attempt to fix #98

peloader/winapi/Internal.c

@@ -32,16 +32,20 @@ NTSTATUS WINAPI LdrGetDllHandle(PWCHAR pwPath, PVOID unused, PUNICODE_STRING Mod
     return 0;
 }
 
-NTSTATUS WINAPI EtwRegister(PVOID ProvideId, PVOID EnableCallback, PVOID CallbackContext, PVOID RegHandle)
+NTSTATUS WINAPI EtwRegister(PVOID ProviderId,
+                            PVOID EnableCallback,
+                            PVOID CallbackContext,
+                            PQWORD RegHandle)
 {
     DebugLog("");
+    *RegHandle = 'ETW';
     return 0;
 }
 
-NTSTATUS WINAPI EtwUnregister(HANDLE RegHandle)
+NTSTATUS WINAPI EtwUnregister(QWORD RegHandle)
 {
-    DebugLog("");
-    return 0;
+    DebugLog("%llx", RegHandle);
+    return -1;
 }
 
 ULONG WINAPI EtwEventWrite(HANDLE RegHAndle, PVOID EventDescriptor, ULONG UserDataCount, PVOID UserData, PVOID a5)
@@ -113,3 +117,5 @@ DECLARE_CRT_EXPORT("LdrGetDllHandle", LdrGetDllHandle);
 DECLARE_CRT_EXPORT("LdrLoadDll", LdrLoadDll);
 DECLARE_CRT_EXPORT("LdrUnloadDll", LdrUnloadDll);
 DECLARE_CRT_EXPORT("LdrGetProcedureAddress", LdrGetProcedureAddress);
+DECLARE_CRT_EXPORT("EventRegister", EtwRegister);
+DECLARE_CRT_EXPORT("EventUnregister", EtwUnregister);

peloader/winapi/Registry.c

@@ -46,6 +46,9 @@ STATIC LONG WINAPI RegOpenKeyExW(HANDLE hKey, PVOID lpSubKey, DWORD ulOptions, D
     } else if (strstr(ansikey, "ProfileList")) {
         *phkResult = (HANDLE) 'REG2';
         Result = 0;
+    } else if (strstr(ansikey, "DataCollection")) {
+        *phkResult = (HANDLE) 'REG3';
+        Result = 0;
     }
     free(ansikey);
     return Result;
@@ -193,6 +196,17 @@ STATIC LONG WINAPI RegCreateKeyExW(HANDLE hKey, PVOID lpSubKey, DWORD Reserved,
     return 0;
 }
 
+STATIC NTSTATUS WINAPI RegQueryValueExW(HANDLE hKey,
+                                        PVOID lpValueName,
+                                        PDWORD lpReserved,
+                                        PDWORD lpType,
+                                        PBYTE lpData,
+                                        PDWORD lpcbData)
+{
+    DebugLog("%p, %p, %p, %p, %p, %p", hKey, lpValueName, lpReserved, lpType, lpData, lpcbData);
+    return 2;
+}
+
 
 DECLARE_CRT_EXPORT("RegOpenKeyExW", RegOpenKeyExW);
 DECLARE_CRT_EXPORT("RegCloseKey", RegCloseKey);
@@ -200,4 +214,5 @@ DECLARE_CRT_EXPORT("RegQueryInfoKeyW", RegQueryInfoKeyW);
 DECLARE_CRT_EXPORT("NtEnumerateValueKey", NtEnumerateValueKey);
 DECLARE_CRT_EXPORT("NtQueryValueKey", NtQueryValueKey);
 DECLARE_CRT_EXPORT("RegCreateKeyExW", RegCreateKeyExW);
+DECLARE_CRT_EXPORT("RegQueryValueExW", RegQueryValueExW);
 

peloader/winapi/Strings.c

@@ -18,11 +18,21 @@
 #define MB_ERR_INVALID_CHARS 8
 #define MB_PRECOMPOSED 1
 
-STATIC int WINAPI MultiByteToWideChar(UINT CodePage, DWORD  dwFlags, PCHAR lpMultiByteStr, int cbMultiByte, PUSHORT lpWideCharStr, int cchWideChar)
+STATIC int WINAPI MultiByteToWideChar(UINT CodePage,
+                                      DWORD dwFlags,
+                                      PCHAR lpMultiByteStr,
+                                      int cbMultiByte,
+                                      PUSHORT lpWideCharStr,
+                                      int cchWideChar)
 {
     size_t i;
 
-    DebugLog("%u, %#x, %p, %u, %p, %u", CodePage, dwFlags, lpMultiByteStr, cbMultiByte, lpWideCharStr, cchWideChar);
+    DebugLog("%u, %#x, %p, %u, %p, %u", CodePage,
+                                        dwFlags,
+                                        lpMultiByteStr,
+                                        cbMultiByte,
+                                        lpWideCharStr,
+                                        cchWideChar);
 
     if ((dwFlags & ~(MB_ERR_INVALID_CHARS | MB_PRECOMPOSED)) != 0) {
         LogMessage("Unsupported Conversion Flags %#x", dwFlags);
@@ -148,6 +158,64 @@ STATIC INT WINAPI UuidCreate(PBYTE Uuid)
     return 0;
 }
 
+#define CSTR_LESS_THAN    1
+#define CSTR_EQUAL        2
+#define CSTR_GREATER_THAN 3
+
+STATIC INT WINAPI CompareStringOrdinal(PVOID lpString1,
+                                       INT cchCount1,
+                                       PVOID lpString2,
+                                       INT cchCount2,
+                                       BOOL bIgnoreCase)
+{
+    int Result;
+    int Length;
+    PVOID lpt1;
+    PVOID lpt2;
+
+    DebugLog("%p, %d, %p, %d, %d", lpString1,
+                                   cchCount1,
+                                   lpString2,
+                                   cchCount2,
+                                   bIgnoreCase);
+
+    if (cchCount1 == -1)
+        cchCount1 = CountWideChars(lpString1);
+
+    if (cchCount2 == -1)
+        cchCount2 = CountWideChars(lpString2);
+
+    lpt1 = calloc(cchCount1 + 1, 2);
+    lpt2 = calloc(cchCount2 + 1, 2);
+
+    if (!lpt1 || !lpt2) {
+        // "The function returns 0 if it does not succeed."
+        free(lpt1);
+        free(lpt2);
+        return 0;
+    }
+
+    memcpy(lpt1, lpString1, cchCount1 * 2);
+    memcpy(lpt2, lpString2, cchCount2 * 2);
+
+    Result = bIgnoreCase
+        ? wcsicmp(lpt1, lpt2)
+        : wcscmp(lpt1, lpt2);
+
+    free(lpt1);
+    free(lpt2);
+
+    // I am not sure if this logic is correct, I just read the msdn page and
+    // wrote it blindly.
+
+    if (Result < 0)
+        return CSTR_LESS_THAN;
+    if (Result == 0)
+        return CSTR_EQUAL;
+
+    return CSTR_GREATER_THAN;
+}
+
 DECLARE_CRT_EXPORT("MultiByteToWideChar", MultiByteToWideChar);
 DECLARE_CRT_EXPORT("WideCharToMultiByte", WideCharToMultiByte);
 DECLARE_CRT_EXPORT("GetStringTypeA", GetStringTypeA);
@@ -155,4 +223,5 @@ DECLARE_CRT_EXPORT("GetStringTypeW", GetStringTypeW);
 DECLARE_CRT_EXPORT("RtlInitUnicodeString", RtlInitUnicodeString);
 DECLARE_CRT_EXPORT("UuidFromStringW", UuidFromStringW);
 DECLARE_CRT_EXPORT("UuidCreate", UuidCreate);
+DECLARE_CRT_EXPORT("CompareStringOrdinal", CompareStringOrdinal);
 

peloader/winstrings.h

@@ -5,4 +5,9 @@ size_t CountWideChars(const void *wcharbuf);
 char * CreateAnsiFromWide(void *wcharbuf);
 char *string_from_wchar(void *wcharbuf, size_t len);
 
+#define wcscmp _win_wcscmp
+#define wcsicmp _win_wcsicmp
+extern INT wcscmp(const wchar_t *s1, const wchar_t *s2);
+extern INT wcsicmp(const wchar_t *s1, const wchar_t *s2);
+
 #endif