able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/public/sdk/inc/ntldr.h
CryptoAlgo Inc b3cac27891 Add source files
2020-09-26 16:20:57 +08:00

838 lines
20 KiB
C
Raw Permalink Blame History

/*++ BUILD Version: 0004 // Increment this if a change has global effects
Copyright (c) Microsoft Corporation. All rights reserved.
Module Name:
ntldr.h
Abstract:
This module implements the public interfaces of the Loader (Ldr)
subsystem. Ldr is coupled with the session manager. It is not
a separate process.
Author:
Mike O'Leary (mikeol) 22-Mar-1990
[Environment:]
optional-environment-info (e.g. kernel mode only...)
[Notes:]
optional-notes
Revision History:
--*/
#ifndef _NTLDRAPI_
#define _NTLDRAPI_
#if _MSC_VER > 1000
#pragma once
#endif
#ifdef __cplusplus
extern "C" {
#endif
//
// Private flags for loader data table entries
//
#define LDRP_STATIC_LINK 0x00000002
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_LOAD_IN_PROGRESS 0x00001000
#define LDRP_UNLOAD_IN_PROGRESS 0x00002000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_CURRENT_LOAD 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD 0x00020000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
#define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000
#define LDRP_COR_IMAGE 0x00400000
#define LDRP_COR_OWNS_UNMAP 0x00800000
#define LDRP_SYSTEM_MAPPED 0x01000000
#define LDRP_IMAGE_VERIFYING 0x02000000
#define LDRP_DRIVER_DEPENDENT_DLL 0x04000000
#define LDRP_ENTRY_NATIVE 0x08000000
#define LDRP_REDIRECTED 0x10000000
#define LDRP_NON_PAGED_DEBUG_INFO 0x20000000
//
// Loader Data Table. Used to track DLLs loaded into an
// image.
//
typedef struct _LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY HashLinks;
struct {
PVOID SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
PVOID LoadedImports;
};
};
PVOID EntryPointActivationContext;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
typedef const struct _LDR_DATA_TABLE_ENTRY *PCLDR_DATA_TABLE_ENTRY;
typedef struct _KLDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
PVOID __Unused1;
PVOID __Unused2;
PVOID __Unused3;
PNON_PAGED_DEBUG_INFO NonPagedDebugInfo;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT __Unused5;
PVOID SectionPointer;
ULONG CheckSum;
// ULONG padding on IA64
PVOID LoadedImports;
PVOID __Unused6;
} KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY;
typedef struct _LDR_DATA_TABLE_ENTRY32 {
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
LIST_ENTRY32 InInitializationOrderLinks;
ULONG DllBase;
ULONG EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING32 FullDllName;
UNICODE_STRING32 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY32 HashLinks;
struct {
ULONG SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
ULONG LoadedImports;
};
};
//
// NOTE : Do not grow this structure at the dump files used a packed
// array of these structures.
//
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
typedef struct _LDR_DATA_TABLE_ENTRY64 {
LIST_ENTRY64 InLoadOrderLinks;
LIST_ENTRY64 InMemoryOrderLinks;
LIST_ENTRY64 InInitializationOrderLinks;
ULONG64 DllBase;
ULONG64 EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING64 FullDllName;
UNICODE_STRING64 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY64 HashLinks;
struct {
ULONG64 SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
ULONG64 LoadedImports;
};
};
//
// NOTE : Do not grow this structure at the dump files used a packed
// array of these structures.
//
} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64;
typedef struct _KLDR_DATA_TABLE_ENTRY32 {
LIST_ENTRY32 InLoadOrderLinks;
ULONG __Undefined1;
ULONG __Undefined2;
ULONG __Undefined3;
ULONG NonPagedDebugInfo;
ULONG DllBase;
ULONG EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING32 FullDllName;
UNICODE_STRING32 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT __Undefined5;
ULONG __Undefined6;
ULONG CheckSum;
ULONG TimeDateStamp;
//
// NOTE : Do not grow this structure at the dump files used a packed
// array of these structures.
//
} KLDR_DATA_TABLE_ENTRY32, *PKLDR_DATA_TABLE_ENTRY32;
typedef struct _KLDR_DATA_TABLE_ENTRY64 {
LIST_ENTRY64 InLoadOrderLinks;
ULONG64 __Undefined1;
ULONG64 __Undefined2;
ULONG64 __Undefined3;
ULONG64 NonPagedDebugInfo;
ULONG64 DllBase;
ULONG64 EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING64 FullDllName;
UNICODE_STRING64 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT __Undefined5;
ULONG64 __Undefined6;
ULONG CheckSum;
ULONG __padding1;
ULONG TimeDateStamp;
ULONG __padding2;
//
// NOTE : Do not grow this structure at the dump files used a packed
// array of these structures.
//
} KLDR_DATA_TABLE_ENTRY64, *PKLDR_DATA_TABLE_ENTRY64;
#define DLL_PROCESS_ATTACH 1 // winnt
#define DLL_THREAD_ATTACH 2 // winnt
#define DLL_THREAD_DETACH 3 // winnt
#define DLL_PROCESS_DETACH 0 // winnt
#define DLL_PROCESS_VERIFIER 4 // winnt
typedef
BOOLEAN
(*PDLL_INIT_ROUTINE) (
IN PVOID DllHandle,
IN ULONG Reason,
IN PCONTEXT Context OPTIONAL
);
typedef
BOOLEAN
(*PPROCESS_STARTER_ROUTINE) (
IN PVOID RealStartAddress
);
VOID
LdrProcessStarterHelper(
IN PPROCESS_STARTER_ROUTINE ProcessStarter,
IN PVOID RealStartAddress
);
VOID
NTAPI
LdrShutdownProcess(
VOID
);
VOID
NTAPI
LdrShutdownThread(
VOID
);
NTSTATUS
NTAPI
LdrLoadDll(
IN PWSTR DllPath OPTIONAL,
IN PULONG DllCharacteristics OPTIONAL,
IN PUNICODE_STRING DllName,
OUT PVOID *DllHandle
);
NTSTATUS
NTAPI
LdrGetDllHandle(
IN PWSTR DllPath OPTIONAL,
IN PULONG DllCharacteristics OPTIONAL,
IN PUNICODE_STRING DllName,
OUT PVOID *DllHandle
);
NTSTATUS
NTAPI
LdrUnloadDll(
IN PVOID DllHandle
);
typedef
NTSTATUS
(NTAPI * PLDR_MANIFEST_PROBER_ROUTINE) (
IN PVOID DllBase,
IN PCWSTR FullDllPath,
OUT PVOID *ActivationContext
);
VOID
NTAPI
LdrSetDllManifestProber(
IN PLDR_MANIFEST_PROBER_ROUTINE ManifestProberRoutine
);
#if defined(BLDR_KERNEL_RUNTIME)
typedef ULONG ARC_STATUS;
typedef ARC_STATUS LDR_RELOCATE_IMAGE_RETURN_TYPE;
#else
typedef NTSTATUS LDR_RELOCATE_IMAGE_RETURN_TYPE;
#endif
LDR_RELOCATE_IMAGE_RETURN_TYPE
LdrRelocateImage (
IN PVOID NewBase,
IN CONST CHAR* LoaderName,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Success,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Conflict,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Invalid
);
#if defined(NTOS_KERNEL_RUNTIME) && defined(_ALPHA_)
NTSTATUS
LdrDoubleRelocateImage (
IN PVOID NewBase,
IN PVOID CurrentBase,
IN CONST CHAR* LoaderName,
IN NTSTATUS Success,
IN NTSTATUS Conflict,
IN NTSTATUS Invalid
);
#endif
LDR_RELOCATE_IMAGE_RETURN_TYPE
LdrRelocateImageWithBias (
IN PVOID NewBase,
IN LONGLONG Bias,
IN CONST CHAR* LoaderName,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Success,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Conflict,
IN LDR_RELOCATE_IMAGE_RETURN_TYPE Invalid
);
PIMAGE_BASE_RELOCATION
NTAPI
LdrProcessRelocationBlock(
IN ULONG_PTR VA,
IN ULONG SizeOfBlock,
IN PUSHORT NextOffset,
IN LONG_PTR Diff
);
BOOLEAN
NTAPI
LdrVerifyMappedImageMatchesChecksum (
IN PVOID BaseAddress,
IN ULONG FileLength
);
typedef
VOID
(*PLDR_IMPORT_MODULE_CALLBACK)(
IN PVOID Parameter,
PCHAR ModuleName
);
NTSTATUS
NTAPI
LdrVerifyImageMatchesChecksum (
IN HANDLE ImageFileHandle,
IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine OPTIONAL,
IN PVOID ImportCallbackParameter,
OUT PUSHORT ImageCharacteristics OPTIONAL
);
NTSTATUS
NTAPI
LdrGetProcedureAddress(
IN PVOID DllHandle,
IN CONST ANSI_STRING* ProcedureName OPTIONAL,
IN ULONG ProcedureNumber OPTIONAL,
OUT PVOID *ProcedureAddress
);
#define LDR_RESOURCE_ID_NAME_MASK ((~(ULONG_PTR)0) << 16) /* lower 16bits clear */
#define LDR_RESOURCE_ID_NAME_MINVAL (( (ULONG_PTR)1) << 16) /* 17th bit set */
//
// These are how you currently pass the flag to FindResource.
//
// VIEW_TO_DATAFILE and DATAFILE_TO_VIEW are idempotent,
// so you can covert a datafile to a datafile with VIEW_TO_DATAFILE.
// Think of better names therefore..
//
#define LDR_VIEW_TO_DATAFILE(x) ((PVOID)(((ULONG_PTR)(x)) | (ULONG_PTR)1))
#define LDR_IS_DATAFILE(x) (((ULONG_PTR)(x)) & (ULONG_PTR)1)
#define LDR_IS_VIEW(x) (!LDR_IS_DATAFILE(x))
#define LDR_DATAFILE_TO_VIEW(x) ((PVOID)(((ULONG_PTR)(x)) & ~(ULONG_PTR)1))
//
// Flags to LdrCreateOutOfProcessImage.
//
// These first two values must not share any bits, even though this is an enum,
// because LDR_DLL_MAPPED_AS_UNREFORMATED_IMAGE is actually changed to one of them
// and then it is treated as bits.
#define LDR_DLL_MAPPED_AS_IMAGE (0x00000001)
#define LDR_DLL_MAPPED_AS_DATA (0x00000002)
#define LDR_DLL_MAPPED_AS_UNFORMATED_IMAGE (0x00000003)
#define LDR_DLL_MAPPED_AS_MASK (0x00000003)
//
// These are flags to a function that doesn't yet exist:
// LdrpSearchResourceSectionEx and/or LdrpSearchOutOfProcessResourceSection
//
#define LDRP_FIND_RESOURCE_DATA (0x00000000)
#define LDRP_FIND_RESOURCE_DIRECTORY (0x00000002)
//
// Flags to LdrFindResourceEx/LdrpSearchResourceSection/LdrFindOutOfProcessResource.
//
#define LDR_FIND_RESOURCE_LANGUAGE_CAN_FALLBACK (0x00000000)
#define LDR_FIND_RESOURCE_LANGUAGE_EXACT (0x00000004)
#define LDR_FIND_RESOURCE_LANGUAGE_REDIRECT_VERSION (0x00000008)
NTSTATUS
NTAPI
LdrFindResourceDirectory_U(
IN PVOID DllHandle,
IN CONST ULONG_PTR* ResourceIdPath,
IN ULONG ResourceIdPathLength,
OUT PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
);
NTSTATUS
NTAPI
LdrFindResource_U(
IN PVOID DllHandle,
IN CONST ULONG_PTR* ResourceIdPath,
IN ULONG ResourceIdPathLength,
OUT PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry
);
NTSTATUS
NTAPI
LdrFindResourceEx_U(
ULONG Flags,
IN PVOID DllHandle,
IN CONST ULONG_PTR* ResourceIdPath,
IN ULONG ResourceIdPathLength,
OUT PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry
);
#ifndef NTOS_KERNEL_RUNTIME
#if !defined(RTL_BUFFER)
// This is duplicated in nturtl.h.
#define RTL_BUFFER RTL_BUFFER
typedef struct _RTL_BUFFER {
PUCHAR Buffer;
PUCHAR StaticBuffer;
SIZE_T Size;
SIZE_T StaticSize;
SIZE_T ReservedForAllocatedSize; // for future doubling
PVOID ReservedForIMalloc; // for future pluggable growth
} RTL_BUFFER, *PRTL_BUFFER;
#endif
//
// This will always contain the MS-DOS header,
// File header, Optional header, and Section headers.
//
// If multiple fast resource loads are needed, we could
// populate it on demand with resource directory stuff too.
//
// This struct is opaque.
// Only access it with Ldr*OutOfProcess* functions.
//
struct _LDR_OUT_OF_PROCESS_IMAGE;
typedef struct _LDR_OUT_OF_PROCESS_IMAGE {
RTL_BUFFER HeadersBuffer;
// Internally, the memory manager is limited to 2*PAGE_SIZE
// for headers, but that not public. We use 4k because
// it is generally enough and we is the smallest pagesize
// NT has run on, so we should always be able to read 4k, even
// across processes into other architectures, like if ia64
// supported 4k pages for x86 processes.
//
// 13-Nov-2000 jonwis: This 4k buffer caused several stack overflows in a
// stress run. There's a stack-local instance of this in
// CsrBasepSxsCreateResourceStream, which was blowing the stack in
// CsrBasepSxsCreateProcess, so this has been toned down to 1024
// bytes instead. The counter-argument is that LdrCreateOutOfProcessImage
// has its minimal cross-process read size set to 4096 bytes, and always
// does an RtlEnsureBufferSize to make sure it's 4096 bytes. We could
// just as easily get rid of this storage space and always have the
// loader create a heap-space buffer instead, and avoid any stack usage
// whatsoever.
//
// 17-Nov-2000 jonwis: The executive decision has been made (on a suggestion by
// mgrier) to reduce the size of the PreallocatedHeadersBuffer to a
// single byte. This way, we always take the hit of allocating space for
// it, but we don't use any (or much) stack space and don't explode in stress.
//
UCHAR PreallocatedHeadersBuffer[1];
HANDLE ProcessHandle;
PVOID DllHandle; // base of mapped section, not kernel handle
ULONG Flags;
} LDR_OUT_OF_PROCESS_IMAGE, *PLDR_OUT_OF_PROCESS_IMAGE;
NTSTATUS
NTAPI
LdrCreateOutOfProcessImage(
IN ULONG Flags,
IN HANDLE ProcessHandle,
IN PVOID DllHandle, // base of mapped section, not kernel handle
OUT PLDR_OUT_OF_PROCESS_IMAGE Image
);
//
// - You may destroy an out of process image that is all zeros.
// - You may destroy an out of process image repeatedly.
//
VOID
NTAPI
LdrDestroyOutOfProcessImage(
IN OUT PLDR_OUT_OF_PROCESS_IMAGE Image
);
NTSTATUS
NTAPI
LdrFindCreateProcessManifest(
IN ULONG Flags,
PLDR_OUT_OF_PROCESS_IMAGE Image,
IN CONST ULONG_PTR* ResourceIdPath,
IN ULONG ResourceIdPathLength,
OUT PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry
);
NTSTATUS
NTAPI
LdrAccessOutOfProcessResource(
IN ULONG Flags,
PLDR_OUT_OF_PROCESS_IMAGE Image,
IN CONST IMAGE_RESOURCE_DATA_ENTRY* DataEntry,
OUT PVOID* Address OPTIONAL,
OUT PULONG Size OPTIONAL
);
#endif
// type, id/name, langid
#define LDR_MAXIMUM_RESOURCE_PATH_DEPTH (3)
typedef struct _LDR_ENUM_RESOURCE_ENTRY {
union {
ULONG_PTR NameOrId;
PIMAGE_RESOURCE_DIRECTORY_STRING Name;
struct {
USHORT Id;
USHORT NameIsPresent;
};
} Path[ LDR_MAXIMUM_RESOURCE_PATH_DEPTH ];
PVOID Data;
ULONG Size;
ULONG Reserved;
} LDR_ENUM_RESOURCE_ENTRY, *PLDR_ENUM_RESOURCE_ENTRY;
NTSTATUS
NTAPI
LdrEnumResources(
IN PVOID DllHandle,
IN CONST ULONG_PTR* ResourceIdPath,
IN ULONG ResourceIdPathLength,
IN OUT PULONG NumberOfResources,
OUT PLDR_ENUM_RESOURCE_ENTRY Resources OPTIONAL
);
NTSTATUS
NTAPI
LdrAccessResource(
IN PVOID DllHandle,
IN CONST IMAGE_RESOURCE_DATA_ENTRY* ResourceDataEntry,
OUT PVOID *Address OPTIONAL,
OUT PULONG Size OPTIONAL
);
NTSTATUS
NTAPI
LdrFindEntryForAddress(
IN PVOID Address,
OUT PLDR_DATA_TABLE_ENTRY *TableEntry
);
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll (
IN PVOID DllHandle
);
typedef struct _RTL_PROCESS_MODULE_INFORMATION {
HANDLE Section; // Not filled in
PVOID MappedBase;
PVOID ImageBase;
ULONG ImageSize;
ULONG Flags;
USHORT LoadOrderIndex;
USHORT InitOrderIndex;
USHORT LoadCount;
USHORT OffsetToFileName;
UCHAR FullPathName[ 256 ];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
typedef struct _RTL_PROCESS_MODULES {
ULONG NumberOfModules;
RTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
NTSTATUS
NTAPI
LdrQueryProcessModuleInformation(
OUT PRTL_PROCESS_MODULES ModuleInformation,
IN ULONG ModuleInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
NTSTATUS
NTAPI
LdrQueryImageFileExecutionOptions(
IN PUNICODE_STRING ImagePathName,
IN PWSTR OptionName,
IN ULONG Type,
OUT PVOID Buffer,
IN ULONG BufferSize,
OUT PULONG ResultSize OPTIONAL
);
BOOLEAN
NTAPI
LdrAlternateResourcesEnabled(
VOID
);
PVOID
NTAPI
LdrGetAlternateResourceModuleHandle(
IN PVOID Module
);
PVOID
NTAPI
LdrLoadAlternateResourceModule(
IN PVOID Module,
IN LPCWSTR PathToAlternateModule OPTIONAL
);
BOOLEAN
NTAPI
LdrUnloadAlternateResourceModule(
IN PVOID Module
);
BOOLEAN
NTAPI
LdrFlushAlternateResourceModules(
VOID
);
#define LDR_DLL_LOADED_FLAG_RELOCATED (0x00000001)
typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA {
ULONG Flags;
PCUNICODE_STRING FullDllName;
PCUNICODE_STRING BaseDllName;
PVOID DllBase;
ULONG SizeOfImage;
} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;
typedef const LDR_DLL_LOADED_NOTIFICATION_DATA *PCLDR_DLL_LOADED_NOTIFICATION_DATA;
#define LDR_DLL_UNLOADED_FLAG_PROCESS_TERMINATION (0x00000001)
typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA {
ULONG Flags;
PCUNICODE_STRING FullDllName;
PCUNICODE_STRING BaseDllName;
PVOID DllBase;
ULONG SizeOfImage;
} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
typedef const LDR_DLL_UNLOADED_NOTIFICATION_DATA *PCLDR_DLL_UNLOADED_NOTIFICATION_DATA;
typedef union _LDR_DLL_NOTIFICATION_DATA {
LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;
typedef const LDR_DLL_NOTIFICATION_DATA *PCLDR_DLL_NOTIFICATION_DATA;
#define LDR_DLL_NOTIFICATION_REASON_LOADED (1)
#define LDR_DLL_NOTIFICATION_REASON_UNLOADED (2)
typedef
VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(
IN ULONG NotificationReason,
IN PCLDR_DLL_NOTIFICATION_DATA NotificationData,
IN PVOID Context
);
NTSTATUS
NTAPI
LdrRegisterDllNotification(
IN ULONG Flags,
IN PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
IN PVOID Context,
OUT PVOID *Cookie
);
NTSTATUS
NTAPI
LdrUnregisterDllNotification(
IN PVOID Cookie
);
typedef
VOID (NTAPI *PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION)(
IN PCLDR_DATA_TABLE_ENTRY DataTableEntry,
IN PVOID Context,
IN OUT BOOLEAN *StopEnumeration
);
NTSTATUS
NTAPI
LdrEnumerateLoadedModules(
IN ULONG Flags,
IN PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION CallbackFunction,
IN PVOID Context
);
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS (0x00000001)
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY (0x00000002)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID (0)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED (1)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED (2)
NTSTATUS
NTAPI
LdrLockLoaderLock(
IN ULONG Flags,
OUT ULONG *Disposition OPTIONAL, // not optional if LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY is set
OUT PVOID *Cookie
);
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS (0x00000001)
NTSTATUS
NTAPI
LdrUnlockLoaderLock(
IN ULONG Flags,
IN OUT PVOID Cookie
);
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT (0x00000001)
#define LDR_GET_DLL_HANDLE_EX_PIN (0x00000002)
NTSTATUS
NTAPI
LdrGetDllHandleEx(
IN ULONG Flags,
IN PWSTR DllPath OPTIONAL,
IN PULONG DllCharacteristics OPTIONAL,
IN PUNICODE_STRING DllName,
OUT PVOID *DllHandle OPTIONAL
);
#define LDR_ADDREF_DLL_PIN (0x00000001)
NTSTATUS
NTAPI
LdrAddRefDll(
ULONG Flags,
PVOID DllHandle
);
typedef
NTSTATUS (NTAPI *PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(
IN ULONG Flags,
IN PCWSTR DllName,
IN PCWSTR DllPath OPTIONAL,
IN OUT PULONG DllCharacteristics OPTIONAL,
IN PVOID CallbackData,
OUT PWSTR *EffectiveDllPath
);
NTSTATUS
NTAPI
LdrSetAppCompatDllRedirectionCallback(
IN ULONG Flags,
IN PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION CallbackFunction,
IN PVOID CallbackData
);
#ifdef __cplusplus
}
#endif
#endif // _NTLDRAPI_
Reference in a new issue View git blame Copy permalink