1434 lines
38 KiB
C++
1434 lines
38 KiB
C++
/*++
|
|
|
|
Copyright (c) 2000 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
Win2000VersionLie.cpp
|
|
|
|
Abstract:
|
|
|
|
This DLL hooks GetVersion and GetVersionEx so that they return Windows 2000
|
|
version credentials.
|
|
|
|
Notes:
|
|
|
|
This is a general purpose shim.
|
|
|
|
History:
|
|
|
|
03/13/2000 clupu Created
|
|
10/26/2000 Vadimb Merged WowProcessHistory functionality, new environment-handling cases
|
|
|
|
--*/
|
|
|
|
#include "precomp.h"
|
|
|
|
// This module has been given an official blessing to use the str routines.
|
|
#include "LegalStr.h"
|
|
|
|
IMPLEMENT_SHIM_BEGIN(Win2kPropagateLayer)
|
|
#include "ShimHookMacro.h"
|
|
|
|
#include "Win2kPropagateLayer.h"
|
|
#include "stdio.h"
|
|
|
|
APIHOOK_ENUM_BEGIN
|
|
APIHOOK_ENUM_ENTRY(CreateProcessA)
|
|
APIHOOK_ENUM_ENTRY(CreateProcessW)
|
|
APIHOOK_ENUM_ENTRY(UserRegisterWowHandlers)
|
|
APIHOOK_ENUM_END
|
|
|
|
|
|
#define LI_WIN95 0x00000001
|
|
#define LI_NT4 0x00000002
|
|
#define LI_WIN98 0x00000004
|
|
|
|
#define LS_MAGIC 0x07036745
|
|
|
|
typedef struct tagLayerStorageHeader {
|
|
DWORD dwItemCount; // number of items in the file
|
|
DWORD dwMagic; // magic to identify the file
|
|
SYSTEMTIME timeLast; // time of last access
|
|
} LayerStorageHeader, *PLayerStorageHeader;
|
|
|
|
|
|
typedef struct tagLayeredItem {
|
|
WCHAR szItemName[MAX_PATH];
|
|
DWORD dwFlags;
|
|
|
|
} LayeredItem, *PLayeredItem;
|
|
|
|
|
|
|
|
#define APPCOMPAT_KEY L"System\\CurrentControlSet\\Control\\Session Manager\\AppCompatibility"
|
|
|
|
WCHAR g_szLayerStorage[MAX_PATH] = L"";
|
|
|
|
|
|
CHAR g_szCompatLayerVar[] = "__COMPAT_LAYER";
|
|
CHAR g_szProcessHistoryVar[] = "__PROCESS_HISTORY";
|
|
CHAR g_szShimFileLogVar[] = "SHIM_FILE_LOG";
|
|
|
|
|
|
WCHAR g_wszCompatLayerVar[] = L"__COMPAT_LAYER";
|
|
WCHAR g_wszProcessHistroyVar[] = L"__PROCESS_HISTORY";
|
|
//
|
|
// This variable receives current process' compat layer
|
|
//
|
|
|
|
WCHAR* g_pwszCompatLayer = NULL;
|
|
WCHAR* g_pwszProcessHistory = NULL;
|
|
|
|
//
|
|
// Unicode equivalent of the above
|
|
//
|
|
UNICODE_STRING g_ustrProcessHistoryVar = RTL_CONSTANT_STRING(L"__PROCESS_HISTORY");
|
|
UNICODE_STRING g_ustrCompatLayerVar = RTL_CONSTANT_STRING(L"__COMPAT_LAYER");
|
|
|
|
//
|
|
// Global flags
|
|
//
|
|
BOOL g_bIsNTVDM = FALSE;
|
|
BOOL g_bIsExplorer = FALSE;
|
|
|
|
INT g_argc = 0;
|
|
CHAR** g_argv = NULL;
|
|
|
|
//
|
|
// is this a separate wow ?
|
|
//
|
|
|
|
BOOL* g_pSeparateWow = NULL;
|
|
|
|
|
|
void
|
|
InitLayerStorage(
|
|
BOOL bDelete
|
|
)
|
|
{
|
|
GetSystemWindowsDirectoryW(g_szLayerStorage, MAX_PATH);
|
|
|
|
if (g_szLayerStorage[lstrlenW(g_szLayerStorage) - 1] == L'\\') {
|
|
g_szLayerStorage[lstrlenW(g_szLayerStorage) - 1] = 0;
|
|
}
|
|
|
|
lstrcatW(g_szLayerStorage, L"\\AppPatch\\LayerStorage.dat");
|
|
|
|
if (bDelete) {
|
|
DeleteFileW(g_szLayerStorage);
|
|
}
|
|
}
|
|
|
|
void
|
|
ReadLayeredStorage(
|
|
LPWSTR pszItem,
|
|
LPDWORD lpdwFlags
|
|
)
|
|
{
|
|
HANDLE hFile = INVALID_HANDLE_VALUE;
|
|
HANDLE hFileMapping = NULL;
|
|
DWORD dwFileSize;
|
|
PBYTE pData = NULL;
|
|
PLayerStorageHeader pHeader = NULL;
|
|
PLayeredItem pItems;
|
|
PLayeredItem pCrtItem = NULL;
|
|
int nLeft, nRight, nMid, nItem;
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ReadLayeredStorage] for \"%S\"",
|
|
pszItem);
|
|
|
|
//
|
|
// Make sure we don't corrupt the layer storage.
|
|
//
|
|
if (lstrlenW(pszItem) + 1 > MAX_PATH) {
|
|
pszItem[MAX_PATH - 1] = 0;
|
|
}
|
|
|
|
hFile = CreateFileW(g_szLayerStorage,
|
|
GENERIC_READ | GENERIC_WRITE,
|
|
FILE_SHARE_READ | FILE_SHARE_WRITE,
|
|
NULL,
|
|
OPEN_EXISTING,
|
|
0,
|
|
NULL);
|
|
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ReadLayeredStorage] the layer storage doesn't exist.");
|
|
*lpdwFlags = 0;
|
|
return;
|
|
}
|
|
|
|
//
|
|
// The file already exists. Create a file mapping that will allow
|
|
// for querying the item.
|
|
//
|
|
dwFileSize = GetFileSize(hFile, NULL);
|
|
|
|
hFileMapping = CreateFileMapping(hFile,
|
|
NULL,
|
|
PAGE_READWRITE,
|
|
0,
|
|
dwFileSize,
|
|
NULL);
|
|
|
|
if (hFileMapping == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ReadLayeredStorage] CreateFileMapping failed 0x%X",
|
|
GetLastError());
|
|
goto done;
|
|
}
|
|
|
|
pData = (PBYTE)MapViewOfFile(hFileMapping,
|
|
FILE_MAP_READ | FILE_MAP_WRITE,
|
|
0,
|
|
0,
|
|
0);
|
|
|
|
if (pData == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ReadLayeredStorage] MapViewOfFile failed 0x%X",
|
|
GetLastError());
|
|
goto done;
|
|
}
|
|
|
|
pHeader = (PLayerStorageHeader)pData;
|
|
|
|
pItems = (PLayeredItem)(pData + sizeof(LayerStorageHeader));
|
|
|
|
//
|
|
// Make sure it's our file.
|
|
//
|
|
if (dwFileSize < sizeof(LayerStorageHeader) || pHeader->dwMagic != LS_MAGIC) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ReadLayeredStorage] invalid file magic 0x%X",
|
|
pHeader->dwMagic);
|
|
goto done;
|
|
}
|
|
|
|
//
|
|
// First search for the item. The array is sorted so we do binary search.
|
|
//
|
|
nItem = -1, nLeft = 0, nRight = (int)pHeader->dwItemCount - 1;
|
|
|
|
while (nLeft <= nRight) {
|
|
|
|
int nVal;
|
|
|
|
nMid = (nLeft + nRight) / 2;
|
|
|
|
pCrtItem = pItems + nMid;
|
|
|
|
nVal = _wcsnicmp(pszItem, pCrtItem->szItemName, lstrlenW(pCrtItem->szItemName));
|
|
|
|
if (nVal == 0) {
|
|
nItem = nMid;
|
|
break;
|
|
} else if (nVal < 0) {
|
|
nRight = nMid - 1;
|
|
} else {
|
|
nLeft = nMid + 1;
|
|
}
|
|
}
|
|
|
|
if (nItem == -1) {
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ReadLayeredStorage] the item was not found in the file.");
|
|
|
|
*lpdwFlags = 0;
|
|
} else {
|
|
//
|
|
// The item is in the file.
|
|
//
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ReadLayeredStorage] the item is in the file.");
|
|
|
|
*lpdwFlags = pCrtItem->dwFlags;
|
|
}
|
|
|
|
done:
|
|
|
|
if (pData != NULL) {
|
|
UnmapViewOfFile(pData);
|
|
}
|
|
|
|
if (hFileMapping != NULL) {
|
|
CloseHandle(hFileMapping);
|
|
}
|
|
|
|
if (hFile != INVALID_HANDLE_VALUE) {
|
|
CloseHandle(hFile);
|
|
}
|
|
}
|
|
|
|
|
|
BOOL
|
|
GetFileNameFromCmdLine(
|
|
LPWSTR lpFileName,
|
|
DWORD dwFileNameSize,
|
|
LPCWSTR lpCmdLine
|
|
)
|
|
{
|
|
LPWSTR pTemp = lpFileName;
|
|
LPCWSTR pSrc = lpCmdLine;
|
|
DWORD dwQuote = 0;
|
|
LPCWSTR pStart;
|
|
BOOL bQuote = FALSE;
|
|
BOOL bInitialQuote = FALSE;
|
|
BOOL bDone = FALSE;
|
|
DWORD dwLength; // length of the result, in chars
|
|
|
|
pSrc += wcsspn(pSrc, L" \t");
|
|
if (*pSrc == L'\"') {
|
|
++pSrc;
|
|
bQuote = TRUE;
|
|
bInitialQuote = TRUE;
|
|
}
|
|
|
|
pStart = pSrc; // note -- we're past the quote
|
|
|
|
// we end when: 1) we start we the quote -- we end with the quote or
|
|
// we did not start with the quote -- we encounter space then
|
|
|
|
while (*pSrc && !bDone) {
|
|
switch(*pSrc) {
|
|
case L'\"':
|
|
bQuote = !bQuote;
|
|
break;
|
|
|
|
case L' ':
|
|
bDone = !bQuote; // out of quotes? this is the end
|
|
break;
|
|
}
|
|
|
|
if (!bDone) {
|
|
++pSrc;
|
|
}
|
|
}
|
|
|
|
if (pSrc > pStart && bInitialQuote && *(pSrc-1) == L'\"') {
|
|
--pSrc;
|
|
}
|
|
|
|
//
|
|
// now that we ended the run, copy
|
|
//
|
|
dwLength = (DWORD)(pSrc - pStart);
|
|
|
|
if (dwFileNameSize < (dwLength + 1)) {
|
|
// too big
|
|
LOGN( eDbgLevelError,
|
|
"[GetFileNameFromCmdLine] filename is too long\"%S\".\n", lpCmdLine);
|
|
return FALSE;
|
|
}
|
|
|
|
RtlCopyMemory(lpFileName, pStart, dwLength * sizeof(WCHAR));
|
|
lpFileName[dwLength] = L'\0';
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
BOOL
|
|
AddSupport(
|
|
LPCWSTR lpCommandLine,
|
|
LPVOID* ppEnvironment,
|
|
LPDWORD lpdwCreationFlags
|
|
)
|
|
{
|
|
WCHAR szKey[MAX_PATH];
|
|
WCHAR szFullPath[MAX_PATH] = L"\"";
|
|
WCHAR szExeName[128];
|
|
HKEY hkey;
|
|
DWORD type;
|
|
DWORD cbData = 0;
|
|
BOOL bBraket = FALSE;
|
|
LPVOID pEnvironmentNew = *ppEnvironment;
|
|
DWORD dwCreationFlags = *lpdwCreationFlags;
|
|
BOOL bUserEnvironment = (*ppEnvironment != NULL);
|
|
NTSTATUS Status;
|
|
LPCWSTR pszEnd;
|
|
LPCWSTR pszStart = lpCommandLine;
|
|
|
|
//
|
|
// Need to look in lpCommandLine for the first token
|
|
//
|
|
LPCWSTR psz = lpCommandLine;
|
|
|
|
while (*psz == L' ' || *psz == L'\t') {
|
|
psz++;
|
|
}
|
|
|
|
if (*psz == L'\"') {
|
|
pszStart = psz + 1;
|
|
} else {
|
|
pszStart = psz;
|
|
}
|
|
|
|
while (*psz != 0) {
|
|
if (*psz == L'\"') {
|
|
bBraket = !bBraket;
|
|
} else if (*psz == L' ' && !bBraket) {
|
|
break;
|
|
}
|
|
|
|
psz++;
|
|
}
|
|
|
|
pszEnd = psz;
|
|
|
|
//
|
|
// Now walk back to get the caracters.
|
|
//
|
|
psz--;
|
|
|
|
if (*psz == L'\"') {
|
|
psz--;
|
|
pszEnd--;
|
|
}
|
|
|
|
memcpy(szFullPath + 1, pszStart, (pszEnd - pszStart) * sizeof(WCHAR));
|
|
szFullPath[pszEnd - pszStart + 1] = L'\"';
|
|
szFullPath[pszEnd - pszStart + 2] = 0;
|
|
|
|
pszStart = lpCommandLine;
|
|
|
|
pszEnd = psz + 1;
|
|
|
|
while (psz >= lpCommandLine) {
|
|
if (*psz == L'\\') {
|
|
pszStart = psz + 1;
|
|
break;
|
|
}
|
|
psz--;
|
|
}
|
|
|
|
memcpy(szExeName, pszStart, (pszEnd - pszStart) * sizeof(WCHAR));
|
|
szExeName[pszEnd - pszStart] = 0;
|
|
|
|
if (g_bIsExplorer) {
|
|
DWORD dwFlags = 0, id = 0;
|
|
LPVOID pEnvironmentNew = NULL;
|
|
|
|
ReadLayeredStorage(szFullPath, &dwFlags);
|
|
|
|
if (dwFlags != LI_WIN95 && dwFlags != LI_NT4 && dwFlags != LI_WIN98) {
|
|
//
|
|
// no layer support
|
|
//
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[AddSupport] No Layer specified for \"%S\".",
|
|
lpCommandLine);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
// we are using layer -- clone the environment
|
|
Status = ShimCloneEnvironment(&pEnvironmentNew, *ppEnvironment, !!(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT));
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[AddSupport] Failed to Clone the environment. Status = 0x%x",
|
|
Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (LI_WIN95 == dwFlags) {
|
|
Status = ShimSetEnvironmentVar(&pEnvironmentNew, g_wszCompatLayerVar, L"Win95");
|
|
|
|
LOGN( eDbgLevelInfo, "[AddSupport] Env var \"Win95\" added.");
|
|
|
|
} else if (LI_WIN98 == dwFlags) {
|
|
Status = ShimSetEnvironmentVar(&pEnvironmentNew, g_wszCompatLayerVar, L"Win98");
|
|
|
|
LOGN( eDbgLevelInfo, "[AddSupport] Env var \"Win98\" added.");
|
|
|
|
} else if (LI_NT4 == dwFlags) {
|
|
Status = ShimSetEnvironmentVar(&pEnvironmentNew, g_wszCompatLayerVar, L"NT4SP5");
|
|
|
|
LOGN( eDbgLevelInfo, "[AddSupport] Env var \"NT4SP5\" added.");
|
|
|
|
}
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[AddSupport] Failed to set the environment variable. Status = 0x%x",
|
|
Status);
|
|
ShimFreeEnvironment(pEnvironmentNew);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// We have succeeded, set the output values.
|
|
//
|
|
*ppEnvironment = pEnvironmentNew;
|
|
*lpdwCreationFlags |= CREATE_UNICODE_ENVIRONMENT;
|
|
|
|
} else {
|
|
//
|
|
// not explorer - set the environment variable up
|
|
// compat_layer will be inherited by the child process if bUserEnvironment is FALSE
|
|
//
|
|
if (bUserEnvironment) {
|
|
|
|
//
|
|
// Clone the environment and add the layer variable to the new env.
|
|
//
|
|
Status = ShimCloneEnvironment(&pEnvironmentNew,
|
|
*ppEnvironment,
|
|
!!(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT));
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[AddSupport] Failed to clone the environment. Status = 0x%x",
|
|
Status);
|
|
return FALSE;
|
|
}
|
|
|
|
Status = ShimSetEnvironmentVar(&pEnvironmentNew,
|
|
g_wszCompatLayerVar,
|
|
g_pwszCompatLayer);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
ShimFreeEnvironment(pEnvironmentNew);
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[AddSupport] Failed to set compat layer variable. Status = 0x%x",
|
|
Status);
|
|
return FALSE;
|
|
}
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[AddSupport] Env var \"%S\" added.",
|
|
g_pwszCompatLayer);
|
|
|
|
*ppEnvironment = pEnvironmentNew;
|
|
*lpdwCreationFlags |= CREATE_UNICODE_ENVIRONMENT;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Build the registry key.
|
|
//
|
|
swprintf(szKey, L"%s\\%s", APPCOMPAT_KEY, szExeName);
|
|
|
|
if (RegCreateKeyW(HKEY_LOCAL_MACHINE, szKey, &hkey) != ERROR_SUCCESS) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"Failed to open/create the appcompat key \"%s\"",
|
|
szKey);
|
|
} else {
|
|
if (RegQueryValueExA(hkey, "DllPatch-x", NULL, &type, NULL, &cbData) != ERROR_SUCCESS) {
|
|
|
|
BYTE data[16] = {0x0c, 0, 0, 0, 0, 0, 0, 0,
|
|
0x06, 0, 0, 0, 0, 0, 0, 0};
|
|
|
|
//
|
|
// The value doesn't exist. Create it.
|
|
//
|
|
RegSetValueExA(hkey,
|
|
"y",
|
|
NULL,
|
|
REG_BINARY,
|
|
data,
|
|
sizeof(data));
|
|
|
|
data[0] = 0;
|
|
|
|
RegSetValueExA(hkey,
|
|
"DllPatch-y",
|
|
NULL,
|
|
REG_SZ,
|
|
data,
|
|
2);
|
|
}
|
|
}
|
|
|
|
RegCloseKey(hkey);
|
|
|
|
//
|
|
// Finally, set a separate vdm flag
|
|
// if we are here, it means that we are running under the layer
|
|
// and the next exe is going to be shimmed.
|
|
//
|
|
*lpdwCreationFlags &= ~CREATE_SHARED_WOW_VDM;
|
|
*lpdwCreationFlags |= CREATE_SEPARATE_WOW_VDM;
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
LPVOID
|
|
ShimCreateWowEnvironment_U(
|
|
LPVOID lpEnvironment, // pointer to the existing environment
|
|
DWORD* lpdwFlags, // process creation flags
|
|
BOOL bNewEnvironment // when set, forces us to clone environment ptr
|
|
)
|
|
{
|
|
WOWENVDATA WowEnvData = { 0 };
|
|
LPVOID lpEnvRet = lpEnvironment;
|
|
LPVOID lpEnvCurrent = NULL;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
DWORD dwFlags = *lpdwFlags;
|
|
UNICODE_STRING ustrProcessHistory = { 0 };
|
|
ANSI_STRING strProcessHistory = { 0 };
|
|
DWORD dwProcessHistoryLength = 0;
|
|
UNICODE_STRING ustrCompatLayer = { 0 };
|
|
ANSI_STRING strCompatLayer = { 0 };
|
|
|
|
if (!ShimRetrieveVariablesEx(&WowEnvData)) {
|
|
//
|
|
// If no data, we have failed. Return the current data.
|
|
//
|
|
goto Fail;
|
|
}
|
|
|
|
if (bNewEnvironment) {
|
|
Status = ShimCloneEnvironment(&lpEnvCurrent,
|
|
lpEnvironment,
|
|
!!(dwFlags & CREATE_UNICODE_ENVIRONMENT));
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] Failed to clone the environment. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
} else {
|
|
lpEnvCurrent = lpEnvironment;
|
|
}
|
|
|
|
//
|
|
// Now we are ready to set the environment in place.
|
|
//
|
|
|
|
//
|
|
// Nuke the existing process history first. We don't care for the return result.
|
|
//
|
|
RtlSetEnvironmentVariable(&lpEnvCurrent, &g_ustrProcessHistoryVar, NULL);
|
|
|
|
if (WowEnvData.pszProcessHistory != NULL ||
|
|
WowEnvData.pszCurrentProcessHistory != NULL) {
|
|
|
|
//
|
|
// Convert the process history which consists of 2 strings.
|
|
//
|
|
// The length is the existing process history length + 1 (for ';') +
|
|
// new process history length + 1 (for '\0')
|
|
//
|
|
dwProcessHistoryLength = ((WowEnvData.pszProcessHistory == NULL) ? 0 : (strlen(WowEnvData.pszProcessHistory) + 1)) +
|
|
((WowEnvData.pszCurrentProcessHistory == NULL) ? 0 : strlen(WowEnvData.pszCurrentProcessHistory)) + 1;
|
|
|
|
//
|
|
// Allocate process history buffer and convert it, allocating resulting unicode string.
|
|
//
|
|
strProcessHistory.Buffer = (PCHAR)ShimMalloc(dwProcessHistoryLength);
|
|
|
|
if (strProcessHistory.Buffer == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] failed to allocate %d bytes for process history.",
|
|
dwProcessHistoryLength);
|
|
Status = STATUS_NO_MEMORY;
|
|
goto Fail;
|
|
}
|
|
|
|
strProcessHistory.MaximumLength = (USHORT)dwProcessHistoryLength;
|
|
|
|
if (WowEnvData.pszProcessHistory != NULL) {
|
|
strcpy(strProcessHistory.Buffer, WowEnvData.pszProcessHistory);
|
|
strProcessHistory.Length = strlen(WowEnvData.pszProcessHistory);
|
|
} else {
|
|
strProcessHistory.Length = 0;
|
|
}
|
|
|
|
if (WowEnvData.pszCurrentProcessHistory != NULL) {
|
|
|
|
//
|
|
// Append ';' if the string was not empty.
|
|
//
|
|
if (strProcessHistory.Length) {
|
|
Status = RtlAppendAsciizToString(&strProcessHistory, ";");
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] failed to append ';' to the process history. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
}
|
|
|
|
Status = RtlAppendAsciizToString(&strProcessHistory,
|
|
WowEnvData.pszCurrentProcessHistory);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] failed to build the process history. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
|
|
}
|
|
|
|
//
|
|
// Convert the process history.
|
|
//
|
|
Status = RtlAnsiStringToUnicodeString(&ustrProcessHistory, &strProcessHistory, TRUE);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] failed to convert process history to UNICODE. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
|
|
//
|
|
// Now we can set the process history.
|
|
//
|
|
Status = RtlSetEnvironmentVariable(&lpEnvCurrent,
|
|
&g_ustrProcessHistoryVar,
|
|
&ustrProcessHistory);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] failed to set the process history. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now we pass along any compat layer that we might have.
|
|
//
|
|
if (g_pwszCompatLayer != NULL) {
|
|
|
|
//
|
|
// Pass along this thing, we have been started under layer.
|
|
//
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ShimCreateWowEnvironment_U] Propagating CompatLayer from the ntvdm environment __COMPAT_LAYER=\"%S\"",
|
|
g_pwszCompatLayer);
|
|
|
|
RtlInitUnicodeString(&ustrCompatLayer, g_pwszCompatLayer);
|
|
|
|
Status = RtlSetEnvironmentVariable(&lpEnvCurrent, &g_ustrCompatLayerVar, &ustrCompatLayer);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] Failed to set compatlayer environment variable. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
|
|
} else if (WowEnvData.pszCompatLayerVal != NULL) {
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[ShimCreateWowEnvironment_U] Propagating CompatLayer from the parent WOW app \"%s\"",
|
|
WowEnvData.pszCompatLayer);
|
|
|
|
RtlInitString(&strCompatLayer, WowEnvData.pszCompatLayerVal);
|
|
|
|
Status = RtlAnsiStringToUnicodeString(&ustrCompatLayer, &strCompatLayer, TRUE);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] Failed to convert compatlayer to UNICODE. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
|
|
Status = RtlSetEnvironmentVariable(&lpEnvCurrent, &g_ustrCompatLayerVar, &ustrCompatLayer);
|
|
|
|
RtlFreeUnicodeString(&ustrCompatLayer);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimCreateWowEnvironment_U] Failed to set compatlayer environment variable. Status = 0x%x",
|
|
Status);
|
|
goto Fail;
|
|
}
|
|
}
|
|
|
|
//
|
|
// We have been successful. The return environment is UNICODE now.
|
|
//
|
|
lpEnvRet = (LPVOID)lpEnvCurrent;
|
|
*lpdwFlags = dwFlags | CREATE_UNICODE_ENVIRONMENT;
|
|
Status = STATUS_SUCCESS;
|
|
|
|
Fail:
|
|
|
|
if (!NT_SUCCESS(Status) && lpEnvCurrent != NULL && bNewEnvironment) {
|
|
//
|
|
// This points to the cloned environment ALWAYS.
|
|
//
|
|
RtlDestroyEnvironment(lpEnvCurrent);
|
|
}
|
|
|
|
RtlFreeUnicodeString(&ustrProcessHistory);
|
|
|
|
if (strProcessHistory.Buffer != NULL) {
|
|
ShimFree(strProcessHistory.Buffer);
|
|
}
|
|
|
|
//
|
|
// This call is only necessary when using ShimRetrieveVariables.
|
|
// It is not needed when using ShimRetrieveVariablesEx.
|
|
//
|
|
// ShimFreeWOWEnvData(&WowEnvData);
|
|
//
|
|
|
|
return lpEnvRet;
|
|
}
|
|
|
|
ULONG
|
|
Win2kPropagateLayerExceptionHandler(
|
|
PEXCEPTION_POINTERS pexi,
|
|
char* szFile,
|
|
DWORD dwLine
|
|
)
|
|
{
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[Win2kPropagateLayerExceptionHandler] %#x in module \"%s\", line %d,"
|
|
" at address %#p. flags:%#x. !exr %#p !cxr %#p",
|
|
pexi->ExceptionRecord->ExceptionCode,
|
|
szFile,
|
|
dwLine,
|
|
CONTEXT_TO_PROGRAM_COUNTER(pexi->ContextRecord),
|
|
pexi->ExceptionRecord->ExceptionFlags,
|
|
pexi->ExceptionRecord,
|
|
pexi->ContextRecord);
|
|
|
|
#if DBG
|
|
DbgBreakPoint();
|
|
#endif // DBG
|
|
|
|
return EXCEPTION_EXECUTE_HANDLER;
|
|
}
|
|
|
|
/*++
|
|
|
|
Stub functions that are intercepted from WOW initialization code
|
|
(through APIHook_UserRegisterWowHandlers)
|
|
|
|
--*/
|
|
|
|
|
|
|
|
NSWOWUSERP::PFNINITTASK g_pfnInitTask;
|
|
NSWOWUSERP::PFNWOWCLEANUP g_pfnWowCleanup;
|
|
|
|
BOOL WINAPI
|
|
StubInitTask(
|
|
UINT dwExpWinVer,
|
|
DWORD dwAppCompatFlags,
|
|
LPCSTR lpszModName,
|
|
LPCSTR lpszBaseFileName,
|
|
DWORD hTaskWow,
|
|
DWORD dwHotkey,
|
|
DWORD idTask,
|
|
DWORD dwX,
|
|
DWORD dwY,
|
|
DWORD dwXSize,
|
|
DWORD dwYSize
|
|
)
|
|
{
|
|
BOOL bReturn;
|
|
|
|
bReturn = g_pfnInitTask(dwExpWinVer,
|
|
dwAppCompatFlags,
|
|
lpszModName,
|
|
lpszBaseFileName,
|
|
hTaskWow,
|
|
dwHotkey,
|
|
idTask,
|
|
dwX,
|
|
dwY,
|
|
dwXSize,
|
|
dwYSize);
|
|
if (bReturn) {
|
|
CheckAndShimNTVDM((WORD)hTaskWow);
|
|
UpdateWowTaskList((WORD)hTaskWow);
|
|
}
|
|
|
|
|
|
return bReturn;
|
|
}
|
|
|
|
|
|
BOOL WINAPI
|
|
StubWowCleanup(
|
|
HANDLE hInstance,
|
|
DWORD hTaskWow
|
|
)
|
|
{
|
|
BOOL bReturn;
|
|
|
|
bReturn = g_pfnWowCleanup(hInstance, hTaskWow);
|
|
|
|
if (bReturn) {
|
|
CleanupWowTaskList((WORD)hTaskWow);
|
|
}
|
|
|
|
return bReturn;
|
|
}
|
|
|
|
|
|
/*++
|
|
APIHook_UserRegisterWowHandlers
|
|
|
|
Trap InitTask and WowCleanup functions and
|
|
replace them with stubs
|
|
|
|
--*/
|
|
|
|
ULONG_PTR
|
|
APIHOOK(UserRegisterWowHandlers)(
|
|
NSWOWUSERP::APFNWOWHANDLERSIN apfnWowIn,
|
|
NSWOWUSERP::APFNWOWHANDLERSOUT apfnWowOut
|
|
)
|
|
{
|
|
ULONG_PTR ulRet;
|
|
|
|
ulRet = ORIGINAL_API(UserRegisterWowHandlers)(apfnWowIn, apfnWowOut);
|
|
|
|
g_pfnInitTask = apfnWowOut->pfnInitTask;
|
|
apfnWowOut->pfnInitTask = StubInitTask;
|
|
|
|
g_pfnWowCleanup = apfnWowOut->pfnWOWCleanup;
|
|
apfnWowOut->pfnWOWCleanup = StubWowCleanup;
|
|
|
|
return ulRet;
|
|
}
|
|
|
|
BOOL
|
|
CheckWOWExe(
|
|
LPCWSTR lpApplicationName,
|
|
LPVOID lpEnvironment,
|
|
LPDWORD lpdwCreationFlags
|
|
)
|
|
{
|
|
BOOL bSuccess;
|
|
BOOL bReturn = FALSE;
|
|
NTSTATUS Status;
|
|
LPVOID pEnvironmentNew = lpEnvironment;
|
|
SDBQUERYRESULT QueryResult;
|
|
DWORD dwBinaryType = 0;
|
|
HSDB hSDB = NULL;
|
|
DWORD dwExes;
|
|
WCHAR wszAppName[MAX_PATH];
|
|
|
|
bSuccess = GetFileNameFromCmdLine(wszAppName, CHARCOUNT(wszAppName), lpApplicationName);
|
|
if (!bSuccess) {
|
|
return FALSE;
|
|
}
|
|
|
|
bSuccess = GetBinaryTypeW(wszAppName, &dwBinaryType);
|
|
if (!bSuccess || dwBinaryType != SCS_WOW_BINARY) {
|
|
LOGN( eDbgLevelInfo, "[CheckWowExe] can't get binary type\n");
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// for these binaries we shall perform the good deed of running the detection
|
|
//
|
|
hSDB = SdbInitDatabase(0, NULL);
|
|
if (hSDB == NULL) {
|
|
LOGN( eDbgLevelError, "[CheckWowExe] Failed to init the database.");
|
|
return FALSE;
|
|
}
|
|
|
|
if (lpEnvironment != NULL && !(*lpdwCreationFlags & CREATE_UNICODE_ENVIRONMENT)) { // non-null unicode env?
|
|
Status = ShimCloneEnvironment(&pEnvironmentNew,
|
|
lpEnvironment,
|
|
FALSE);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN( eDbgLevelError, "[ShimCloneEnvironment] failed with status 0x%lx\n", Status);
|
|
goto cleanup;
|
|
}
|
|
}
|
|
|
|
//
|
|
// all parameters below have to be unicode
|
|
//
|
|
|
|
dwExes = SdbGetMatchingExe(hSDB,
|
|
wszAppName,
|
|
NULL,
|
|
(LPCWSTR)pEnvironmentNew,
|
|
0,
|
|
&QueryResult);
|
|
bSuccess = (QueryResult.atrExes [0] != TAGREF_NULL ||
|
|
QueryResult.atrLayers[0] != TAGREF_NULL);
|
|
|
|
//
|
|
// if we have been successful -- layers apply to this thing
|
|
//
|
|
|
|
if (!bSuccess) {
|
|
goto cleanup;
|
|
}
|
|
|
|
//
|
|
// set the separate ntvdm flag and be on our way out
|
|
//
|
|
*lpdwCreationFlags &= ~CREATE_SHARED_WOW_VDM;
|
|
*lpdwCreationFlags |= CREATE_SEPARATE_WOW_VDM;
|
|
|
|
bReturn = TRUE;
|
|
|
|
cleanup:
|
|
|
|
if (pEnvironmentNew != lpEnvironment) {
|
|
ShimFreeEnvironment(pEnvironmentNew);
|
|
}
|
|
|
|
if (hSDB) {
|
|
SdbReleaseDatabase(hSDB);
|
|
}
|
|
|
|
return bReturn;
|
|
}
|
|
|
|
BOOL
|
|
APIHOOK(CreateProcessA)(
|
|
LPCSTR lpApplicationName,
|
|
LPSTR lpCommandLine,
|
|
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
BOOL bInheritHandles,
|
|
DWORD dwCreationFlags,
|
|
LPVOID lpEnvironment,
|
|
LPCSTR lpCurrentDirectory,
|
|
LPSTARTUPINFOA lpStartupInfo,
|
|
LPPROCESS_INFORMATION lpProcessInformation
|
|
)
|
|
{
|
|
BOOL bRet;
|
|
LPVOID lpEnvironmentNew = lpEnvironment;
|
|
DWORD dwCreationFlagsOriginal = dwCreationFlags;
|
|
LPSTR pszApp = NULL;
|
|
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CreateProcessA] called for:");
|
|
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CreateProcessA] lpApplicationName : \"%s\"",
|
|
(lpApplicationName == NULL ? "null": lpApplicationName));
|
|
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CreateProcessA] lpCommandLine : \"%s\"",
|
|
(lpCommandLine == NULL ? "null": lpCommandLine));
|
|
|
|
if (lpApplicationName != NULL) {
|
|
pszApp = (LPSTR)lpApplicationName;
|
|
} else if (lpCommandLine != NULL) {
|
|
pszApp = lpCommandLine;
|
|
} else {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CreateProcessA] called with NULL params.");
|
|
}
|
|
|
|
__try {
|
|
|
|
WCHAR wszApp[MAX_PATH];
|
|
|
|
if (pszApp != NULL) {
|
|
|
|
MultiByteToWideChar(CP_ACP,
|
|
0,
|
|
pszApp,
|
|
-1,
|
|
wszApp,
|
|
MAX_PATH);
|
|
|
|
AddSupport(wszApp, &lpEnvironmentNew, &dwCreationFlags);
|
|
}
|
|
|
|
if (g_bIsNTVDM) {
|
|
|
|
//
|
|
// if the environment stayed the same as it was passed in -- clone it to propagate process history
|
|
// if it was modified in AddSupport -- use it
|
|
//
|
|
|
|
lpEnvironmentNew = ShimCreateWowEnvironment_U(lpEnvironmentNew,
|
|
&dwCreationFlags,
|
|
lpEnvironmentNew == lpEnvironment);
|
|
}
|
|
|
|
|
|
if (pszApp != NULL && !(dwCreationFlags & CREATE_SEPARATE_WOW_VDM)) {
|
|
// since the separate vdm flag is not set -- we need to determine whether we have
|
|
// any kind of fixes to care about.
|
|
CheckWOWExe(wszApp, lpEnvironmentNew, &dwCreationFlags);
|
|
}
|
|
|
|
|
|
} __except(WOWPROCESSHISTORYEXCEPTIONFILTER) {
|
|
|
|
//
|
|
// cleanup the mess, if we have allocated the environment, free it now
|
|
//
|
|
if (lpEnvironmentNew != lpEnvironment) {
|
|
|
|
ShimFreeEnvironment(lpEnvironmentNew);
|
|
|
|
lpEnvironmentNew = lpEnvironment;
|
|
}
|
|
}
|
|
|
|
|
|
bRet = ORIGINAL_API(CreateProcessA)(lpApplicationName,
|
|
lpCommandLine,
|
|
lpProcessAttributes,
|
|
lpThreadAttributes,
|
|
bInheritHandles,
|
|
dwCreationFlags,
|
|
lpEnvironmentNew,
|
|
lpCurrentDirectory,
|
|
lpStartupInfo,
|
|
lpProcessInformation);
|
|
|
|
if (lpEnvironmentNew != lpEnvironment) {
|
|
//
|
|
// The function below does not need a __try/__except wrapper, it has it internally
|
|
//
|
|
ShimFreeEnvironment(lpEnvironmentNew);
|
|
}
|
|
|
|
return bRet;
|
|
}
|
|
|
|
BOOL
|
|
APIHOOK(CreateProcessW)(
|
|
LPCWSTR lpApplicationName,
|
|
LPWSTR lpCommandLine,
|
|
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
BOOL bInheritHandles,
|
|
DWORD dwCreationFlags,
|
|
LPVOID lpEnvironment,
|
|
LPCWSTR lpCurrentDirectory,
|
|
LPSTARTUPINFOW lpStartupInfo,
|
|
LPPROCESS_INFORMATION lpProcessInformation
|
|
)
|
|
{
|
|
LPWSTR pszApp = NULL;
|
|
BOOL bRet;
|
|
LPVOID lpEnvironmentNew = lpEnvironment;
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[CreateProcessW] called for:");
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[CreateProcessW] lpApplicationName : \"%S\"",
|
|
(lpApplicationName == NULL ? L"null": lpApplicationName));
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[CreateProcessW] lpCommandLine : \"%S\"",
|
|
(lpCommandLine == NULL ? L"null": lpCommandLine));
|
|
|
|
if (lpApplicationName != NULL) {
|
|
pszApp = (LPWSTR)lpApplicationName;
|
|
} else if (lpCommandLine != NULL) {
|
|
pszApp = lpCommandLine;
|
|
} else {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CreateProcessW] called with NULL params.");
|
|
}
|
|
|
|
__try {
|
|
|
|
if (pszApp != NULL) {
|
|
|
|
AddSupport(pszApp, &lpEnvironmentNew, &dwCreationFlags);
|
|
}
|
|
|
|
if (g_bIsNTVDM) {
|
|
|
|
lpEnvironmentNew = ShimCreateWowEnvironment_U(lpEnvironmentNew,
|
|
&dwCreationFlags,
|
|
lpEnvironment == lpEnvironmentNew);
|
|
}
|
|
|
|
//
|
|
// typically we need to find out whether the current app is ntvdm
|
|
//
|
|
|
|
if (!(dwCreationFlags & CREATE_SEPARATE_WOW_VDM)) {
|
|
// since the separate vdm flag is not set -- we need to determine whether we have
|
|
// any kind of fixes to care about.
|
|
CheckWOWExe(pszApp, lpEnvironmentNew, &dwCreationFlags);
|
|
}
|
|
|
|
} __except(WOWPROCESSHISTORYEXCEPTIONFILTER) {
|
|
|
|
if (lpEnvironmentNew != lpEnvironment) {
|
|
|
|
ShimFreeEnvironment(lpEnvironmentNew);
|
|
|
|
lpEnvironmentNew = lpEnvironment; // reset the pointer
|
|
}
|
|
}
|
|
|
|
bRet = ORIGINAL_API(CreateProcessW)(lpApplicationName,
|
|
lpCommandLine,
|
|
lpProcessAttributes,
|
|
lpThreadAttributes,
|
|
bInheritHandles,
|
|
dwCreationFlags,
|
|
lpEnvironmentNew,
|
|
lpCurrentDirectory,
|
|
lpStartupInfo,
|
|
lpProcessInformation);
|
|
|
|
if (lpEnvironmentNew != lpEnvironment) {
|
|
|
|
ShimFreeEnvironment(lpEnvironmentNew);
|
|
|
|
}
|
|
|
|
return bRet;
|
|
}
|
|
|
|
BOOL
|
|
GetVariableFromEnvironment(
|
|
LPCWSTR pwszVariableName,
|
|
LPWSTR* ppwszVariableValue
|
|
)
|
|
{
|
|
DWORD dwLength;
|
|
DWORD dwLen;
|
|
BOOL bSuccess = FALSE;
|
|
LPWSTR pwszVariableValue = *ppwszVariableValue;
|
|
|
|
dwLength = GetEnvironmentVariableW(pwszVariableName, NULL, 0);
|
|
|
|
if (dwLength == 0) {
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[GetCompatLayerFromEnvironment] Not under the compatibility layer.");
|
|
*ppwszVariableValue = NULL;
|
|
return FALSE;
|
|
}
|
|
|
|
if (pwszVariableValue != NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[GetCompatLayerFromEnvironment] called twice!");
|
|
ShimFree(pwszVariableValue);
|
|
pwszVariableValue = NULL;
|
|
}
|
|
|
|
pwszVariableValue = (WCHAR*)ShimMalloc(dwLength * sizeof(WCHAR));
|
|
|
|
if (pwszVariableValue == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[GetCompatLayerFromEnvironment] Failed to allocate %d bytes for Compat Layer.",
|
|
dwLength * sizeof(WCHAR));
|
|
goto out;
|
|
}
|
|
|
|
*pwszVariableValue = L'\0';
|
|
|
|
dwLen = GetEnvironmentVariableW(pwszVariableName,
|
|
pwszVariableValue,
|
|
dwLength);
|
|
|
|
bSuccess = (dwLen != 0 && dwLen < dwLength);
|
|
|
|
if (!bSuccess) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[GetCompatLayerFromEnvironment] Failed to get compat layer variable.");
|
|
ShimFree(pwszVariableValue);
|
|
pwszVariableValue = NULL;
|
|
}
|
|
|
|
out:
|
|
|
|
*ppwszVariableValue = pwszVariableValue;
|
|
|
|
return bSuccess;
|
|
}
|
|
|
|
BOOL
|
|
GetCompatLayerFromEnvironment(
|
|
VOID
|
|
)
|
|
{
|
|
return GetVariableFromEnvironment(g_wszCompatLayerVar, &g_pwszCompatLayer);
|
|
}
|
|
|
|
|
|
BOOL
|
|
GetSeparateWowPtr(
|
|
VOID
|
|
)
|
|
{
|
|
|
|
HMODULE hMod = GetModuleHandle(NULL);
|
|
|
|
g_pSeparateWow = (BOOL*)GetProcAddress(hMod, "fSeparateWow");
|
|
if (g_pSeparateWow == NULL) {
|
|
LOGN( eDbgLevelError, "[GetSeparateWowPtr] Failed 0x%lx\n", GetLastError());
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
VOID
|
|
ParseCommandLine(
|
|
LPCSTR commandLine
|
|
)
|
|
{
|
|
int i;
|
|
char* pArg;
|
|
|
|
g_argc = 0;
|
|
g_argv = NULL;
|
|
|
|
g_bIsNTVDM = FALSE;
|
|
g_bIsExplorer = FALSE;
|
|
|
|
g_argv = _CommandLineToArgvA(commandLine, &g_argc);
|
|
|
|
if (0 == g_argc || NULL == g_argv) {
|
|
return; // nothing to do
|
|
}
|
|
|
|
for (i = 0; i < g_argc; ++i) {
|
|
pArg = g_argv[i];
|
|
|
|
if (!_strcmpi(pArg, "ntvdm")) {
|
|
LOGN( eDbgLevelInfo, "[ParseCommandLine] Running NTVDM.");
|
|
g_bIsNTVDM = TRUE;
|
|
|
|
} else if (!_strcmpi(pArg, "explorer")) {
|
|
LOGN( eDbgLevelInfo, "[ParseCommandLine] Running Explorer.");
|
|
g_bIsExplorer = TRUE;
|
|
|
|
} else {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ParseCommandLine] Unrecognized argument: \"%s\"",
|
|
pArg);
|
|
}
|
|
}
|
|
|
|
if (g_bIsNTVDM && g_bIsExplorer) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ParseCommandLine] Conflicting arguments! Neither will be applied.");
|
|
g_bIsNTVDM = FALSE;
|
|
g_bIsExplorer = FALSE;
|
|
}
|
|
}
|
|
|
|
|
|
BOOL
|
|
NOTIFY_FUNCTION(
|
|
DWORD fdwReason
|
|
)
|
|
{
|
|
OSVERSIONINFO osvi;
|
|
BOOL bHook = FALSE;
|
|
DWORD dwCompatLayerLength;
|
|
DWORD dwLen;
|
|
|
|
if (fdwReason != DLL_PROCESS_ATTACH) {
|
|
return TRUE;
|
|
}
|
|
|
|
osvi.dwOSVersionInfoSize = sizeof(osvi);
|
|
|
|
GetVersionEx(&osvi);
|
|
|
|
if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 0) {
|
|
|
|
ParseCommandLine(COMMAND_LINE);
|
|
|
|
InitLayerStorage(FALSE);
|
|
|
|
CleanupRegistryForCurrentExe();
|
|
|
|
if (g_bIsNTVDM) {
|
|
|
|
bHook = TRUE;
|
|
|
|
//
|
|
// Retrieve the compat layer variable that we have been started with (just in case)
|
|
//
|
|
GetCompatLayerFromEnvironment();
|
|
|
|
GetSeparateWowPtr(); // retrieve ptr to a sep flag
|
|
|
|
} else if (g_bIsExplorer) {
|
|
|
|
//
|
|
// Cleanup compat layer variable
|
|
//
|
|
SetEnvironmentVariableW(g_wszCompatLayerVar, NULL);
|
|
bHook = TRUE;
|
|
|
|
} else {
|
|
//
|
|
// Neither explorer nor ntvdm. Get the compat layer.
|
|
//
|
|
bHook = GetCompatLayerFromEnvironment();
|
|
if (!bHook) {
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[NOTIFY_FUNCTION] Not under the compatibility layer.");
|
|
}
|
|
}
|
|
}
|
|
|
|
if (bHook) {
|
|
APIHOOK_ENTRY(KERNEL32.DLL, CreateProcessA)
|
|
APIHOOK_ENTRY(KERNEL32.DLL, CreateProcessW)
|
|
APIHOOK_ENTRY(USER32.DLL, UserRegisterWowHandlers)
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
HOOK_BEGIN
|
|
|
|
CALL_NOTIFY_FUNCTION
|
|
|
|
HOOK_END
|
|
|
|
|
|
IMPLEMENT_SHIM_END
|
|
|