From 06c1e134e1665356394c1947ff061d28a918aa5a Mon Sep 17 00:00:00 2001 From: Mark Jansen Date: Tue, 29 Aug 2017 22:21:58 +0200 Subject: [PATCH] [SHIMENG] Mark modified dll's as visited, and apply shims to newly loaded dlls --- dll/appcompat/apphelp/shimeng.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/dll/appcompat/apphelp/shimeng.c b/dll/appcompat/apphelp/shimeng.c index 26e64b051f9..0d95d61183e 100644 --- a/dll/appcompat/apphelp/shimeng.c +++ b/dll/appcompat/apphelp/shimeng.c @@ -833,6 +833,12 @@ VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry) return; } + if (LdrEntry->Flags & LDRP_COMPAT_DATABASE_PROCESSED) + { + SHIMENG_INFO("Skipping module 0x%p \"%wZ\" because it was already processed\n", LdrEntry->DllBase, &LdrEntry->BaseDllName); + return; + } + ImportDescriptor = RtlImageDirectoryEntryToData(DllBase, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &Size); if (!ImportDescriptor) { @@ -902,6 +908,9 @@ VOID SeiHookImports(PLDR_DATA_TABLE_ENTRY LdrEntry) } } } + + /* Mark this module as processed. */ + LdrEntry->Flags |= LDRP_COMPAT_DATABASE_PROCESSED; } @@ -1185,12 +1194,18 @@ VOID NTAPI SE_ProcessDying(VOID) VOID WINAPI SE_DllLoaded(PLDR_DATA_TABLE_ENTRY LdrEntry) { SHIMENG_INFO("%sINIT. loading DLL \"%wZ\"\n", g_bShimDuringInit ? "" : "AFTER ", &LdrEntry->BaseDllName); + + SeiHookImports(LdrEntry); + NotifyShims(SHIM_REASON_DLL_LOAD, LdrEntry); } VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry) { SHIMENG_INFO("(%p)\n", LdrEntry); + + /* Should we unhook here? */ + NotifyShims(SHIM_REASON_DLL_UNLOAD, LdrEntry); }