeHandled = FALSE;
        return HRESULT_FROM_WIN32(ERROR_MOD_NOT_FOUND);
    }

    *NativeHandled = TRUE;

    Status = DloadResolveDelayLoadsFromDll((PVOID)&__ImageBase,
                                           DllName,
                                           0);

    if (Status == STATUS_DLL_NOT_FOUND) {
        return HRESULT_FROM_WIN32(ERROR_MOD_NOT_FOUND);

    } else {
        return S_OK;
    }
}

DLOAD_INLINE BOOLEAN DloadResolve

(

VOID

)

{

    HMODULE Kernel32;

    Kernel32 = (HMODULE)ReadPointerAcquire((PVOID *) &DloadKernel32);
    if (Kernel32 == DLOAD_UNSUPPORTED) {
        return FALSE;
    }
    if (Kernel32 != NULL) {
        return TRUE;
    }

    Kernel32 = GetModuleHandleW(L"api-ms-win-core-delayload-l1-1-1.dll");
    if (Kernel32 == NULL) {
        Kernel32 = GetModuleHandleW(L"KERNEL32.DLL");
        if (Kernel32 == NULL) {
            Kernel32 = DLOAD_UNSUPPORTED;
            goto Done;
        }
    }

    DloadResolveDelayLoadedAPI =
        (ResolveDelayLoadedAPIProc)GetProcAddress(Kernel32,
                                                  "ResolveDelayLoadedAPI");

    if (DloadResolveDelayLoadedAPI == NULL) {
        Kernel32 = DLOAD_UNSUPPORTED;
        goto Done;
    }

    DloadResolveDelayLoadsFromDll =
        (ResolveDelayLoadsFromDllProc)GetProcAddress(Kernel32,
                                                     "ResolveDelayLoadsFromDll");

    if (DloadResolveDelayLoadsFromDll == NULL) {
        Kernel32 = DLOAD_UNSUPPORTED;
        goto Done;
    }

Done:
    WritePointerRelease((PVOID *)&DloadKernel32, Kernel32);
    return (Kernel32 != DLOAD_UNSUPPORTED);
}

typedef NTSTATUS

(

NTAPI *

ResolveDelayLoadsFromDllProc

)

typedef PVOID

(

NTAPI *

ResolveDelayLoadedAPIProc

)

Variable Documentation

HMODULE DloadKernel32

ResolveDelayLoadedAPIProc DloadResolveDelayLoadedAPI

ResolveDelayLoadsFromDllProc DloadResolveDelayLoadsFromDll