static BOOL __cdecl _check_manifest(HMODULE hDllHandle){ /* We check that the dll is loaded through a manifest. * * We check several conditions and exceptions: * * (1) if (pre-fusion OS) * return TRUE; [no need to check] * * (2) if dll is being loaded by instrumented-mscoree.dll. * return TRUE; * * (3) if (dll is loaded from system32) * return FALSE; * * (4) if (!(loaded through a manifest)) * return FALSE; * * (5) if (loaded from %SystemRoot%\WinSxS) * return TRUE; [loaded from the WinSxS cache] * * (6) if (manifest is in the same folder as the dll) * return TRUE; * * (7) return FALSE; [loaded with another manifest] * * In general, when we encounter an error condition or something * which blocks us from checking if the dll is loaded through a * manifest, we do not return an error, but we let the dll to be * loaded. Notice that this is not a security feature: it's an helper * which will try (as much as possible) to discourage the practice * of not using a manifest to load the crt dll. */ wchar_t moduleFilePath[_PATH_LEN]; wchar_t systemRoot[MAX_PATH]; size_t moduleFilePathLen = 0; size_t systemRootLen = 0; PFN_FINDAC pfnFindActCtxSectionStringW =NULL; /* check condition (1) */ { HINSTANCE hKernel32 = GetModuleHandle("kernel32.dll"); if (hKernel32 == NULL) { /* unexpected condition, probably some strange loader lock situation */ return TRUE; } pfnFindActCtxSectionStringW = (PFN_FINDAC) GetProcAddress(hKernel32, "FindActCtxSectionStringW"); if (pfnFindActCtxSectionStringW == NULL) { /* pre-fusion OS, so no more checking.*/ return TRUE; } } /* being loaded by instrumented-mscoree.dll. (2) */ { HINSTANCE hMSCoree = GetModuleHandle("MSCoree.dll"); HINSTANCE hPGORT80 = GetModuleHandle("PGORT80.dll"); if( hMSCoree && hPGORT80 ) { // If pogo-instrumented mscoree is loaded, it has // a dependency on pgort80.dll. However, the manifest // in pgort80.dll is ignored. return TRUE; } } /* retrieve moduleFilePath and systemRoot */ { wchar_t tempPath[_PATH_LEN]; wchar_t *moduleName = NULL; DWORD ret = GetModuleFileNameW(hDllHandle, tempPath, _countof(tempPath)); if (ret == 0 || ret >= _countof(tempPath)) { /* error or filename longer than _PATH_LEN: we just let * the user load the dll, without checking the manifest */ return TRUE; } ret = GetLongPathNameW(tempPath, moduleFilePath, _countof(moduleFilePath)); if (ret == 0 || ret >= _countof(moduleFilePath)) { /* error or filename longer than _PATH_LEN: we just let * the user load the dll, without checking the manifest */ return TRUE; } moduleName = wcsrchr(moduleFilePath, L'\\'); if (moduleName == NULL) { /* error: we could not find a backslash in moduleFilePath */ return TRUE; } moduleName++; *moduleName = 0; /* moduleFilePath now contains only the path of the module ending with a backslash */ moduleFilePathLen = wcslen(moduleFilePath); ret = GetSystemDirectoryW(systemRoot, _countof(systemRoot)); if (ret == 0 || ret >= _countof(systemRoot)) { /* error or path longer than MAX_PATH: we just let * the user load the dll, without checking the manifest */ return TRUE; } /* add a trailing backslash if not there already */ systemRootLen = ret; if (systemRoot[systemRootLen - 1] != L'\\') { if (wcsncat_s(systemRoot, _countof(systemRoot), L"\\", _TRUNCATE) != 0) { /* error or not enough space */ return TRUE; } } systemRootLen = wcslen(systemRoot); } /* check condition (3) */ if (moduleFilePathLen == systemRootLen && _wcsicmp(moduleFilePath, systemRoot) == 0) { return FALSE; /* dll loaded from system32 */ } /* check condition (4) */ { ACTCTX_SECTION_KEYED_DATA askd = { sizeof(askd) }; if (!(*pfnFindActCtxSectionStringW)(0, NULL, ACTIVATION_CONTEXT_SECTION_DLL_REDIRECTION, _CRT_DLL_FILENAME, &askd)) { /* no activation context used to load CRT DLL, means no manifest present in the process */ return FALSE; } } /* check condition (5) */ { HINSTANCE hKernel32 = GetModuleHandle("kernel32.dll"); PFN_GETSYSTEMWINDOWSDIRECTORY pfnGetSystemWindowsDirectory = NULL; if (hKernel32 == NULL) { /* unexpected condition, probably some strange loader lock situation */ return TRUE; } pfnGetSystemWindowsDirectory = (PFN_GETSYSTEMWINDOWSDIRECTORY) GetProcAddress(hKernel32, "GetSystemWindowsDirectoryW"); if (pfnGetSystemWindowsDirectory == NULL) { /* pre-win2k OS, so no more checking. We shouldn't get to here because we checked OS version earlier */ return TRUE; } /* retrieves the windows folder */ systemRootLen = pfnGetSystemWindowsDirectory(systemRoot, _countof(systemRoot)); if (systemRootLen == 0 || systemRootLen >= _countof(systemRoot)) { /* error or path longer than MAX_PATH: we just let * the user load the dll, without checking the manifest */ return TRUE; } /* add a trailing backslash if not there already */ if (systemRoot[systemRootLen - 1] != L'\\') { if (wcsncat_s(systemRoot, _countof(systemRoot), L"\\" _WINSXS_FOLDER, _TRUNCATE) != 0) { /* error or not enough space */ return TRUE; } } else { if (wcsncat_s(systemRoot, _countof(systemRoot), _WINSXS_FOLDER, _TRUNCATE) != 0) { /* error or not enough space */ return TRUE; } } systemRootLen = wcslen(systemRoot); if (_wcsnicmp(systemRoot, moduleFilePath, systemRootLen) == 0) { /* moduleFileName begins with %SYSTEMROOT%\WinSxS\ */ return TRUE; /* dll has been loaded from the WinSxS cache */ } } /* check condition (6) */ { struct _wfinddata_t findData = { 0 }; intptr_t findHandle = -1; if (wcsncat_s(moduleFilePath, _countof(moduleFilePath), _MANIFEST_FILENAME, _TRUNCATE) != 0) { /* error or truncation */ return TRUE; } findHandle = _wfindfirst(moduleFilePath, &findData); if (findHandle != -1) { _findclose(findHandle); return TRUE; /* manifest is in the same folder as the dll */ } /* we could not find the manifest in the same folder as the dll */ moduleFilePath[moduleFilePathLen] = 0; /* restore moduleFilePath so that it contains only the path of the module with final backslash */ } /* case (7): loaded with another manifest */ return FALSE;}