[PATCH v2 0/2] MR4523: ntdll: RtlFindExportedRoutine returns NULL on forwarded function.
Signed-off-by: Eric Pouech <epouech(a)codeweavers.com> -- v2: ntdll: Search for CtrlRoutine in kernelbase. ntdll: RtlFindExportedRoutine returns NULL on forwarded function. https://gitlab.winehq.org/wine/wine/-/merge_requests/4523
From: Eric Pouech <epouech(a)codeweavers.com> Signed-off-by: Eric Pouech <epouech(a)codeweavers.com> --- dlls/ntdll/loader.c | 8 +++++++- dlls/ntdll/tests/rtl.c | 18 ++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c index 5b0d3f6b6ee..c983f6f8302 100644 --- a/dlls/ntdll/loader.c +++ b/dlls/ntdll/loader.c @@ -1066,6 +1066,7 @@ void * WINAPI RtlFindExportedRoutineByName( HMODULE module, const char *name ) const DWORD *functions; DWORD exp_size; int ordinal; + void *proc; exports = RtlImageDirectoryEntryToData( module, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &exp_size ); if (!exports || exp_size < sizeof(*exports)) return NULL; @@ -1074,7 +1075,12 @@ void * WINAPI RtlFindExportedRoutineByName( HMODULE module, const char *name ) if (ordinal >= exports->NumberOfFunctions) return NULL; functions = get_rva( module, exports->AddressOfFunctions ); if (!functions[ordinal]) return NULL; - return get_rva( module, functions[ordinal] ); + proc = get_rva( module, functions[ordinal] ); + /* if the address falls into the export dir, it's a forward */ + if (((const char *)proc >= (const char *)exports) && + ((const char *)proc < (const char *)exports + exp_size)) + return NULL; + return proc; } diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c index 88f62b0b588..a319720c375 100644 --- a/dlls/ntdll/tests/rtl.c +++ b/dlls/ntdll/tests/rtl.c @@ -95,6 +95,7 @@ static NTSTATUS (WINAPI *pRtlIpv6StringToAddressExW)(PCWSTR, struct in6_addr *, static BOOL (WINAPI *pRtlIsCriticalSectionLocked)(CRITICAL_SECTION *); static BOOL (WINAPI *pRtlIsCriticalSectionLockedByThread)(CRITICAL_SECTION *); static NTSTATUS (WINAPI *pRtlInitializeCriticalSectionEx)(CRITICAL_SECTION *, ULONG, ULONG); +static void * (WINAPI *pRtlFindExportedRoutineByName)(HMODULE,const char*); static NTSTATUS (WINAPI *pLdrEnumerateLoadedModules)(void *, void *, void *); static NTSTATUS (WINAPI *pLdrRegisterDllNotification)(ULONG, PLDR_DLL_NOTIFICATION_FUNCTION, void *, void **); static NTSTATUS (WINAPI *pLdrUnregisterDllNotification)(void *); @@ -137,6 +138,7 @@ static void InitFunctionPtrs(void) pRtlIsCriticalSectionLocked = (void *)GetProcAddress(hntdll, "RtlIsCriticalSectionLocked"); pRtlIsCriticalSectionLockedByThread = (void *)GetProcAddress(hntdll, "RtlIsCriticalSectionLockedByThread"); pRtlInitializeCriticalSectionEx = (void *)GetProcAddress(hntdll, "RtlInitializeCriticalSectionEx"); + pRtlFindExportedRoutineByName = (void *)GetProcAddress(hntdll, "RtlFindExportedRoutineByName"); pLdrEnumerateLoadedModules = (void *)GetProcAddress(hntdll, "LdrEnumerateLoadedModules"); pLdrRegisterDllNotification = (void *)GetProcAddress(hntdll, "LdrRegisterDllNotification"); pLdrUnregisterDllNotification = (void *)GetProcAddress(hntdll, "LdrUnregisterDllNotification"); @@ -3651,6 +3653,21 @@ static void test_RtlValidSecurityDescriptor(void) free(sd); } +static void test_RtlFindExportedRoutineByName(void) +{ + void *proc; + + if (!pRtlFindExportedRoutineByName) + { + win_skip("RtlFindExportedRoutineByName is not present\n"); + return; + } + proc = pRtlFindExportedRoutineByName(GetModuleHandleW(L"kernelbase"), "CtrlRoutine"); + ok(proc != NULL, "Expected non NULL address\n"); + proc = pRtlFindExportedRoutineByName(GetModuleHandleW(L"kernel32"), "CtrlRoutine"); + ok(proc == NULL, "Shouldn't find forwarded function\n"); +} + START_TEST(rtl) { InitFunctionPtrs(); @@ -3697,4 +3714,5 @@ START_TEST(rtl) test_RtlFirstFreeAce(); test_RtlInitializeSid(); test_RtlValidSecurityDescriptor(); + test_RtlFindExportedRoutineByName(); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4523
From: Eric Pouech <epouech(a)codeweavers.com> Signed-off-by: Eric Pouech <epouech(a)codeweavers.com> --- dlls/ntdll/loader.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c index c983f6f8302..413d0efd81f 100644 --- a/dlls/ntdll/loader.c +++ b/dlls/ntdll/loader.c @@ -4276,6 +4276,8 @@ void loader_init( CONTEXT *context, void **entry ) MEMORY_BASIC_INFORMATION meminfo; WINE_MODREF *kernel32; PEB *peb = NtCurrentTeb()->Peb; + UNICODE_STRING kernelbase = RTL_CONSTANT_STRING( L"kernelbase" ); + HMODULE kernelbase_module; NtQueryVirtualMemory( GetCurrentProcess(), LdrInitializeThunk, MemoryBasicInformation, &meminfo, sizeof(meminfo), NULL ); @@ -4310,7 +4312,8 @@ void loader_init( CONTEXT *context, void **entry ) } node_kernel32 = kernel32->ldr.DdagNode; pBaseThreadInitThunk = RtlFindExportedRoutineByName( kernel32->ldr.DllBase, "BaseThreadInitThunk" ); - pCtrlRoutine = RtlFindExportedRoutineByName( kernel32->ldr.DllBase, "CtrlRoutine" ); + if (!LdrGetDllHandleEx( 0, NULL, NULL, &kernelbase, &kernelbase_module )) + pCtrlRoutine = RtlFindExportedRoutineByName( kernelbase_module, "CtrlRoutine" ); actctx_init(); locale_init(); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/4523
I pushed the changes to loader_init() as well. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/4523#note_53898
participants (2)
-
Eric Pouech -
eric pouech (＠epo)