#include "mi.h"Go to the source code of this file.
Classes | |
| struct | _LOAD_IMPORTS |
Defines | |
| #define | LOADED_AT_BOOT ((PLOAD_IMPORTS)0) |
| #define | NO_IMPORTS_USED ((PLOAD_IMPORTS)-2) |
| #define | SINGLE_ENTRY(ImportVoid) ((ULONG)((ULONG_PTR)(ImportVoid) & 0x1)) |
| #define | SINGLE_ENTRY_TO_POINTER(ImportVoid) ((PLDR_DATA_TABLE_ENTRY)((ULONG_PTR)(ImportVoid) & ~0x1)) |
| #define | POINTER_TO_SINGLE_ENTRY(Pointer) ((PLDR_DATA_TABLE_ENTRY)((ULONG_PTR)(Pointer) | 0x1)) |
Typedefs | |
| typedef _LOAD_IMPORTS | LOAD_IMPORTS |
| typedef _LOAD_IMPORTS * | PLOAD_IMPORTS |
Functions | |
| ULONG | LdrDoubleRelocateImage (IN PVOID NewBase, IN PVOID CurrentBase, IN PUCHAR LoaderName, IN ULONG Success, IN ULONG Conflict, IN ULONG Invalid) |
| ULONG | CacheImageSymbols (IN PVOID ImageBase) |
| NTSTATUS | MiResolveImageReferences (PVOID ImageBase, IN PUNICODE_STRING ImageFileDirectory, IN PUNICODE_STRING NamePrefix OPTIONAL, IN BOOLEAN LoadInSessionSpace, OUT PCHAR *MissingProcedureName, OUT PWSTR *MissingDriverName, OUT PLOAD_IMPORTS *LoadedImports) |
| NTSTATUS | MiSnapThunk (IN PVOID DllBase, IN PVOID ImageBase, IN PIMAGE_THUNK_DATA NameThunk, OUT PIMAGE_THUNK_DATA AddrThunk, IN PIMAGE_EXPORT_DIRECTORY ExportDirectory, IN ULONG ExportSize, IN BOOLEAN SnapForwarder, OUT PCHAR *MissingProcedureName) |
| NTSTATUS | MiLoadImageSection (IN PSECTION SectionPointer, OUT PVOID *ImageBase, IN PUNICODE_STRING ImageFileName, IN BOOLEAN LoadInSessionSpace) |
| VOID | MiEnablePagingOfDriver (IN PVOID ImageHandle) |
| VOID | MiSetPagingOfDriver (IN PMMPTE PointerPte, IN PMMPTE LastPte, IN BOOLEAN SessionSpace) |
| PVOID | MiLookupImageSectionByName (IN PVOID Base, IN BOOLEAN MappedAsImage, IN PCHAR SectionName, OUT PULONG SectionSize) |
| VOID | MiClearImports (IN PLDR_DATA_TABLE_ENTRY DataTableEntry) |
| NTSTATUS | MiBuildImportsForBootDrivers (VOID) |
| NTSTATUS | MmCheckSystemImage (IN HANDLE ImageFileHandle) |
| LONG | MiMapCacheExceptionFilter (OUT PNTSTATUS Status, IN PEXCEPTION_POINTERS ExceptionPointer) |
| ULONG | MiSetProtectionOnTransitionPte (IN PMMPTE PointerPte, IN ULONG ProtectionMask) |
| NTSTATUS | MiDereferenceImports (IN PLOAD_IMPORTS ImportList) |
| LOGICAL | MiCallDllUnloadAndUnloadDll (IN PLDR_DATA_TABLE_ENTRY DataTableEntry) |
| PVOID | MiLocateExportName (IN PVOID DllBase, IN PCHAR FunctionName) |
| NTSTATUS | MiLoadSystemImage (IN PUNICODE_STRING ImageFileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedBaseName OPTIONAL, IN BOOLEAN LoadInSessionSpace, OUT PVOID *ImageHandle, OUT PVOID *ImageBaseAddress, IN BOOLEAN LockDownPages) |
| VOID | MiRememberUnloadedDriver (IN PUNICODE_STRING DriverName, IN PVOID Address, IN ULONG Length) |
| VOID | MiWriteProtectSystemImage (IN PVOID DllBase) |
| VOID | MiLocateKernelSections (IN PLDR_DATA_TABLE_ENTRY DataTableEntry) |
| VOID | MiUpdateThunks (IN PLOADER_PARAMETER_BLOCK LoaderBlock, IN PVOID OldAddress, IN PVOID NewAddress, IN ULONG NumberOfBytes) |
| NTSTATUS | MiCheckPageFilePath (PFILE_OBJECT FileObject) |
| PVOID | MiFindExportedRoutineByName (IN PLDR_DATA_TABLE_ENTRY DataTableEntry, IN PANSI_STRING AnsiImageRoutineName) |
| VOID | MiRemoveLowPages (VOID) |
| NTSTATUS | MmLoadSystemImage (IN PUNICODE_STRING ImageFileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedBaseName OPTIONAL, IN BOOLEAN LoadInSessionSpace, OUT PVOID *ImageHandle, OUT PVOID *ImageBaseAddress) |
| NTSTATUS | MmLoadAndLockSystemImage (IN PUNICODE_STRING ImageFileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedBaseName OPTIONAL, OUT PVOID *ImageHandle, OUT PVOID *ImageBaseAddress) |
| VOID | MmFreeDriverInitialization (IN PVOID ImageHandle) |
| PVOID | MmPageEntireDriver (IN PVOID AddressWithinSection) |
| VOID | MmResetDriverPaging (IN PVOID AddressWithinSection) |
| PUNICODE_STRING | MmLocateUnloadedDriver (IN PVOID VirtualAddress) |
| NTSTATUS | MmUnloadSystemImage (IN PVOID ImageHandle) |
| BOOLEAN | MmVerifyImageIsOkForMpUse (IN PVOID BaseAddress) |
| PFN_NUMBER | MiDeleteSystemPagableVm (IN PMMPTE PointerPte, IN PFN_NUMBER NumberOfPtes, IN MMPTE NewPteValue, IN LOGICAL SessionAllocation, OUT PPFN_NUMBER ResidentPages) |
| VOID | MiSetImageProtect (IN PSEGMENT Segment, IN ULONG Protection) |
| VOID | MiSetSystemCodeProtection (IN PMMPTE FirstPte, IN PMMPTE LastPte) |
| VOID | MiReloadBootLoadedDrivers (IN PLOADER_PARAMETER_BLOCK LoaderBlock) |
| VOID | MmMakeKernelResourceSectionWritable (VOID) |
| LOGICAL | MiInitializeLoadedModuleList (IN PLOADER_PARAMETER_BLOCK LoaderBlock) |
| NTSTATUS | MmCallDllInitialize (IN PLDR_DATA_TABLE_ENTRY DataTableEntry) |
| NTKERNELAPI PVOID | MmGetSystemRoutineAddress (IN PUNICODE_STRING SystemRoutineName) |
Variables | |
| KMUTANT | MmSystemLoadLock |
| ULONG | MmTotalSystemDriverPages |
| ULONG | MmDriverCommit |
| BOOLEAN | MiFirstDriverLoadEver = TRUE |
| LOGICAL | MmMakeLowMemory = TRUE |
| PUNLOADED_DRIVERS | MiUnloadedDrivers |
| ULONG | MiLastUnloadedDriver |
| ULONG | MiTotalUnloads |
| ULONG | MiUnloadsSkipped |
| ULONG | MmEnforceWriteProtection = 1 |
| PVOID | ExPoolCodeStart |
| PVOID | ExPoolCodeEnd |
| PVOID | MmPoolCodeStart |
| PVOID | MmPoolCodeEnd |
| PVOID | MmPteCodeStart |
| PVOID | MmPteCodeEnd |
| KSPIN_LOCK | PsLoadedModuleSpinLock |
| LOGICAL | MiNoLowMemory |
| CHAR | MiPteStr [] = "\0" |
| PVOID | PsNtosImageBase |
| LIST_ENTRY | PsLoadedModuleList |
| ERESOURCE | PsLoadedModuleResource |
|
|
Definition at line 46 of file sysload.c. Referenced by MiBuildImportsForBootDrivers(), MiClearImports(), MiDereferenceImports(), and MmUnloadSystemImage(). |
|
|
Definition at line 47 of file sysload.c. Referenced by MiBuildImportsForBootDrivers(), MiClearImports(), MiDereferenceImports(), MiLoadSystemImage(), and MiResolveImageReferences(). |
|
|
Definition at line 53 of file sysload.c. Referenced by MiBuildImportsForBootDrivers(), and MiResolveImageReferences(). |
|
|
Definition at line 49 of file sysload.c. Referenced by MiBuildImportsForBootDrivers(), MiClearImports(), and MiDereferenceImports(). |
|
|
Definition at line 51 of file sysload.c. Referenced by MiDereferenceImports(). |
|
|
|
|
|
Referenced by MiBuildImportsForBootDrivers(), MiDereferenceImports(), MiLoadSystemImage(), MiResolveImageReferences(), and MmUnloadSystemImage(). |
|
|
Referenced by MiLoadSystemImage(), and MiMapViewOfImageSection(). |
|
||||||||||||||||||||||||||||
|
Referenced by MiReloadBootLoadedDrivers(). |
|
|
Definition at line 3326 of file sysload.c. References ASSERT, _LOAD_IMPORTS::Count, DbgPrint, _LOAD_IMPORTS::Entry, ExAllocatePoolWithTag, ExFreePool(), FALSE, L, LOADED_AT_BOOT, NO_IMPORTS_USED, NULL, PAGED_CODE, PagedPool, PLOAD_IMPORTS, POINTER_TO_SINGLE_ENTRY, PsLoadedModuleList, RtlEqualUnicodeString(), RtlImageDirectoryEntryToData(), RtlInitUnicodeString(), SINGLE_ENTRY, and TRUE. Referenced by MiInitializeLoadedModuleList().
|
|
|
Definition at line 3645 of file sysload.c. References ASSERT, FALSE, MiLocateExportName(), MmUnloadSystemImage(), NT_SUCCESS, NTSTATUS(), PAGED_CODE, PMM_DLL_UNLOAD, Status, and TRUE. Referenced by MiDereferenceImports().
|
|
|
Definition at line 166 of file modwrite.c. References ASSERT, _IRP::AssociatedIrp, DeviceUsageTypePaging, Executive, FALSE, _IO_STACK_LOCATION::FileObject, _IRP::Flags, IoAllocateIrp(), IoCallDriver, IoGetNextIrpStackLocation, IoGetRelatedDeviceObject(), IoQueueThreadIrp(), _IRP::IoStatus, IRP_MJ_PNP, IRP_MN_DEVICE_USAGE_NOTIFICATION, IRP_SYNCHRONOUS_API, KeInitializeEvent, KernelMode, KeWaitForSingleObject(), _IO_STACK_LOCATION::MajorFunction, _IO_STACK_LOCATION::MinorFunction, NTSTATUS(), NULL, ObReferenceObject, _IRP::Overlay, PAGED_CODE, _IO_STACK_LOCATION::Parameters, PsGetCurrentThread, _IRP::RequestorMode, _DEVICE_OBJECT::StackSize, _IRP::Tail, TRUE, _IRP::UserEvent, _IRP::UserIosb, and VOID(). Referenced by MiLoadSystemImage(), and NtCreatePagingFile().
|
|
|
Definition at line 2693 of file sysload.c. References ExFreePool(), LOADED_AT_BOOT, NO_IMPORTS_USED, PAGED_CODE, and SINGLE_ENTRY. Referenced by MmUnloadSystemImage().
|
|
||||||||||||||||||||||||
|
Definition at line 4950 of file sysload.c. References APC_LEVEL, ASSERT, _MMPTE_FLUSH_LIST::Count, DbgPrint, FALSE, _MMWSL::FirstDynamic, _MMPTE_FLUSH_LIST::FlushPte, _MMPTE_FLUSH_LIST::FlushVa, FreePageList, KeBugCheckEx(), LOCK_PFN, LOCK_SESSION_SPACE_WS, LOCK_SYSTEM_WS, _MMWSLENTRY::LockedInMemory, _MMWSLENTRY::LockedInWs, MI_CAPTURE_DIRTY_BIT_TO_PFN, MI_FLUSH_ENTIRE_SESSION_TB, MI_GET_PAGE_FRAME_FROM_PTE, MI_GET_PAGE_FRAME_FROM_TRANSITION_PTE, MI_PFN_ELEMENT, MI_SET_PFN_DELETED, MI_WRITE_INVALID_PTE, MiCheckPdeForPagedPool(), MiDecrementShareAndValidCount, MiDecrementShareCount(), MiDecrementShareCountOnly, MiFlushPteList(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiHighestUserPte, MiInsertPageInList(), MiLocateWsle(), MiReleasePageFileSpace(), MiReleaseWsle(), MiRemoveWsle(), MiSwapWslEntries(), MiUnlinkPageFromList(), MM_MAXIMUM_FLUSH_COUNT, MmPageLocationList, MmSessionSpace, MmSystemCacheWorkingSetList, MmSystemCacheWs, NT_SUCCESS, _MMPFN::OriginalPte, PAGE_ALIGN, _MMPFN::PteFrame, TRUE, _MMPTE::u, _MMWSLE::u1, _MMPFN::u1, _MMPFN::u2, _MMPFN::u3, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, UNLOCK_SYSTEM_WS, _MM_SESSION_SPACE::Vm, _MMSUPPORT::VmWorkingSetList, _MM_SESSION_SPACE::Wsle, WSLE_NULL_INDEX, WSLE_NUMBER, and ZeroKernelPte. Referenced by MiFreeInitializationCode(), MiFreePoolPages(), MiLoadImageSection(), MmFreeDriverInitialization(), MmFreeSpecialPool(), and MmUnloadSystemImage().
|
|
|
Definition at line 3822 of file sysload.c. References ASSERT, _LOAD_IMPORTS::Count, _LOAD_IMPORTS::Entry, ExFreePool(), LOADED_AT_BOOT, MiCallDllUnloadAndUnloadDll(), NO_IMPORTS_USED, PAGED_CODE, PLOAD_IMPORTS, PsLoadedModuleList, SINGLE_ENTRY, SINGLE_ENTRY_TO_POINTER, and TRUE. Referenced by MiResolveImageReferences(), and MmUnloadSystemImage().
|
|
|
Definition at line 2208 of file sysload.c. References DbgPrint, FALSE, MiGetPteAddress, MiSetPagingOfDriver(), MmDisablePagingExecutive, NULL, PAGE_SIZE, ROUND_TO_PAGES, and RtlImageNtHeader(). Referenced by MiLoadSystemImage().
|
|
||||||||||||
|
Definition at line 6928 of file sysload.c. References ASSERT, NULL, PAGED_CODE, PUSHORT, RtlImageDirectoryEntryToData(), TRUE, and USHORT. Referenced by MmGetSystemRoutineAddress().
|
|
|
Definition at line 6591 of file sysload.c. References ExAllocatePoolWithTag, ExFreePool(), ExInitializeResource, FALSE, KeInitializeSpinLock(), MiBuildImportsForBootDrivers(), MiLocateKernelSections(), NonPagedPool, NULL, PagedPool, PsLoadedModuleList, PsLoadedModuleResource, PsLoadedModuleSpinLock, PsNtosImageBase, and TRUE. Referenced by MmInitSystem().
|
|
||||||||||||||||||||
|
Definition at line 1474 of file sysload.c. References ASSERT, BYTES_TO_PAGES, _MM_SESSION_SPACE::CommittedPages, DbgPrint, ExpDefaultErrorPortProcess, FALSE, KeAttachProcess(), KeDetachProcess(), LOCK_EXPANSION, LOCK_PFN, LOCK_SESSION_SPACE_WS, MI_GET_PAGE_COLOR_FROM_PTE, MI_GET_PAGE_FRAME_FROM_PTE, MI_PFN_ELEMENT, MI_SET_PFN_DELETED, MI_WRITE_INVALID_PTE, MI_WRITE_VALID_PTE, MiChargeCommitmentCantExpand(), MiDecrementShareAndValidCount, MiDecrementShareCountOnly, MiDeleteSystemPagableVm(), MiEnsureAvailablePageOrWait(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiHydra, MiInitializePfn(), MiMapCacheExceptionFilter(), MiReleaseSystemPtes(), MiRemoveAnyPage(), MiRemoveImageSessionWide(), MiReserveSystemPtes(), MiReturnCommitment(), MiSessionCommitImagePages(), MiSessionWideReserveImageAddress(), MiShareSessionImage(), MM_BUMP_COUNTER, MM_BUMP_SESS_COUNTER, MM_DBG_COMMIT_DRIVER_PAGES, MM_DBG_COMMIT_RETURN_SESSION_DRIVER_LOAD_FAILURE1, MM_DBG_SESSION_COMMIT_IMAGELOAD_FAILED1, MM_DBG_SESSION_COMMIT_IMAGELOAD_FAILED2, MM_DBG_SESSION_COMMIT_IMAGELOAD_NOACCESS, MM_EXECUTE, MM_KERNEL_DEMAND_ZERO_PTE, MM_NOACCESS, MM_PTE_EXECUTE, MM_TRACK_COMMIT, MmDriverCommit, MmMapViewOfSection(), MmResidentAvailablePages, MmSessionSpace, MmUnmapViewOfSection(), NT_SUCCESS, NtGlobalFlag, NTSTATUS(), NULL, ObDereferenceObject, ObReferenceObject, PAGE_SIZE, PAGED_CODE, _EPROCESS::Pcb, _MM_SESSION_SPACE::ProcessList, PsGetCurrentProcess, _MMPFN::PteFrame, SESSION_GLOBAL, Status, SystemPteSpace, TRUE, _MM_SESSION_SPACE::u, _MMPTE::u, UNLOCK_EXPANSION, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, ValidKernelPte, ZERO_LARGE, ZeroKernelPte, and ZeroPte. Referenced by MiLoadSystemImage().
|
|
||||||||||||||||||||||||||||||||
|
Definition at line 443 of file sysload.c. References ASSERT, BaseName, CacheImageSymbols(), CHAR, DbgPrint, ExAcquireResourceExclusive, ExAllocatePoolWithTag, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), ExPageLockHandle, ExReleaseResource, FALSE, IMAGE_ADDRESSING_MODE_32BIT, _IMAGE_INFO::ImageAddressingMode, _IMAGE_INFO::ImageBase, _IMAGE_INFO::ImageSectionNumber, _IMAGE_INFO::ImageSelector, _IMAGE_INFO::ImageSize, KeAttachProcess(), KeDetachProcess(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeSweepIcache(), KeWaitForSingleObject(), L, LdrRelocateImage(), MI_IS_SESSION_ADDRESS, MiApplyDriverVerifier(), MiCheckPageFilePath(), MiEnablePagingOfDriver(), MiFirstDriverLoadEver, MiGetPpeAddress, MiHydra, MiLoadImageSection(), MiResolveImageReferences(), MiSetImageProtect(), MiWriteProtectSystemImage(), MM_EXECUTE_READWRITE, MmCheckSystemImage(), MmIsAddressValid(), MmLockPagableSectionByHandle(), MmMapViewInSystemSpace(), MmPageEntireDriver(), MmSectionObjectType, MmSession, MmSessionSpace, MmSystemLoadLock, MmUnloadSystemImage(), MmUnlockPagableImageSection(), NO_IMPORTS_USED, NonPagedPool, NT_SUCCESS, NtGlobalFlag, NTSTATUS(), NULL, ObDereferenceObject, ObjectAttributes, ObReferenceObjectByHandle(), PAGE_SHIFT, PAGED_CODE, PagedPool, _EPROCESS::Pcb, PERFINFO_IMAGE_LOAD, PLOAD_IMPORTS, _IMAGE_INFO::Properties, PsCallImageNotifyRoutines(), PSECTION, PsGetCurrentProcess, PsImageNotifyEnabled, PsInitialSystemProcess, PsLoadedModuleList, PsLoadedModuleResource, PsLoadedModuleSpinLock, RtlAnsiStringToUnicodeString(), RtlAppendUnicodeStringToString(), RtlEqualUnicodeString(), RtlFreeUnicodeString(), RtlImageNtHeader(), RtlInitAnsiString(), RtlInitString(), RtlInitUnicodeString(), _MM_SESSION_SPACE::Session, _MM_SESSION_SPACE::SessionId, sprintf(), Status, _IMAGE_INFO::SystemModeImage, _MMSESSION::SystemSpaceViewStart, TRUE, _MMPTE::u, USHORT, WrVirtualMemory, X64K, and ZwOpenFile(). Referenced by MmLoadAndLockSystemImage(), and MmLoadSystemImage().
|
|
||||||||||||
|
Definition at line 3712 of file sysload.c. References NULL, PAGED_CODE, PUSHORT, RtlImageDirectoryEntryToData(), TRUE, and USHORT. Referenced by MiCallDllUnloadAndUnloadDll(), MiResolveImageReferences(), and MmCallDllInitialize().
|
|
|
Definition at line 6395 of file sysload.c. References ExPoolCodeEnd, ExPoolCodeStart, MiGetPteAddress, MmPoolCodeEnd, MmPoolCodeStart, MmPteCodeEnd, MmPteCodeStart, NULL, PAGE_SIZE, PUSHORT, ROUND_TO_PAGES, RtlImageNtHeader(), and SECTION_BASE_ADDRESS. Referenced by MiInitializeLoadedModuleList().
|
|
||||||||||||||||||||
|
|
|
||||||||||||
|
|
|
|
Definition at line 5956 of file sysload.c. References ASSERT, DbgPrint, FALSE, InitializationPhase, LdrDoubleRelocateImage(), LdrRelocateImage(), LOCK_PFN, MI_GET_PAGE_COLOR_FROM_PTE, MI_GET_PAGE_FRAME_FROM_PTE, MI_MAKE_VALID_PTE, MI_PFN_ELEMENT, MI_SET_ACCESSED_IN_PTE, MI_SET_PFN_DELETED, MI_SET_PTE_DIRTY, MI_WRITE_VALID_PTE, MiDecrementShareAndValidCount, MiDecrementShareCountOnly, MiEnsureAvailablePageOrWait(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiInitializePfn(), MiNoLowMemory, MiReleaseSystemPtes(), MiRemoveAnyPage(), MiRemoveLowPages(), MiReserveSystemPtes(), MiUpdateThunks(), MM_EXECUTE_READWRITE, MmMakeLowMemory, NT_SUCCESS, NTSTATUS(), NULL, PAGE_SHIFT, PAGE_SIZE, _MMPFN::PteAddress, _MMPFN::PteFrame, ROUND_TO_PAGES, RtlImageNtHeader(), Status, SystemPteSpace, TRUE, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, _MMPFN::u3, UNLOCK_PFN, and ZeroPte. Referenced by MmInitSystem().
|
|
||||||||||||||||
|
Definition at line 2740 of file sysload.c. References _UNLOADED_DRIVERS::CurrentTime, _UNLOADED_DRIVERS::EndAddress, ExAllocatePoolWithTag, KeQuerySystemTime(), MI_UNLOADED_DRIVERS, MiLastUnloadedDriver, MiTotalUnloads, MiUnloadedDrivers, MiUnloadsSkipped, _UNLOADED_DRIVERS::Name, NonPagedPool, NULL, RtlFreeUnicodeString(), and _UNLOADED_DRIVERS::StartAddress. Referenced by MmUnloadSystemImage().
|
|
|
Referenced by MiInitMachineDependent(), and MiReloadBootLoadedDrivers(). |
|
||||||||||||||||||||||||||||||||
|
Definition at line 3953 of file sysload.c. References ASSERT, CmRegistryMachineSystemCurrentControlSetServices, _LOAD_IMPORTS::Count, Count, _LOAD_IMPORTS::Entry, ExAllocatePoolWithTag, ExFreePool(), FALSE, L, MiDereferenceImports(), MiLocateExportName(), MiSnapThunk(), MmLoadSystemImage(), MmUnloadSystemImage(), NO_IMPORTS_USED, NonPagedPool, NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, PagedPool, PLOAD_IMPORTS, PMM_DLL_INITIALIZE, POINTER_TO_SINGLE_ENTRY, PsLoadedModuleList, RtlAnsiStringToUnicodeString(), RtlAppendStringToString(), RtlAppendUnicodeStringToString(), RtlAppendUnicodeToString(), RtlEqualUnicodeString(), RtlFreeUnicodeString(), RtlImageDirectoryEntryToData(), RtlInitAnsiString(), TRUE, and USHORT. Referenced by MiLoadSystemImage().
|
|
||||||||||||
|
Definition at line 5376 of file sysload.c. References ASSERT, MiSetProtectionOnTransitionPte(), MM_PROTECTION_WRITE_MASK, MmLockPagedPool(), MMPTE, MmUnlockPagedPool(), _MMPTE::u, _SUBSECTION::u, and ZeroPte. Referenced by MiLoadSystemImage(), and MiShareSessionImage().
|
|
||||||||||||||||
|
Definition at line 2309 of file sysload.c. References ASSERT, ExPageLockHandle, FALSE, KeFlushSingleTb(), LOCK_PFN, LOCK_SESSION_SPACE_WS, LOCK_SYSTEM_WS, MI_CAPTURE_DIRTY_BIT_TO_PFN, MI_FLUSH_ENTIRE_SESSION_TB, MI_GET_PAGE_FRAME_FROM_PTE, MI_IS_PHYSICAL_ADDRESS, MI_MAKE_VALID_PTE_TRANSITION, MI_PFN_ELEMENT, MiDecrementShareCount(), MiGetVirtualAddressMappedByPte, MM_BUMP_COUNTER, MM_BUMP_SESS_COUNTER, MM_DBG_SESSION_DRIVER_PAGES_UNLOCKED, MM_EXECUTE, MM_KERNEL_DEMAND_ZERO_PTE, MmIsAddressValid(), MmLockPagableSectionByHandle(), MmResidentAvailablePages, MmSessionSpace, MmTotalSystemDriverPages, MmUnlockPagableImageSection(), _MM_SESSION_SPACE::NonPagablePages, _MMPFN::OriginalPte, PAGE_SIZE, PAGED_CODE, TRUE, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, and UNLOCK_SYSTEM_WS. Referenced by MiEnablePagingOfDriver(), and MmPageEntireDriver().
|
|
||||||||||||
|
Referenced by MiProtectVirtualMemory(), MiSetImageProtect(), and MiSetProtectionOnSection(). |
|
||||||||||||
|
Definition at line 5448 of file sysload.c. References ASSERT, FALSE, KeFlushSingleTb(), LOCK_PFN, MI_ADD_LOCKED_PAGE_CHARGE, MI_CAPTURE_DIRTY_BIT_TO_PFN, MI_FLUSH_SINGLE_SESSION_TB, MI_IS_PHYSICAL_ADDRESS, MI_IS_PTE_DIRTY, MI_IS_SESSION_ADDRESS, MI_MAKE_VALID_PTE, MI_PFN_ELEMENT, MI_REMOVE_LOCKED_PAGE_CHARGE, MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiMakeSystemAddressValidPfn(), MiPteStr, MiPteToProto, MM_EXECUTE_READ, _MMPFN::OriginalPte, TRUE, _MMPTE::u, _MMPFN::u3, UNLOCK_PFN, and ZeroPte. Referenced by MiWriteProtectSystemImage().
|
|
||||||||||||||||||||||||||||||||||||
|
Definition at line 4464 of file sysload.c. References CHAR, ExAllocatePoolWithTag, ExFreePool(), NT_SUCCESS, NTSTATUS(), PAGED_CODE, PagedPool, PsLoadedModuleList, PUSHORT, RtlAnsiStringToUnicodeString(), RtlFreeUnicodeString(), RtlImageDirectoryEntryToData(), RtlPrefixString(), Status, strlen(), TRUE, and USHORT. Referenced by MiResolveImageReferences().
|
|
||||||||||||||||||||
|
Definition at line 5878 of file sysload.c. References NULL, RtlImageDirectoryEntryToData(), and TRUE. Referenced by MiReloadBootLoadedDrivers().
|
|
|
Referenced by MiLoadSystemImage(), and MmInitSystem(). |
|
|
Definition at line 6717 of file sysload.c. References CmRegistryMachineSystemCurrentControlSetServices, ExAllocatePoolWithTag, ExFreePool(), L, MiLocateExportName(), NonPagedPool, NTSTATUS(), NULL, PMM_DLL_INITIALIZE, RtlAppendUnicodeStringToString(), RtlAppendUnicodeToString(), and USHORT. Referenced by IopInitializeBootDrivers().
|
|
|
Definition at line 4820 of file sysload.c. References EXCEPTION_EXECUTE_HANDLER, L, LdrVerifyMappedImageMatchesChecksum(), MmVerifyImageIsOkForMpUse(), NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, and Status.
|
|
|
Definition at line 2106 of file sysload.c. References ASSERT, ExPageLockHandle, FALSE, MI_IS_SESSION_ADDRESS, MiDeleteSystemPagableVm(), MiGetPteAddress, MiReturnCommitment(), MM_BUMP_COUNTER, MM_DBG_COMMIT_RETURN_DRIVER_INIT_CODE, MM_TRACK_COMMIT, MmDriverCommit, MmLockPagableSectionByHandle(), MmResidentAvailablePages, MmUnlockPagableImageSection(), NULL, PAGE_SHIFT, ROUND_TO_PAGES, RtlImageNtHeader(), and ZeroKernelPte. Referenced by IopLoadDriver().
|
|
|
Definition at line 6808 of file sysload.c. References ASSERT, ExAcquireResourceShared, ExReleaseResource, FALSE, KeDelayExecutionThread(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KernelMode, L, MiFindExportedRoutineByName(), MmShortTime, NT_SUCCESS, NTSTATUS(), NULL, PASSIVE_LEVEL, PsLoadedModuleList, PsLoadedModuleResource, RtlEqualUnicodeString(), RtlFreeAnsiString(), RtlInitUnicodeString(), RtlUnicodeStringToAnsiString(), Status, and TRUE.
|
|
||||||||||||||||||||||||
|
Definition at line 379 of file sysload.c. References FALSE, MiLoadSystemImage(), PAGED_CODE, and TRUE. Referenced by IopLoadDumpDriver().
|
|
||||||||||||||||||||||||||||
|
Definition at line 315 of file sysload.c. References FALSE, MiLoadSystemImage(), and PAGED_CODE. Referenced by IopLoadDriver(), MiResolveImageReferences(), and NtSetSystemInformation().
|
|
|
Definition at line 2836 of file sysload.c. References _UNLOADED_DRIVERS::EndAddress, Index, MI_UNLOADED_DRIVERS, MiLastUnloadedDriver, MiUnloadedDrivers, _UNLOADED_DRIVERS::Name, NULL, and _UNLOADED_DRIVERS::StartAddress. Referenced by KeBugCheckEx(), and KiDumpParameterImages().
|
|
|
Definition at line 6495 of file sysload.c. References KeFlushCurrentTb(), MI_IS_PHYSICAL_ADDRESS, MI_MAKE_VALID_PTE, MI_WRITE_VALID_PTE_NEW_PROTECTION, MiGetVirtualAddressMappedByPte, MM_READWRITE, NULL, and _MMPTE::u. Referenced by KeGetBugMessageText().
|
|
|
Definition at line 2472 of file sysload.c. References FALSE, MI_IS_SESSION_IMAGE_ADDRESS, MiGetPteAddress, MiLookupDataTableEntry(), MiSetPagingOfDriver(), MmDisablePagingExecutive, NULL, PAGE_SHIFT, PAGED_CODE, PSECTION, and TRUE. Referenced by DriverEntry(), MiLoadSystemImage(), and NtSetSystemInformation().
|
|
|
Definition at line 2560 of file sysload.c. References ASSERT, DbgPrint, ExPageLockHandle, FALSE, LOCK_PFN, LOCK_SYSTEM_WS, MI_IS_PHYSICAL_ADDRESS, MiGetPteAddress, MiLockCode(), MiLookupDataTableEntry(), MM_LOCK_BY_NONPAGE, MmDisablePagingExecutive, MmLockPagableSectionByHandle(), MmUnlockPagableImageSection(), NULL, PAGED_CODE, RtlImageNtHeader(), UNLOCK_PFN, and UNLOCK_SYSTEM_WS.
|
|
|
Definition at line 2896 of file sysload.c. References ASSERT, _MM_SESSION_SPACE::CommittedPages, DbgPrint, ExAcquireResourceExclusive, ExFreePool(), ExPageLockHandle, ExpCheckForResource(), ExReleaseResource, FALSE, _IMAGE_ENTRY_IN_SESSION::ImageCountInThisSession, KeBugCheckEx(), KeCheckForTimer(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), LOADED_AT_BOOT, LOCK_PFN, LOCK_SESSION_SPACE_WS, MI_IS_SESSION_IMAGE_ADDRESS, MiActiveVerifierThunks, MiClearImports(), MiDeleteSystemPagableVm(), MiDereferenceImports(), MiGetPteAddress, MiReleaseSystemPtes(), MiRememberUnloadedDriver(), MiRemoveImageSessionWide(), MiReturnCommitment(), MiSessionLookupImage(), MiSessionWideGetImageSize(), MiVerifierCheckThunks(), MiVerifyingDriverUnloading(), MM_BUMP_COUNTER, MM_BUMP_SESS_COUNTER, MM_DBG_COMMIT_RETURN_DRIVER_UNLOAD, MM_DBG_COMMIT_RETURN_DRIVER_UNLOAD1, MM_DBG_SESSION_COMMIT_IMAGE_UNLOAD, MM_TRACK_COMMIT, MmDisablePagingExecutive, MmDriverCommit, MmLockPagableSectionByHandle(), MmResidentAvailablePages, MmSessionSpace, MmSnapUnloads, MmSystemLoadLock, MmTotalSystemDriverPages, MmUnlockPagableImageSection(), NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, PAGE_SHIFT, PERFINFO_IMAGE_UNLOAD, PLOAD_IMPORTS, PSECTION, PsLoadedModuleList, PsLoadedModuleResource, PsLoadedModuleSpinLock, RtlFreeAnsiString(), RtlUnicodeStringToAnsiString(), _MM_SESSION_SPACE::SessionId, Status, SystemPteSpace, TRUE, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, WrVirtualMemory, and ZeroKernelPte. Referenced by IoFreeDumpStack(), IopDeleteDriver(), IopLoadDriver(), MiCallDllUnloadAndUnloadDll(), MiLoadSystemImage(), MiResolveImageReferences(), MiSessionUnloadAllImages(), and NtSetSystemInformation().
|
|
|
Definition at line 4923 of file sysload.c. References FALSE, KeNumberProcessors, NULL, PAGED_CODE, RtlImageNtHeader(), and TRUE. Referenced by MmCheckSystemImage().
|
|
|
Definition at line 92 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
Definition at line 91 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
Definition at line 61 of file sysload.c. Referenced by MiLoadSystemImage(). |
|
|
Definition at line 77 of file sysload.c. Referenced by MiRememberUnloadedDriver(), and MmLocateUnloadedDriver(). |
|
|
|
|
|
Definition at line 311 of file sysload.c. Referenced by MiSetSystemCodeProtection(), and MmInitSystem(). |
|
|
Definition at line 78 of file sysload.c. Referenced by MiRememberUnloadedDriver(). |
|
|
|
|
|
Definition at line 79 of file sysload.c. Referenced by MiRememberUnloadedDriver(). |
|
|
|
|
|
|
|
|
|
|
|
Definition at line 94 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
Definition at line 93 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
Definition at line 96 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
Definition at line 95 of file sysload.c. Referenced by KeBugCheckEx(), and MiLocateKernelSections(). |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Definition at line 6583 of file sysload.c. Referenced by KdpGetVersion(), KiInitializeKernel(), and MiInitializeLoadedModuleList(). |
1.3.7