Skip to content

Commit b27429b

Browse files
tkreuzertkreuzer
committed
[ADVAPI32][ETWTRACE] Add etwtrace library and link advapi32 to it on NT6+
1 parent 98e7e64 commit b27429b

File tree

3 files changed

+31
-24
lines changed

3 files changed

+31
-24
lines changed

‎dll/ntdll/CMakeLists.txt‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,18 @@ add_library(rtl_um OBJECT
2424
target_link_libraries(rtl_um apisets ${PSEH_LIB})
2525
add_dependencies(rtl_um psdk)
2626

27+
# On NT6+ this is used by advapi32
28+
add_library(etwtrace etw/trace.c)
29+
target_link_libraries(etwtrace ${PSEH_LIB})
30+
add_dependencies(etwtrace psdk)
31+
2732
list(APPEND SOURCE
2833
dbg/dbgui.c
2934
ldr/ldrapi.c
3035
ldr/ldrinit.c
3136
ldr/ldrpe.c
3237
ldr/ldrutils.c
33-
ldr/verifier.c
34-
etw/trace.c)
38+
ldr/verifier.c)
3539

3640
if(ARCH STREQUAL "i386")
3741
list(APPEND ASM_SOURCE dispatch/i386/dispatch.S)
@@ -61,7 +65,7 @@ set_module_type(ntdll win32dll ENTRYPOINT 0)
6165
set_subsystem(ntdll console)
6266
################# END HACK #################
6367

64-
target_link_libraries(ntdll csrlib rtl rtl_um rtl_vista ntdllsys libcntpr uuid ${PSEH_LIB})
68+
target_link_libraries(ntdll etwtrace csrlib rtl rtl_um rtl_vista ntdllsys libcntpr uuid ${PSEH_LIB})
6569
if(DLL_EXPORT_VERSION GREATER_EQUAL 0x600)
6670
target_link_libraries(ntdll cryptlib)
6771
endif()

‎dll/win32/advapi32/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ add_library(advapi32 MODULE
6262

6363
set_module_type(advapi32 win32dll UNICODE ENTRYPOINT DllMain 12)
6464
target_link_libraries(advapi32 cryptlib wine ${PSEH_LIB})
65+
if(DLL_EXPORT_VERSION GREATER_EQUAL 0x600)
66+
target_link_libraries(advapi32 etwtrace)
67+
endif()
6568
add_delay_importlibs(advapi32 secur32)
6669
add_importlibs(advapi32 advapi32_vista rpcrt4 kernel32 ntdll)
6770
add_pch(advapi32 advapi32.h "${PCH_SKIP_SOURCE}")

‎dll/win32/advapi32/advapi32.spec‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,9 @@
7070
@ stub ComputeAccessTokenFromCodeAuthzLevel
7171
@ stdcall ControlService(long long ptr)
7272
@ stdcall -version=0x502 ControlTraceA(double str ptr long) ntdll.EtwControlTraceA
73-
@ stdcall -stub -version=0x600+ ControlTraceA(double str ptr long)
73+
@ stdcall -version=0x600+ ControlTraceA(double str ptr long) EtwControlTraceA
7474
@ stdcall -version=0x502 ControlTraceW(double wstr ptr long) ntdll.EtwControlTraceW
75-
@ stdcall -stub -version=0x600+ ControlTraceW(double wstr ptr long)
75+
@ stdcall -version=0x600+ ControlTraceW(double wstr ptr long) EtwControlTraceW
7676
@ stub ConvertAccessToSecurityDescriptorA
7777
@ stub ConvertAccessToSecurityDescriptorW
7878
@ stub ConvertSDToStringSDRootDomainA
@@ -207,7 +207,7 @@
207207
@ stdcall ElfReportEventAndSourceW(long long ptr long long long ptr ptr long long ptr ptr long ptr ptr)
208208
@ stdcall ElfReportEventW(long long long long ptr long long ptr ptr long ptr ptr)
209209
@ stdcall -version=0x502 EnableTrace(long long long ptr double) ntdll.EtwEnableTrace
210-
@ stdcall -stub -version=0x600+ EnableTrace(long long long ptr double)
210+
@ stdcall -version=0x600+ EnableTrace(long long long ptr double) EtwEnableTrace
211211
@ stdcall EncryptFileA(str)
212212
@ stdcall EncryptFileW(wstr)
213213
@ stub EncryptedFileKeyInfo
@@ -220,17 +220,17 @@
220220
@ stdcall EnumServicesStatusExW(long long long long ptr long ptr ptr ptr wstr)
221221
@ stdcall EnumServicesStatusW(long long long ptr long ptr ptr ptr)
222222
@ stdcall -version=0x502 EnumerateTraceGuids(ptr long ptr) ntdll.EtwEnumerateTraceGuids
223-
@ stdcall -stub -version=0x600+ EnumerateTraceGuids(ptr long ptr)
223+
@ stdcall -stub -version=0x600+ EnumerateTraceGuids(ptr long ptr) # EtwEnumerateTraceGuids
224224
@ stdcall EqualDomainSid(ptr ptr ptr)
225225
@ stdcall EqualPrefixSid(ptr ptr)
226226
@ stdcall EqualSid(ptr ptr)
227227
@ stdcall FileEncryptionStatusA(str ptr)
228228
@ stdcall FileEncryptionStatusW(wstr ptr)
229229
@ stdcall FindFirstFreeAce(ptr ptr)
230230
@ stdcall -version=0x502 FlushTraceA(double str ptr) ntdll.EtwFlushTraceA
231-
@ stdcall -stub -version=0x600+ FlushTraceA(double str ptr)
231+
@ stdcall -version=0x600+ FlushTraceA(double str ptr) EtwFlushTraceA
232232
@ stdcall -version=0x502 FlushTraceW(double wstr ptr) ntdll.EtwFlushTraceW
233-
@ stdcall -stub -version=0x600+ FlushTraceW(double wstr ptr)
233+
@ stdcall -version=0x600+ FlushTraceW(double wstr ptr) EtwFlushTraceW
234234
@ stub FreeEncryptedFileKeyInfo
235235
@ stdcall FreeEncryptionCertificateHashList(ptr)
236236
@ stdcall FreeInheritedFromArray(ptr long ptr)
@@ -456,9 +456,9 @@
456456
@ stub ProcessIdleTasks
457457
@ stdcall ProcessTrace(ptr long ptr ptr)
458458
@ stdcall -version=0x502 QueryAllTracesA(ptr long ptr) ntdll.EtwQueryAllTracesA
459-
@ stdcall -stub -version=0x600+ QueryAllTracesA(ptr long ptr)
459+
@ stdcall -version=0x600+ QueryAllTracesA(ptr long ptr) EtwQueryAllTracesA
460460
@ stdcall -version=0x502 QueryAllTracesW(ptr long ptr) ntdll.EtwQueryAllTracesW
461-
@ stdcall -stub -version=0x600+ QueryAllTracesW(ptr long ptr)
461+
@ stdcall -version=0x600+ QueryAllTracesW(ptr long ptr) EtwQueryAllTracesW
462462
@ stdcall QueryRecoveryAgentsOnEncryptedFile(wstr ptr)
463463
@ stdcall QueryServiceConfig2A(long long ptr long ptr)
464464
@ stdcall QueryServiceConfig2W(long long ptr long ptr)
@@ -470,9 +470,9 @@
470470
@ stdcall QueryServiceStatus(long ptr)
471471
@ stdcall QueryServiceStatusEx(long long ptr long ptr)
472472
@ stdcall -version=0x502 QueryTraceA(double str ptr) ntdll.EtwQueryTraceA
473-
@ stdcall -stub -version=0x600+ QueryTraceA(double str ptr)
473+
@ stdcall -version=0x600+ QueryTraceA(double str ptr) EtwQueryTraceA
474474
@ stdcall -version=0x502 QueryTraceW(double str ptr) ntdll.EtwQueryTraceW
475-
@ stdcall -stub -version=0x600+ QueryTraceW(double str ptr)
475+
@ stdcall -version=0x600+ QueryTraceW(double str ptr) EtwQueryTraceW
476476
@ stdcall QueryUsersOnEncryptedFile(wstr ptr)
477477
@ stdcall ReadEncryptedFileRaw(ptr ptr ptr)
478478
@ stdcall ReadEventLogA(long long long ptr long ptr ptr)
@@ -608,13 +608,13 @@
608608
@ stdcall StartServiceCtrlDispatcherW(ptr)
609609
@ stdcall StartServiceW(long long ptr)
610610
@ stdcall -version=0x502 StartTraceA(ptr str ptr) ntdll.EtwStartTraceA
611-
@ stdcall -stub -version=0x600+ StartTraceA(ptr str ptr)
611+
@ stdcall -version=0x600+ StartTraceA(ptr str ptr) EtwStartTraceA
612612
@ stdcall -version=0x502 StartTraceW(ptr wstr ptr) ntdll.EtwStartTraceW
613-
@ stdcall -stub -version=0x600+ StartTraceW(ptr wstr ptr)
613+
@ stdcall -version=0x600+ StartTraceW(ptr wstr ptr) EtwStartTraceW
614614
@ stdcall -version=0x502 StopTraceA(double str ptr) ntdll.EtwStopTraceA
615-
@ stdcall -stub -version=0x600+ StopTraceA(double str ptr)
615+
@ stdcall -version=0x600+ StopTraceA(double str ptr) EtwStopTraceA
616616
@ stdcall -version=0x502 StopTraceW(double wstr ptr) ntdll.EtwStopTraceW
617-
@ stdcall -stub -version=0x600+ StopTraceW(double wstr ptr)
617+
@ stdcall -version=0x600+ StopTraceW(double wstr ptr) EtwStopTraceW
618618
@ stdcall SystemFunction001(ptr ptr ptr)
619619
@ stdcall SystemFunction002(ptr ptr ptr)
620620
@ stdcall SystemFunction003(ptr ptr)
@@ -654,7 +654,7 @@
654654
@ stdcall SystemFunction040(ptr long long) # RtlEncryptMemory
655655
@ stdcall SystemFunction041(ptr long long) # RtlDecryptMemory
656656
@ stdcall -version=0x502 TraceEvent(double ptr) ntdll.EtwTraceEvent
657-
@ stdcall -stub -version=0x600+ TraceEvent(double ptr)
657+
@ stdcall -version=0x600+ TraceEvent(double ptr) EtwTraceEvent
658658
@ stdcall TraceEventInstance(double ptr ptr ptr) ntdll.EtwTraceEventInstance
659659
@ varargs TraceMessage() ntdll.EtwTraceMessage
660660
@ stdcall TraceMessageVa() ntdll.EtwTraceMessageVa
@@ -667,9 +667,9 @@
667667
@ stub UnregisterIdleTask
668668
@ stdcall UnregisterTraceGuids(double) ntdll.EtwUnregisterTraceGuids
669669
@ stdcall -version=0x502 UpdateTraceA(double str ptr) ntdll.EtwUpdateTraceA
670-
@ stdcall -stub -version=0x600+ UpdateTraceA(double str ptr)
670+
@ stdcall -version=0x600+ UpdateTraceA(double str ptr) EtwUpdateTraceA
671671
@ stdcall -version=0x502 UpdateTraceW(double wstr ptr) ntdll.EtwUpdateTraceW
672-
@ stdcall -stub -version=0x600+ UpdateTraceW(double wstr ptr)
672+
@ stdcall -version=0x600+ UpdateTraceW(double wstr ptr) EtwUpdateTraceW
673673
@ stub WdmWmiServiceMain
674674
@ stub WmiCloseBlock
675675
@ stub WmiCloseTraceWithCursor
@@ -688,9 +688,9 @@
688688
@ stub WmiMofEnumerateResourcesA
689689
@ stub WmiMofEnumerateResourcesW
690690
@ stdcall -version=0x502 WmiNotificationRegistrationA(ptr long ptr long long) ntdll.EtwNotificationRegistrationA
691-
@ stdcall -stub -version=0x600+ WmiNotificationRegistrationA(ptr long ptr long long)
691+
@ stdcall -stub -version=0x600+ WmiNotificationRegistrationA(ptr long ptr long long) # EtwNotificationRegistrationA
692692
@ stdcall -version=0x502 WmiNotificationRegistrationW(ptr long ptr long long) ntdll.EtwNotificationRegistrationW
693-
@ stdcall -stub -version=0x600+ WmiNotificationRegistrationW(ptr long ptr long long)
693+
@ stdcall -stub -version=0x600+ WmiNotificationRegistrationW(ptr long ptr long long) # EtwNotificationRegistrationW
694694
@ stub WmiOpenBlock
695695
@ stub WmiOpenTraceWithCursor
696696
@ stub WmiParseTraceEvent
@@ -704,9 +704,9 @@
704704
@ stub WmiQuerySingleInstanceMultipleW
705705
@ stub WmiQuerySingleInstanceW
706706
@ stdcall -version=0x502 WmiReceiveNotificationsA(long long long long) ntdll.EtwReceiveNotificationsA
707-
@ stdcall -stub -version=0x600+ WmiReceiveNotificationsA(long long long long)
707+
@ stdcall -stub -version=0x600+ WmiReceiveNotificationsA(long long long long) # EtwReceiveNotificationsA
708708
@ stdcall -version=0x502 WmiReceiveNotificationsW(long long long long) ntdll.EtwReceiveNotificationsW
709-
@ stdcall -stub -version=0x600+ WmiReceiveNotificationsW(long long long long)
709+
@ stdcall -stub -version=0x600+ WmiReceiveNotificationsW(long long long long) # EtwReceiveNotificationsW
710710
@ stub WmiSetSingleInstanceA
711711
@ stub WmiSetSingleInstanceW
712712
@ stub WmiSetSingleItemA

0 commit comments

Comments
 (0)