0.8pre. installers are not finished [skip ci]
This commit is contained in:
zeffy
1
.gitignore
vendored
1
.gitignore
vendored
@@ -257,3 +257,4 @@ paket-files/
|
|||||||
|
|
||||||
# Other
|
# Other
|
||||||
setup-batch/*.dll
|
setup-batch/*.dll
|
||||||
|
/setup-ai/wufuc.back.aip
|
||||||
|
|||||||
68
README.md
68
README.md
@@ -1,25 +1,14 @@
|
|||||||
# wufuc [](https://ci.appveyor.com/project/zeffy/wufuc)
|
# wufuc [](https://ci.appveyor.com/project/zeffy/wufuc) [](https://isitmaintained.com/project/zeffy/wufuc)
|
||||||
|
|
||||||
**English** | [русский](translations/README.ru-RU.md) | [Français](translations/README.fr-FR.md) | [Deutsch](translations/README.de-DE.md) | [Magyar](translations/README.hu-HU.md) | [Portuguese (Brazil)](translations/README.pt-BR.md)
|
**English** | [русский](translations/README.ru-RU.md) | [Français](translations/README.fr-FR.md) | [Deutsch](translations/README.de-DE.md) | [Magyar](translations/README.hu-HU.md) | [Portuguese (Brazil)](translations/README.pt-BR.md)
|
||||||
|
|
||||||
[](https://pledgie.com/campaigns/34055)
|
|
||||||
|
|
||||||
Disables the "Unsupported Hardware" message in Windows Update, and allows you to continue installing updates on Windows 7 and 8.1 systems with Intel Kaby Lake, AMD Ryzen, or other unsupported processors.
|
Disables the "Unsupported Hardware" message in Windows Update, and allows you to continue installing updates on Windows 7 and 8.1 systems with Intel Kaby Lake, AMD Ryzen, or other unsupported processors.
|
||||||
|
|
||||||
## Downloads [](../../releases)
|
## Downloads [](../../releases)
|
||||||
|
|
||||||
### You can get the latest stable version [here](../../releases/latest)!
|
- [**Click here for the latest stable version**](../../releases/latest)
|
||||||
|
|
||||||
If you are feeling brave, you can try the latest unstable builds [here](https://ci.appveyor.com/project/zeffy/wufuc). **Use these at your own risk!**
|
- [Unstable builds](https://ci.appveyor.com/project/zeffy/wufuc) (Use these at your own risk!)
|
||||||
|
|
||||||
## Sponsors
|
|
||||||
|
|
||||||
### [Advanced Installer](http://www.advancedinstaller.com/)
|
|
||||||
The installer packages are created with Advanced Installer on an open source license. Advanced Installer's intuitive and friendly user interface allowed me to quickly create a feature complete installer with minimal effort. [Check it out!](http://www.advancedinstaller.com/)
|
|
||||||
|
|
||||||
## Reporting an issue [](https://isitmaintained.com/project/zeffy/wufuc)
|
|
||||||
|
|
||||||
See [CONTRIBUTING.md](CONTRIBUTING.md).
|
|
||||||
|
|
||||||
## Preface
|
## Preface
|
||||||
|
|
||||||
@@ -28,29 +17,54 @@ The changelog for Windows updates KB4012218 and KB4012219 included the following
|
|||||||
> Enabled detection of processor generation and hardware support when PC tries to scan or download updates through Windows Update.
|
> Enabled detection of processor generation and hardware support when PC tries to scan or download updates through Windows Update.
|
||||||
|
|
||||||
These updates marked the implementation of a [policy change](https://blogs.windows.com/windowsexperience/2016/01/15/windows-10-embracing-silicon-innovation/) they announced some time ago, where Microsoft stated that they would not be supporting Windows 7 or 8.1 on next-gen Intel, AMD and Qualcomm processors.
|
These updates marked the implementation of a [policy change](https://blogs.windows.com/windowsexperience/2016/01/15/windows-10-embracing-silicon-innovation/) they announced some time ago, where Microsoft stated that they would not be supporting Windows 7 or 8.1 on next-gen Intel, AMD and Qualcomm processors.
|
||||||
|
This was essentially a big middle finger to anyone who decides to not "upgrade" to the steaming pile of :shit: known as Windows 10, especially considering the extended support periods for Windows 7 and 8.1 won't be ending until January 4, 2020 and January 10, 2023 respectively.
|
||||||
|
|
||||||
It is essentially a big middle finger to anyone who decides to not "upgrade" to the steaming pile of :shit: known as Windows 10, especially considering the extended support periods for Windows 7 and 8.1 won't be ending until January 4, 2020 and January 10, 2023 respectively.
|
## Some people with older Intel and AMD processors are also affected!
|
||||||
|
|
||||||
This has even affected people with older Intel and AMD processors! I've received user reports of the [Intel Atom Z530](../../issues/7), [Intel Core i5-M 560](../../issues/23), [Intel Core i5-4300M](../../issues/24), [Intel Atom D525](../../issues/34), [Intel Pentium B940](../../issues/63), [AMD FX-8350](../../issues/32), and [AMD Turion 64 Mobile Technology ML-34](../../issues/80) all being blocked from receiving updates.
|
I've received user reports of the following CPUs all being blocked from receiving updates:
|
||||||
|
|
||||||
|
- [Intel Atom Z530](../../issues/7)
|
||||||
|
- [Intel Atom D525](../../issues/34)
|
||||||
|
- [Intel Core i5-M 560](../../issues/23)
|
||||||
|
- [Intel Core i5-4300M](../../issues/24)
|
||||||
|
- [Intel Pentium B940](../../issues/63)
|
||||||
|
- [AMD FX-8350](../../issues/32)
|
||||||
|
- [AMD Turion 64 Mobile Technology ML-34](../../issues/80)
|
||||||
|
|
||||||
## Bad Microsoft!
|
## Bad Microsoft!
|
||||||
|
|
||||||
If you are interested, you can read my original write up on discovering the CPU check [here](../../tree/old-kb4012218-19).
|
If you are interested, you can read my original write up on discovering the CPU check [here](../../tree/old-kb4012218-19).
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
- Enables Windows Update on PCs with unsupported processors.
|
||||||
|
- Written in C, the best programming language. :sunglasses:
|
||||||
|
- Comepletely free software (as in freedom) ([GPL v3.0](LICENSE))
|
||||||
|
- Does not modify any system files.
|
||||||
|
- Byte pattern-based patching, which means it will usually keep working even after new updates come out.
|
||||||
|
- Absolutely zero dependencies.
|
||||||
|
|
||||||
## How it works
|
## How it works
|
||||||
|
|
||||||
Basically, inside a file called `wuaueng.dll` there are two functions: [`IsDeviceServiceable(void)`](https://gist.github.com/zeffy/e5ec266952932bc905eb0cbc6ed72185) and [`IsCPUSupported(void)`](https://gist.github.com/zeffy/1a8f8984d2bec97ae24af63a76278694). `IsDeviceServiceable(void)` is essentially a wrapper around `IsCPUSupported(void)` that caches the result it receives and recycles it on subsequent calls.
|
Basically, inside a system file called `wuaueng.dll` there are two functions responsible for the CPU check: `IsDeviceServiceable(void)` and `IsCPUSupported(void)`.
|
||||||
|
`IsDeviceServiceable` simply calls `IsCPUSupported` once, and then re-uses the result that it receives on subsequent calls.
|
||||||
|
My patch takes advantage of this behavior by patching a couple of boolean values and basically making Windows Update think that it has already checked your processor, and the result was that it is indeed supported.
|
||||||
|
|
||||||
My patch takes advantage of this result caching behavior by setting the "first run" value to `FALSE` and the cached result to `TRUE`.
|
- The installer registers wufuc as a custom Application Verifier provider.
|
||||||
|
- When a `svchost.exe` process starts, the Windows PE loader automatically loads wufuc into its virtual address space.
|
||||||
|
- After that, wufuc will then check the command line of the process it was loaded into, then install some API hooks when appropriate:
|
||||||
|
* `LoadLibraryExW` hook will automatically patch `wuaueng.dll` as soon as it is loaded.
|
||||||
|
* `RegQueryValueExW` hook is necessary to provide compatibility with attempts by other third-parties at bypassing the CPU check. (see issue [#100](../../issues/100))
|
||||||
|
- If wufuc gets loaded by a `svchost.exe` process that isn't related to Windows Update, it goes into a dormant state and no hooks are applied.
|
||||||
|
|
||||||
- At system boot the wufuc scheduled task runs as the `NT AUTHORITY\SYSTEM` user.
|
## Sponsors
|
||||||
- `wufuc` determines what service host group process the Windows Update service runs in (typically `netsvcs`), and injects itself into it.
|
|
||||||
- Once injected, it applies a hook to `LoadLibraryEx` that automatically patches `wuaueng.dll` when it is loaded.
|
|
||||||
- Any previously loaded `wuaueng.dll` is also patched.
|
|
||||||
|
|
||||||
### Several improvements over my batchfile method:
|
### [Advanced Installer](http://www.advancedinstaller.com/)
|
||||||
|
|
||||||
- **No system files are modified!**
|
The installer packages are created with Advanced Installer using an [open source license](http://www.advancedinstaller.com/free-license.html). Advanced Installer's intuitive and friendly user interface allowed me to quickly create a feature complete installer with minimal effort. [Check it out!](http://www.advancedinstaller.com/)
|
||||||
- Heuristic-based patching, which means it will usually keep working even after new updates come out.
|
|
||||||
- C is best language!
|
## Special thanks
|
||||||
- No external dependencies.
|
|
||||||
|
- Alex Ionescu ([@ionescu007](https://github.com/ionescu007)) for his [_"Hooking Nirvana"_ presentation at REcon 2015](https://www.youtube.com/watch?v=bqU0y4FzvT0) and its corresponding [repository of example code](https://github.com/ionescu007/HookingNirvana). wufuc v0.8+ could not have been possible without his great work.
|
||||||
|
- Wen Jia Liu ([@wj32](https://github.com/wj32)) for his awesome program [Process Hacker](https://github.com/processhacker2/processhacker) which has been absolutely instrumental in the development of wufuc, and also for his [`phnt`](https://github.com/processhacker2/processhacker/tree/master/phnt) headers.
|
||||||
|
- Duncan Ogilvie ([@mrexodia](https://github.com/mrexodia)) for his [`patternfind.cpp`](https://github.com/x64dbg/x64dbg/blob/development/src/dbg/patternfind.cpp) algorithm from [x64dbg](https://github.com/x64dbg/x64dbg).
|
||||||
24
phnt/README.md
Normal file
24
phnt/README.md
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
This collection of Native API header files has been maintained since 2009 for the Process Hacker project, and is the most up-to-date set of Native API definitions that I know of. I have gathered these definitions from official Microsoft header files and symbol files, as well as a lot of reverse engineering and guessing. See `phnt.h` for more information.
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
First make sure that your program is using the latest Windows SDK.
|
||||||
|
|
||||||
|
These header files are designed to be used by user-mode programs. Instead of `#include <windows.h>`, place
|
||||||
|
|
||||||
|
```
|
||||||
|
#include <phnt_windows.h>
|
||||||
|
#include <phnt.h>
|
||||||
|
```
|
||||||
|
|
||||||
|
at the top of your program. The first line provides access to the Win32 API as well as the `NTSTATUS` values. The second line provides access to the entire Native API. By default, only definitions present in Windows XP are included into your program. To change this, use one of the following:
|
||||||
|
|
||||||
|
```
|
||||||
|
#define PHNT_VERSION PHNT_WINXP // Windows XP
|
||||||
|
#define PHNT_VERSION PHNT_WS03 // Windows Server 2003
|
||||||
|
#define PHNT_VERSION PHNT_VISTA // Windows Vista
|
||||||
|
#define PHNT_VERSION PHNT_WIN7 // Windows 7
|
||||||
|
#define PHNT_VERSION PHNT_WIN8 // Windows 8
|
||||||
|
#define PHNT_VERSION PHNT_WINBLUE // Windows 8.1
|
||||||
|
#define PHNT_VERSION PHNT_THRESHOLD // Windows 10
|
||||||
|
```
|
||||||
271
phnt/include/ntdbg.h
Normal file
271
phnt/include/ntdbg.h
Normal file
@@ -0,0 +1,271 @@
|
|||||||
|
#ifndef _NTDBG_H
|
||||||
|
#define _NTDBG_H
|
||||||
|
|
||||||
|
// Definitions
|
||||||
|
|
||||||
|
typedef struct _DBGKM_EXCEPTION
|
||||||
|
{
|
||||||
|
EXCEPTION_RECORD ExceptionRecord;
|
||||||
|
ULONG FirstChance;
|
||||||
|
} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_CREATE_THREAD
|
||||||
|
{
|
||||||
|
ULONG SubSystemKey;
|
||||||
|
PVOID StartAddress;
|
||||||
|
} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_CREATE_PROCESS
|
||||||
|
{
|
||||||
|
ULONG SubSystemKey;
|
||||||
|
HANDLE FileHandle;
|
||||||
|
PVOID BaseOfImage;
|
||||||
|
ULONG DebugInfoFileOffset;
|
||||||
|
ULONG DebugInfoSize;
|
||||||
|
DBGKM_CREATE_THREAD InitialThread;
|
||||||
|
} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_EXIT_THREAD
|
||||||
|
{
|
||||||
|
NTSTATUS ExitStatus;
|
||||||
|
} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_EXIT_PROCESS
|
||||||
|
{
|
||||||
|
NTSTATUS ExitStatus;
|
||||||
|
} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_LOAD_DLL
|
||||||
|
{
|
||||||
|
HANDLE FileHandle;
|
||||||
|
PVOID BaseOfDll;
|
||||||
|
ULONG DebugInfoFileOffset;
|
||||||
|
ULONG DebugInfoSize;
|
||||||
|
PVOID NamePointer;
|
||||||
|
} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;
|
||||||
|
|
||||||
|
typedef struct _DBGKM_UNLOAD_DLL
|
||||||
|
{
|
||||||
|
PVOID BaseAddress;
|
||||||
|
} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;
|
||||||
|
|
||||||
|
typedef enum _DBG_STATE
|
||||||
|
{
|
||||||
|
DbgIdle,
|
||||||
|
DbgReplyPending,
|
||||||
|
DbgCreateThreadStateChange,
|
||||||
|
DbgCreateProcessStateChange,
|
||||||
|
DbgExitThreadStateChange,
|
||||||
|
DbgExitProcessStateChange,
|
||||||
|
DbgExceptionStateChange,
|
||||||
|
DbgBreakpointStateChange,
|
||||||
|
DbgSingleStepStateChange,
|
||||||
|
DbgLoadDllStateChange,
|
||||||
|
DbgUnloadDllStateChange
|
||||||
|
} DBG_STATE, *PDBG_STATE;
|
||||||
|
|
||||||
|
typedef struct _DBGUI_CREATE_THREAD
|
||||||
|
{
|
||||||
|
HANDLE HandleToThread;
|
||||||
|
DBGKM_CREATE_THREAD NewThread;
|
||||||
|
} DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;
|
||||||
|
|
||||||
|
typedef struct _DBGUI_CREATE_PROCESS
|
||||||
|
{
|
||||||
|
HANDLE HandleToProcess;
|
||||||
|
HANDLE HandleToThread;
|
||||||
|
DBGKM_CREATE_PROCESS NewProcess;
|
||||||
|
} DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;
|
||||||
|
|
||||||
|
typedef struct _DBGUI_WAIT_STATE_CHANGE
|
||||||
|
{
|
||||||
|
DBG_STATE NewState;
|
||||||
|
CLIENT_ID AppClientId;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
DBGKM_EXCEPTION Exception;
|
||||||
|
DBGUI_CREATE_THREAD CreateThread;
|
||||||
|
DBGUI_CREATE_PROCESS CreateProcessInfo;
|
||||||
|
DBGKM_EXIT_THREAD ExitThread;
|
||||||
|
DBGKM_EXIT_PROCESS ExitProcess;
|
||||||
|
DBGKM_LOAD_DLL LoadDll;
|
||||||
|
DBGKM_UNLOAD_DLL UnloadDll;
|
||||||
|
} StateInfo;
|
||||||
|
} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;
|
||||||
|
|
||||||
|
// System calls
|
||||||
|
|
||||||
|
#define DEBUG_READ_EVENT 0x0001
|
||||||
|
#define DEBUG_PROCESS_ASSIGN 0x0002
|
||||||
|
#define DEBUG_SET_INFORMATION 0x0004
|
||||||
|
#define DEBUG_QUERY_INFORMATION 0x0008
|
||||||
|
#define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
|
||||||
|
DEBUG_READ_EVENT | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | \
|
||||||
|
DEBUG_QUERY_INFORMATION)
|
||||||
|
|
||||||
|
#define DEBUG_KILL_ON_CLOSE 0x1
|
||||||
|
|
||||||
|
typedef enum _DEBUGOBJECTINFOCLASS
|
||||||
|
{
|
||||||
|
DebugObjectFlags = 1,
|
||||||
|
MaxDebugObjectInfoClass
|
||||||
|
} DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateDebugObject(
|
||||||
|
_Out_ PHANDLE DebugObjectHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDebugActiveProcess(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ HANDLE DebugObjectHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDebugContinue(
|
||||||
|
_In_ HANDLE DebugObjectHandle,
|
||||||
|
_In_ PCLIENT_ID ClientId,
|
||||||
|
_In_ NTSTATUS ContinueStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRemoveProcessDebug(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ HANDLE DebugObjectHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationDebugObject(
|
||||||
|
_In_ HANDLE DebugObjectHandle,
|
||||||
|
_In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,
|
||||||
|
_In_ PVOID DebugInformation,
|
||||||
|
_In_ ULONG DebugInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWaitForDebugEvent(
|
||||||
|
_In_ HANDLE DebugObjectHandle,
|
||||||
|
_In_ BOOLEAN Alertable,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout,
|
||||||
|
_Out_ PVOID WaitStateChange
|
||||||
|
);
|
||||||
|
|
||||||
|
// Debugging UI
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiConnectToDbg(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
HANDLE
|
||||||
|
NTAPI
|
||||||
|
DbgUiGetThreadDebugObject(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
DbgUiSetThreadDebugObject(
|
||||||
|
_In_ HANDLE DebugObject
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiWaitStateChange(
|
||||||
|
_Out_ PDBGUI_WAIT_STATE_CHANGE StateChange,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiContinue(
|
||||||
|
_In_ PCLIENT_ID AppClientId,
|
||||||
|
_In_ NTSTATUS ContinueStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiStopDebugging(
|
||||||
|
_In_ HANDLE Process
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiDebugActiveProcess(
|
||||||
|
_In_ HANDLE Process
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
DbgUiRemoteBreakin(
|
||||||
|
_In_ PVOID Context
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiIssueRemoteBreakin(
|
||||||
|
_In_ HANDLE Process
|
||||||
|
);
|
||||||
|
|
||||||
|
struct _DEBUG_EVENT;
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
DbgUiConvertStateChangeStructure(
|
||||||
|
_In_ PDBGUI_WAIT_STATE_CHANGE StateChange,
|
||||||
|
_Out_ struct _DEBUG_EVENT *DebugEvent
|
||||||
|
);
|
||||||
|
|
||||||
|
struct _EVENT_FILTER_DESCRIPTOR;
|
||||||
|
|
||||||
|
typedef VOID (NTAPI *PENABLECALLBACK)(
|
||||||
|
_In_ LPCGUID SourceId,
|
||||||
|
_In_ ULONG IsEnabled,
|
||||||
|
_In_ UCHAR Level,
|
||||||
|
_In_ ULONGLONG MatchAnyKeyword,
|
||||||
|
_In_ ULONGLONG MatchAllKeyword,
|
||||||
|
_In_opt_ struct _EVENT_FILTER_DESCRIPTOR *FilterData,
|
||||||
|
_Inout_opt_ PVOID CallbackContext
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef ULONGLONG REGHANDLE, *PREGHANDLE;
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
EtwEventRegister(
|
||||||
|
_In_ LPCGUID ProviderId,
|
||||||
|
_In_opt_ PENABLECALLBACK EnableCallback,
|
||||||
|
_In_opt_ PVOID CallbackContext,
|
||||||
|
_Out_ PREGHANDLE RegHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
3871
phnt/include/ntexapi.h
Normal file
3871
phnt/include/ntexapi.h
Normal file
File diff suppressed because it is too large
Load Diff
121
phnt/include/ntgdi.h
Normal file
121
phnt/include/ntgdi.h
Normal file
@@ -0,0 +1,121 @@
|
|||||||
|
#ifndef _NTGDI_H
|
||||||
|
#define _NTGDI_H
|
||||||
|
|
||||||
|
#define GDI_MAX_HANDLE_COUNT 0x4000
|
||||||
|
|
||||||
|
#define GDI_HANDLE_INDEX_SHIFT 0
|
||||||
|
#define GDI_HANDLE_INDEX_BITS 16
|
||||||
|
#define GDI_HANDLE_INDEX_MASK 0xffff
|
||||||
|
|
||||||
|
#define GDI_HANDLE_TYPE_SHIFT 16
|
||||||
|
#define GDI_HANDLE_TYPE_BITS 5
|
||||||
|
#define GDI_HANDLE_TYPE_MASK 0x1f
|
||||||
|
|
||||||
|
#define GDI_HANDLE_ALTTYPE_SHIFT 21
|
||||||
|
#define GDI_HANDLE_ALTTYPE_BITS 2
|
||||||
|
#define GDI_HANDLE_ALTTYPE_MASK 0x3
|
||||||
|
|
||||||
|
#define GDI_HANDLE_STOCK_SHIFT 23
|
||||||
|
#define GDI_HANDLE_STOCK_BITS 1
|
||||||
|
#define GDI_HANDLE_STOCK_MASK 0x1
|
||||||
|
|
||||||
|
#define GDI_HANDLE_UNIQUE_SHIFT 24
|
||||||
|
#define GDI_HANDLE_UNIQUE_BITS 8
|
||||||
|
#define GDI_HANDLE_UNIQUE_MASK 0xff
|
||||||
|
|
||||||
|
#define GDI_HANDLE_INDEX(Handle) ((ULONG)(Handle) & GDI_HANDLE_INDEX_MASK)
|
||||||
|
#define GDI_HANDLE_TYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_TYPE_SHIFT) & GDI_HANDLE_TYPE_MASK)
|
||||||
|
#define GDI_HANDLE_ALTTYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_ALTTYPE_SHIFT) & GDI_HANDLE_ALTTYPE_MASK)
|
||||||
|
#define GDI_HANDLE_STOCK(Handle) (((ULONG)(Handle) >> GDI_HANDLE_STOCK_SHIFT)) & GDI_HANDLE_STOCK_MASK)
|
||||||
|
|
||||||
|
#define GDI_MAKE_HANDLE(Index, Unique) ((ULONG)(((ULONG)(Unique) << GDI_HANDLE_INDEX_BITS) | (ULONG)(Index)))
|
||||||
|
|
||||||
|
// GDI server-side types
|
||||||
|
|
||||||
|
#define GDI_DEF_TYPE 0 // invalid handle
|
||||||
|
#define GDI_DC_TYPE 1
|
||||||
|
#define GDI_DD_DIRECTDRAW_TYPE 2
|
||||||
|
#define GDI_DD_SURFACE_TYPE 3
|
||||||
|
#define GDI_RGN_TYPE 4
|
||||||
|
#define GDI_SURF_TYPE 5
|
||||||
|
#define GDI_CLIENTOBJ_TYPE 6
|
||||||
|
#define GDI_PATH_TYPE 7
|
||||||
|
#define GDI_PAL_TYPE 8
|
||||||
|
#define GDI_ICMLCS_TYPE 9
|
||||||
|
#define GDI_LFONT_TYPE 10
|
||||||
|
#define GDI_RFONT_TYPE 11
|
||||||
|
#define GDI_PFE_TYPE 12
|
||||||
|
#define GDI_PFT_TYPE 13
|
||||||
|
#define GDI_ICMCXF_TYPE 14
|
||||||
|
#define GDI_ICMDLL_TYPE 15
|
||||||
|
#define GDI_BRUSH_TYPE 16
|
||||||
|
#define GDI_PFF_TYPE 17 // unused
|
||||||
|
#define GDI_CACHE_TYPE 18 // unused
|
||||||
|
#define GDI_SPACE_TYPE 19
|
||||||
|
#define GDI_DBRUSH_TYPE 20 // unused
|
||||||
|
#define GDI_META_TYPE 21
|
||||||
|
#define GDI_EFSTATE_TYPE 22
|
||||||
|
#define GDI_BMFD_TYPE 23 // unused
|
||||||
|
#define GDI_VTFD_TYPE 24 // unused
|
||||||
|
#define GDI_TTFD_TYPE 25 // unused
|
||||||
|
#define GDI_RC_TYPE 26 // unused
|
||||||
|
#define GDI_TEMP_TYPE 27 // unused
|
||||||
|
#define GDI_DRVOBJ_TYPE 28
|
||||||
|
#define GDI_DCIOBJ_TYPE 29 // unused
|
||||||
|
#define GDI_SPOOL_TYPE 30
|
||||||
|
|
||||||
|
// GDI client-side types
|
||||||
|
|
||||||
|
#define GDI_CLIENT_TYPE_FROM_HANDLE(Handle) ((ULONG)(Handle) & ((GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT) | \
|
||||||
|
(GDI_HANDLE_TYPE_MASK << GDI_HANDLE_TYPE_SHIFT)))
|
||||||
|
#define GDI_CLIENT_TYPE_FROM_UNIQUE(Unique) GDI_CLIENT_TYPE_FROM_HANDLE((ULONG)(Unique) << 16)
|
||||||
|
|
||||||
|
#define GDI_ALTTYPE_1 (1 << GDI_HANDLE_ALTTYPE_SHIFT)
|
||||||
|
#define GDI_ALTTYPE_2 (2 << GDI_HANDLE_ALTTYPE_SHIFT)
|
||||||
|
#define GDI_ALTTYPE_3 (3 << GDI_HANDLE_ALTTYPE_SHIFT)
|
||||||
|
|
||||||
|
#define GDI_CLIENT_BITMAP_TYPE (GDI_SURF_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_BRUSH_TYPE (GDI_BRUSH_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_CLIENTOBJ_TYPE (GDI_CLIENTOBJ_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_DC_TYPE (GDI_DC_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_FONT_TYPE (GDI_LFONT_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_PALETTE_TYPE (GDI_PAL_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
#define GDI_CLIENT_REGION_TYPE (GDI_RGN_TYPE << GDI_HANDLE_TYPE_SHIFT)
|
||||||
|
|
||||||
|
#define GDI_CLIENT_ALTDC_TYPE (GDI_CLIENT_DC_TYPE | GDI_ALTTYPE_1)
|
||||||
|
#define GDI_CLIENT_DIBSECTION_TYPE (GDI_CLIENT_BITMAP_TYPE | GDI_ALTTYPE_1)
|
||||||
|
#define GDI_CLIENT_EXTPEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_2)
|
||||||
|
#define GDI_CLIENT_METADC16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_3)
|
||||||
|
#define GDI_CLIENT_METAFILE_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_2)
|
||||||
|
#define GDI_CLIENT_METAFILE16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_1)
|
||||||
|
#define GDI_CLIENT_PEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_1)
|
||||||
|
|
||||||
|
typedef struct _GDI_HANDLE_ENTRY
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PVOID Object;
|
||||||
|
PVOID NextFree;
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT ProcessId;
|
||||||
|
USHORT Lock : 1;
|
||||||
|
USHORT Count : 15;
|
||||||
|
};
|
||||||
|
ULONG Value;
|
||||||
|
} Owner;
|
||||||
|
USHORT Unique;
|
||||||
|
UCHAR Type;
|
||||||
|
UCHAR Flags;
|
||||||
|
PVOID UserPointer;
|
||||||
|
} GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY;
|
||||||
|
|
||||||
|
typedef struct _GDI_SHARED_MEMORY
|
||||||
|
{
|
||||||
|
GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT];
|
||||||
|
} GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY;
|
||||||
|
|
||||||
|
#endif
|
||||||
1779
phnt/include/ntioapi.h
Normal file
1779
phnt/include/ntioapi.h
Normal file
File diff suppressed because it is too large
Load Diff
165
phnt/include/ntkeapi.h
Normal file
165
phnt/include/ntkeapi.h
Normal file
@@ -0,0 +1,165 @@
|
|||||||
|
#ifndef _NTKEAPI_H
|
||||||
|
#define _NTKEAPI_H
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#define LOW_PRIORITY 0 // Lowest thread priority level
|
||||||
|
#define LOW_REALTIME_PRIORITY 16 // Lowest realtime priority level
|
||||||
|
#define HIGH_PRIORITY 31 // Highest thread priority level
|
||||||
|
#define MAXIMUM_PRIORITY 32 // Number of thread priority levels
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef enum _KTHREAD_STATE
|
||||||
|
{
|
||||||
|
Initialized,
|
||||||
|
Ready,
|
||||||
|
Running,
|
||||||
|
Standby,
|
||||||
|
Terminated,
|
||||||
|
Waiting,
|
||||||
|
Transition,
|
||||||
|
DeferredReady,
|
||||||
|
GateWaitObsolete,
|
||||||
|
WaitingForProcessInSwap,
|
||||||
|
MaximumThreadState
|
||||||
|
} KTHREAD_STATE, *PKTHREAD_STATE;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _KHETERO_CPU_POLICY
|
||||||
|
{
|
||||||
|
KHeteroCpuPolicyAll,
|
||||||
|
KHeteroCpuPolicyLarge,
|
||||||
|
KHeteroCpuPolicyLargeOrIdle,
|
||||||
|
KHeteroCpuPolicySmall,
|
||||||
|
KHeteroCpuPolicySmallOrIdle,
|
||||||
|
KHeteroCpuPolicyDynamic,
|
||||||
|
KHeteroCpuPolicyStaticMax,
|
||||||
|
KHeteroCpuPolicyBiasedSmall,
|
||||||
|
KHeteroCpuPolicyBiasedLarge,
|
||||||
|
KHeteroCpuPolicyDefault,
|
||||||
|
KHeteroCpuPolicyMax
|
||||||
|
} KHETERO_CPU_POLICY, *PKHETERO_CPU_POLICY;
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
typedef enum _KWAIT_REASON
|
||||||
|
{
|
||||||
|
Executive,
|
||||||
|
FreePage,
|
||||||
|
PageIn,
|
||||||
|
PoolAllocation,
|
||||||
|
DelayExecution,
|
||||||
|
Suspended,
|
||||||
|
UserRequest,
|
||||||
|
WrExecutive,
|
||||||
|
WrFreePage,
|
||||||
|
WrPageIn,
|
||||||
|
WrPoolAllocation,
|
||||||
|
WrDelayExecution,
|
||||||
|
WrSuspended,
|
||||||
|
WrUserRequest,
|
||||||
|
WrEventPair,
|
||||||
|
WrQueue,
|
||||||
|
WrLpcReceive,
|
||||||
|
WrLpcReply,
|
||||||
|
WrVirtualMemory,
|
||||||
|
WrPageOut,
|
||||||
|
WrRendezvous,
|
||||||
|
WrKeyedEvent,
|
||||||
|
WrTerminated,
|
||||||
|
WrProcessInSwap,
|
||||||
|
WrCpuRateControl,
|
||||||
|
WrCalloutStack,
|
||||||
|
WrKernel,
|
||||||
|
WrResource,
|
||||||
|
WrPushLock,
|
||||||
|
WrMutex,
|
||||||
|
WrQuantumEnd,
|
||||||
|
WrDispatchInt,
|
||||||
|
WrPreempted,
|
||||||
|
WrYieldExecution,
|
||||||
|
WrFastMutex,
|
||||||
|
WrGuardedMutex,
|
||||||
|
WrRundown,
|
||||||
|
WrAlertByThreadId,
|
||||||
|
WrDeferredPreempt,
|
||||||
|
MaximumWaitReason
|
||||||
|
} KWAIT_REASON, *PKWAIT_REASON;
|
||||||
|
|
||||||
|
typedef enum _KPROFILE_SOURCE
|
||||||
|
{
|
||||||
|
ProfileTime,
|
||||||
|
ProfileAlignmentFixup,
|
||||||
|
ProfileTotalIssues,
|
||||||
|
ProfilePipelineDry,
|
||||||
|
ProfileLoadInstructions,
|
||||||
|
ProfilePipelineFrozen,
|
||||||
|
ProfileBranchInstructions,
|
||||||
|
ProfileTotalNonissues,
|
||||||
|
ProfileDcacheMisses,
|
||||||
|
ProfileIcacheMisses,
|
||||||
|
ProfileCacheMisses,
|
||||||
|
ProfileBranchMispredictions,
|
||||||
|
ProfileStoreInstructions,
|
||||||
|
ProfileFpInstructions,
|
||||||
|
ProfileIntegerInstructions,
|
||||||
|
Profile2Issue,
|
||||||
|
Profile3Issue,
|
||||||
|
Profile4Issue,
|
||||||
|
ProfileSpecialInstructions,
|
||||||
|
ProfileTotalCycles,
|
||||||
|
ProfileIcacheIssues,
|
||||||
|
ProfileDcacheAccesses,
|
||||||
|
ProfileMemoryBarrierCycles,
|
||||||
|
ProfileLoadLinkedIssues,
|
||||||
|
ProfileMaximum
|
||||||
|
} KPROFILE_SOURCE;
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCallbackReturn(
|
||||||
|
_In_reads_bytes_opt_(OutputLength) PVOID OutputBuffer,
|
||||||
|
_In_ ULONG OutputLength,
|
||||||
|
_In_ NTSTATUS Status
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
NtFlushProcessWriteBuffers(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryDebugFilterState(
|
||||||
|
_In_ ULONG ComponentId,
|
||||||
|
_In_ ULONG Level
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetDebugFilterState(
|
||||||
|
_In_ ULONG ComponentId,
|
||||||
|
_In_ ULONG Level,
|
||||||
|
_In_ BOOLEAN State
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtYieldExecution(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
589
phnt/include/ntldr.h
Normal file
589
phnt/include/ntldr.h
Normal file
@@ -0,0 +1,589 @@
|
|||||||
|
#ifndef _NTLDR_H
|
||||||
|
#define _NTLDR_H
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
// DLLs
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _LDR_SERVICE_TAG_RECORD
|
||||||
|
{
|
||||||
|
struct _LDR_SERVICE_TAG_RECORD *Next;
|
||||||
|
ULONG ServiceTag;
|
||||||
|
} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _LDRP_CSLIST
|
||||||
|
{
|
||||||
|
PSINGLE_LIST_ENTRY Tail;
|
||||||
|
} LDRP_CSLIST, *PLDRP_CSLIST;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef enum _LDR_DDAG_STATE
|
||||||
|
{
|
||||||
|
LdrModulesMerged = -5,
|
||||||
|
LdrModulesInitError = -4,
|
||||||
|
LdrModulesSnapError = -3,
|
||||||
|
LdrModulesUnloaded = -2,
|
||||||
|
LdrModulesUnloading = -1,
|
||||||
|
LdrModulesPlaceHolder = 0,
|
||||||
|
LdrModulesMapping = 1,
|
||||||
|
LdrModulesMapped = 2,
|
||||||
|
LdrModulesWaitingForDependencies = 3,
|
||||||
|
LdrModulesSnapping = 4,
|
||||||
|
LdrModulesSnapped = 5,
|
||||||
|
LdrModulesCondensed = 6,
|
||||||
|
LdrModulesReadyToInit = 7,
|
||||||
|
LdrModulesInitializing = 8,
|
||||||
|
LdrModulesReadyToRun = 9
|
||||||
|
} LDR_DDAG_STATE;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _LDR_DDAG_NODE
|
||||||
|
{
|
||||||
|
LIST_ENTRY Modules;
|
||||||
|
PLDR_SERVICE_TAG_RECORD ServiceTagList;
|
||||||
|
ULONG LoadCount;
|
||||||
|
ULONG LoadWhileUnloadingCount;
|
||||||
|
ULONG LowestLink;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
LDRP_CSLIST Dependencies;
|
||||||
|
SINGLE_LIST_ENTRY RemovalLink;
|
||||||
|
};
|
||||||
|
LDRP_CSLIST IncomingDependencies;
|
||||||
|
LDR_DDAG_STATE State;
|
||||||
|
SINGLE_LIST_ENTRY CondenseLink;
|
||||||
|
ULONG PreorderNumber;
|
||||||
|
} LDR_DDAG_NODE, *PLDR_DDAG_NODE;
|
||||||
|
|
||||||
|
// rev
|
||||||
|
typedef struct _LDR_DEPENDENCY_RECORD
|
||||||
|
{
|
||||||
|
SINGLE_LIST_ENTRY DependencyLink;
|
||||||
|
PLDR_DDAG_NODE DependencyNode;
|
||||||
|
SINGLE_LIST_ENTRY IncomingDependencyLink;
|
||||||
|
PLDR_DDAG_NODE IncomingDependencyNode;
|
||||||
|
} LDR_DEPENDENCY_RECORD, *PLDR_DEPENDENCY_RECORD;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef enum _LDR_DLL_LOAD_REASON
|
||||||
|
{
|
||||||
|
LoadReasonStaticDependency,
|
||||||
|
LoadReasonStaticForwarderDependency,
|
||||||
|
LoadReasonDynamicForwarderDependency,
|
||||||
|
LoadReasonDelayloadDependency,
|
||||||
|
LoadReasonDynamicLoad,
|
||||||
|
LoadReasonAsImageLoad,
|
||||||
|
LoadReasonAsDataLoad,
|
||||||
|
LoadReasonUnknown = -1
|
||||||
|
} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
|
||||||
|
|
||||||
|
#define LDRP_PACKAGED_BINARY 0x00000001
|
||||||
|
#define LDRP_IMAGE_DLL 0x00000004
|
||||||
|
#define LDRP_LOAD_IN_PROGRESS 0x00001000
|
||||||
|
#define LDRP_ENTRY_PROCESSED 0x00004000
|
||||||
|
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
|
||||||
|
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
|
||||||
|
#define LDRP_PROCESS_ATTACH_FAILED 0x00100000
|
||||||
|
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000 // Vista and below
|
||||||
|
#define LDRP_COR_IMAGE 0x00400000
|
||||||
|
#define LDRP_DONT_RELOCATE 0x00800000
|
||||||
|
#define LDRP_REDIRECTED 0x10000000
|
||||||
|
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000
|
||||||
|
|
||||||
|
// Use the size of the structure as it was in Windows XP.
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _LDR_DATA_TABLE_ENTRY
|
||||||
|
{
|
||||||
|
LIST_ENTRY InLoadOrderLinks;
|
||||||
|
LIST_ENTRY InMemoryOrderLinks;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
LIST_ENTRY InInitializationOrderLinks;
|
||||||
|
LIST_ENTRY InProgressLinks;
|
||||||
|
};
|
||||||
|
PVOID DllBase;
|
||||||
|
PVOID EntryPoint;
|
||||||
|
ULONG SizeOfImage;
|
||||||
|
UNICODE_STRING FullDllName;
|
||||||
|
UNICODE_STRING BaseDllName;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
UCHAR FlagGroup[4];
|
||||||
|
ULONG Flags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG PackagedBinary : 1;
|
||||||
|
ULONG MarkedForRemoval : 1;
|
||||||
|
ULONG ImageDll : 1;
|
||||||
|
ULONG LoadNotificationsSent : 1;
|
||||||
|
ULONG TelemetryEntryProcessed : 1;
|
||||||
|
ULONG ProcessStaticImport : 1;
|
||||||
|
ULONG InLegacyLists : 1;
|
||||||
|
ULONG InIndexes : 1;
|
||||||
|
ULONG ShimDll : 1;
|
||||||
|
ULONG InExceptionTable : 1;
|
||||||
|
ULONG ReservedFlags1 : 2;
|
||||||
|
ULONG LoadInProgress : 1;
|
||||||
|
ULONG LoadConfigProcessed : 1;
|
||||||
|
ULONG EntryProcessed : 1;
|
||||||
|
ULONG ProtectDelayLoad : 1;
|
||||||
|
ULONG ReservedFlags3 : 2;
|
||||||
|
ULONG DontCallForThreads : 1;
|
||||||
|
ULONG ProcessAttachCalled : 1;
|
||||||
|
ULONG ProcessAttachFailed : 1;
|
||||||
|
ULONG CorDeferredValidate : 1;
|
||||||
|
ULONG CorImage : 1;
|
||||||
|
ULONG DontRelocate : 1;
|
||||||
|
ULONG CorILOnly : 1;
|
||||||
|
ULONG ReservedFlags5 : 3;
|
||||||
|
ULONG Redirected : 1;
|
||||||
|
ULONG ReservedFlags6 : 2;
|
||||||
|
ULONG CompatDatabaseProcessed : 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
USHORT ObsoleteLoadCount;
|
||||||
|
USHORT TlsIndex;
|
||||||
|
LIST_ENTRY HashLinks;
|
||||||
|
ULONG TimeDateStamp;
|
||||||
|
struct _ACTIVATION_CONTEXT *EntryPointActivationContext;
|
||||||
|
PVOID Lock;
|
||||||
|
PLDR_DDAG_NODE DdagNode;
|
||||||
|
LIST_ENTRY NodeModuleLink;
|
||||||
|
struct _LDRP_LOAD_CONTEXT *LoadContext;
|
||||||
|
PVOID ParentDllBase;
|
||||||
|
PVOID SwitchBackContext;
|
||||||
|
RTL_BALANCED_NODE BaseAddressIndexNode;
|
||||||
|
RTL_BALANCED_NODE MappingInfoIndexNode;
|
||||||
|
ULONG_PTR OriginalBase;
|
||||||
|
LARGE_INTEGER LoadTime;
|
||||||
|
ULONG BaseNameHashValue;
|
||||||
|
LDR_DLL_LOAD_REASON LoadReason;
|
||||||
|
ULONG ImplicitPathOptions;
|
||||||
|
ULONG ReferenceCount;
|
||||||
|
ULONG DependentLoadFlags;
|
||||||
|
UCHAR SigningLevel; // since REDSTONE2
|
||||||
|
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||||
|
|
||||||
|
typedef BOOLEAN (NTAPI *PDLL_INIT_ROUTINE)(
|
||||||
|
_In_ PVOID DllHandle,
|
||||||
|
_In_ ULONG Reason,
|
||||||
|
_In_opt_ PCONTEXT Context
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrLoadDll(
|
||||||
|
_In_opt_ PWSTR DllPath,
|
||||||
|
_In_opt_ PULONG DllCharacteristics,
|
||||||
|
_In_ PUNICODE_STRING DllName,
|
||||||
|
_Out_ PVOID *DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrUnloadDll(
|
||||||
|
_In_ PVOID DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetDllHandle(
|
||||||
|
_In_opt_ PWSTR DllPath,
|
||||||
|
_In_opt_ PULONG DllCharacteristics,
|
||||||
|
_In_ PUNICODE_STRING DllName,
|
||||||
|
_Out_ PVOID *DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001
|
||||||
|
#define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetDllHandleEx(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ PCWSTR DllPath,
|
||||||
|
_In_opt_ PULONG DllCharacteristics,
|
||||||
|
_In_ PUNICODE_STRING DllName,
|
||||||
|
_Out_opt_ PVOID *DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetDllHandleByMapping(
|
||||||
|
_In_ PVOID Base,
|
||||||
|
_Out_ PVOID *DllHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetDllHandleByName(
|
||||||
|
_In_opt_ PUNICODE_STRING BaseDllName,
|
||||||
|
_In_opt_ PUNICODE_STRING FullDllName,
|
||||||
|
_Out_ PVOID *DllHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define LDR_ADDREF_DLL_PIN 0x00000001
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrAddRefDll(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ PVOID DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetProcedureAddress(
|
||||||
|
_In_ PVOID DllHandle,
|
||||||
|
_In_opt_ PANSI_STRING ProcedureName,
|
||||||
|
_In_opt_ ULONG ProcedureNumber,
|
||||||
|
_Out_ PVOID *ProcedureAddress
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
#define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetProcedureAddressEx(
|
||||||
|
_In_ PVOID DllHandle,
|
||||||
|
_In_opt_ PANSI_STRING ProcedureName,
|
||||||
|
_In_opt_ ULONG ProcedureNumber,
|
||||||
|
_Out_ PVOID *ProcedureAddress,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
|
||||||
|
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002
|
||||||
|
|
||||||
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0
|
||||||
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1
|
||||||
|
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrLockLoaderLock(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_Out_opt_ ULONG *Disposition,
|
||||||
|
_Out_ PVOID *Cookie
|
||||||
|
);
|
||||||
|
|
||||||
|
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrUnlockLoaderLock(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_Inout_ PVOID Cookie
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrRelocateImage(
|
||||||
|
_In_ PVOID NewBase,
|
||||||
|
_In_ PSTR LoaderName,
|
||||||
|
_In_ NTSTATUS Success,
|
||||||
|
_In_ NTSTATUS Conflict,
|
||||||
|
_In_ NTSTATUS Invalid
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrRelocateImageWithBias(
|
||||||
|
_In_ PVOID NewBase,
|
||||||
|
_In_ LONGLONG Bias,
|
||||||
|
_In_ PSTR LoaderName,
|
||||||
|
_In_ NTSTATUS Success,
|
||||||
|
_In_ NTSTATUS Conflict,
|
||||||
|
_In_ NTSTATUS Invalid
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
PIMAGE_BASE_RELOCATION
|
||||||
|
NTAPI
|
||||||
|
LdrProcessRelocationBlock(
|
||||||
|
_In_ ULONG_PTR VA,
|
||||||
|
_In_ ULONG SizeOfBlock,
|
||||||
|
_In_ PUSHORT NextOffset,
|
||||||
|
_In_ LONG_PTR Diff
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
BOOLEAN
|
||||||
|
NTAPI
|
||||||
|
LdrVerifyMappedImageMatchesChecksum(
|
||||||
|
_In_ PVOID BaseAddress,
|
||||||
|
_In_ SIZE_T NumberOfBytes,
|
||||||
|
_In_ ULONG FileLength
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef VOID (NTAPI *PLDR_IMPORT_MODULE_CALLBACK)(
|
||||||
|
_In_ PVOID Parameter,
|
||||||
|
_In_ PSTR ModuleName
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrVerifyImageMatchesChecksum(
|
||||||
|
_In_ HANDLE ImageFileHandle,
|
||||||
|
_In_opt_ PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine,
|
||||||
|
_In_ PVOID ImportCallbackParameter,
|
||||||
|
_Out_opt_ PUSHORT ImageCharacteristics
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _LDR_IMPORT_CALLBACK_INFO
|
||||||
|
{
|
||||||
|
PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine;
|
||||||
|
PVOID ImportCallbackParameter;
|
||||||
|
} LDR_IMPORT_CALLBACK_INFO, *PLDR_IMPORT_CALLBACK_INFO;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _LDR_SECTION_INFO
|
||||||
|
{
|
||||||
|
HANDLE SectionHandle;
|
||||||
|
ACCESS_MASK DesiredAccess;
|
||||||
|
POBJECT_ATTRIBUTES ObjA;
|
||||||
|
ULONG SectionPageProtection;
|
||||||
|
ULONG AllocationAttributes;
|
||||||
|
} LDR_SECTION_INFO, *PLDR_SECTION_INFO;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _LDR_VERIFY_IMAGE_INFO
|
||||||
|
{
|
||||||
|
ULONG Size;
|
||||||
|
ULONG Flags;
|
||||||
|
LDR_IMPORT_CALLBACK_INFO CallbackInfo;
|
||||||
|
LDR_SECTION_INFO SectionInfo;
|
||||||
|
USHORT ImageCharacteristics;
|
||||||
|
} LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO;
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrVerifyImageMatchesChecksumEx(
|
||||||
|
_In_ HANDLE ImageFileHandle,
|
||||||
|
_Inout_ PLDR_VERIFY_IMAGE_INFO VerifyInfo
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrQueryModuleServiceTags(
|
||||||
|
_In_ PVOID DllHandle,
|
||||||
|
_Out_writes_(*BufferSize) PULONG ServiceTagBuffer,
|
||||||
|
_Inout_ PULONG BufferSize
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// begin_msdn:"DLL Load Notification"
|
||||||
|
|
||||||
|
#define LDR_DLL_NOTIFICATION_REASON_LOADED 1
|
||||||
|
#define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2
|
||||||
|
|
||||||
|
typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
PUNICODE_STRING FullDllName;
|
||||||
|
PUNICODE_STRING BaseDllName;
|
||||||
|
PVOID DllBase;
|
||||||
|
ULONG SizeOfImage;
|
||||||
|
} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;
|
||||||
|
|
||||||
|
typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
PCUNICODE_STRING FullDllName;
|
||||||
|
PCUNICODE_STRING BaseDllName;
|
||||||
|
PVOID DllBase;
|
||||||
|
ULONG SizeOfImage;
|
||||||
|
} LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
|
||||||
|
|
||||||
|
typedef union _LDR_DLL_NOTIFICATION_DATA
|
||||||
|
{
|
||||||
|
LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
|
||||||
|
LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
|
||||||
|
} LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;
|
||||||
|
|
||||||
|
typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(
|
||||||
|
_In_ ULONG NotificationReason,
|
||||||
|
_In_ PLDR_DLL_NOTIFICATION_DATA NotificationData,
|
||||||
|
_In_opt_ PVOID Context
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrRegisterDllNotification(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
|
||||||
|
_In_ PVOID Context,
|
||||||
|
_Out_ PVOID *Cookie
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrUnregisterDllNotification(
|
||||||
|
_In_ PVOID Cookie
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// end_msdn
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _PS_MITIGATION_OPTIONS_MAP
|
||||||
|
{
|
||||||
|
ULONG_PTR Map[2];
|
||||||
|
} PS_MITIGATION_OPTIONS_MAP, *PPS_MITIGATION_OPTIONS_MAP;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _PS_SYSTEM_DLL_INIT_BLOCK
|
||||||
|
{
|
||||||
|
ULONG Size;
|
||||||
|
ULONG_PTR SystemDllWowRelocation;
|
||||||
|
ULONG_PTR SystemDllNativeRelocation;
|
||||||
|
ULONG_PTR Wow64SharedInformation[16];
|
||||||
|
ULONG RngData;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG CfgOverride : 1;
|
||||||
|
ULONG Reserved : 31;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
PS_MITIGATION_OPTIONS_MAP MitigationOptionsMap;
|
||||||
|
ULONG_PTR CfgBitMap;
|
||||||
|
ULONG_PTR CfgBitMapSize;
|
||||||
|
ULONG_PTR Wow64CfgBitMap;
|
||||||
|
ULONG_PTR Wow64CfgBitMapSize;
|
||||||
|
} PS_SYSTEM_DLL_INIT_BLOCK, *PPS_SYSTEM_DLL_INIT_BLOCK;
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
PPS_SYSTEM_DLL_INIT_BLOCK
|
||||||
|
NTAPI
|
||||||
|
LdrSystemDllInitBlock(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Load as data table
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrAddLoadAsDataTable(
|
||||||
|
_In_ PVOID Module,
|
||||||
|
_In_ PWSTR FilePath,
|
||||||
|
_In_ SIZE_T Size,
|
||||||
|
_In_ HANDLE Handle
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrRemoveLoadAsDataTable(
|
||||||
|
_In_ PVOID InitModule,
|
||||||
|
_Out_opt_ PVOID *BaseModule,
|
||||||
|
_Out_opt_ PSIZE_T Size,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrGetFileNameFromLoadAsDataTable(
|
||||||
|
_In_ PVOID Module,
|
||||||
|
_Out_ PVOID *pFileNamePrt
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
LdrDisableThreadCalloutsForDll(
|
||||||
|
_In_ PVOID DllImageBase
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif // (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
// Module information
|
||||||
|
|
||||||
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION
|
||||||
|
{
|
||||||
|
HANDLE Section;
|
||||||
|
PVOID MappedBase;
|
||||||
|
PVOID ImageBase;
|
||||||
|
ULONG ImageSize;
|
||||||
|
ULONG Flags;
|
||||||
|
USHORT LoadOrderIndex;
|
||||||
|
USHORT InitOrderIndex;
|
||||||
|
USHORT LoadCount;
|
||||||
|
USHORT OffsetToFileName;
|
||||||
|
UCHAR FullPathName[256];
|
||||||
|
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _RTL_PROCESS_MODULES
|
||||||
|
{
|
||||||
|
ULONG NumberOfModules;
|
||||||
|
RTL_PROCESS_MODULE_INFORMATION Modules[1];
|
||||||
|
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
|
||||||
|
{
|
||||||
|
USHORT NextOffset;
|
||||||
|
RTL_PROCESS_MODULE_INFORMATION BaseInfo;
|
||||||
|
ULONG ImageChecksum;
|
||||||
|
ULONG TimeDateStamp;
|
||||||
|
PVOID DefaultBase;
|
||||||
|
} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;
|
||||||
|
|
||||||
|
#endif
|
||||||
995
phnt/include/ntlpcapi.h
Normal file
995
phnt/include/ntlpcapi.h
Normal file
@@ -0,0 +1,995 @@
|
|||||||
|
#ifndef _NTLPCAPI_H
|
||||||
|
#define _NTLPCAPI_H
|
||||||
|
|
||||||
|
// Local Inter-process Communication
|
||||||
|
|
||||||
|
#define PORT_CONNECT 0x0001
|
||||||
|
#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1)
|
||||||
|
|
||||||
|
typedef struct _PORT_MESSAGE
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
CSHORT DataLength;
|
||||||
|
CSHORT TotalLength;
|
||||||
|
} s1;
|
||||||
|
ULONG Length;
|
||||||
|
} u1;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
CSHORT Type;
|
||||||
|
CSHORT DataInfoOffset;
|
||||||
|
} s2;
|
||||||
|
ULONG ZeroInit;
|
||||||
|
} u2;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
CLIENT_ID ClientId;
|
||||||
|
double DoNotUseThisField;
|
||||||
|
};
|
||||||
|
ULONG MessageId;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
SIZE_T ClientViewSize; // only valid for LPC_CONNECTION_REQUEST messages
|
||||||
|
ULONG CallbackId; // only valid for LPC_REQUEST messages
|
||||||
|
};
|
||||||
|
} PORT_MESSAGE, *PPORT_MESSAGE;
|
||||||
|
|
||||||
|
typedef struct _PORT_DATA_ENTRY
|
||||||
|
{
|
||||||
|
PVOID Base;
|
||||||
|
ULONG Size;
|
||||||
|
} PORT_DATA_ENTRY, *PPORT_DATA_ENTRY;
|
||||||
|
|
||||||
|
typedef struct _PORT_DATA_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG CountDataEntries;
|
||||||
|
PORT_DATA_ENTRY DataEntries[1];
|
||||||
|
} PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION;
|
||||||
|
|
||||||
|
#define LPC_REQUEST 1
|
||||||
|
#define LPC_REPLY 2
|
||||||
|
#define LPC_DATAGRAM 3
|
||||||
|
#define LPC_LOST_REPLY 4
|
||||||
|
#define LPC_PORT_CLOSED 5
|
||||||
|
#define LPC_CLIENT_DIED 6
|
||||||
|
#define LPC_EXCEPTION 7
|
||||||
|
#define LPC_DEBUG_EVENT 8
|
||||||
|
#define LPC_ERROR_EVENT 9
|
||||||
|
#define LPC_CONNECTION_REQUEST 10
|
||||||
|
|
||||||
|
#define LPC_KERNELMODE_MESSAGE (CSHORT)0x8000
|
||||||
|
#define LPC_NO_IMPERSONATE (CSHORT)0x4000
|
||||||
|
|
||||||
|
#define PORT_VALID_OBJECT_ATTRIBUTES OBJ_CASE_INSENSITIVE
|
||||||
|
|
||||||
|
#ifdef _WIN64
|
||||||
|
#define PORT_MAXIMUM_MESSAGE_LENGTH 512
|
||||||
|
#else
|
||||||
|
#define PORT_MAXIMUM_MESSAGE_LENGTH 256
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define LPC_MAX_CONNECTION_INFO_SIZE (16 * sizeof(ULONG_PTR))
|
||||||
|
|
||||||
|
#define PORT_TOTAL_MAXIMUM_MESSAGE_LENGTH \
|
||||||
|
((PORT_MAXIMUM_MESSAGE_LENGTH + sizeof(PORT_MESSAGE) + LPC_MAX_CONNECTION_INFO_SIZE + 0xf) & ~0xf)
|
||||||
|
|
||||||
|
typedef struct _LPC_CLIENT_DIED_MSG
|
||||||
|
{
|
||||||
|
PORT_MESSAGE PortMsg;
|
||||||
|
LARGE_INTEGER CreateTime;
|
||||||
|
} LPC_CLIENT_DIED_MSG, *PLPC_CLIENT_DIED_MSG;
|
||||||
|
|
||||||
|
typedef struct _PORT_VIEW
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
HANDLE SectionHandle;
|
||||||
|
ULONG SectionOffset;
|
||||||
|
SIZE_T ViewSize;
|
||||||
|
PVOID ViewBase;
|
||||||
|
PVOID ViewRemoteBase;
|
||||||
|
} PORT_VIEW, *PPORT_VIEW;
|
||||||
|
|
||||||
|
typedef struct _REMOTE_PORT_VIEW
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
SIZE_T ViewSize;
|
||||||
|
PVOID ViewBase;
|
||||||
|
} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
|
||||||
|
|
||||||
|
// WOW64 definitions
|
||||||
|
|
||||||
|
// Except in a small number of special cases, WOW64 programs using the LPC APIs must use the 64-bit versions of the
|
||||||
|
// PORT_MESSAGE, PORT_VIEW and REMOTE_PORT_VIEW data structures. Note that we take a different approach than the
|
||||||
|
// official NT headers, which produce 64-bit versions in a 32-bit environment when USE_LPC6432 is defined.
|
||||||
|
|
||||||
|
typedef struct _PORT_MESSAGE64
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
CSHORT DataLength;
|
||||||
|
CSHORT TotalLength;
|
||||||
|
} s1;
|
||||||
|
ULONG Length;
|
||||||
|
} u1;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
CSHORT Type;
|
||||||
|
CSHORT DataInfoOffset;
|
||||||
|
} s2;
|
||||||
|
ULONG ZeroInit;
|
||||||
|
} u2;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
CLIENT_ID64 ClientId;
|
||||||
|
double DoNotUseThisField;
|
||||||
|
};
|
||||||
|
ULONG MessageId;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONGLONG ClientViewSize; // only valid for LPC_CONNECTION_REQUEST messages
|
||||||
|
ULONG CallbackId; // only valid for LPC_REQUEST messages
|
||||||
|
};
|
||||||
|
} PORT_MESSAGE64, *PPORT_MESSAGE64;
|
||||||
|
|
||||||
|
typedef struct _LPC_CLIENT_DIED_MSG64
|
||||||
|
{
|
||||||
|
PORT_MESSAGE64 PortMsg;
|
||||||
|
LARGE_INTEGER CreateTime;
|
||||||
|
} LPC_CLIENT_DIED_MSG64, *PLPC_CLIENT_DIED_MSG64;
|
||||||
|
|
||||||
|
typedef struct _PORT_VIEW64
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
ULONGLONG SectionHandle;
|
||||||
|
ULONG SectionOffset;
|
||||||
|
ULONGLONG ViewSize;
|
||||||
|
ULONGLONG ViewBase;
|
||||||
|
ULONGLONG ViewRemoteBase;
|
||||||
|
} PORT_VIEW64, *PPORT_VIEW64;
|
||||||
|
|
||||||
|
typedef struct _REMOTE_PORT_VIEW64
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
ULONGLONG ViewSize;
|
||||||
|
ULONGLONG ViewBase;
|
||||||
|
} REMOTE_PORT_VIEW64, *PREMOTE_PORT_VIEW64;
|
||||||
|
|
||||||
|
// Port creation
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreatePort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG MaxConnectionInfoLength,
|
||||||
|
_In_ ULONG MaxMessageLength,
|
||||||
|
_In_opt_ ULONG MaxPoolUsage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateWaitablePort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG MaxConnectionInfoLength,
|
||||||
|
_In_ ULONG MaxMessageLength,
|
||||||
|
_In_opt_ ULONG MaxPoolUsage
|
||||||
|
);
|
||||||
|
|
||||||
|
// Port connection (client)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtConnectPort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_ PUNICODE_STRING PortName,
|
||||||
|
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
|
||||||
|
_Inout_opt_ PPORT_VIEW ClientView,
|
||||||
|
_Inout_opt_ PREMOTE_PORT_VIEW ServerView,
|
||||||
|
_Out_opt_ PULONG MaxMessageLength,
|
||||||
|
_Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,
|
||||||
|
_Inout_opt_ PULONG ConnectionInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSecureConnectPort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_ PUNICODE_STRING PortName,
|
||||||
|
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
|
||||||
|
_Inout_opt_ PPORT_VIEW ClientView,
|
||||||
|
_In_opt_ PSID RequiredServerSid,
|
||||||
|
_Inout_opt_ PREMOTE_PORT_VIEW ServerView,
|
||||||
|
_Out_opt_ PULONG MaxMessageLength,
|
||||||
|
_Inout_updates_bytes_to_opt_(*ConnectionInformationLength, *ConnectionInformationLength) PVOID ConnectionInformation,
|
||||||
|
_Inout_opt_ PULONG ConnectionInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
// Port connection (server)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtListenPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Out_ PPORT_MESSAGE ConnectionRequest
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAcceptConnectPort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_opt_ PVOID PortContext,
|
||||||
|
_In_ PPORT_MESSAGE ConnectionRequest,
|
||||||
|
_In_ BOOLEAN AcceptConnection,
|
||||||
|
_Inout_opt_ PPORT_VIEW ServerView,
|
||||||
|
_Out_opt_ PREMOTE_PORT_VIEW ClientView
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCompleteConnectPort(
|
||||||
|
_In_ HANDLE PortHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
// General
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRequestPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRequestWaitReplyPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_reads_bytes_(RequestMessage->u1.s1.TotalLength) PPORT_MESSAGE RequestMessage,
|
||||||
|
_Out_ PPORT_MESSAGE ReplyMessage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplyPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_reads_bytes_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplyWaitReplyPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Inout_ PPORT_MESSAGE ReplyMessage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplyWaitReceivePort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Out_opt_ PVOID *PortContext,
|
||||||
|
_In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,
|
||||||
|
_Out_ PPORT_MESSAGE ReceiveMessage
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplyWaitReceivePortEx(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Out_opt_ PVOID *PortContext,
|
||||||
|
_In_reads_bytes_opt_(ReplyMessage->u1.s1.TotalLength) PPORT_MESSAGE ReplyMessage,
|
||||||
|
_Out_ PPORT_MESSAGE ReceiveMessage,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtImpersonateClientOfPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE Message
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReadRequestData(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE Message,
|
||||||
|
_In_ ULONG DataEntryIndex,
|
||||||
|
_Out_writes_bytes_to_(BufferSize, *NumberOfBytesRead) PVOID Buffer,
|
||||||
|
_In_ SIZE_T BufferSize,
|
||||||
|
_Out_opt_ PSIZE_T NumberOfBytesRead
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWriteRequestData(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE Message,
|
||||||
|
_In_ ULONG DataEntryIndex,
|
||||||
|
_In_reads_bytes_(BufferSize) PVOID Buffer,
|
||||||
|
_In_ SIZE_T BufferSize,
|
||||||
|
_Out_opt_ PSIZE_T NumberOfBytesWritten
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef enum _PORT_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
PortBasicInformation,
|
||||||
|
PortDumpInformation
|
||||||
|
} PORT_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PORT_INFORMATION_CLASS PortInformationClass,
|
||||||
|
_Out_writes_bytes_to_(Length, *ReturnLength) PVOID PortInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
// Asynchronous Local Inter-process Communication
|
||||||
|
|
||||||
|
// rev
|
||||||
|
typedef HANDLE ALPC_HANDLE, *PALPC_HANDLE;
|
||||||
|
|
||||||
|
#define ALPC_PORFLG_ALLOW_LPC_REQUESTS 0x20000 // rev
|
||||||
|
#define ALPC_PORFLG_WAITABLE_PORT 0x40000 // dbg
|
||||||
|
#define ALPC_PORFLG_SYSTEM_PROCESS 0x100000 // dbg
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _ALPC_PORT_ATTRIBUTES
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
SECURITY_QUALITY_OF_SERVICE SecurityQos;
|
||||||
|
SIZE_T MaxMessageLength;
|
||||||
|
SIZE_T MemoryBandwidth;
|
||||||
|
SIZE_T MaxPoolUsage;
|
||||||
|
SIZE_T MaxSectionSize;
|
||||||
|
SIZE_T MaxViewSize;
|
||||||
|
SIZE_T MaxTotalSectionSize;
|
||||||
|
ULONG DupObjectTypes;
|
||||||
|
#ifdef _WIN64
|
||||||
|
ULONG Reserved;
|
||||||
|
#endif
|
||||||
|
} ALPC_PORT_ATTRIBUTES, *PALPC_PORT_ATTRIBUTES;
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
#define ALPC_MESSAGE_SECURITY_ATTRIBUTE 0x80000000
|
||||||
|
#define ALPC_MESSAGE_VIEW_ATTRIBUTE 0x40000000
|
||||||
|
#define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000
|
||||||
|
#define ALPC_MESSAGE_HANDLE_ATTRIBUTE 0x10000000
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _ALPC_MESSAGE_ATTRIBUTES
|
||||||
|
{
|
||||||
|
ULONG AllocatedAttributes;
|
||||||
|
ULONG ValidAttributes;
|
||||||
|
} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _ALPC_COMPLETION_LIST_STATE
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG64 Head : 24;
|
||||||
|
ULONG64 Tail : 24;
|
||||||
|
ULONG64 ActiveThreadCount : 16;
|
||||||
|
} s1;
|
||||||
|
ULONG64 Value;
|
||||||
|
} u1;
|
||||||
|
} ALPC_COMPLETION_LIST_STATE, *PALPC_COMPLETION_LIST_STATE;
|
||||||
|
|
||||||
|
#define ALPC_COMPLETION_LIST_BUFFER_GRANULARITY_MASK 0x3f // dbg
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct DECLSPEC_ALIGN(128) _ALPC_COMPLETION_LIST_HEADER
|
||||||
|
{
|
||||||
|
ULONG64 StartMagic;
|
||||||
|
|
||||||
|
ULONG TotalSize;
|
||||||
|
ULONG ListOffset;
|
||||||
|
ULONG ListSize;
|
||||||
|
ULONG BitmapOffset;
|
||||||
|
ULONG BitmapSize;
|
||||||
|
ULONG DataOffset;
|
||||||
|
ULONG DataSize;
|
||||||
|
ULONG AttributeFlags;
|
||||||
|
ULONG AttributeSize;
|
||||||
|
|
||||||
|
DECLSPEC_ALIGN(128) ALPC_COMPLETION_LIST_STATE State;
|
||||||
|
ULONG LastMessageId;
|
||||||
|
ULONG LastCallbackId;
|
||||||
|
DECLSPEC_ALIGN(128) ULONG PostCount;
|
||||||
|
DECLSPEC_ALIGN(128) ULONG ReturnCount;
|
||||||
|
DECLSPEC_ALIGN(128) ULONG LogSequenceNumber;
|
||||||
|
DECLSPEC_ALIGN(128) RTL_SRWLOCK UserLock;
|
||||||
|
|
||||||
|
ULONG64 EndMagic;
|
||||||
|
} ALPC_COMPLETION_LIST_HEADER, *PALPC_COMPLETION_LIST_HEADER;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_CONTEXT_ATTR
|
||||||
|
{
|
||||||
|
PVOID PortContext;
|
||||||
|
PVOID MessageContext;
|
||||||
|
ULONG Sequence;
|
||||||
|
ULONG MessageId;
|
||||||
|
ULONG CallbackId;
|
||||||
|
} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR;
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
#define ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS 0x10000
|
||||||
|
#define ALPC_HANDLEFLG_DUPLICATE_SAME_ATTRIBUTES 0x20000
|
||||||
|
#define ALPC_HANDLEFLG_DUPLICATE_INHERIT 0x80000
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_HANDLE_ATTR32
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG Reserved0;
|
||||||
|
ULONG SameAccess;
|
||||||
|
ULONG SameAttributes;
|
||||||
|
ULONG Indirect;
|
||||||
|
ULONG Inherit;
|
||||||
|
ULONG Reserved1;
|
||||||
|
ULONG Handle;
|
||||||
|
ULONG ObjectType; // ObjectTypeCode, not ObjectTypeIndex
|
||||||
|
ULONG DesiredAccess;
|
||||||
|
ULONG GrantedAccess;
|
||||||
|
} ALPC_HANDLE_ATTR32, *PALPC_HANDLE_ATTR32;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_HANDLE_ATTR
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG Reserved0;
|
||||||
|
ULONG SameAccess;
|
||||||
|
ULONG SameAttributes;
|
||||||
|
ULONG Indirect;
|
||||||
|
ULONG Inherit;
|
||||||
|
ULONG Reserved1;
|
||||||
|
HANDLE Handle;
|
||||||
|
PALPC_HANDLE_ATTR32 HandleAttrArray;
|
||||||
|
ULONG ObjectType; // ObjectTypeCode, not ObjectTypeIndex
|
||||||
|
ULONG HandleCount;
|
||||||
|
ACCESS_MASK DesiredAccess;
|
||||||
|
ACCESS_MASK GrantedAccess;
|
||||||
|
} ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR;
|
||||||
|
|
||||||
|
#define ALPC_SECFLG_CREATE_HANDLE 0x20000 // dbg
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_SECURITY_ATTR
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
PSECURITY_QUALITY_OF_SERVICE QoS;
|
||||||
|
ALPC_HANDLE ContextHandle; // dbg
|
||||||
|
} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR;
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
#define ALPC_VIEWFLG_NOT_SECURE 0x40000
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_DATA_VIEW_ATTR
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ALPC_HANDLE SectionHandle;
|
||||||
|
PVOID ViewBase; // must be zero on input
|
||||||
|
SIZE_T ViewSize;
|
||||||
|
} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _ALPC_PORT_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
AlpcBasicInformation, // q: out ALPC_BASIC_INFORMATION
|
||||||
|
AlpcPortInformation, // s: in ALPC_PORT_ATTRIBUTES
|
||||||
|
AlpcAssociateCompletionPortInformation, // s: in ALPC_PORT_ASSOCIATE_COMPLETION_PORT
|
||||||
|
AlpcConnectedSIDInformation, // q: in SID
|
||||||
|
AlpcServerInformation, // q: inout ALPC_SERVER_INFORMATION
|
||||||
|
AlpcMessageZoneInformation, // s: in ALPC_PORT_MESSAGE_ZONE_INFORMATION
|
||||||
|
AlpcRegisterCompletionListInformation, // s: in ALPC_PORT_COMPLETION_LIST_INFORMATION
|
||||||
|
AlpcUnregisterCompletionListInformation, // s: VOID
|
||||||
|
AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
|
||||||
|
AlpcRegisterCallbackInformation, // kernel-mode only
|
||||||
|
AlpcCompletionListRundownInformation, // s: VOID
|
||||||
|
AlpcWaitForPortReferences
|
||||||
|
} ALPC_PORT_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG SequenceNo;
|
||||||
|
PVOID PortContext;
|
||||||
|
} ALPC_BASIC_INFORMATION, *PALPC_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_PORT_ASSOCIATE_COMPLETION_PORT
|
||||||
|
{
|
||||||
|
PVOID CompletionKey;
|
||||||
|
HANDLE CompletionPort;
|
||||||
|
} ALPC_PORT_ASSOCIATE_COMPLETION_PORT, *PALPC_PORT_ASSOCIATE_COMPLETION_PORT;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_SERVER_INFORMATION
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
HANDLE ThreadHandle;
|
||||||
|
} In;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
BOOLEAN ThreadBlocked;
|
||||||
|
HANDLE ConnectedProcessId;
|
||||||
|
UNICODE_STRING ConnectionPortName;
|
||||||
|
} Out;
|
||||||
|
};
|
||||||
|
} ALPC_SERVER_INFORMATION, *PALPC_SERVER_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_PORT_MESSAGE_ZONE_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID Buffer;
|
||||||
|
ULONG Size;
|
||||||
|
} ALPC_PORT_MESSAGE_ZONE_INFORMATION, *PALPC_PORT_MESSAGE_ZONE_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _ALPC_PORT_COMPLETION_LIST_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID Buffer; // PALPC_COMPLETION_LIST_HEADER
|
||||||
|
ULONG Size;
|
||||||
|
ULONG ConcurrencyCount;
|
||||||
|
ULONG AttributeFlags;
|
||||||
|
} ALPC_PORT_COMPLETION_LIST_INFORMATION, *PALPC_PORT_COMPLETION_LIST_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _ALPC_MESSAGE_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
AlpcMessageSidInformation, // q: out SID
|
||||||
|
AlpcMessageTokenModifiedIdInformation, // q: out LUID
|
||||||
|
AlpcMessageDirectStatusInformation,
|
||||||
|
AlpcMessageHandleInformation, // ALPC_MESSAGE_HANDLE_INFORMATION
|
||||||
|
MaxAlpcMessageInfoClass
|
||||||
|
} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _ALPC_MESSAGE_HANDLE_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Index;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG Handle;
|
||||||
|
ULONG ObjectType;
|
||||||
|
ACCESS_MASK GrantedAccess;
|
||||||
|
} ALPC_MESSAGE_HANDLE_INFORMATION, *PALPC_MESSAGE_HANDLE_INFORMATION;
|
||||||
|
|
||||||
|
// begin_private
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
// System calls
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCreatePort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcDisconnectPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcQueryInformation(
|
||||||
|
_In_opt_ HANDLE PortHandle,
|
||||||
|
_In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
|
||||||
|
_Inout_updates_bytes_to_(Length, *ReturnLength) PVOID PortInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcSetInformation(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
|
||||||
|
_In_reads_bytes_opt_(Length) PVOID PortInformation,
|
||||||
|
_In_ ULONG Length
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCreatePortSection(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ HANDLE SectionHandle,
|
||||||
|
_In_ SIZE_T SectionSize,
|
||||||
|
_Out_ PALPC_HANDLE AlpcSectionHandle,
|
||||||
|
_Out_ PSIZE_T ActualSectionSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcDeletePortSection(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ ALPC_HANDLE SectionHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCreateResourceReserve(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ SIZE_T MessageSize,
|
||||||
|
_Out_ PALPC_HANDLE ResourceId
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcDeleteResourceReserve(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ ALPC_HANDLE ResourceId
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCreateSectionView(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcDeleteSectionView(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ PVOID ViewBase
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCreateSecurityContext(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_Inout_ PALPC_SECURITY_ATTR SecurityAttribute
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcDeleteSecurityContext(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ ALPC_HANDLE ContextHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcRevokeSecurityContext(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Reserved_ ULONG Flags,
|
||||||
|
_In_ ALPC_HANDLE ContextHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcQueryInformationMessage(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE PortMessage,
|
||||||
|
_In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,
|
||||||
|
_Out_writes_bytes_to_opt_(Length, *ReturnLength) PVOID MessageInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#define ALPC_MSGFLG_REPLY_MESSAGE 0x1
|
||||||
|
#define ALPC_MSGFLG_LPC_MODE 0x2 // ?
|
||||||
|
#define ALPC_MSGFLG_RELEASE_MESSAGE 0x10000 // dbg
|
||||||
|
#define ALPC_MSGFLG_SYNC_REQUEST 0x20000 // dbg
|
||||||
|
#define ALPC_MSGFLG_WAIT_USER_MODE 0x100000
|
||||||
|
#define ALPC_MSGFLG_WAIT_ALERTABLE 0x200000
|
||||||
|
#define ALPC_MSGFLG_WOW64_CALL 0x80000000 // dbg
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcConnectPort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_ PUNICODE_STRING PortName,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ PSID RequiredServerSid,
|
||||||
|
_Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
|
||||||
|
_Inout_opt_ PULONG BufferLength,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcConnectPortEx(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,
|
||||||
|
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,
|
||||||
|
_Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
|
||||||
|
_Inout_opt_ PSIZE_T BufferLength,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcAcceptConnectPort(
|
||||||
|
_Out_ PHANDLE PortHandle,
|
||||||
|
_In_ HANDLE ConnectionPortHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
|
||||||
|
_In_opt_ PVOID PortContext,
|
||||||
|
_In_reads_bytes_(ConnectionRequest->u1.s1.TotalLength) PPORT_MESSAGE ConnectionRequest,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
|
||||||
|
_In_ BOOLEAN AcceptConnection
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcSendWaitReceivePort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
|
||||||
|
_Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ReceiveMessage,
|
||||||
|
_Inout_opt_ PSIZE_T BufferLength,
|
||||||
|
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
#define ALPC_CANCELFLG_TRY_CANCEL 0x1 // dbg
|
||||||
|
#define ALPC_CANCELFLG_NO_CONTEXT_CHECK 0x8
|
||||||
|
#define ALPC_CANCELFLGP_FLUSH 0x10000 // dbg
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcCancelMessage(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ PALPC_CONTEXT_ATTR MessageContext
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcImpersonateClientOfPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE Message,
|
||||||
|
_In_ PVOID Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcImpersonateClientContainerOfPort(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE Message,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcOpenSenderProcess(
|
||||||
|
_Out_ PHANDLE ProcessHandle,
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE PortMessage,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAlpcOpenSenderThread(
|
||||||
|
_Out_ PHANDLE ThreadHandle,
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ PPORT_MESSAGE PortMessage,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
// Support functions
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
ULONG
|
||||||
|
NTAPI
|
||||||
|
AlpcMaxAllowedMessageLength(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
ULONG
|
||||||
|
NTAPI
|
||||||
|
AlpcGetHeaderSize(
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
AlpcInitializeMessageAttribute(
|
||||||
|
_In_ ULONG AttributeFlags,
|
||||||
|
_Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,
|
||||||
|
_In_ ULONG BufferSize,
|
||||||
|
_Out_ PULONG RequiredBufferSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
PVOID
|
||||||
|
NTAPI
|
||||||
|
AlpcGetMessageAttribute(
|
||||||
|
_In_ PALPC_MESSAGE_ATTRIBUTES Buffer,
|
||||||
|
_In_ ULONG AttributeFlag
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
AlpcRegisterCompletionList(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_Out_ PALPC_COMPLETION_LIST_HEADER Buffer,
|
||||||
|
_In_ ULONG Size,
|
||||||
|
_In_ ULONG ConcurrencyCount,
|
||||||
|
_In_ ULONG AttributeFlags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
AlpcUnregisterCompletionList(
|
||||||
|
_In_ HANDLE PortHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
AlpcRundownCompletionList(
|
||||||
|
_In_ HANDLE PortHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
AlpcAdjustCompletionListConcurrencyCount(
|
||||||
|
_In_ HANDLE PortHandle,
|
||||||
|
_In_ ULONG ConcurrencyCount
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
BOOLEAN
|
||||||
|
NTAPI
|
||||||
|
AlpcRegisterCompletionListWorkerThread(
|
||||||
|
_Inout_ PVOID CompletionList
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
BOOLEAN
|
||||||
|
NTAPI
|
||||||
|
AlpcUnregisterCompletionListWorkerThread(
|
||||||
|
_Inout_ PVOID CompletionList
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
AlpcGetCompletionListLastMessageInformation(
|
||||||
|
_In_ PVOID CompletionList,
|
||||||
|
_Out_ PULONG LastMessageId,
|
||||||
|
_Out_ PULONG LastCallbackId
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
ULONG
|
||||||
|
NTAPI
|
||||||
|
AlpcGetOutstandingCompletionListMessageCount(
|
||||||
|
_In_ PVOID CompletionList
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
PPORT_MESSAGE
|
||||||
|
NTAPI
|
||||||
|
AlpcGetMessageFromCompletionList(
|
||||||
|
_In_ PVOID CompletionList,
|
||||||
|
_Out_opt_ PALPC_MESSAGE_ATTRIBUTES *MessageAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
AlpcFreeCompletionListMessage(
|
||||||
|
_Inout_ PVOID CompletionList,
|
||||||
|
_In_ PPORT_MESSAGE Message
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
PALPC_MESSAGE_ATTRIBUTES
|
||||||
|
NTAPI
|
||||||
|
AlpcGetCompletionListMessageAttributes(
|
||||||
|
_In_ PVOID CompletionList,
|
||||||
|
_In_ PPORT_MESSAGE Message
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// end_private
|
||||||
|
|
||||||
|
#endif
|
||||||
77
phnt/include/ntmisc.h
Normal file
77
phnt/include/ntmisc.h
Normal file
@@ -0,0 +1,77 @@
|
|||||||
|
#ifndef _NTMISC_H
|
||||||
|
#define _NTMISC_H
|
||||||
|
|
||||||
|
// Boot graphics
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDrawText(
|
||||||
|
_In_ PUNICODE_STRING Text
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Filter manager
|
||||||
|
|
||||||
|
#define FLT_PORT_CONNECT 0x0001
|
||||||
|
#define FLT_PORT_ALL_ACCESS (FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL)
|
||||||
|
|
||||||
|
// VDM
|
||||||
|
|
||||||
|
typedef enum _VDMSERVICECLASS
|
||||||
|
{
|
||||||
|
VdmStartExecution,
|
||||||
|
VdmQueueInterrupt,
|
||||||
|
VdmDelayInterrupt,
|
||||||
|
VdmInitialize,
|
||||||
|
VdmFeatures,
|
||||||
|
VdmSetInt21Handler,
|
||||||
|
VdmQueryDir,
|
||||||
|
VdmPrinterDirectIoOpen,
|
||||||
|
VdmPrinterDirectIoClose,
|
||||||
|
VdmPrinterInitialize,
|
||||||
|
VdmSetLdtEntries,
|
||||||
|
VdmSetProcessLdtInfo,
|
||||||
|
VdmAdlibEmulation,
|
||||||
|
VdmPMCliControl,
|
||||||
|
VdmQueryVdmProcess
|
||||||
|
} VDMSERVICECLASS, *PVDMSERVICECLASS;
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtVdmControl(
|
||||||
|
_In_ VDMSERVICECLASS Service,
|
||||||
|
_Inout_ PVOID ServiceData
|
||||||
|
);
|
||||||
|
|
||||||
|
// WMI/ETW
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtTraceEvent(
|
||||||
|
_In_ HANDLE TraceHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ ULONG FieldSize,
|
||||||
|
_In_ PVOID Fields
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtTraceControl(
|
||||||
|
_In_ ULONG FunctionCode,
|
||||||
|
_In_reads_bytes_opt_(InBufferLen) PVOID InBuffer,
|
||||||
|
_In_ ULONG InBufferLen,
|
||||||
|
_Out_writes_bytes_opt_(OutBufferLen) PVOID OutBuffer,
|
||||||
|
_In_ ULONG OutBufferLen,
|
||||||
|
_Out_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
859
phnt/include/ntmmapi.h
Normal file
859
phnt/include/ntmmapi.h
Normal file
@@ -0,0 +1,859 @@
|
|||||||
|
#ifndef _NTMMAPI_H
|
||||||
|
#define _NTMMAPI_H
|
||||||
|
|
||||||
|
#if (PHNT_MODE == PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
// Protection constants
|
||||||
|
|
||||||
|
#define PAGE_NOACCESS 0x01
|
||||||
|
#define PAGE_READONLY 0x02
|
||||||
|
#define PAGE_READWRITE 0x04
|
||||||
|
#define PAGE_WRITECOPY 0x08
|
||||||
|
#define PAGE_EXECUTE 0x10
|
||||||
|
#define PAGE_EXECUTE_READ 0x20
|
||||||
|
#define PAGE_EXECUTE_READWRITE 0x40
|
||||||
|
#define PAGE_EXECUTE_WRITECOPY 0x80
|
||||||
|
#define PAGE_GUARD 0x100
|
||||||
|
#define PAGE_NOCACHE 0x200
|
||||||
|
#define PAGE_WRITECOMBINE 0x400
|
||||||
|
|
||||||
|
#define PAGE_REVERT_TO_FILE_MAP 0x80000000
|
||||||
|
#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000
|
||||||
|
#define PAGE_TARGETS_NO_UPDATE 0x40000000
|
||||||
|
#define PAGE_TARGETS_INVALID 0x40000000
|
||||||
|
#define PAGE_ENCLAVE_UNVALIDATED 0x20000000
|
||||||
|
|
||||||
|
// Region and section constants
|
||||||
|
|
||||||
|
#define MEM_COMMIT 0x1000
|
||||||
|
#define MEM_RESERVE 0x2000
|
||||||
|
#define MEM_DECOMMIT 0x4000
|
||||||
|
#define MEM_RELEASE 0x8000
|
||||||
|
#define MEM_FREE 0x10000
|
||||||
|
#define MEM_PRIVATE 0x20000
|
||||||
|
#define MEM_MAPPED 0x40000
|
||||||
|
#define MEM_RESET 0x80000
|
||||||
|
#define MEM_TOP_DOWN 0x100000
|
||||||
|
#define MEM_WRITE_WATCH 0x200000
|
||||||
|
#define MEM_PHYSICAL 0x400000
|
||||||
|
#define MEM_ROTATE 0x800000
|
||||||
|
#define MEM_DIFFERENT_IMAGE_BASE_OK 0x800000
|
||||||
|
#define MEM_RESET_UNDO 0x1000000
|
||||||
|
#define MEM_LARGE_PAGES 0x20000000
|
||||||
|
#define MEM_4MB_PAGES 0x80000000
|
||||||
|
|
||||||
|
#define SEC_FILE 0x800000
|
||||||
|
#define SEC_IMAGE 0x1000000
|
||||||
|
#define SEC_PROTECTED_IMAGE 0x2000000
|
||||||
|
#define SEC_RESERVE 0x4000000
|
||||||
|
#define SEC_COMMIT 0x8000000
|
||||||
|
#define SEC_NOCACHE 0x10000000
|
||||||
|
#define SEC_WRITECOMBINE 0x40000000
|
||||||
|
#define SEC_LARGE_PAGES 0x80000000
|
||||||
|
#define SEC_IMAGE_NO_EXECUTE (SEC_IMAGE | SEC_NOCACHE)
|
||||||
|
#define MEM_IMAGE SEC_IMAGE
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _MEMORY_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
MemoryBasicInformation, // MEMORY_BASIC_INFORMATION
|
||||||
|
MemoryWorkingSetInformation, // MEMORY_WORKING_SET_INFORMATION
|
||||||
|
MemoryMappedFilenameInformation, // UNICODE_STRING
|
||||||
|
MemoryRegionInformation, // MEMORY_REGION_INFORMATION
|
||||||
|
MemoryWorkingSetExInformation, // MEMORY_WORKING_SET_EX_INFORMATION
|
||||||
|
MemorySharedCommitInformation, // MEMORY_SHARED_COMMIT_INFORMATION
|
||||||
|
MemoryImageInformation, // MEMORY_IMAGE_INFORMATION
|
||||||
|
MemoryRegionInformationEx,
|
||||||
|
MemoryPrivilegedBasicInformation
|
||||||
|
} MEMORY_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
#if (PHNT_MODE == PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
typedef struct _MEMORY_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID BaseAddress;
|
||||||
|
PVOID AllocationBase;
|
||||||
|
ULONG AllocationProtect;
|
||||||
|
SIZE_T RegionSize;
|
||||||
|
ULONG State;
|
||||||
|
ULONG Protect;
|
||||||
|
ULONG Type;
|
||||||
|
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef struct _MEMORY_WORKING_SET_BLOCK
|
||||||
|
{
|
||||||
|
ULONG_PTR Protection : 5;
|
||||||
|
ULONG_PTR ShareCount : 3;
|
||||||
|
ULONG_PTR Shared : 1;
|
||||||
|
ULONG_PTR Node : 3;
|
||||||
|
#ifdef _WIN64
|
||||||
|
ULONG_PTR VirtualPage : 52;
|
||||||
|
#else
|
||||||
|
ULONG VirtualPage : 20;
|
||||||
|
#endif
|
||||||
|
} MEMORY_WORKING_SET_BLOCK, *PMEMORY_WORKING_SET_BLOCK;
|
||||||
|
|
||||||
|
typedef struct _MEMORY_WORKING_SET_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG_PTR NumberOfEntries;
|
||||||
|
MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1];
|
||||||
|
} MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_REGION_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID AllocationBase;
|
||||||
|
ULONG AllocationProtect;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG RegionType;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG Private : 1;
|
||||||
|
ULONG MappedDataFile : 1;
|
||||||
|
ULONG MappedImage : 1;
|
||||||
|
ULONG MappedPageFile : 1;
|
||||||
|
ULONG MappedPhysical : 1;
|
||||||
|
ULONG DirectMapped : 1;
|
||||||
|
ULONG Reserved : 26;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
SIZE_T RegionSize;
|
||||||
|
SIZE_T CommitSize;
|
||||||
|
} MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_WORKING_SET_EX_BLOCK
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG_PTR Valid : 1;
|
||||||
|
ULONG_PTR ShareCount : 3;
|
||||||
|
ULONG_PTR Win32Protection : 11;
|
||||||
|
ULONG_PTR Shared : 1;
|
||||||
|
ULONG_PTR Node : 6;
|
||||||
|
ULONG_PTR Locked : 1;
|
||||||
|
ULONG_PTR LargePage : 1;
|
||||||
|
ULONG_PTR Priority : 3;
|
||||||
|
ULONG_PTR Reserved : 3;
|
||||||
|
ULONG_PTR SharedOriginal : 1;
|
||||||
|
ULONG_PTR Bad : 1;
|
||||||
|
#ifdef _WIN64
|
||||||
|
ULONG_PTR ReservedUlong : 32;
|
||||||
|
#endif
|
||||||
|
};
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG_PTR Valid : 1;
|
||||||
|
ULONG_PTR Reserved0 : 14;
|
||||||
|
ULONG_PTR Shared : 1;
|
||||||
|
ULONG_PTR Reserved1 : 5;
|
||||||
|
ULONG_PTR PageTable : 1;
|
||||||
|
ULONG_PTR Location : 2;
|
||||||
|
ULONG_PTR Priority : 3;
|
||||||
|
ULONG_PTR ModifiedList : 1;
|
||||||
|
ULONG_PTR Reserved2 : 2;
|
||||||
|
ULONG_PTR SharedOriginal : 1;
|
||||||
|
ULONG_PTR Bad : 1;
|
||||||
|
#ifdef _WIN64
|
||||||
|
ULONG_PTR ReservedUlong : 32;
|
||||||
|
#endif
|
||||||
|
} Invalid;
|
||||||
|
};
|
||||||
|
} MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_WORKING_SET_EX_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID VirtualAddress;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes;
|
||||||
|
ULONG_PTR Long;
|
||||||
|
} u1;
|
||||||
|
} MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_SHARED_COMMIT_INFORMATION
|
||||||
|
{
|
||||||
|
SIZE_T CommitSize;
|
||||||
|
} MEMORY_SHARED_COMMIT_INFORMATION, *PMEMORY_SHARED_COMMIT_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_IMAGE_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID ImageBase;
|
||||||
|
SIZE_T SizeOfImage;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG ImageFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG ImagePartialMap : 1;
|
||||||
|
ULONG ImageNotExecutable : 1;
|
||||||
|
ULONG Reserved : 30;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
} MEMORY_IMAGE_INFORMATION, *PMEMORY_IMAGE_INFORMATION;
|
||||||
|
|
||||||
|
#define MMPFNLIST_ZERO 0
|
||||||
|
#define MMPFNLIST_FREE 1
|
||||||
|
#define MMPFNLIST_STANDBY 2
|
||||||
|
#define MMPFNLIST_MODIFIED 3
|
||||||
|
#define MMPFNLIST_MODIFIEDNOWRITE 4
|
||||||
|
#define MMPFNLIST_BAD 5
|
||||||
|
#define MMPFNLIST_ACTIVE 6
|
||||||
|
#define MMPFNLIST_TRANSITION 7
|
||||||
|
|
||||||
|
#define MMPFNUSE_PROCESSPRIVATE 0
|
||||||
|
#define MMPFNUSE_FILE 1
|
||||||
|
#define MMPFNUSE_PAGEFILEMAPPED 2
|
||||||
|
#define MMPFNUSE_PAGETABLE 3
|
||||||
|
#define MMPFNUSE_PAGEDPOOL 4
|
||||||
|
#define MMPFNUSE_NONPAGEDPOOL 5
|
||||||
|
#define MMPFNUSE_SYSTEMPTE 6
|
||||||
|
#define MMPFNUSE_SESSIONPRIVATE 7
|
||||||
|
#define MMPFNUSE_METAFILE 8
|
||||||
|
#define MMPFNUSE_AWEPAGE 9
|
||||||
|
#define MMPFNUSE_DRIVERLOCKPAGE 10
|
||||||
|
#define MMPFNUSE_KERNELSTACK 11
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_FRAME_INFORMATION
|
||||||
|
{
|
||||||
|
ULONGLONG UseDescription : 4; // MMPFNUSE_*
|
||||||
|
ULONGLONG ListDescription : 3; // MMPFNLIST_*
|
||||||
|
ULONGLONG Reserved0 : 1; // reserved for future expansion
|
||||||
|
ULONGLONG Pinned : 1; // 1 - pinned, 0 - not pinned
|
||||||
|
ULONGLONG DontUse : 48; // *_INFORMATION overlay
|
||||||
|
ULONGLONG Priority : 3; // rev
|
||||||
|
ULONGLONG Reserved : 4; // reserved for future expansion
|
||||||
|
} MEMORY_FRAME_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _FILEOFFSET_INFORMATION
|
||||||
|
{
|
||||||
|
ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
|
||||||
|
ULONGLONG Offset : 48; // mapped files
|
||||||
|
ULONGLONG Reserved : 7; // reserved for future expansion
|
||||||
|
} FILEOFFSET_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _PAGEDIR_INFORMATION
|
||||||
|
{
|
||||||
|
ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
|
||||||
|
ULONGLONG PageDirectoryBase : 48; // private pages
|
||||||
|
ULONGLONG Reserved : 7; // reserved for future expansion
|
||||||
|
} PAGEDIR_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _UNIQUE_PROCESS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
|
||||||
|
ULONGLONG UniqueProcessKey : 48; // ProcessId
|
||||||
|
ULONGLONG Reserved : 7; // reserved for future expansion
|
||||||
|
} UNIQUE_PROCESS_INFORMATION, *PUNIQUE_PROCESS_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MMPFN_IDENTITY
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
MEMORY_FRAME_INFORMATION e1; // all
|
||||||
|
FILEOFFSET_INFORMATION e2; // mapped files
|
||||||
|
PAGEDIR_INFORMATION e3; // private pages
|
||||||
|
UNIQUE_PROCESS_INFORMATION e4; // owning process
|
||||||
|
} u1;
|
||||||
|
ULONG_PTR PageFrameIndex; // all
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG_PTR Image : 1;
|
||||||
|
ULONG_PTR Mismatch : 1;
|
||||||
|
} e1;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG_PTR CombinedPage;
|
||||||
|
} e2;
|
||||||
|
ULONG_PTR FileObject; // mapped files
|
||||||
|
ULONG_PTR UniqueFileObjectKey;
|
||||||
|
ULONG_PTR ProtoPteAddress;
|
||||||
|
ULONG_PTR VirtualAddress; // everything else
|
||||||
|
} u2;
|
||||||
|
} MMPFN_IDENTITY, *PMMPFN_IDENTITY;
|
||||||
|
|
||||||
|
typedef struct _MMPFN_MEMSNAP_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG_PTR InitialPageFrameIndex;
|
||||||
|
ULONG_PTR Count;
|
||||||
|
} MMPFN_MEMSNAP_INFORMATION, *PMMPFN_MEMSNAP_INFORMATION;
|
||||||
|
|
||||||
|
typedef enum _SECTION_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
SectionBasicInformation,
|
||||||
|
SectionImageInformation,
|
||||||
|
SectionRelocationInformation, // name:wow64:whNtQuerySection_SectionRelocationInformation
|
||||||
|
SectionOriginalBaseInformation, // PVOID BaseAddress
|
||||||
|
SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
|
||||||
|
MaxSectionInfoClass
|
||||||
|
} SECTION_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _SECTION_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID BaseAddress;
|
||||||
|
ULONG AllocationAttributes;
|
||||||
|
LARGE_INTEGER MaximumSize;
|
||||||
|
} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _SECTION_IMAGE_INFORMATION
|
||||||
|
{
|
||||||
|
PVOID TransferAddress;
|
||||||
|
ULONG ZeroBits;
|
||||||
|
SIZE_T MaximumStackSize;
|
||||||
|
SIZE_T CommittedStackSize;
|
||||||
|
ULONG SubSystemType;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT SubSystemMinorVersion;
|
||||||
|
USHORT SubSystemMajorVersion;
|
||||||
|
};
|
||||||
|
ULONG SubSystemVersion;
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT MajorOperatingSystemVersion;
|
||||||
|
USHORT MinorOperatingSystemVersion;
|
||||||
|
};
|
||||||
|
ULONG OperatingSystemVersion;
|
||||||
|
};
|
||||||
|
USHORT ImageCharacteristics;
|
||||||
|
USHORT DllCharacteristics;
|
||||||
|
USHORT Machine;
|
||||||
|
BOOLEAN ImageContainsCode;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
UCHAR ImageFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
UCHAR ComPlusNativeReady : 1;
|
||||||
|
UCHAR ComPlusILOnly : 1;
|
||||||
|
UCHAR ImageDynamicallyRelocated : 1;
|
||||||
|
UCHAR ImageMappedFlat : 1;
|
||||||
|
UCHAR BaseBelow4gb : 1;
|
||||||
|
UCHAR ComPlusPrefer32bit : 1;
|
||||||
|
UCHAR Reserved : 2;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
ULONG LoaderFlags;
|
||||||
|
ULONG ImageFileSize;
|
||||||
|
ULONG CheckSum;
|
||||||
|
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _SECTION_INTERNAL_IMAGE_INFORMATION
|
||||||
|
{
|
||||||
|
SECTION_IMAGE_INFORMATION SectionInformation;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG ExtendedFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG ImageReturnFlowGuardEnabled : 1;
|
||||||
|
ULONG ImageReturnFlowGuardStrict : 1;
|
||||||
|
ULONG ImageExportSuppressionEnabled : 1;
|
||||||
|
ULONG Reserved : 29;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
} SECTION_INTERNAL_IMAGE_INFORMATION, *PSECTION_INTERNAL_IMAGE_INFORMATION;
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
typedef enum _SECTION_INHERIT
|
||||||
|
{
|
||||||
|
ViewShare = 1,
|
||||||
|
ViewUnmap = 2
|
||||||
|
} SECTION_INHERIT;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define SEC_BASED 0x200000
|
||||||
|
#define SEC_NO_CHANGE 0x400000
|
||||||
|
#define SEC_GLOBAL 0x20000000
|
||||||
|
|
||||||
|
#define MEM_EXECUTE_OPTION_DISABLE 0x1
|
||||||
|
#define MEM_EXECUTE_OPTION_ENABLE 0x2
|
||||||
|
#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x4
|
||||||
|
#define MEM_EXECUTE_OPTION_PERMANENT 0x8
|
||||||
|
#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10
|
||||||
|
#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20
|
||||||
|
#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f
|
||||||
|
|
||||||
|
// Virtual memory
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAllocateVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
|
||||||
|
_In_ ULONG_PTR ZeroBits,
|
||||||
|
_Inout_ PSIZE_T RegionSize,
|
||||||
|
_In_ ULONG AllocationType,
|
||||||
|
_In_ ULONG Protect
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFreeVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PVOID *BaseAddress,
|
||||||
|
_Inout_ PSIZE_T RegionSize,
|
||||||
|
_In_ ULONG FreeType
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReadVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_opt_ PVOID BaseAddress,
|
||||||
|
_Out_writes_bytes_(BufferSize) PVOID Buffer,
|
||||||
|
_In_ SIZE_T BufferSize,
|
||||||
|
_Out_opt_ PSIZE_T NumberOfBytesRead
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWriteVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_opt_ PVOID BaseAddress,
|
||||||
|
_In_reads_bytes_(BufferSize) PVOID Buffer,
|
||||||
|
_In_ SIZE_T BufferSize,
|
||||||
|
_Out_opt_ PSIZE_T NumberOfBytesWritten
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtProtectVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PVOID *BaseAddress,
|
||||||
|
_Inout_ PSIZE_T RegionSize,
|
||||||
|
_In_ ULONG NewProtect,
|
||||||
|
_Out_ PULONG OldProtect
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ PVOID BaseAddress,
|
||||||
|
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
||||||
|
_Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
|
||||||
|
_In_ SIZE_T MemoryInformationLength,
|
||||||
|
_Out_opt_ PSIZE_T ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// begin_private
|
||||||
|
|
||||||
|
typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
VmPrefetchInformation,
|
||||||
|
VmPagePriorityInformation,
|
||||||
|
VmCfgCallTargetInformation
|
||||||
|
} VIRTUAL_MEMORY_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _MEMORY_RANGE_ENTRY
|
||||||
|
{
|
||||||
|
PVOID VirtualAddress;
|
||||||
|
SIZE_T NumberOfBytes;
|
||||||
|
} MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY;
|
||||||
|
|
||||||
|
// end_private
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass,
|
||||||
|
_In_ ULONG_PTR NumberOfEntries,
|
||||||
|
_In_reads_ (NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses,
|
||||||
|
_In_reads_bytes_ (VmInformationLength) PVOID VmInformation,
|
||||||
|
_In_ ULONG VmInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLockVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PVOID *BaseAddress,
|
||||||
|
_Inout_ PSIZE_T RegionSize,
|
||||||
|
_In_ ULONG MapType
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnlockVirtualMemory(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PVOID *BaseAddress,
|
||||||
|
_Inout_ PSIZE_T RegionSize,
|
||||||
|
_In_ ULONG MapType
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Sections
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateSection(
|
||||||
|
_Out_ PHANDLE SectionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PLARGE_INTEGER MaximumSize,
|
||||||
|
_In_ ULONG SectionPageProtection,
|
||||||
|
_In_ ULONG AllocationAttributes,
|
||||||
|
_In_opt_ HANDLE FileHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenSection(
|
||||||
|
_Out_ PHANDLE SectionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtMapViewOfSection(
|
||||||
|
_In_ HANDLE SectionHandle,
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress,
|
||||||
|
_In_ ULONG_PTR ZeroBits,
|
||||||
|
_In_ SIZE_T CommitSize,
|
||||||
|
_Inout_opt_ PLARGE_INTEGER SectionOffset,
|
||||||
|
_Inout_ PSIZE_T ViewSize,
|
||||||
|
_In_ SECTION_INHERIT InheritDisposition,
|
||||||
|
_In_ ULONG AllocationType,
|
||||||
|
_In_ ULONG Win32Protect
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnmapViewOfSection(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_opt_ PVOID BaseAddress
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnmapViewOfSectionEx(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_opt_ PVOID BaseAddress,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtExtendSection(
|
||||||
|
_In_ HANDLE SectionHandle,
|
||||||
|
_Inout_ PLARGE_INTEGER NewSectionSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQuerySection(
|
||||||
|
_In_ HANDLE SectionHandle,
|
||||||
|
_In_ SECTION_INFORMATION_CLASS SectionInformationClass,
|
||||||
|
_Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation,
|
||||||
|
_In_ SIZE_T SectionInformationLength,
|
||||||
|
_Out_opt_ PSIZE_T ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAreMappedFilesTheSame(
|
||||||
|
_In_ PVOID File1MappedAsAnImage,
|
||||||
|
_In_ PVOID File2MappedAsFile
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Partitions
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _MEMORY_PARTITION_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
SystemMemoryPartitionInformation, // q: MEMORY_PARTITION_CONFIGURATION_INFORMATION
|
||||||
|
SystemMemoryPartitionMoveMemory, // s: MEMORY_PARTITION_TRANSFER_INFORMATION
|
||||||
|
SystemMemoryPartitionAddPagefile, // s: MEMORY_PARTITION_PAGEFILE_INFORMATION
|
||||||
|
SystemMemoryPartitionCombineMemory, // q; s: MEMORY_PARTITION_PAGE_COMBINE_INFORMATION
|
||||||
|
SystemMemoryPartitionInitialAddMemory, // q; s: MEMORY_PARTITION_INITIAL_ADD_INFORMATION
|
||||||
|
SystemMemoryPartitionGetMemoryEvents // MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION // since REDSTONE2
|
||||||
|
} MEMORY_PARTITION_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_CONFIGURATION_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG NumaNode;
|
||||||
|
ULONG Channel;
|
||||||
|
ULONG NumberOfNumaNodes;
|
||||||
|
ULONG_PTR ResidentAvailablePages;
|
||||||
|
ULONG_PTR CommittedPages;
|
||||||
|
ULONG_PTR CommitLimit;
|
||||||
|
ULONG_PTR PeakCommitment;
|
||||||
|
ULONG_PTR TotalNumberOfPages;
|
||||||
|
ULONG_PTR AvailablePages;
|
||||||
|
ULONG_PTR ZeroPages;
|
||||||
|
ULONG_PTR FreePages;
|
||||||
|
ULONG_PTR StandbyPages;
|
||||||
|
ULONG StandbyPageCountByPriority[8]; // since REDSTONE2
|
||||||
|
ULONG RepurposedPagesByPriority[8];
|
||||||
|
ULONG MaximumCommitLimit;
|
||||||
|
ULONG DonatedPagesToPartitions;
|
||||||
|
} MEMORY_PARTITION_CONFIGURATION_INFORMATION, *PMEMORY_PARTITION_CONFIGURATION_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_TRANSFER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG_PTR NumberOfPages;
|
||||||
|
ULONG NumaNode;
|
||||||
|
ULONG Flags;
|
||||||
|
} MEMORY_PARTITION_TRANSFER_INFORMATION, *PMEMORY_PARTITION_TRANSFER_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_PAGEFILE_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING PageFileName;
|
||||||
|
LARGE_INTEGER MinimumSize;
|
||||||
|
LARGE_INTEGER MaximumSize;
|
||||||
|
ULONG Flags;
|
||||||
|
} MEMORY_PARTITION_PAGEFILE_INFORMATION, *PMEMORY_PARTITION_PAGEFILE_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION
|
||||||
|
{
|
||||||
|
HANDLE StopHandle;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG_PTR TotalNumberOfPages;
|
||||||
|
} MEMORY_PARTITION_PAGE_COMBINE_INFORMATION, *PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_PAGE_RANGE
|
||||||
|
{
|
||||||
|
ULONG_PTR StartPage;
|
||||||
|
ULONG_PTR NumberOfPages;
|
||||||
|
} MEMORY_PARTITION_PAGE_RANGE, *PMEMORY_PARTITION_PAGE_RANGE;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_INITIAL_ADD_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG NumberOfRanges;
|
||||||
|
ULONG_PTR NumberOfPagesAdded;
|
||||||
|
MEMORY_PARTITION_PAGE_RANGE PartitionRanges[1];
|
||||||
|
} MEMORY_PARTITION_INITIAL_ADD_INFORMATION, *PMEMORY_PARTITION_INITIAL_ADD_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG CommitEvents : 1;
|
||||||
|
ULONG Spare : 31;
|
||||||
|
};
|
||||||
|
ULONG AllFlags;
|
||||||
|
};
|
||||||
|
} MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION, *PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION;
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreatePartition(
|
||||||
|
_Out_ PHANDLE PartitionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG PreferredNode
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenPartition(
|
||||||
|
_Out_ PHANDLE PartitionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtManagePartition(
|
||||||
|
_In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,
|
||||||
|
_In_ PVOID PartitionInformation,
|
||||||
|
_In_ ULONG PartitionInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// User physical pages
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtMapUserPhysicalPages(
|
||||||
|
_In_ PVOID VirtualAddress,
|
||||||
|
_In_ ULONG_PTR NumberOfPages,
|
||||||
|
_In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtMapUserPhysicalPagesScatter(
|
||||||
|
_In_reads_(NumberOfPages) PVOID *VirtualAddresses,
|
||||||
|
_In_ ULONG_PTR NumberOfPages,
|
||||||
|
_In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAllocateUserPhysicalPages(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PULONG_PTR NumberOfPages,
|
||||||
|
_Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFreeUserPhysicalPages(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_Inout_ PULONG_PTR NumberOfPages,
|
||||||
|
_In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Sessions
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenSession(
|
||||||
|
_Out_ PHANDLE SessionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Misc.
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtGetWriteWatch(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ PVOID BaseAddress,
|
||||||
|
_In_ SIZE_T RegionSize,
|
||||||
|
_Out_writes_(*EntriesInUserAddressArray) PVOID *UserAddressArray,
|
||||||
|
_Inout_ PULONG_PTR EntriesInUserAddressArray,
|
||||||
|
_Out_ PULONG Granularity
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtResetWriteWatch(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ PVOID BaseAddress,
|
||||||
|
_In_ SIZE_T RegionSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreatePagingFile(
|
||||||
|
_In_ PUNICODE_STRING PageFileName,
|
||||||
|
_In_ PLARGE_INTEGER MinimumSize,
|
||||||
|
_In_ PLARGE_INTEGER MaximumSize,
|
||||||
|
_In_ ULONG Priority
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFlushInstructionCache(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_opt_ PVOID BaseAddress,
|
||||||
|
_In_ SIZE_T Length
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFlushWriteBuffer(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
30
phnt/include/ntnls.h
Normal file
30
phnt/include/ntnls.h
Normal file
@@ -0,0 +1,30 @@
|
|||||||
|
#ifndef _NTNLS_H
|
||||||
|
#define _NTNLS_H
|
||||||
|
|
||||||
|
#define MAXIMUM_LEADBYTES 12
|
||||||
|
|
||||||
|
typedef struct _CPTABLEINFO
|
||||||
|
{
|
||||||
|
USHORT CodePage;
|
||||||
|
USHORT MaximumCharacterSize;
|
||||||
|
USHORT DefaultChar;
|
||||||
|
USHORT UniDefaultChar;
|
||||||
|
USHORT TransDefaultChar;
|
||||||
|
USHORT TransUniDefaultChar;
|
||||||
|
USHORT DBCSCodePage;
|
||||||
|
UCHAR LeadByte[MAXIMUM_LEADBYTES];
|
||||||
|
PUSHORT MultiByteTable;
|
||||||
|
PVOID WideCharTable;
|
||||||
|
PUSHORT DBCSRanges;
|
||||||
|
PUSHORT DBCSOffsets;
|
||||||
|
} CPTABLEINFO, *PCPTABLEINFO;
|
||||||
|
|
||||||
|
typedef struct _NLSTABLEINFO
|
||||||
|
{
|
||||||
|
CPTABLEINFO OemTableInfo;
|
||||||
|
CPTABLEINFO AnsiTableInfo;
|
||||||
|
PUSHORT UpperCaseTable;
|
||||||
|
PUSHORT LowerCaseTable;
|
||||||
|
} NLSTABLEINFO, *PNLSTABLEINFO;
|
||||||
|
|
||||||
|
#endif
|
||||||
372
phnt/include/ntobapi.h
Normal file
372
phnt/include/ntobapi.h
Normal file
@@ -0,0 +1,372 @@
|
|||||||
|
#ifndef _NTOBAPI_H
|
||||||
|
#define _NTOBAPI_H
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#define OBJECT_TYPE_CREATE 0x0001
|
||||||
|
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#define DIRECTORY_QUERY 0x0001
|
||||||
|
#define DIRECTORY_TRAVERSE 0x0002
|
||||||
|
#define DIRECTORY_CREATE_OBJECT 0x0004
|
||||||
|
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
|
||||||
|
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#define SYMBOLIC_LINK_QUERY 0x0001
|
||||||
|
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define OBJ_PROTECT_CLOSE 0x00000001
|
||||||
|
#ifndef OBJ_INHERIT
|
||||||
|
#define OBJ_INHERIT 0x00000002
|
||||||
|
#endif
|
||||||
|
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
typedef enum _OBJECT_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
ObjectBasicInformation, // OBJECT_BASIC_INFORMATION
|
||||||
|
ObjectNameInformation, // OBJECT_NAME_INFORMATION
|
||||||
|
ObjectTypeInformation, // OBJECT_TYPE_INFORMATION
|
||||||
|
ObjectTypesInformation, // OBJECT_TYPES_INFORMATION
|
||||||
|
ObjectHandleFlagInformation, // OBJECT_HANDLE_FLAG_INFORMATION
|
||||||
|
ObjectSessionInformation,
|
||||||
|
ObjectSessionObjectInformation,
|
||||||
|
MaxObjectInfoClass
|
||||||
|
} OBJECT_INFORMATION_CLASS;
|
||||||
|
#else
|
||||||
|
#define ObjectNameInformation 1
|
||||||
|
#define ObjectTypesInformation 3
|
||||||
|
#define ObjectHandleFlagInformation 4
|
||||||
|
#define ObjectSessionInformation 5
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef struct _OBJECT_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Attributes;
|
||||||
|
ACCESS_MASK GrantedAccess;
|
||||||
|
ULONG HandleCount;
|
||||||
|
ULONG PointerCount;
|
||||||
|
ULONG PagedPoolCharge;
|
||||||
|
ULONG NonPagedPoolCharge;
|
||||||
|
ULONG Reserved[3];
|
||||||
|
ULONG NameInfoSize;
|
||||||
|
ULONG TypeInfoSize;
|
||||||
|
ULONG SecurityDescriptorSize;
|
||||||
|
LARGE_INTEGER CreationTime;
|
||||||
|
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
typedef struct _OBJECT_NAME_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING Name;
|
||||||
|
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef struct _OBJECT_TYPE_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING TypeName;
|
||||||
|
ULONG TotalNumberOfObjects;
|
||||||
|
ULONG TotalNumberOfHandles;
|
||||||
|
ULONG TotalPagedPoolUsage;
|
||||||
|
ULONG TotalNonPagedPoolUsage;
|
||||||
|
ULONG TotalNamePoolUsage;
|
||||||
|
ULONG TotalHandleTableUsage;
|
||||||
|
ULONG HighWaterNumberOfObjects;
|
||||||
|
ULONG HighWaterNumberOfHandles;
|
||||||
|
ULONG HighWaterPagedPoolUsage;
|
||||||
|
ULONG HighWaterNonPagedPoolUsage;
|
||||||
|
ULONG HighWaterNamePoolUsage;
|
||||||
|
ULONG HighWaterHandleTableUsage;
|
||||||
|
ULONG InvalidAttributes;
|
||||||
|
GENERIC_MAPPING GenericMapping;
|
||||||
|
ULONG ValidAccessMask;
|
||||||
|
BOOLEAN SecurityRequired;
|
||||||
|
BOOLEAN MaintainHandleCount;
|
||||||
|
UCHAR TypeIndex; // since WINBLUE
|
||||||
|
CHAR ReservedByte;
|
||||||
|
ULONG PoolType;
|
||||||
|
ULONG DefaultPagedPoolCharge;
|
||||||
|
ULONG DefaultNonPagedPoolCharge;
|
||||||
|
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_TYPES_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NumberOfTypes;
|
||||||
|
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
|
||||||
|
{
|
||||||
|
BOOLEAN Inherit;
|
||||||
|
BOOLEAN ProtectFromClose;
|
||||||
|
} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;
|
||||||
|
|
||||||
|
// Objects, handles
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryObject(
|
||||||
|
_In_ HANDLE Handle,
|
||||||
|
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||||
|
_Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
|
||||||
|
_In_ ULONG ObjectInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationObject(
|
||||||
|
_In_ HANDLE Handle,
|
||||||
|
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||||
|
_In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation,
|
||||||
|
_In_ ULONG ObjectInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#define DUPLICATE_CLOSE_SOURCE 0x00000001
|
||||||
|
#define DUPLICATE_SAME_ACCESS 0x00000002
|
||||||
|
#define DUPLICATE_SAME_ATTRIBUTES 0x00000004
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDuplicateObject(
|
||||||
|
_In_ HANDLE SourceProcessHandle,
|
||||||
|
_In_ HANDLE SourceHandle,
|
||||||
|
_In_opt_ HANDLE TargetProcessHandle,
|
||||||
|
_Out_opt_ PHANDLE TargetHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ ULONG HandleAttributes,
|
||||||
|
_In_ ULONG Options
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtMakeTemporaryObject(
|
||||||
|
_In_ HANDLE Handle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtMakePermanentObject(
|
||||||
|
_In_ HANDLE Handle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSignalAndWaitForSingleObject(
|
||||||
|
_In_ HANDLE SignalHandle,
|
||||||
|
_In_ HANDLE WaitHandle,
|
||||||
|
_In_ BOOLEAN Alertable,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWaitForSingleObject(
|
||||||
|
_In_ HANDLE Handle,
|
||||||
|
_In_ BOOLEAN Alertable,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWaitForMultipleObjects(
|
||||||
|
_In_ ULONG Count,
|
||||||
|
_In_reads_(Count) HANDLE Handles[],
|
||||||
|
_In_ WAIT_TYPE WaitType,
|
||||||
|
_In_ BOOLEAN Alertable,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WS03)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtWaitForMultipleObjects32(
|
||||||
|
_In_ ULONG Count,
|
||||||
|
_In_reads_(Count) LONG Handles[],
|
||||||
|
_In_ WAIT_TYPE WaitType,
|
||||||
|
_In_ BOOLEAN Alertable,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetSecurityObject(
|
||||||
|
_In_ HANDLE Handle,
|
||||||
|
_In_ SECURITY_INFORMATION SecurityInformation,
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQuerySecurityObject(
|
||||||
|
_In_ HANDLE Handle,
|
||||||
|
_In_ SECURITY_INFORMATION SecurityInformation,
|
||||||
|
_Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG LengthNeeded
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtClose(
|
||||||
|
_In_ HANDLE Handle
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCompareObjects(
|
||||||
|
_In_ HANDLE FirstObjectHandle,
|
||||||
|
_In_ HANDLE SecondObjectHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Directory objects
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateDirectoryObject(
|
||||||
|
_Out_ PHANDLE DirectoryHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateDirectoryObjectEx(
|
||||||
|
_Out_ PHANDLE DirectoryHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ HANDLE ShadowDirectoryHandle,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenDirectoryObject(
|
||||||
|
_Out_ PHANDLE DirectoryHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef struct _OBJECT_DIRECTORY_INFORMATION
|
||||||
|
{
|
||||||
|
UNICODE_STRING Name;
|
||||||
|
UNICODE_STRING TypeName;
|
||||||
|
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryDirectoryObject(
|
||||||
|
_In_ HANDLE DirectoryHandle,
|
||||||
|
_Out_writes_bytes_opt_(Length) PVOID Buffer,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_In_ BOOLEAN ReturnSingleEntry,
|
||||||
|
_In_ BOOLEAN RestartScan,
|
||||||
|
_Inout_ PULONG Context,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Private namespaces
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreatePrivateNamespace(
|
||||||
|
_Out_ PHANDLE NamespaceHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ PVOID BoundaryDescriptor
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenPrivateNamespace(
|
||||||
|
_Out_ PHANDLE NamespaceHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ PVOID BoundaryDescriptor
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDeletePrivateNamespace(
|
||||||
|
_In_ HANDLE NamespaceHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Symbolic links
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateSymbolicLinkObject(
|
||||||
|
_Out_ PHANDLE LinkHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ PUNICODE_STRING LinkTarget
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenSymbolicLinkObject(
|
||||||
|
_Out_ PHANDLE LinkHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQuerySymbolicLinkObject(
|
||||||
|
_In_ HANDLE LinkHandle,
|
||||||
|
_Inout_ PUNICODE_STRING LinkTarget,
|
||||||
|
_Out_opt_ PULONG ReturnedLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
324
phnt/include/ntpebteb.h
Normal file
324
phnt/include/ntpebteb.h
Normal file
@@ -0,0 +1,324 @@
|
|||||||
|
#ifndef _NTPEBTEB_H
|
||||||
|
#define _NTPEBTEB_H
|
||||||
|
|
||||||
|
typedef struct _RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
|
||||||
|
typedef struct _RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
|
||||||
|
|
||||||
|
// symbols
|
||||||
|
typedef struct _PEB
|
||||||
|
{
|
||||||
|
BOOLEAN InheritedAddressSpace;
|
||||||
|
BOOLEAN ReadImageFileExecOptions;
|
||||||
|
BOOLEAN BeingDebugged;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
BOOLEAN BitField;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
BOOLEAN ImageUsesLargePages : 1;
|
||||||
|
BOOLEAN IsProtectedProcess : 1;
|
||||||
|
BOOLEAN IsImageDynamicallyRelocated : 1;
|
||||||
|
BOOLEAN SkipPatchingUser32Forwarders : 1;
|
||||||
|
BOOLEAN IsPackagedProcess : 1;
|
||||||
|
BOOLEAN IsAppContainer : 1;
|
||||||
|
BOOLEAN IsProtectedProcessLight : 1;
|
||||||
|
BOOLEAN IsLongPathAwareProcess : 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
HANDLE Mutant;
|
||||||
|
|
||||||
|
PVOID ImageBaseAddress;
|
||||||
|
PPEB_LDR_DATA Ldr;
|
||||||
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
||||||
|
PVOID SubSystemData;
|
||||||
|
PVOID ProcessHeap;
|
||||||
|
PRTL_CRITICAL_SECTION FastPebLock;
|
||||||
|
PVOID AtlThunkSListPtr;
|
||||||
|
PVOID IFEOKey;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG CrossProcessFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG ProcessInJob : 1;
|
||||||
|
ULONG ProcessInitializing : 1;
|
||||||
|
ULONG ProcessUsingVEH : 1;
|
||||||
|
ULONG ProcessUsingVCH : 1;
|
||||||
|
ULONG ProcessUsingFTH : 1;
|
||||||
|
ULONG ProcessPreviouslyThrottled : 1;
|
||||||
|
ULONG ProcessCurrentlyThrottled : 1;
|
||||||
|
ULONG ReservedBits0 : 25;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PVOID KernelCallbackTable;
|
||||||
|
PVOID UserSharedInfoPtr;
|
||||||
|
};
|
||||||
|
ULONG SystemReserved[1];
|
||||||
|
ULONG AtlThunkSListPtr32;
|
||||||
|
PVOID ApiSetMap;
|
||||||
|
ULONG TlsExpansionCounter;
|
||||||
|
PVOID TlsBitmap;
|
||||||
|
ULONG TlsBitmapBits[2];
|
||||||
|
PVOID ReadOnlySharedMemoryBase;
|
||||||
|
PVOID HotpatchInformation;
|
||||||
|
PVOID *ReadOnlyStaticServerData;
|
||||||
|
PVOID AnsiCodePageData; // PCPTABLEINFO
|
||||||
|
PVOID OemCodePageData; // PCPTABLEINFO
|
||||||
|
PVOID UnicodeCaseTableData; // PNLSTABLEINFO
|
||||||
|
|
||||||
|
ULONG NumberOfProcessors;
|
||||||
|
ULONG NtGlobalFlag;
|
||||||
|
|
||||||
|
LARGE_INTEGER CriticalSectionTimeout;
|
||||||
|
SIZE_T HeapSegmentReserve;
|
||||||
|
SIZE_T HeapSegmentCommit;
|
||||||
|
SIZE_T HeapDeCommitTotalFreeThreshold;
|
||||||
|
SIZE_T HeapDeCommitFreeBlockThreshold;
|
||||||
|
|
||||||
|
ULONG NumberOfHeaps;
|
||||||
|
ULONG MaximumNumberOfHeaps;
|
||||||
|
PVOID *ProcessHeaps; // PHEAP
|
||||||
|
|
||||||
|
PVOID GdiSharedHandleTable;
|
||||||
|
PVOID ProcessStarterHelper;
|
||||||
|
ULONG GdiDCAttributeList;
|
||||||
|
|
||||||
|
PRTL_CRITICAL_SECTION LoaderLock;
|
||||||
|
|
||||||
|
ULONG OSMajorVersion;
|
||||||
|
ULONG OSMinorVersion;
|
||||||
|
USHORT OSBuildNumber;
|
||||||
|
USHORT OSCSDVersion;
|
||||||
|
ULONG OSPlatformId;
|
||||||
|
ULONG ImageSubsystem;
|
||||||
|
ULONG ImageSubsystemMajorVersion;
|
||||||
|
ULONG ImageSubsystemMinorVersion;
|
||||||
|
ULONG_PTR ActiveProcessAffinityMask;
|
||||||
|
GDI_HANDLE_BUFFER GdiHandleBuffer;
|
||||||
|
PVOID PostProcessInitRoutine;
|
||||||
|
|
||||||
|
PVOID TlsExpansionBitmap;
|
||||||
|
ULONG TlsExpansionBitmapBits[32];
|
||||||
|
|
||||||
|
ULONG SessionId;
|
||||||
|
|
||||||
|
ULARGE_INTEGER AppCompatFlags;
|
||||||
|
ULARGE_INTEGER AppCompatFlagsUser;
|
||||||
|
PVOID pShimData;
|
||||||
|
PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA
|
||||||
|
|
||||||
|
UNICODE_STRING CSDVersion;
|
||||||
|
|
||||||
|
PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA
|
||||||
|
PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
|
||||||
|
PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA
|
||||||
|
PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
|
||||||
|
|
||||||
|
SIZE_T MinimumStackCommit;
|
||||||
|
|
||||||
|
PVOID *FlsCallback;
|
||||||
|
LIST_ENTRY FlsListHead;
|
||||||
|
PVOID FlsBitmap;
|
||||||
|
ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
|
||||||
|
ULONG FlsHighIndex;
|
||||||
|
|
||||||
|
PVOID WerRegistrationData;
|
||||||
|
PVOID WerShipAssertPtr;
|
||||||
|
PVOID pContextData;
|
||||||
|
PVOID pImageHeaderHash;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG TracingFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG HeapTracingEnabled : 1;
|
||||||
|
ULONG CritSecTracingEnabled : 1;
|
||||||
|
ULONG LibLoaderTracingEnabled : 1;
|
||||||
|
ULONG SpareTracingBits : 29;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
ULONGLONG CsrServerReadOnlySharedMemoryBase;
|
||||||
|
PVOID TppWorkerpListLock;
|
||||||
|
LIST_ENTRY TppWorkerpList;
|
||||||
|
PVOID WaitOnAddressHashTable[128];
|
||||||
|
} PEB, *PPEB;
|
||||||
|
|
||||||
|
#define GDI_BATCH_BUFFER_SIZE 310
|
||||||
|
|
||||||
|
typedef struct _GDI_TEB_BATCH
|
||||||
|
{
|
||||||
|
ULONG Offset;
|
||||||
|
ULONG_PTR HDC;
|
||||||
|
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
|
||||||
|
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;
|
||||||
|
|
||||||
|
typedef struct _TEB_ACTIVE_FRAME_CONTEXT
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
PSTR FrameName;
|
||||||
|
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
|
||||||
|
|
||||||
|
typedef struct _TEB_ACTIVE_FRAME
|
||||||
|
{
|
||||||
|
ULONG Flags;
|
||||||
|
struct _TEB_ACTIVE_FRAME *Previous;
|
||||||
|
PTEB_ACTIVE_FRAME_CONTEXT Context;
|
||||||
|
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
|
||||||
|
|
||||||
|
typedef struct _TEB
|
||||||
|
{
|
||||||
|
NT_TIB NtTib;
|
||||||
|
|
||||||
|
PVOID EnvironmentPointer;
|
||||||
|
CLIENT_ID ClientId;
|
||||||
|
PVOID ActiveRpcHandle;
|
||||||
|
PVOID ThreadLocalStoragePointer;
|
||||||
|
PPEB ProcessEnvironmentBlock;
|
||||||
|
|
||||||
|
ULONG LastErrorValue;
|
||||||
|
ULONG CountOfOwnedCriticalSections;
|
||||||
|
PVOID CsrClientThread;
|
||||||
|
PVOID Win32ThreadInfo;
|
||||||
|
ULONG User32Reserved[26];
|
||||||
|
ULONG UserReserved[5];
|
||||||
|
PVOID WOW32Reserved;
|
||||||
|
LCID CurrentLocale;
|
||||||
|
ULONG FpSoftwareStatusRegister;
|
||||||
|
PVOID ReservedForDebuggerInstrumentation[16];
|
||||||
|
PVOID SystemReserved1[37];
|
||||||
|
UCHAR WorkingOnBehalfTicket[8];
|
||||||
|
NTSTATUS ExceptionCode;
|
||||||
|
|
||||||
|
PVOID ActivationContextStackPointer;
|
||||||
|
ULONG_PTR InstrumentationCallbackSp;
|
||||||
|
ULONG_PTR InstrumentationCallbackPreviousPc;
|
||||||
|
ULONG_PTR InstrumentationCallbackPreviousSp;
|
||||||
|
ULONG TxFsContext;
|
||||||
|
|
||||||
|
BOOLEAN InstrumentationCallbackDisabled;
|
||||||
|
GDI_TEB_BATCH GdiTebBatch;
|
||||||
|
CLIENT_ID RealClientId;
|
||||||
|
HANDLE GdiCachedProcessHandle;
|
||||||
|
ULONG GdiClientPID;
|
||||||
|
ULONG GdiClientTID;
|
||||||
|
PVOID GdiThreadLocalInfo;
|
||||||
|
ULONG_PTR Win32ClientInfo[62];
|
||||||
|
PVOID glDispatchTable[233];
|
||||||
|
ULONG_PTR glReserved1[29];
|
||||||
|
PVOID glReserved2;
|
||||||
|
PVOID glSectionInfo;
|
||||||
|
PVOID glSection;
|
||||||
|
PVOID glTable;
|
||||||
|
PVOID glCurrentRC;
|
||||||
|
PVOID glContext;
|
||||||
|
|
||||||
|
NTSTATUS LastStatusValue;
|
||||||
|
UNICODE_STRING StaticUnicodeString;
|
||||||
|
WCHAR StaticUnicodeBuffer[261];
|
||||||
|
|
||||||
|
PVOID DeallocationStack;
|
||||||
|
PVOID TlsSlots[64];
|
||||||
|
LIST_ENTRY TlsLinks;
|
||||||
|
|
||||||
|
PVOID Vdm;
|
||||||
|
PVOID ReservedForNtRpc;
|
||||||
|
PVOID DbgSsReserved[2];
|
||||||
|
|
||||||
|
ULONG HardErrorMode;
|
||||||
|
#ifdef _WIN64
|
||||||
|
PVOID Instrumentation[11];
|
||||||
|
#else
|
||||||
|
PVOID Instrumentation[9];
|
||||||
|
#endif
|
||||||
|
GUID ActivityId;
|
||||||
|
|
||||||
|
PVOID SubProcessTag;
|
||||||
|
PVOID PerflibData;
|
||||||
|
PVOID EtwTraceData;
|
||||||
|
PVOID WinSockData;
|
||||||
|
ULONG GdiBatchCount;
|
||||||
|
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PROCESSOR_NUMBER CurrentIdealProcessor;
|
||||||
|
ULONG IdealProcessorValue;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
UCHAR ReservedPad0;
|
||||||
|
UCHAR ReservedPad1;
|
||||||
|
UCHAR ReservedPad2;
|
||||||
|
UCHAR IdealProcessor;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
ULONG GuaranteedStackBytes;
|
||||||
|
PVOID ReservedForPerf;
|
||||||
|
PVOID ReservedForOle;
|
||||||
|
ULONG WaitingOnLoaderLock;
|
||||||
|
PVOID SavedPriorityState;
|
||||||
|
ULONG_PTR ReservedForCodeCoverage;
|
||||||
|
PVOID ThreadPoolData;
|
||||||
|
PVOID *TlsExpansionSlots;
|
||||||
|
#ifdef _WIN64
|
||||||
|
PVOID DeallocationBStore;
|
||||||
|
PVOID BStoreLimit;
|
||||||
|
#endif
|
||||||
|
ULONG MuiGeneration;
|
||||||
|
ULONG IsImpersonating;
|
||||||
|
PVOID NlsCache;
|
||||||
|
PVOID pShimData;
|
||||||
|
USHORT HeapVirtualAffinity;
|
||||||
|
USHORT LowFragHeapDataSlot;
|
||||||
|
HANDLE CurrentTransactionHandle;
|
||||||
|
PTEB_ACTIVE_FRAME ActiveFrame;
|
||||||
|
PVOID FlsData;
|
||||||
|
|
||||||
|
PVOID PreferredLanguages;
|
||||||
|
PVOID UserPrefLanguages;
|
||||||
|
PVOID MergedPrefLanguages;
|
||||||
|
ULONG MuiImpersonation;
|
||||||
|
|
||||||
|
union
|
||||||
|
{
|
||||||
|
USHORT CrossTebFlags;
|
||||||
|
USHORT SpareCrossTebBits : 16;
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
USHORT SameTebFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT SafeThunkCall : 1;
|
||||||
|
USHORT InDebugPrint : 1;
|
||||||
|
USHORT HasFiberData : 1;
|
||||||
|
USHORT SkipThreadAttach : 1;
|
||||||
|
USHORT WerInShipAssertCode : 1;
|
||||||
|
USHORT RanProcessInit : 1;
|
||||||
|
USHORT ClonedThread : 1;
|
||||||
|
USHORT SuppressDebugMsg : 1;
|
||||||
|
USHORT DisableUserStackWalk : 1;
|
||||||
|
USHORT RtlExceptionAttached : 1;
|
||||||
|
USHORT InitialThread : 1;
|
||||||
|
USHORT SessionAware : 1;
|
||||||
|
USHORT LoadOwner : 1;
|
||||||
|
USHORT LoaderWorker : 1;
|
||||||
|
USHORT SkipLoaderInit : 1;
|
||||||
|
USHORT SpareSameTebBits : 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
PVOID TxnScopeEnterCallback;
|
||||||
|
PVOID TxnScopeExitCallback;
|
||||||
|
PVOID TxnScopeContext;
|
||||||
|
ULONG LockCount;
|
||||||
|
LONG WowTebOffset;
|
||||||
|
PVOID ResourceRetValue;
|
||||||
|
PVOID ReservedForWdf;
|
||||||
|
ULONGLONG ReservedForCrt;
|
||||||
|
GUID EffectiveContainerId;
|
||||||
|
} TEB, *PTEB;
|
||||||
|
|
||||||
|
#endif
|
||||||
261
phnt/include/ntpfapi.h
Normal file
261
phnt/include/ntpfapi.h
Normal file
@@ -0,0 +1,261 @@
|
|||||||
|
#ifndef _NTPFAPI_H
|
||||||
|
#define _NTPFAPI_H
|
||||||
|
|
||||||
|
// begin_private
|
||||||
|
|
||||||
|
// Prefetch
|
||||||
|
|
||||||
|
typedef enum _PF_BOOT_PHASE_ID
|
||||||
|
{
|
||||||
|
PfKernelInitPhase = 0,
|
||||||
|
PfBootDriverInitPhase = 90,
|
||||||
|
PfSystemDriverInitPhase = 120,
|
||||||
|
PfSessionManagerInitPhase = 150,
|
||||||
|
PfSMRegistryInitPhase = 180,
|
||||||
|
PfVideoInitPhase = 210,
|
||||||
|
PfPostVideoInitPhase = 240,
|
||||||
|
PfBootAcceptedRegistryInitPhase = 270,
|
||||||
|
PfUserShellReadyPhase = 300,
|
||||||
|
PfMaxBootPhaseId = 900
|
||||||
|
} PF_BOOT_PHASE_ID;
|
||||||
|
|
||||||
|
typedef enum _PF_ENABLE_STATUS
|
||||||
|
{
|
||||||
|
PfSvNotSpecified,
|
||||||
|
PfSvEnabled,
|
||||||
|
PfSvDisabled,
|
||||||
|
PfSvMaxEnableStatus
|
||||||
|
} PF_ENABLE_STATUS;
|
||||||
|
|
||||||
|
typedef struct _PF_TRACE_LIMITS
|
||||||
|
{
|
||||||
|
ULONG MaxNumPages;
|
||||||
|
ULONG MaxNumSections;
|
||||||
|
LONGLONG TimerPeriod;
|
||||||
|
} PF_TRACE_LIMITS, *PPF_TRACE_LIMITS;
|
||||||
|
|
||||||
|
typedef struct _PF_SYSTEM_PREFETCH_PARAMETERS
|
||||||
|
{
|
||||||
|
PF_ENABLE_STATUS EnableStatus[2];
|
||||||
|
PF_TRACE_LIMITS TraceLimits[2];
|
||||||
|
ULONG MaxNumActiveTraces;
|
||||||
|
ULONG MaxNumSavedTraces;
|
||||||
|
WCHAR RootDirPath[32];
|
||||||
|
WCHAR HostingApplicationList[128];
|
||||||
|
} PF_SYSTEM_PREFETCH_PARAMETERS, *PPF_SYSTEM_PREFETCH_PARAMETERS;
|
||||||
|
|
||||||
|
#define PF_BOOT_CONTROL_VERSION 1
|
||||||
|
|
||||||
|
typedef struct _PF_BOOT_CONTROL
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG DisableBootPrefetching;
|
||||||
|
} PF_BOOT_CONTROL, *PPF_BOOT_CONTROL;
|
||||||
|
|
||||||
|
typedef enum _PREFETCHER_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
PrefetcherRetrieveTrace = 1, // q: CHAR[]
|
||||||
|
PrefetcherSystemParameters, // q: PF_SYSTEM_PREFETCH_PARAMETERS
|
||||||
|
PrefetcherBootPhase, // s: PF_BOOT_PHASE_ID
|
||||||
|
PrefetcherRetrieveBootLoaderTrace, // q: CHAR[]
|
||||||
|
PrefetcherBootControl // s: PF_BOOT_CONTROL
|
||||||
|
} PREFETCHER_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
#define PREFETCHER_INFORMATION_VERSION 23 // rev
|
||||||
|
#define PREFETCHER_INFORMATION_MAGIC ('kuhC') // rev
|
||||||
|
|
||||||
|
typedef struct _PREFETCHER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG Magic;
|
||||||
|
PREFETCHER_INFORMATION_CLASS PrefetcherInformationClass;
|
||||||
|
PVOID PrefetcherInformation;
|
||||||
|
ULONG PrefetcherInformationLength;
|
||||||
|
} PREFETCHER_INFORMATION, *PPREFETCHER_INFORMATION;
|
||||||
|
|
||||||
|
// Superfetch
|
||||||
|
|
||||||
|
typedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS
|
||||||
|
{
|
||||||
|
ULONG EnabledComponents;
|
||||||
|
ULONG BootID;
|
||||||
|
ULONG SavedSectInfoTracesMax;
|
||||||
|
ULONG SavedPageAccessTracesMax;
|
||||||
|
ULONG ScenarioPrefetchTimeoutStandby;
|
||||||
|
ULONG ScenarioPrefetchTimeoutHibernate;
|
||||||
|
} PF_SYSTEM_SUPERFETCH_PARAMETERS, *PPF_SYSTEM_SUPERFETCH_PARAMETERS;
|
||||||
|
|
||||||
|
#define PF_PFN_PRIO_REQUEST_VERSION 1
|
||||||
|
#define PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST 0x1
|
||||||
|
#define PF_PFN_PRIO_REQUEST_VALID_FLAGS 0x1
|
||||||
|
|
||||||
|
typedef struct _PF_PFN_PRIO_REQUEST
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG RequestFlags;
|
||||||
|
ULONG_PTR PfnCount;
|
||||||
|
SYSTEM_MEMORY_LIST_INFORMATION MemInfo;
|
||||||
|
MMPFN_IDENTITY PageData[256];
|
||||||
|
} PF_PFN_PRIO_REQUEST, *PPF_PFN_PRIO_REQUEST;
|
||||||
|
|
||||||
|
typedef enum _PFS_PRIVATE_PAGE_SOURCE_TYPE
|
||||||
|
{
|
||||||
|
PfsPrivateSourceKernel,
|
||||||
|
PfsPrivateSourceSession,
|
||||||
|
PfsPrivateSourceProcess,
|
||||||
|
PfsPrivateSourceMax
|
||||||
|
} PFS_PRIVATE_PAGE_SOURCE_TYPE;
|
||||||
|
|
||||||
|
typedef struct _PFS_PRIVATE_PAGE_SOURCE
|
||||||
|
{
|
||||||
|
PFS_PRIVATE_PAGE_SOURCE_TYPE Type;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG SessionId;
|
||||||
|
ULONG ProcessId;
|
||||||
|
};
|
||||||
|
ULONG ImagePathHash;
|
||||||
|
ULONG_PTR UniqueProcessHash;
|
||||||
|
} PFS_PRIVATE_PAGE_SOURCE, *PPFS_PRIVATE_PAGE_SOURCE;
|
||||||
|
|
||||||
|
typedef struct _PF_PRIVSOURCE_INFO
|
||||||
|
{
|
||||||
|
PFS_PRIVATE_PAGE_SOURCE DbInfo;
|
||||||
|
PVOID EProcess;
|
||||||
|
SIZE_T WsPrivatePages;
|
||||||
|
SIZE_T TotalPrivatePages;
|
||||||
|
ULONG SessionID;
|
||||||
|
CHAR ImageName[16];
|
||||||
|
union {
|
||||||
|
ULONG_PTR WsSwapPages; // process only PF_PRIVSOURCE_QUERY_WS_SWAP_PAGES.
|
||||||
|
ULONG_PTR SessionPagedPoolPages; // session only.
|
||||||
|
ULONG_PTR StoreSizePages; // process only PF_PRIVSOURCE_QUERY_STORE_INFO.
|
||||||
|
};
|
||||||
|
ULONG_PTR WsTotalPages; // process/session only.
|
||||||
|
ULONG DeepFreezeTimeMs; // process only.
|
||||||
|
ULONG ModernApp : 1; // process only.
|
||||||
|
ULONG DeepFrozen : 1; // process only. If set, DeepFreezeTimeMs contains the time at which the freeze occurred
|
||||||
|
ULONG Foreground : 1; // process only.
|
||||||
|
ULONG PerProcessStore : 1; // process only.
|
||||||
|
ULONG Spare : 28;
|
||||||
|
} PF_PRIVSOURCE_INFO, *PPF_PRIVSOURCE_INFO;
|
||||||
|
|
||||||
|
#define PF_PRIVSOURCE_QUERY_REQUEST_VERSION 3
|
||||||
|
|
||||||
|
typedef struct _PF_PRIVSOURCE_QUERY_REQUEST
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG InfoCount;
|
||||||
|
PF_PRIVSOURCE_INFO InfoArray[1];
|
||||||
|
} PF_PRIVSOURCE_QUERY_REQUEST, *PPF_PRIVSOURCE_QUERY_REQUEST;
|
||||||
|
|
||||||
|
typedef enum _PF_PHASED_SCENARIO_TYPE
|
||||||
|
{
|
||||||
|
PfScenarioTypeNone,
|
||||||
|
PfScenarioTypeStandby,
|
||||||
|
PfScenarioTypeHibernate,
|
||||||
|
PfScenarioTypeFUS,
|
||||||
|
PfScenarioTypeMax
|
||||||
|
} PF_PHASED_SCENARIO_TYPE;
|
||||||
|
|
||||||
|
#define PF_SCENARIO_PHASE_INFO_VERSION 4
|
||||||
|
|
||||||
|
typedef struct _PF_SCENARIO_PHASE_INFO
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
PF_PHASED_SCENARIO_TYPE ScenType;
|
||||||
|
ULONG PhaseId;
|
||||||
|
ULONG SequenceNumber;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG FUSUserId;
|
||||||
|
} PF_SCENARIO_PHASE_INFO, *PPF_SCENARIO_PHASE_INFO;
|
||||||
|
|
||||||
|
typedef struct _PF_MEMORY_LIST_NODE
|
||||||
|
{
|
||||||
|
ULONGLONG Node : 8;
|
||||||
|
ULONGLONG Spare : 56;
|
||||||
|
ULONGLONG StandbyLowPageCount;
|
||||||
|
ULONGLONG StandbyMediumPageCount;
|
||||||
|
ULONGLONG StandbyHighPageCount;
|
||||||
|
ULONGLONG FreePageCount;
|
||||||
|
ULONGLONG ModifiedPageCount;
|
||||||
|
} PF_MEMORY_LIST_NODE, *PPF_MEMORY_LIST_NODE;
|
||||||
|
|
||||||
|
#define PF_MEMORY_LIST_INFO_VERSION 1
|
||||||
|
|
||||||
|
typedef struct _PF_MEMORY_LIST_INFO
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG Size;
|
||||||
|
ULONG NodeCount;
|
||||||
|
PF_MEMORY_LIST_NODE Nodes[1];
|
||||||
|
} PF_MEMORY_LIST_INFO, *PPF_MEMORY_LIST_INFO;
|
||||||
|
|
||||||
|
typedef struct _PF_PHYSICAL_MEMORY_RANGE
|
||||||
|
{
|
||||||
|
ULONG_PTR BasePfn;
|
||||||
|
ULONG_PTR PageCount;
|
||||||
|
} PF_PHYSICAL_MEMORY_RANGE, *PPF_PHYSICAL_MEMORY_RANGE;
|
||||||
|
|
||||||
|
#define PF_PHYSICAL_MEMORY_RANGE_INFO_VERSION 1
|
||||||
|
|
||||||
|
typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG RangeCount;
|
||||||
|
PF_PHYSICAL_MEMORY_RANGE Ranges[1];
|
||||||
|
} PF_PHYSICAL_MEMORY_RANGE_INFO, *PPF_PHYSICAL_MEMORY_RANGE_INFO;
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
|
||||||
|
#define PF_REPURPOSED_BY_PREFETCH_INFO_VERSION 1
|
||||||
|
|
||||||
|
typedef struct _PF_REPURPOSED_BY_PREFETCH_INFO
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG RepurposedByPrefetch;
|
||||||
|
} PF_REPURPOSED_BY_PREFETCH_INFO, *PPF_REPURPOSED_BY_PREFETCH_INFO;
|
||||||
|
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
typedef enum _SUPERFETCH_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
SuperfetchRetrieveTrace = 1, // q: CHAR[]
|
||||||
|
SuperfetchSystemParameters, // q: PF_SYSTEM_SUPERFETCH_PARAMETERS
|
||||||
|
SuperfetchLogEvent,
|
||||||
|
SuperfetchGenerateTrace,
|
||||||
|
SuperfetchPrefetch,
|
||||||
|
SuperfetchPfnQuery, // q: PF_PFN_PRIO_REQUEST
|
||||||
|
SuperfetchPfnSetPriority,
|
||||||
|
SuperfetchPrivSourceQuery, // q: PF_PRIVSOURCE_QUERY_REQUEST
|
||||||
|
SuperfetchSequenceNumberQuery, // q: ULONG
|
||||||
|
SuperfetchScenarioPhase, // 10
|
||||||
|
SuperfetchWorkerPriority,
|
||||||
|
SuperfetchScenarioQuery, // q: PF_SCENARIO_PHASE_INFO
|
||||||
|
SuperfetchScenarioPrefetch,
|
||||||
|
SuperfetchRobustnessControl,
|
||||||
|
SuperfetchTimeControl,
|
||||||
|
SuperfetchMemoryListQuery, // q: PF_MEMORY_LIST_INFO
|
||||||
|
SuperfetchMemoryRangesQuery, // q: PF_PHYSICAL_MEMORY_RANGE_INFO
|
||||||
|
SuperfetchTracingControl,
|
||||||
|
SuperfetchTrimWhileAgingControl,
|
||||||
|
SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // rev
|
||||||
|
SuperfetchInformationMax
|
||||||
|
} SUPERFETCH_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
#define SUPERFETCH_INFORMATION_VERSION 45 // rev
|
||||||
|
#define SUPERFETCH_INFORMATION_MAGIC ('kuhC') // rev
|
||||||
|
|
||||||
|
typedef struct _SUPERFETCH_INFORMATION
|
||||||
|
{
|
||||||
|
_In_ ULONG Version;
|
||||||
|
_In_ ULONG Magic;
|
||||||
|
_In_ SUPERFETCH_INFORMATION_CLASS InfoClass;
|
||||||
|
_Inout_ PVOID Data;
|
||||||
|
_Inout_ ULONG Length;
|
||||||
|
} SUPERFETCH_INFORMATION, *PSUPERFETCH_INFORMATION;
|
||||||
|
|
||||||
|
// end_private
|
||||||
|
|
||||||
|
#endif
|
||||||
159
phnt/include/ntpnpapi.h
Normal file
159
phnt/include/ntpnpapi.h
Normal file
@@ -0,0 +1,159 @@
|
|||||||
|
#ifndef _NTPNPAPI_H
|
||||||
|
#define _NTPNPAPI_H
|
||||||
|
|
||||||
|
typedef enum _PLUGPLAY_EVENT_CATEGORY
|
||||||
|
{
|
||||||
|
HardwareProfileChangeEvent,
|
||||||
|
TargetDeviceChangeEvent,
|
||||||
|
DeviceClassChangeEvent,
|
||||||
|
CustomDeviceEvent,
|
||||||
|
DeviceInstallEvent,
|
||||||
|
DeviceArrivalEvent,
|
||||||
|
PowerEvent,
|
||||||
|
VetoEvent,
|
||||||
|
BlockedDriverEvent,
|
||||||
|
InvalidIDEvent,
|
||||||
|
MaxPlugEventCategory
|
||||||
|
} PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY;
|
||||||
|
|
||||||
|
typedef struct _PLUGPLAY_EVENT_BLOCK
|
||||||
|
{
|
||||||
|
GUID EventGuid;
|
||||||
|
PLUGPLAY_EVENT_CATEGORY EventCategory;
|
||||||
|
PULONG Result;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG TotalSize;
|
||||||
|
PVOID DeviceObject;
|
||||||
|
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
GUID ClassGuid;
|
||||||
|
WCHAR SymbolicLinkName[1];
|
||||||
|
} DeviceClass;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
WCHAR DeviceIds[1];
|
||||||
|
} TargetDevice;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
WCHAR DeviceId[1];
|
||||||
|
} InstallDevice;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
PVOID NotificationStructure;
|
||||||
|
WCHAR DeviceIds[1];
|
||||||
|
} CustomNotification;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
PVOID Notification;
|
||||||
|
} ProfileNotification;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG NotificationCode;
|
||||||
|
ULONG NotificationData;
|
||||||
|
} PowerNotification;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
PNP_VETO_TYPE VetoType;
|
||||||
|
WCHAR DeviceIdVetoNameBuffer[1]; // DeviceId<null>VetoName<null><null>
|
||||||
|
} VetoNotification;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
GUID BlockedDriverGuid;
|
||||||
|
} BlockedDriverNotification;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
WCHAR ParentId[1];
|
||||||
|
} InvalidIDNotification;
|
||||||
|
} u;
|
||||||
|
} PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK;
|
||||||
|
|
||||||
|
typedef enum _PLUGPLAY_CONTROL_CLASS
|
||||||
|
{
|
||||||
|
PlugPlayControlEnumerateDevice,
|
||||||
|
PlugPlayControlRegisterNewDevice,
|
||||||
|
PlugPlayControlDeregisterDevice,
|
||||||
|
PlugPlayControlInitializeDevice,
|
||||||
|
PlugPlayControlStartDevice,
|
||||||
|
PlugPlayControlUnlockDevice,
|
||||||
|
PlugPlayControlQueryAndRemoveDevice,
|
||||||
|
PlugPlayControlUserResponse,
|
||||||
|
PlugPlayControlGenerateLegacyDevice,
|
||||||
|
PlugPlayControlGetInterfaceDeviceList,
|
||||||
|
PlugPlayControlProperty,
|
||||||
|
PlugPlayControlDeviceClassAssociation,
|
||||||
|
PlugPlayControlGetRelatedDevice,
|
||||||
|
PlugPlayControlGetInterfaceDeviceAlias,
|
||||||
|
PlugPlayControlDeviceStatus,
|
||||||
|
PlugPlayControlGetDeviceDepth,
|
||||||
|
PlugPlayControlQueryDeviceRelations,
|
||||||
|
PlugPlayControlTargetDeviceRelation,
|
||||||
|
PlugPlayControlQueryConflictList,
|
||||||
|
PlugPlayControlRetrieveDock,
|
||||||
|
PlugPlayControlResetDevice,
|
||||||
|
PlugPlayControlHaltDevice,
|
||||||
|
PlugPlayControlGetBlockedDriverList,
|
||||||
|
PlugPlayControlGetDeviceInterfaceEnabled,
|
||||||
|
MaxPlugPlayControl
|
||||||
|
} PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS;
|
||||||
|
|
||||||
|
#if (PHNT_VERSION < PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtGetPlugPlayEvent(
|
||||||
|
_In_ HANDLE EventHandle,
|
||||||
|
_In_opt_ PVOID Context,
|
||||||
|
_Out_writes_bytes_(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,
|
||||||
|
_In_ ULONG EventBufferSize
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPlugPlayControl(
|
||||||
|
_In_ PLUGPLAY_CONTROL_CLASS PnPControlClass,
|
||||||
|
_Inout_updates_bytes_(PnPControlDataLength) PVOID PnPControlData,
|
||||||
|
_In_ ULONG PnPControlDataLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSerializeBoot(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtEnableLastKnownGood(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDisableLastKnownGood(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplacePartitionUnit(
|
||||||
|
_In_ PUNICODE_STRING TargetInstancePath,
|
||||||
|
_In_ PUNICODE_STRING SpareInstancePath,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
182
phnt/include/ntpoapi.h
Normal file
182
phnt/include/ntpoapi.h
Normal file
@@ -0,0 +1,182 @@
|
|||||||
|
#ifndef _NTPOAPI_H
|
||||||
|
#define _NTPOAPI_H
|
||||||
|
|
||||||
|
typedef union _POWER_STATE
|
||||||
|
{
|
||||||
|
SYSTEM_POWER_STATE SystemState;
|
||||||
|
DEVICE_POWER_STATE DeviceState;
|
||||||
|
} POWER_STATE, *PPOWER_STATE;
|
||||||
|
|
||||||
|
typedef enum _POWER_STATE_TYPE
|
||||||
|
{
|
||||||
|
SystemPowerState = 0,
|
||||||
|
DevicePowerState
|
||||||
|
} POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// wdm
|
||||||
|
typedef struct _SYSTEM_POWER_STATE_CONTEXT
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG Reserved1 : 8;
|
||||||
|
ULONG TargetSystemState : 4;
|
||||||
|
ULONG EffectiveSystemState : 4;
|
||||||
|
ULONG CurrentSystemState : 4;
|
||||||
|
ULONG IgnoreHibernationPath : 1;
|
||||||
|
ULONG PseudoTransition : 1;
|
||||||
|
ULONG Reserved2 : 10;
|
||||||
|
};
|
||||||
|
ULONG ContextAsUlong;
|
||||||
|
};
|
||||||
|
} SYSTEM_POWER_STATE_CONTEXT, *PSYSTEM_POWER_STATE_CONTEXT;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
/** \cond NEVER */ // disable doxygen warning
|
||||||
|
// wdm
|
||||||
|
typedef struct _COUNTED_REASON_CONTEXT
|
||||||
|
{
|
||||||
|
ULONG Version;
|
||||||
|
ULONG Flags;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
UNICODE_STRING ResourceFileName;
|
||||||
|
USHORT ResourceReasonId;
|
||||||
|
ULONG StringCount;
|
||||||
|
PUNICODE_STRING _Field_size_(StringCount) ReasonStrings;
|
||||||
|
};
|
||||||
|
UNICODE_STRING SimpleString;
|
||||||
|
};
|
||||||
|
} COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;
|
||||||
|
/** \endcond */
|
||||||
|
#endif
|
||||||
|
|
||||||
|
typedef enum
|
||||||
|
{
|
||||||
|
PowerStateSleeping1 = 0,
|
||||||
|
PowerStateSleeping2 = 1,
|
||||||
|
PowerStateSleeping3 = 2,
|
||||||
|
PowerStateSleeping4 = 3,
|
||||||
|
PowerStateShutdownOff = 4,
|
||||||
|
PowerStateShutdownReset = 5,
|
||||||
|
PowerStateSleeping4Firmware = 6,
|
||||||
|
PowerStateMaximum = 7
|
||||||
|
} POWER_STATE_HANDLER_TYPE, *PPOWER_STATE_HANDLER_TYPE;
|
||||||
|
|
||||||
|
typedef NTSTATUS (NTAPI *PENTER_STATE_SYSTEM_HANDLER)(
|
||||||
|
_In_ PVOID SystemContext
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS (NTAPI *PENTER_STATE_HANDLER)(
|
||||||
|
_In_ PVOID Context,
|
||||||
|
_In_opt_ PENTER_STATE_SYSTEM_HANDLER SystemHandler,
|
||||||
|
_In_ PVOID SystemContext,
|
||||||
|
_In_ LONG NumberProcessors,
|
||||||
|
_In_ volatile PLONG Number
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef struct _POWER_STATE_HANDLER
|
||||||
|
{
|
||||||
|
POWER_STATE_HANDLER_TYPE Type;
|
||||||
|
BOOLEAN RtcWake;
|
||||||
|
UCHAR Spare[3];
|
||||||
|
PENTER_STATE_HANDLER Handler;
|
||||||
|
PVOID Context;
|
||||||
|
} POWER_STATE_HANDLER, *PPOWER_STATE_HANDLER;
|
||||||
|
|
||||||
|
typedef NTSTATUS (NTAPI *PENTER_STATE_NOTIFY_HANDLER)(
|
||||||
|
_In_ POWER_STATE_HANDLER_TYPE State,
|
||||||
|
_In_ PVOID Context,
|
||||||
|
_In_ BOOLEAN Entering
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef struct _POWER_STATE_NOTIFY_HANDLER
|
||||||
|
{
|
||||||
|
PENTER_STATE_NOTIFY_HANDLER Handler;
|
||||||
|
PVOID Context;
|
||||||
|
} POWER_STATE_NOTIFY_HANDLER, *PPOWER_STATE_NOTIFY_HANDLER;
|
||||||
|
|
||||||
|
typedef struct _PROCESSOR_POWER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Number;
|
||||||
|
ULONG MaxMhz;
|
||||||
|
ULONG CurrentMhz;
|
||||||
|
ULONG MhzLimit;
|
||||||
|
ULONG MaxIdleState;
|
||||||
|
ULONG CurrentIdleState;
|
||||||
|
} PROCESSOR_POWER_INFORMATION, *PPROCESSOR_POWER_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _SYSTEM_POWER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG MaxIdlenessAllowed;
|
||||||
|
ULONG Idleness;
|
||||||
|
ULONG TimeRemaining;
|
||||||
|
UCHAR CoolingMode;
|
||||||
|
} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPowerInformation(
|
||||||
|
_In_ POWER_INFORMATION_LEVEL InformationLevel,
|
||||||
|
_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
|
||||||
|
_In_ ULONG InputBufferLength,
|
||||||
|
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
|
||||||
|
_In_ ULONG OutputBufferLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetThreadExecutionState(
|
||||||
|
_In_ EXECUTION_STATE NewFlags, // ES_* flags
|
||||||
|
_Out_ EXECUTION_STATE *PreviousFlags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRequestWakeupLatency(
|
||||||
|
_In_ LATENCY_TIME latency
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtInitiatePowerAction(
|
||||||
|
_In_ POWER_ACTION SystemAction,
|
||||||
|
_In_ SYSTEM_POWER_STATE LightestSystemState,
|
||||||
|
_In_ ULONG Flags, // POWER_ACTION_* flags
|
||||||
|
_In_ BOOLEAN Asynchronous
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetSystemPowerState(
|
||||||
|
_In_ POWER_ACTION SystemAction,
|
||||||
|
_In_ SYSTEM_POWER_STATE LightestSystemState,
|
||||||
|
_In_ ULONG Flags // POWER_ACTION_* flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtGetDevicePowerState(
|
||||||
|
_In_ HANDLE Device,
|
||||||
|
_Out_ PDEVICE_POWER_STATE State
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
BOOLEAN
|
||||||
|
NTAPI
|
||||||
|
NtIsSystemResumeAutomatic(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
1825
phnt/include/ntpsapi.h
Normal file
1825
phnt/include/ntpsapi.h
Normal file
File diff suppressed because it is too large
Load Diff
637
phnt/include/ntregapi.h
Normal file
637
phnt/include/ntregapi.h
Normal file
@@ -0,0 +1,637 @@
|
|||||||
|
#ifndef _NTREGAPI_H
|
||||||
|
#define _NTREGAPI_H
|
||||||
|
|
||||||
|
// Boot condition flags (NtInitializeRegistry)
|
||||||
|
|
||||||
|
#define REG_INIT_BOOT_SM 0x0000
|
||||||
|
#define REG_INIT_BOOT_SETUP 0x0001
|
||||||
|
#define REG_INIT_BOOT_ACCEPTED_BASE 0x0002
|
||||||
|
#define REG_INIT_BOOT_ACCEPTED_MAX REG_INIT_BOOT_ACCEPTED_BASE + 999
|
||||||
|
|
||||||
|
#define REG_MAX_KEY_VALUE_NAME_LENGTH 32767
|
||||||
|
#define REG_MAX_KEY_NAME_LENGTH 512
|
||||||
|
|
||||||
|
typedef enum _KEY_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
KeyBasicInformation, // KEY_BASIC_INFORMATION
|
||||||
|
KeyNodeInformation, // KEY_NODE_INFORMATION
|
||||||
|
KeyFullInformation, // KEY_FULL_INFORMATION
|
||||||
|
KeyNameInformation, // KEY_NAME_INFORMATION
|
||||||
|
KeyCachedInformation, // KEY_CACHED_INFORMATION
|
||||||
|
KeyFlagsInformation, // KEY_FLAGS_INFORMATION
|
||||||
|
KeyVirtualizationInformation, // KEY_VIRTUALIZATION_INFORMATION
|
||||||
|
KeyHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION
|
||||||
|
KeyTrustInformation, // KEY_TRUST_INFORMATION
|
||||||
|
KeyLayerInformation, // KEY_LAYER_INFORMATION
|
||||||
|
MaxKeyInfoClass
|
||||||
|
} KEY_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _KEY_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER LastWriteTime;
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_NODE_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER LastWriteTime;
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG ClassOffset;
|
||||||
|
ULONG ClassLength;
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
// ...
|
||||||
|
// WCHAR Class[1];
|
||||||
|
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_FULL_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER LastWriteTime;
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG ClassOffset;
|
||||||
|
ULONG ClassLength;
|
||||||
|
ULONG SubKeys;
|
||||||
|
ULONG MaxNameLen;
|
||||||
|
ULONG MaxClassLen;
|
||||||
|
ULONG Values;
|
||||||
|
ULONG MaxValueNameLen;
|
||||||
|
ULONG MaxValueDataLen;
|
||||||
|
WCHAR Class[1];
|
||||||
|
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_NAME_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_CACHED_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER LastWriteTime;
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG SubKeys;
|
||||||
|
ULONG MaxNameLen;
|
||||||
|
ULONG Values;
|
||||||
|
ULONG MaxValueNameLen;
|
||||||
|
ULONG MaxValueDataLen;
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
} KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_FLAGS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG UserFlags;
|
||||||
|
} KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_VIRTUALIZATION_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG VirtualizationCandidate : 1; // Tells whether the key is part of the virtualization namespace scope (only HKLM\Software for now).
|
||||||
|
ULONG VirtualizationEnabled : 1; // Tells whether virtualization is enabled on this key. Can be 1 only if above flag is 1.
|
||||||
|
ULONG VirtualTarget : 1; // Tells if the key is a virtual key. Can be 1 only if above 2 are 0. Valid only on the virtual store key handles.
|
||||||
|
ULONG VirtualStore : 1; // Tells if the key is a part of the virtual store path. Valid only on the virtual store key handles.
|
||||||
|
ULONG VirtualSource : 1; // Tells if the key has ever been virtualized, can be 1 only if VirtualizationCandidate is 1.
|
||||||
|
ULONG Reserved : 27;
|
||||||
|
} KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _KEY_TRUST_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG TrustedKey : 1;
|
||||||
|
ULONG Reserved : 31;
|
||||||
|
} KEY_TRUST_INFORMATION, *PKEY_TRUST_INFORMATION;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _KEY_LAYER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG IsTombstone;
|
||||||
|
ULONG IsSupersedeLocal;
|
||||||
|
ULONG IsSupersedeTree;
|
||||||
|
ULONG ClassIsInherited;
|
||||||
|
ULONG Reserved;
|
||||||
|
} KEY_LAYER_INFORMATION, *PKEY_LAYER_INFORMATION;
|
||||||
|
|
||||||
|
typedef enum _KEY_SET_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
KeyWriteTimeInformation, // KEY_WRITE_TIME_INFORMATION
|
||||||
|
KeyWow64FlagsInformation, // KEY_WOW64_FLAGS_INFORMATION
|
||||||
|
KeyControlFlagsInformation, // KEY_CONTROL_FLAGS_INFORMATION
|
||||||
|
KeySetVirtualizationInformation, // KEY_SET_VIRTUALIZATION_INFORMATION
|
||||||
|
KeySetDebugInformation,
|
||||||
|
KeySetHandleTagsInformation, // KEY_HANDLE_TAGS_INFORMATION
|
||||||
|
MaxKeySetInfoClass
|
||||||
|
} KEY_SET_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _KEY_WRITE_TIME_INFORMATION
|
||||||
|
{
|
||||||
|
LARGE_INTEGER LastWriteTime;
|
||||||
|
} KEY_WRITE_TIME_INFORMATION, *PKEY_WRITE_TIME_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_WOW64_FLAGS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG UserFlags;
|
||||||
|
} KEY_WOW64_FLAGS_INFORMATION, *PKEY_WOW64_FLAGS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_HANDLE_TAGS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG HandleTags;
|
||||||
|
} KEY_HANDLE_TAGS_INFORMATION, *PKEY_HANDLE_TAGS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_CONTROL_FLAGS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG ControlFlags;
|
||||||
|
} KEY_CONTROL_FLAGS_INFORMATION, *PKEY_CONTROL_FLAGS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_SET_VIRTUALIZATION_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG VirtualTarget : 1;
|
||||||
|
ULONG VirtualStore : 1;
|
||||||
|
ULONG VirtualSource : 1; // true if key has been virtualized at least once
|
||||||
|
ULONG Reserved : 29;
|
||||||
|
} KEY_SET_VIRTUALIZATION_INFORMATION, *PKEY_SET_VIRTUALIZATION_INFORMATION;
|
||||||
|
|
||||||
|
typedef enum _KEY_VALUE_INFORMATION_CLASS
|
||||||
|
{
|
||||||
|
KeyValueBasicInformation, // KEY_VALUE_BASIC_INFORMATION
|
||||||
|
KeyValueFullInformation, // KEY_VALUE_FULL_INFORMATION
|
||||||
|
KeyValuePartialInformation, // KEY_VALUE_PARTIAL_INFORMATION
|
||||||
|
KeyValueFullInformationAlign64,
|
||||||
|
KeyValuePartialInformationAlign64, // KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
|
||||||
|
KeyValueLayerInformation, // KEY_VALUE_LAYER_INFORMATION
|
||||||
|
MaxKeyValueInfoClass
|
||||||
|
} KEY_VALUE_INFORMATION_CLASS;
|
||||||
|
|
||||||
|
typedef struct _KEY_VALUE_BASIC_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG Type;
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_VALUE_FULL_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG Type;
|
||||||
|
ULONG DataOffset;
|
||||||
|
ULONG DataLength;
|
||||||
|
ULONG NameLength;
|
||||||
|
WCHAR Name[1];
|
||||||
|
// ...
|
||||||
|
// UCHAR Data[1];
|
||||||
|
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_VALUE_PARTIAL_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG TitleIndex;
|
||||||
|
ULONG Type;
|
||||||
|
ULONG DataLength;
|
||||||
|
UCHAR Data[1];
|
||||||
|
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
|
||||||
|
{
|
||||||
|
ULONG Type;
|
||||||
|
ULONG DataLength;
|
||||||
|
UCHAR Data[1];
|
||||||
|
} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _KEY_VALUE_LAYER_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG IsTombstone;
|
||||||
|
ULONG Reserved;
|
||||||
|
} KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_VALUE_ENTRY
|
||||||
|
{
|
||||||
|
PUNICODE_STRING ValueName;
|
||||||
|
ULONG DataLength;
|
||||||
|
ULONG DataOffset;
|
||||||
|
ULONG Type;
|
||||||
|
} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;
|
||||||
|
|
||||||
|
typedef enum _REG_ACTION
|
||||||
|
{
|
||||||
|
KeyAdded,
|
||||||
|
KeyRemoved,
|
||||||
|
KeyModified
|
||||||
|
} REG_ACTION;
|
||||||
|
|
||||||
|
typedef struct _REG_NOTIFY_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NextEntryOffset;
|
||||||
|
REG_ACTION Action;
|
||||||
|
ULONG KeyLength;
|
||||||
|
WCHAR Key[1];
|
||||||
|
} REG_NOTIFY_INFORMATION, *PREG_NOTIFY_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _KEY_PID_ARRAY
|
||||||
|
{
|
||||||
|
HANDLE PID;
|
||||||
|
UNICODE_STRING KeyName;
|
||||||
|
} KEY_PID_ARRAY, *PKEY_PID_ARRAY;
|
||||||
|
|
||||||
|
typedef struct _KEY_OPEN_SUBKEYS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG Count;
|
||||||
|
KEY_PID_ARRAY KeyArray[1];
|
||||||
|
} KEY_OPEN_SUBKEYS_INFORMATION, *PKEY_OPEN_SUBKEYS_INFORMATION;
|
||||||
|
|
||||||
|
// System calls
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateKey(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_Reserved_ ULONG TitleIndex,
|
||||||
|
_In_opt_ PUNICODE_STRING Class,
|
||||||
|
_In_ ULONG CreateOptions,
|
||||||
|
_Out_opt_ PULONG Disposition
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateKeyTransacted(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_Reserved_ ULONG TitleIndex,
|
||||||
|
_In_opt_ PUNICODE_STRING Class,
|
||||||
|
_In_ ULONG CreateOptions,
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_Out_opt_ PULONG Disposition
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenKey(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenKeyTransacted(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ HANDLE TransactionHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenKeyEx(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG OpenOptions
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenKeyTransactedEx(
|
||||||
|
_Out_ PHANDLE KeyHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ ULONG OpenOptions,
|
||||||
|
_In_ HANDLE TransactionHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDeleteKey(
|
||||||
|
_In_ HANDLE KeyHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRenameKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ PUNICODE_STRING NewName
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDeleteValueKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ PUNICODE_STRING ValueName
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
|
||||||
|
_Out_writes_bytes_opt_(Length) PVOID KeyInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG ResultLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,
|
||||||
|
_In_reads_bytes_(KeySetInformationLength) PVOID KeySetInformation,
|
||||||
|
_In_ ULONG KeySetInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryValueKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ PUNICODE_STRING ValueName,
|
||||||
|
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
||||||
|
_Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG ResultLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetValueKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ PUNICODE_STRING ValueName,
|
||||||
|
_In_opt_ ULONG TitleIndex,
|
||||||
|
_In_ ULONG Type,
|
||||||
|
_In_reads_bytes_opt_(DataSize) PVOID Data,
|
||||||
|
_In_ ULONG DataSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryMultipleValueKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries,
|
||||||
|
_In_ ULONG EntryCount,
|
||||||
|
_Out_writes_bytes_(*BufferLength) PVOID ValueBuffer,
|
||||||
|
_Inout_ PULONG BufferLength,
|
||||||
|
_Out_opt_ PULONG RequiredBufferLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtEnumerateKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ ULONG Index,
|
||||||
|
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
|
||||||
|
_Out_writes_bytes_opt_(Length) PVOID KeyInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG ResultLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtEnumerateValueKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ ULONG Index,
|
||||||
|
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
||||||
|
_Out_writes_bytes_opt_(Length) PVOID KeyValueInformation,
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG ResultLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFlushKey(
|
||||||
|
_In_ HANDLE KeyHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCompactKeys(
|
||||||
|
_In_ ULONG Count,
|
||||||
|
_In_reads_(Count) HANDLE KeyArray[]
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCompressKey(
|
||||||
|
_In_ HANDLE Key
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLoadKey(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_ POBJECT_ATTRIBUTES SourceFile
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLoadKey2(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_ POBJECT_ATTRIBUTES SourceFile,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLoadKeyEx(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_ POBJECT_ATTRIBUTES SourceFile,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ HANDLE TrustClassKey,
|
||||||
|
_In_opt_ HANDLE Event,
|
||||||
|
_In_opt_ ACCESS_MASK DesiredAccess,
|
||||||
|
_Out_opt_ PHANDLE RootHandle,
|
||||||
|
_Out_opt_ PIO_STATUS_BLOCK IoStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReplaceKey(
|
||||||
|
_In_ POBJECT_ATTRIBUTES NewFile,
|
||||||
|
_In_ HANDLE TargetHandle,
|
||||||
|
_In_ POBJECT_ATTRIBUTES OldFile
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSaveKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ HANDLE FileHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSaveKeyEx(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ HANDLE FileHandle,
|
||||||
|
_In_ ULONG Format
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSaveMergedKeys(
|
||||||
|
_In_ HANDLE HighPrecedenceKeyHandle,
|
||||||
|
_In_ HANDLE LowPrecedenceKeyHandle,
|
||||||
|
_In_ HANDLE FileHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRestoreKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_ HANDLE FileHandle,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnloadKey(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnloadKey2(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtUnloadKeyEx(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_opt_ HANDLE Event
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtNotifyChangeKey(
|
||||||
|
_In_ HANDLE KeyHandle,
|
||||||
|
_In_opt_ HANDLE Event,
|
||||||
|
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
||||||
|
_In_opt_ PVOID ApcContext,
|
||||||
|
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||||
|
_In_ ULONG CompletionFilter,
|
||||||
|
_In_ BOOLEAN WatchTree,
|
||||||
|
_Out_writes_bytes_opt_(BufferSize) PVOID Buffer,
|
||||||
|
_In_ ULONG BufferSize,
|
||||||
|
_In_ BOOLEAN Asynchronous
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtNotifyChangeMultipleKeys(
|
||||||
|
_In_ HANDLE MasterKeyHandle,
|
||||||
|
_In_opt_ ULONG Count,
|
||||||
|
_In_reads_opt_(Count) OBJECT_ATTRIBUTES SubordinateObjects[],
|
||||||
|
_In_opt_ HANDLE Event,
|
||||||
|
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
||||||
|
_In_opt_ PVOID ApcContext,
|
||||||
|
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||||
|
_In_ ULONG CompletionFilter,
|
||||||
|
_In_ BOOLEAN WatchTree,
|
||||||
|
_Out_writes_bytes_opt_(BufferSize) PVOID Buffer,
|
||||||
|
_In_ ULONG BufferSize,
|
||||||
|
_In_ BOOLEAN Asynchronous
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryOpenSubKeys(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_Out_ PULONG HandleCount
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryOpenSubKeysEx(
|
||||||
|
_In_ POBJECT_ATTRIBUTES TargetKey,
|
||||||
|
_In_ ULONG BufferLength,
|
||||||
|
_Out_writes_bytes_(BufferLength) PVOID Buffer,
|
||||||
|
_Out_ PULONG RequiredSize
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtInitializeRegistry(
|
||||||
|
_In_ USHORT BootCondition
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLockRegistryKey(
|
||||||
|
_In_ HANDLE KeyHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtLockProductActivationKeys(
|
||||||
|
_Inout_opt_ ULONG *pPrivateVer,
|
||||||
|
_Out_opt_ ULONG *pSafeMode
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFreezeRegistry(
|
||||||
|
_In_ ULONG TimeOutInSeconds
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtThawRegistry(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
6586
phnt/include/ntrtl.h
Normal file
6586
phnt/include/ntrtl.h
Normal file
File diff suppressed because it is too large
Load Diff
1735
phnt/include/ntsam.h
Normal file
1735
phnt/include/ntsam.h
Normal file
File diff suppressed because it is too large
Load Diff
635
phnt/include/ntseapi.h
Normal file
635
phnt/include/ntseapi.h
Normal file
@@ -0,0 +1,635 @@
|
|||||||
|
#ifndef _NTSEAPI_H
|
||||||
|
#define _NTSEAPI_H
|
||||||
|
|
||||||
|
// Privileges
|
||||||
|
|
||||||
|
#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
|
||||||
|
#define SE_CREATE_TOKEN_PRIVILEGE (2L)
|
||||||
|
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
|
||||||
|
#define SE_LOCK_MEMORY_PRIVILEGE (4L)
|
||||||
|
#define SE_INCREASE_QUOTA_PRIVILEGE (5L)
|
||||||
|
|
||||||
|
#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
|
||||||
|
#define SE_TCB_PRIVILEGE (7L)
|
||||||
|
#define SE_SECURITY_PRIVILEGE (8L)
|
||||||
|
#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
|
||||||
|
#define SE_LOAD_DRIVER_PRIVILEGE (10L)
|
||||||
|
#define SE_SYSTEM_PROFILE_PRIVILEGE (11L)
|
||||||
|
#define SE_SYSTEMTIME_PRIVILEGE (12L)
|
||||||
|
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
|
||||||
|
#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
|
||||||
|
#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
|
||||||
|
#define SE_CREATE_PERMANENT_PRIVILEGE (16L)
|
||||||
|
#define SE_BACKUP_PRIVILEGE (17L)
|
||||||
|
#define SE_RESTORE_PRIVILEGE (18L)
|
||||||
|
#define SE_SHUTDOWN_PRIVILEGE (19L)
|
||||||
|
#define SE_DEBUG_PRIVILEGE (20L)
|
||||||
|
#define SE_AUDIT_PRIVILEGE (21L)
|
||||||
|
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
|
||||||
|
#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
|
||||||
|
#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
|
||||||
|
#define SE_UNDOCK_PRIVILEGE (25L)
|
||||||
|
#define SE_SYNC_AGENT_PRIVILEGE (26L)
|
||||||
|
#define SE_ENABLE_DELEGATION_PRIVILEGE (27L)
|
||||||
|
#define SE_MANAGE_VOLUME_PRIVILEGE (28L)
|
||||||
|
#define SE_IMPERSONATE_PRIVILEGE (29L)
|
||||||
|
#define SE_CREATE_GLOBAL_PRIVILEGE (30L)
|
||||||
|
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
|
||||||
|
#define SE_RELABEL_PRIVILEGE (32L)
|
||||||
|
#define SE_INC_WORKING_SET_PRIVILEGE (33L)
|
||||||
|
#define SE_TIME_ZONE_PRIVILEGE (34L)
|
||||||
|
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)
|
||||||
|
#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
|
||||||
|
|
||||||
|
|
||||||
|
// Authz
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
|
||||||
|
// Types
|
||||||
|
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10
|
||||||
|
|
||||||
|
// Flags
|
||||||
|
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY 0x0004
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT 0x0008
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_DISABLED 0x0010
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_MANDATORY 0x0020
|
||||||
|
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS ( \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_DISABLED | \
|
||||||
|
TOKEN_SECURITY_ATTRIBUTE_MANDATORY)
|
||||||
|
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS 0xffff0000
|
||||||
|
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE
|
||||||
|
{
|
||||||
|
ULONG64 Version;
|
||||||
|
UNICODE_STRING Name;
|
||||||
|
} TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
|
||||||
|
{
|
||||||
|
PVOID pValue;
|
||||||
|
ULONG ValueLength;
|
||||||
|
} TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
|
||||||
|
{
|
||||||
|
UNICODE_STRING Name;
|
||||||
|
USHORT ValueType;
|
||||||
|
USHORT Reserved;
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG ValueCount;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PLONG64 pInt64;
|
||||||
|
PULONG64 pUint64;
|
||||||
|
PUNICODE_STRING pString;
|
||||||
|
PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
|
||||||
|
PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
|
||||||
|
} Values;
|
||||||
|
} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;
|
||||||
|
|
||||||
|
// rev
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 1
|
||||||
|
// rev
|
||||||
|
#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
|
||||||
|
{
|
||||||
|
USHORT Version;
|
||||||
|
USHORT Reserved;
|
||||||
|
ULONG AttributeCount;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
|
||||||
|
} Attribute;
|
||||||
|
} TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
|
||||||
|
|
||||||
|
// Tokens
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateToken(
|
||||||
|
_Out_ PHANDLE TokenHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ TOKEN_TYPE TokenType,
|
||||||
|
_In_ PLUID AuthenticationId,
|
||||||
|
_In_ PLARGE_INTEGER ExpirationTime,
|
||||||
|
_In_ PTOKEN_USER User,
|
||||||
|
_In_ PTOKEN_GROUPS Groups,
|
||||||
|
_In_ PTOKEN_PRIVILEGES Privileges,
|
||||||
|
_In_opt_ PTOKEN_OWNER Owner,
|
||||||
|
_In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
|
||||||
|
_In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
|
||||||
|
_In_ PTOKEN_SOURCE TokenSource
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateLowBoxToken(
|
||||||
|
_Out_ PHANDLE TokenHandle,
|
||||||
|
_In_ HANDLE ExistingTokenHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ PSID PackageSid,
|
||||||
|
_In_ ULONG CapabilityCount,
|
||||||
|
_In_reads_opt_(CapabilityCount) PSID_AND_ATTRIBUTES Capabilities,
|
||||||
|
_In_ ULONG HandleCount,
|
||||||
|
_In_reads_opt_(HandleCount) HANDLE *Handles
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateTokenEx(
|
||||||
|
_Out_ PHANDLE TokenHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ TOKEN_TYPE TokenType,
|
||||||
|
_In_ PLUID AuthenticationId,
|
||||||
|
_In_ PLARGE_INTEGER ExpirationTime,
|
||||||
|
_In_ PTOKEN_USER User,
|
||||||
|
_In_ PTOKEN_GROUPS Groups,
|
||||||
|
_In_ PTOKEN_PRIVILEGES Privileges,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
|
||||||
|
_In_opt_ PTOKEN_GROUPS DeviceGroups,
|
||||||
|
_In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,
|
||||||
|
_In_opt_ PTOKEN_OWNER Owner,
|
||||||
|
_In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
|
||||||
|
_In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
|
||||||
|
_In_ PTOKEN_SOURCE TokenSource
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenProcessToken(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_Out_ PHANDLE TokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenProcessTokenEx(
|
||||||
|
_In_ HANDLE ProcessHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ ULONG HandleAttributes,
|
||||||
|
_Out_ PHANDLE TokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenThreadToken(
|
||||||
|
_In_ HANDLE ThreadHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ BOOLEAN OpenAsSelf,
|
||||||
|
_Out_ PHANDLE TokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenThreadTokenEx(
|
||||||
|
_In_ HANDLE ThreadHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ BOOLEAN OpenAsSelf,
|
||||||
|
_In_ ULONG HandleAttributes,
|
||||||
|
_Out_ PHANDLE TokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDuplicateToken(
|
||||||
|
_In_ HANDLE ExistingTokenHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ BOOLEAN EffectiveOnly,
|
||||||
|
_In_ TOKEN_TYPE TokenType,
|
||||||
|
_Out_ PHANDLE NewTokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationToken(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
|
||||||
|
_Out_writes_bytes_(TokenInformationLength) PVOID TokenInformation,
|
||||||
|
_In_ ULONG TokenInformationLength,
|
||||||
|
_Out_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationToken(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
|
||||||
|
_In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,
|
||||||
|
_In_ ULONG TokenInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAdjustPrivilegesToken(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_ BOOLEAN DisableAllPrivileges,
|
||||||
|
_In_opt_ PTOKEN_PRIVILEGES NewState,
|
||||||
|
_In_ ULONG BufferLength,
|
||||||
|
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
|
||||||
|
_Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAdjustGroupsToken(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_ BOOLEAN ResetToDefault,
|
||||||
|
_In_opt_ PTOKEN_GROUPS NewState,
|
||||||
|
_In_opt_ ULONG BufferLength,
|
||||||
|
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
|
||||||
|
_Out_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAdjustTokenClaimsAndDeviceGroups(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_ BOOLEAN UserResetToDefault,
|
||||||
|
_In_ BOOLEAN DeviceResetToDefault,
|
||||||
|
_In_ BOOLEAN DeviceGroupsResetToDefault,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewUserState,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION NewDeviceState,
|
||||||
|
_In_opt_ PTOKEN_GROUPS NewDeviceGroupsState,
|
||||||
|
_In_ ULONG UserBufferLength,
|
||||||
|
_Out_writes_bytes_to_opt_(UserBufferLength, *UserReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousUserState,
|
||||||
|
_In_ ULONG DeviceBufferLength,
|
||||||
|
_Out_writes_bytes_to_opt_(DeviceBufferLength, *DeviceReturnLength) PTOKEN_SECURITY_ATTRIBUTES_INFORMATION PreviousDeviceState,
|
||||||
|
_In_ ULONG DeviceGroupsBufferLength,
|
||||||
|
_Out_writes_bytes_to_opt_(DeviceGroupsBufferLength, *DeviceGroupsReturnBufferLength) PTOKEN_GROUPS PreviousDeviceGroups,
|
||||||
|
_Out_opt_ PULONG UserReturnLength,
|
||||||
|
_Out_opt_ PULONG DeviceReturnLength,
|
||||||
|
_Out_opt_ PULONG DeviceGroupsReturnBufferLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFilterToken(
|
||||||
|
_In_ HANDLE ExistingTokenHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ PTOKEN_GROUPS SidsToDisable,
|
||||||
|
_In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
|
||||||
|
_In_opt_ PTOKEN_GROUPS RestrictedSids,
|
||||||
|
_Out_ PHANDLE NewTokenHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFilterTokenEx(
|
||||||
|
_In_ HANDLE ExistingTokenHandle,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_opt_ PTOKEN_GROUPS SidsToDisable,
|
||||||
|
_In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
|
||||||
|
_In_opt_ PTOKEN_GROUPS RestrictedSids,
|
||||||
|
_In_ ULONG DisableUserClaimsCount,
|
||||||
|
_In_opt_ PUNICODE_STRING UserClaimsToDisable,
|
||||||
|
_In_ ULONG DisableDeviceClaimsCount,
|
||||||
|
_In_opt_ PUNICODE_STRING DeviceClaimsToDisable,
|
||||||
|
_In_opt_ PTOKEN_GROUPS DeviceGroupsToDisable,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedUserAttributes,
|
||||||
|
_In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION RestrictedDeviceAttributes,
|
||||||
|
_In_opt_ PTOKEN_GROUPS RestrictedDeviceGroups,
|
||||||
|
_Out_ PHANDLE NewTokenHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCompareTokens(
|
||||||
|
_In_ HANDLE FirstTokenHandle,
|
||||||
|
_In_ HANDLE SecondTokenHandle,
|
||||||
|
_Out_ PBOOLEAN Equal
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrivilegeCheck(
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_Inout_ PPRIVILEGE_SET RequiredPrivileges,
|
||||||
|
_Out_ PBOOLEAN Result
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtImpersonateAnonymousToken(
|
||||||
|
_In_ HANDLE ThreadHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQuerySecurityAttributesToken(
|
||||||
|
_In_ HANDLE TokenHandle,
|
||||||
|
_In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
|
||||||
|
_In_ ULONG NumberOfAttributes,
|
||||||
|
_Out_writes_bytes_(Length) PVOID Buffer, // PTOKEN_SECURITY_ATTRIBUTES_INFORMATION
|
||||||
|
_In_ ULONG Length,
|
||||||
|
_Out_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Access checking
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheck(
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
||||||
|
_Inout_ PULONG PrivilegeSetLength,
|
||||||
|
_Out_ PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_ PNTSTATUS AccessStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckByType(
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_opt_ PSID PrincipalSelfSid,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
||||||
|
_In_ ULONG ObjectTypeListLength,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
||||||
|
_Inout_ PULONG PrivilegeSetLength,
|
||||||
|
_Out_ PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_ PNTSTATUS AccessStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckByTypeResultList(
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_opt_ PSID PrincipalSelfSid,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
||||||
|
_In_ ULONG ObjectTypeListLength,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
||||||
|
_Inout_ PULONG PrivilegeSetLength,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
// Signing
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetCachedSigningLevel(
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_ SE_SIGNING_LEVEL InputSigningLevel,
|
||||||
|
_In_reads_(SourceFileCount) PHANDLE SourceFiles,
|
||||||
|
_In_ ULONG SourceFileCount,
|
||||||
|
_In_opt_ HANDLE TargetFile
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtGetCachedSigningLevel(
|
||||||
|
_In_ HANDLE File,
|
||||||
|
_Out_ PULONG Flags,
|
||||||
|
_Out_ PSE_SIGNING_LEVEL SigningLevel,
|
||||||
|
_Out_writes_bytes_to_opt_(*ThumbprintSize, *ThumbprintSize) PUCHAR Thumbprint,
|
||||||
|
_Inout_opt_ PULONG ThumbprintSize,
|
||||||
|
_Out_opt_ PULONG ThumbprintAlgorithm
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Audit alarm
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckAndAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ PUNICODE_STRING ObjectTypeName,
|
||||||
|
_In_ PUNICODE_STRING ObjectName,
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_In_ BOOLEAN ObjectCreation,
|
||||||
|
_Out_ PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_ PNTSTATUS AccessStatus,
|
||||||
|
_Out_ PBOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckByTypeAndAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ PUNICODE_STRING ObjectTypeName,
|
||||||
|
_In_ PUNICODE_STRING ObjectName,
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_opt_ PSID PrincipalSelfSid,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
||||||
|
_In_ ULONG ObjectTypeListLength,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_In_ BOOLEAN ObjectCreation,
|
||||||
|
_Out_ PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_ PNTSTATUS AccessStatus,
|
||||||
|
_Out_ PBOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckByTypeResultListAndAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ PUNICODE_STRING ObjectTypeName,
|
||||||
|
_In_ PUNICODE_STRING ObjectName,
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_opt_ PSID PrincipalSelfSid,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
||||||
|
_In_ ULONG ObjectTypeListLength,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_In_ BOOLEAN ObjectCreation,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
||||||
|
_Out_ PBOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ PUNICODE_STRING ObjectTypeName,
|
||||||
|
_In_ PUNICODE_STRING ObjectName,
|
||||||
|
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_opt_ PSID PrincipalSelfSid,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ AUDIT_EVENT_TYPE AuditType,
|
||||||
|
_In_ ULONG Flags,
|
||||||
|
_In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
||||||
|
_In_ ULONG ObjectTypeListLength,
|
||||||
|
_In_ PGENERIC_MAPPING GenericMapping,
|
||||||
|
_In_ BOOLEAN ObjectCreation,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
||||||
|
_Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
||||||
|
_Out_ PBOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenObjectAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ PUNICODE_STRING ObjectTypeName,
|
||||||
|
_In_ PUNICODE_STRING ObjectName,
|
||||||
|
_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ ACCESS_MASK GrantedAccess,
|
||||||
|
_In_opt_ PPRIVILEGE_SET Privileges,
|
||||||
|
_In_ BOOLEAN ObjectCreation,
|
||||||
|
_In_ BOOLEAN AccessGranted,
|
||||||
|
_Out_ PBOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrivilegeObjectAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ PPRIVILEGE_SET Privileges,
|
||||||
|
_In_ BOOLEAN AccessGranted
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCloseObjectAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ BOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtDeleteObjectAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_opt_ PVOID HandleId,
|
||||||
|
_In_ BOOLEAN GenerateOnClose
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrivilegedServiceAuditAlarm(
|
||||||
|
_In_ PUNICODE_STRING SubsystemName,
|
||||||
|
_In_ PUNICODE_STRING ServiceName,
|
||||||
|
_In_ HANDLE ClientToken,
|
||||||
|
_In_ PPRIVILEGE_SET Privileges,
|
||||||
|
_In_ BOOLEAN AccessGranted
|
||||||
|
);
|
||||||
|
|
||||||
|
// Misc.
|
||||||
|
|
||||||
|
typedef enum _FILTER_BOOT_OPTION_OPERATION
|
||||||
|
{
|
||||||
|
FilterBootOptionOperationOpenSystemStore,
|
||||||
|
FilterBootOptionOperationSetElement,
|
||||||
|
FilterBootOptionOperationDeleteElement,
|
||||||
|
FilterBootOptionOperationMax
|
||||||
|
} FILTER_BOOT_OPTION_OPERATION;
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFilterBootOption(
|
||||||
|
_In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,
|
||||||
|
_In_ ULONG ObjectType,
|
||||||
|
_In_ ULONG ElementType,
|
||||||
|
_In_reads_bytes_opt_(DataSize) PVOID Data,
|
||||||
|
_In_ ULONG DataSize
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
22
phnt/include/ntsmss.h
Normal file
22
phnt/include/ntsmss.h
Normal file
@@ -0,0 +1,22 @@
|
|||||||
|
#ifndef _NTSMSS_H
|
||||||
|
#define _NTSMSS_H
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
RtlConnectToSm(
|
||||||
|
_In_ PUNICODE_STRING ApiPortName,
|
||||||
|
_In_ HANDLE ApiPortHandle,
|
||||||
|
_In_ DWORD ProcessImageType,
|
||||||
|
_Out_ PHANDLE SmssConnection
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
RtlSendMsgToSm(
|
||||||
|
_In_ HANDLE ApiPortHandle,
|
||||||
|
_In_ PPORT_MESSAGE MessageData
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
473
phnt/include/nttmapi.h
Normal file
473
phnt/include/nttmapi.h
Normal file
@@ -0,0 +1,473 @@
|
|||||||
|
#ifndef _NTTMAPI_H
|
||||||
|
#define _NTTMAPI_H
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateTransactionManager(
|
||||||
|
_Out_ PHANDLE TmHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PUNICODE_STRING LogFileName,
|
||||||
|
_In_opt_ ULONG CreateOptions,
|
||||||
|
_In_opt_ ULONG CommitStrength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenTransactionManager(
|
||||||
|
_Out_ PHANDLE TmHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ PUNICODE_STRING LogFileName,
|
||||||
|
_In_opt_ LPGUID TmIdentity,
|
||||||
|
_In_opt_ ULONG OpenOptions
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRenameTransactionManager(
|
||||||
|
_In_ PUNICODE_STRING LogFileName,
|
||||||
|
_In_ LPGUID ExistingTransactionManagerGuid
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRollforwardTransactionManager(
|
||||||
|
_In_ HANDLE TransactionManagerHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRecoverTransactionManager(
|
||||||
|
_In_ HANDLE TransactionManagerHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationTransactionManager(
|
||||||
|
_In_ HANDLE TransactionManagerHandle,
|
||||||
|
_In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
|
||||||
|
_Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
|
||||||
|
_In_ ULONG TransactionManagerInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationTransactionManager(
|
||||||
|
_In_opt_ HANDLE TmHandle,
|
||||||
|
_In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
|
||||||
|
_In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
|
||||||
|
_In_ ULONG TransactionManagerInformationLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtEnumerateTransactionObject(
|
||||||
|
_In_opt_ HANDLE RootObjectHandle,
|
||||||
|
_In_ KTMOBJECT_TYPE QueryType,
|
||||||
|
_Inout_updates_bytes_(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,
|
||||||
|
_In_ ULONG ObjectCursorLength,
|
||||||
|
_Out_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateTransaction(
|
||||||
|
_Out_ PHANDLE TransactionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ LPGUID Uow,
|
||||||
|
_In_opt_ HANDLE TmHandle,
|
||||||
|
_In_opt_ ULONG CreateOptions,
|
||||||
|
_In_opt_ ULONG IsolationLevel,
|
||||||
|
_In_opt_ ULONG IsolationFlags,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout,
|
||||||
|
_In_opt_ PUNICODE_STRING Description
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenTransaction(
|
||||||
|
_Out_ PHANDLE TransactionHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_ LPGUID Uow,
|
||||||
|
_In_opt_ HANDLE TmHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationTransaction(
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
|
||||||
|
_Out_writes_bytes_(TransactionInformationLength) PVOID TransactionInformation,
|
||||||
|
_In_ ULONG TransactionInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationTransaction(
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
|
||||||
|
_In_reads_bytes_(TransactionInformationLength) PVOID TransactionInformation,
|
||||||
|
_In_ ULONG TransactionInformationLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCommitTransaction(
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_In_ BOOLEAN Wait
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRollbackTransaction(
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_In_ BOOLEAN Wait
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateEnlistment(
|
||||||
|
_Out_ PHANDLE EnlistmentHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ HANDLE TransactionHandle,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ ULONG CreateOptions,
|
||||||
|
_In_ NOTIFICATION_MASK NotificationMask,
|
||||||
|
_In_opt_ PVOID EnlistmentKey
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenEnlistment(
|
||||||
|
_Out_ PHANDLE EnlistmentHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ LPGUID EnlistmentGuid,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
|
||||||
|
_Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
|
||||||
|
_In_ ULONG EnlistmentInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationEnlistment(
|
||||||
|
_In_opt_ HANDLE EnlistmentHandle,
|
||||||
|
_In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
|
||||||
|
_In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,
|
||||||
|
_In_ ULONG EnlistmentInformationLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRecoverEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PVOID EnlistmentKey
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrePrepareEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrepareEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCommitEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRollbackEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrePrepareComplete(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPrepareComplete(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCommitComplete(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtReadOnlyEnlistment(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRollbackComplete(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSinglePhaseReject(
|
||||||
|
_In_ HANDLE EnlistmentHandle,
|
||||||
|
_In_opt_ PLARGE_INTEGER TmVirtualClock
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtCreateResourceManager(
|
||||||
|
_Out_ PHANDLE ResourceManagerHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ HANDLE TmHandle,
|
||||||
|
_In_ LPGUID RmGuid,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||||
|
_In_opt_ ULONG CreateOptions,
|
||||||
|
_In_opt_ PUNICODE_STRING Description
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtOpenResourceManager(
|
||||||
|
_Out_ PHANDLE ResourceManagerHandle,
|
||||||
|
_In_ ACCESS_MASK DesiredAccess,
|
||||||
|
_In_ HANDLE TmHandle,
|
||||||
|
_In_opt_ LPGUID ResourceManagerGuid,
|
||||||
|
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRecoverResourceManager(
|
||||||
|
_In_ HANDLE ResourceManagerHandle
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtGetNotificationResourceManager(
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_Out_ PTRANSACTION_NOTIFICATION TransactionNotification,
|
||||||
|
_In_ ULONG NotificationLength,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout,
|
||||||
|
_Out_opt_ PULONG ReturnLength,
|
||||||
|
_In_ ULONG Asynchronous,
|
||||||
|
_In_opt_ ULONG_PTR AsynchronousContext
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtQueryInformationResourceManager(
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
|
||||||
|
_Out_writes_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
|
||||||
|
_In_ ULONG ResourceManagerInformationLength,
|
||||||
|
_Out_opt_ PULONG ReturnLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtSetInformationResourceManager(
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
|
||||||
|
_In_reads_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
|
||||||
|
_In_ ULONG ResourceManagerInformationLength
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRegisterProtocolAddressInformation(
|
||||||
|
_In_ HANDLE ResourceManager,
|
||||||
|
_In_ PCRM_PROTOCOL_ID ProtocolId,
|
||||||
|
_In_ ULONG ProtocolInformationSize,
|
||||||
|
_In_ PVOID ProtocolInformation,
|
||||||
|
_In_opt_ ULONG CreateOptions
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPropagationComplete(
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ ULONG RequestCookie,
|
||||||
|
_In_ ULONG BufferLength,
|
||||||
|
_In_ PVOID Buffer
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtPropagationFailed(
|
||||||
|
_In_ HANDLE ResourceManagerHandle,
|
||||||
|
_In_ ULONG RequestCookie,
|
||||||
|
_In_ NTSTATUS PropStatus
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtFreezeTransactions(
|
||||||
|
_In_ PLARGE_INTEGER FreezeTimeout,
|
||||||
|
_In_ PLARGE_INTEGER ThawTimeout
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
// private
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtThawTransactions(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
430
phnt/include/nttp.h
Normal file
430
phnt/include/nttp.h
Normal file
@@ -0,0 +1,430 @@
|
|||||||
|
#ifndef _NTTP_H
|
||||||
|
#define _NTTP_H
|
||||||
|
|
||||||
|
// Some types are already defined in winnt.h.
|
||||||
|
|
||||||
|
typedef struct _TP_ALPC TP_ALPC, *PTP_ALPC;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef VOID (NTAPI *PTP_ALPC_CALLBACK)(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_ PTP_ALPC Alpc
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
typedef VOID (NTAPI *PTP_ALPC_CALLBACK_EX)(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_ PTP_ALPC Alpc,
|
||||||
|
_In_ PVOID ApcContext
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocPool(
|
||||||
|
_Out_ PTP_POOL *PoolReturn,
|
||||||
|
_Reserved_ PVOID Reserved
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpool
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleasePool(
|
||||||
|
_Inout_ PTP_POOL Pool
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:SetThreadpoolThreadMaximum
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpSetPoolMaxThreads(
|
||||||
|
_Inout_ PTP_POOL Pool,
|
||||||
|
_In_ LONG MaxThreads
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpSetPoolMinThreads(
|
||||||
|
_Inout_ PTP_POOL Pool,
|
||||||
|
_In_ LONG MinThreads
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpQueryPoolStackInformation(
|
||||||
|
_In_ PTP_POOL Pool,
|
||||||
|
_Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpSetPoolStackInformation(
|
||||||
|
_Inout_ PTP_POOL Pool,
|
||||||
|
_In_ PTP_POOL_STACK_INFORMATION PoolStackInformation
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocCleanupGroup(
|
||||||
|
_Out_ PTP_CLEANUP_GROUP *CleanupGroupReturn
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolCleanupGroup
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseCleanupGroup(
|
||||||
|
_Inout_ PTP_CLEANUP_GROUP CleanupGroup
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolCleanupGroupMembers
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseCleanupGroupMembers(
|
||||||
|
_Inout_ PTP_CLEANUP_GROUP CleanupGroup,
|
||||||
|
_In_ LOGICAL CancelPendingCallbacks,
|
||||||
|
_Inout_opt_ PVOID CleanupParameter
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:SetEventWhenCallbackReturns
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCallbackSetEventOnCompletion(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_In_ HANDLE Event
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:ReleaseSemaphoreWhenCallbackReturns
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCallbackReleaseSemaphoreOnCompletion(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_In_ HANDLE Semaphore,
|
||||||
|
_In_ LONG ReleaseCount
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:ReleaseMutexWhenCallbackReturns
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCallbackReleaseMutexOnCompletion(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_In_ HANDLE Mutex
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:LeaveCriticalSectionWhenCallbackReturns
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCallbackLeaveCriticalSectionOnCompletion(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_Inout_ PRTL_CRITICAL_SECTION CriticalSection
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:FreeLibraryWhenCallbackReturns
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCallbackUnloadDllOnCompletion(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_In_ PVOID DllHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CallbackMayRunLong
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpCallbackMayRunLong(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:DisassociateCurrentThreadFromCallback
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpDisassociateCallback(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:TrySubmitThreadpoolCallback
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpSimpleTryPost(
|
||||||
|
_In_ PTP_SIMPLE_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocWork(
|
||||||
|
_Out_ PTP_WORK *WorkReturn,
|
||||||
|
_In_ PTP_WORK_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolWork
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseWork(
|
||||||
|
_Inout_ PTP_WORK Work
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:SubmitThreadpoolWork
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpPostWork(
|
||||||
|
_Inout_ PTP_WORK Work
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:WaitForThreadpoolWorkCallbacks
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpWaitForWork(
|
||||||
|
_Inout_ PTP_WORK Work,
|
||||||
|
_In_ LOGICAL CancelPendingCallbacks
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocTimer(
|
||||||
|
_Out_ PTP_TIMER *Timer,
|
||||||
|
_In_ PTP_TIMER_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolTimer
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseTimer(
|
||||||
|
_Inout_ PTP_TIMER Timer
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:SetThreadpoolTimer
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpSetTimer(
|
||||||
|
_Inout_ PTP_TIMER Timer,
|
||||||
|
_In_opt_ PLARGE_INTEGER DueTime,
|
||||||
|
_In_ LONG Period,
|
||||||
|
_In_opt_ LONG WindowLength
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:IsThreadpoolTimerSet
|
||||||
|
NTSYSAPI
|
||||||
|
LOGICAL
|
||||||
|
NTAPI
|
||||||
|
TpIsTimerSet(
|
||||||
|
_In_ PTP_TIMER Timer
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:WaitForThreadpoolTimerCallbacks
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpWaitForTimer(
|
||||||
|
_Inout_ PTP_TIMER Timer,
|
||||||
|
_In_ LOGICAL CancelPendingCallbacks
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocWait(
|
||||||
|
_Out_ PTP_WAIT *WaitReturn,
|
||||||
|
_In_ PTP_WAIT_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolWait
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseWait(
|
||||||
|
_Inout_ PTP_WAIT Wait
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:SetThreadpoolWait
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpSetWait(
|
||||||
|
_Inout_ PTP_WAIT Wait,
|
||||||
|
_In_opt_ HANDLE Handle,
|
||||||
|
_In_opt_ PLARGE_INTEGER Timeout
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:WaitForThreadpoolWaitCallbacks
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpWaitForWait(
|
||||||
|
_Inout_ PTP_WAIT Wait,
|
||||||
|
_In_ LOGICAL CancelPendingCallbacks
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef VOID (NTAPI *PTP_IO_CALLBACK)(
|
||||||
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_ PVOID ApcContext,
|
||||||
|
_In_ PIO_STATUS_BLOCK IoSB,
|
||||||
|
_In_ PTP_IO Io
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
_Check_return_
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocIoCompletion(
|
||||||
|
_Out_ PTP_IO *IoReturn,
|
||||||
|
_In_ HANDLE File,
|
||||||
|
_In_ PTP_IO_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CloseThreadpoolIo
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseIoCompletion(
|
||||||
|
_Inout_ PTP_IO Io
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:StartThreadpoolIo
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpStartAsyncIoOperation(
|
||||||
|
_Inout_ PTP_IO Io
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:CancelThreadpoolIo
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCancelAsyncIoOperation(
|
||||||
|
_Inout_ PTP_IO Io
|
||||||
|
);
|
||||||
|
|
||||||
|
// winbase:WaitForThreadpoolIoCallbacks
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpWaitForIoCompletion(
|
||||||
|
_Inout_ PTP_IO Io,
|
||||||
|
_In_ LOGICAL CancelPendingCallbacks
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocAlpcCompletion(
|
||||||
|
_Out_ PTP_ALPC *AlpcReturn,
|
||||||
|
_In_ HANDLE AlpcPort,
|
||||||
|
_In_ PTP_ALPC_CALLBACK Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
||||||
|
// rev
|
||||||
|
NTSYSAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
TpAllocAlpcCompletionEx(
|
||||||
|
_Out_ PTP_ALPC *AlpcReturn,
|
||||||
|
_In_ HANDLE AlpcPort,
|
||||||
|
_In_ PTP_ALPC_CALLBACK_EX Callback,
|
||||||
|
_Inout_opt_ PVOID Context,
|
||||||
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
||||||
|
);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpReleaseAlpcCompletion(
|
||||||
|
_Inout_ PTP_ALPC Alpc
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpWaitForAlpcCompletion(
|
||||||
|
_Inout_ PTP_ALPC Alpc
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _TP_TRACE_TYPE
|
||||||
|
{
|
||||||
|
TpTraceThreadPriority = 1,
|
||||||
|
TpTraceThreadAffinity,
|
||||||
|
MaxTpTraceType
|
||||||
|
} TP_TRACE_TYPE;
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCaptureCaller(
|
||||||
|
_In_ TP_TRACE_TYPE Type
|
||||||
|
);
|
||||||
|
|
||||||
|
// private
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
TpCheckTerminateWorker(
|
||||||
|
_In_ HANDLE Thread
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
567
phnt/include/ntwow64.h
Normal file
567
phnt/include/ntwow64.h
Normal file
@@ -0,0 +1,567 @@
|
|||||||
|
#ifndef _NTWOW64_H
|
||||||
|
#define _NTWOW64_H
|
||||||
|
|
||||||
|
#define WOW64_SYSTEM_DIRECTORY "SysWOW64"
|
||||||
|
#define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64"
|
||||||
|
#define WOW64_X86_TAG " (x86)"
|
||||||
|
#define WOW64_X86_TAG_U L" (x86)"
|
||||||
|
|
||||||
|
// In USER_SHARED_DATA
|
||||||
|
typedef enum _WOW64_SHARED_INFORMATION
|
||||||
|
{
|
||||||
|
SharedNtdll32LdrInitializeThunk,
|
||||||
|
SharedNtdll32KiUserExceptionDispatcher,
|
||||||
|
SharedNtdll32KiUserApcDispatcher,
|
||||||
|
SharedNtdll32KiUserCallbackDispatcher,
|
||||||
|
SharedNtdll32ExpInterlockedPopEntrySListFault,
|
||||||
|
SharedNtdll32ExpInterlockedPopEntrySListResume,
|
||||||
|
SharedNtdll32ExpInterlockedPopEntrySListEnd,
|
||||||
|
SharedNtdll32RtlUserThreadStart,
|
||||||
|
SharedNtdll32pQueryProcessDebugInformationRemote,
|
||||||
|
SharedNtdll32BaseAddress,
|
||||||
|
SharedNtdll32LdrSystemDllInitBlock,
|
||||||
|
Wow64SharedPageEntriesCount
|
||||||
|
} WOW64_SHARED_INFORMATION;
|
||||||
|
|
||||||
|
// 32-bit definitions
|
||||||
|
|
||||||
|
#define WOW64_POINTER(Type) ULONG
|
||||||
|
|
||||||
|
typedef struct _RTL_BALANCED_NODE32
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
WOW64_POINTER(struct _RTL_BALANCED_NODE *) Children[2];
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
WOW64_POINTER(struct _RTL_BALANCED_NODE *) Left;
|
||||||
|
WOW64_POINTER(struct _RTL_BALANCED_NODE *) Right;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
WOW64_POINTER(UCHAR) Red : 1;
|
||||||
|
WOW64_POINTER(UCHAR) Balance : 2;
|
||||||
|
WOW64_POINTER(ULONG_PTR) ParentValue;
|
||||||
|
};
|
||||||
|
} RTL_BALANCED_NODE32, *PRTL_BALANCED_NODE32;
|
||||||
|
|
||||||
|
typedef struct _RTL_RB_TREE32
|
||||||
|
{
|
||||||
|
WOW64_POINTER(PRTL_BALANCED_NODE) Root;
|
||||||
|
WOW64_POINTER(PRTL_BALANCED_NODE) Min;
|
||||||
|
} RTL_RB_TREE32, *PRTL_RB_TREE32;
|
||||||
|
|
||||||
|
typedef struct _PEB_LDR_DATA32
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
BOOLEAN Initialized;
|
||||||
|
WOW64_POINTER(HANDLE) SsHandle;
|
||||||
|
LIST_ENTRY32 InLoadOrderModuleList;
|
||||||
|
LIST_ENTRY32 InMemoryOrderModuleList;
|
||||||
|
LIST_ENTRY32 InInitializationOrderModuleList;
|
||||||
|
WOW64_POINTER(PVOID) EntryInProgress;
|
||||||
|
BOOLEAN ShutdownInProgress;
|
||||||
|
WOW64_POINTER(HANDLE) ShutdownThreadId;
|
||||||
|
} PEB_LDR_DATA32, *PPEB_LDR_DATA32;
|
||||||
|
|
||||||
|
typedef struct _LDR_SERVICE_TAG_RECORD32
|
||||||
|
{
|
||||||
|
WOW64_POINTER(struct _LDR_SERVICE_TAG_RECORD *) Next;
|
||||||
|
ULONG ServiceTag;
|
||||||
|
} LDR_SERVICE_TAG_RECORD32, *PLDR_SERVICE_TAG_RECORD32;
|
||||||
|
|
||||||
|
typedef struct _LDRP_CSLIST32
|
||||||
|
{
|
||||||
|
WOW64_POINTER(PSINGLE_LIST_ENTRY) Tail;
|
||||||
|
} LDRP_CSLIST32, *PLDRP_CSLIST32;
|
||||||
|
|
||||||
|
typedef struct _LDR_DDAG_NODE32
|
||||||
|
{
|
||||||
|
LIST_ENTRY32 Modules;
|
||||||
|
WOW64_POINTER(PLDR_SERVICE_TAG_RECORD) ServiceTagList;
|
||||||
|
ULONG LoadCount;
|
||||||
|
ULONG LoadWhileUnloadingCount;
|
||||||
|
ULONG LowestLink;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
LDRP_CSLIST32 Dependencies;
|
||||||
|
SINGLE_LIST_ENTRY32 RemovalLink;
|
||||||
|
};
|
||||||
|
LDRP_CSLIST32 IncomingDependencies;
|
||||||
|
LDR_DDAG_STATE State;
|
||||||
|
SINGLE_LIST_ENTRY32 CondenseLink;
|
||||||
|
ULONG PreorderNumber;
|
||||||
|
} LDR_DDAG_NODE32, *PLDR_DDAG_NODE32;
|
||||||
|
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, DdagNode)
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, BaseNameHashValue)
|
||||||
|
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY32, ImplicitPathOptions)
|
||||||
|
|
||||||
|
typedef struct _LDR_DATA_TABLE_ENTRY32
|
||||||
|
{
|
||||||
|
LIST_ENTRY32 InLoadOrderLinks;
|
||||||
|
LIST_ENTRY32 InMemoryOrderLinks;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
LIST_ENTRY32 InInitializationOrderLinks;
|
||||||
|
LIST_ENTRY32 InProgressLinks;
|
||||||
|
};
|
||||||
|
WOW64_POINTER(PVOID) DllBase;
|
||||||
|
WOW64_POINTER(PVOID) EntryPoint;
|
||||||
|
ULONG SizeOfImage;
|
||||||
|
UNICODE_STRING32 FullDllName;
|
||||||
|
UNICODE_STRING32 BaseDllName;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
UCHAR FlagGroup[4];
|
||||||
|
ULONG Flags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG PackagedBinary : 1;
|
||||||
|
ULONG MarkedForRemoval : 1;
|
||||||
|
ULONG ImageDll : 1;
|
||||||
|
ULONG LoadNotificationsSent : 1;
|
||||||
|
ULONG TelemetryEntryProcessed : 1;
|
||||||
|
ULONG ProcessStaticImport : 1;
|
||||||
|
ULONG InLegacyLists : 1;
|
||||||
|
ULONG InIndexes : 1;
|
||||||
|
ULONG ShimDll : 1;
|
||||||
|
ULONG InExceptionTable : 1;
|
||||||
|
ULONG ReservedFlags1 : 2;
|
||||||
|
ULONG LoadInProgress : 1;
|
||||||
|
ULONG LoadConfigProcessed : 1;
|
||||||
|
ULONG EntryProcessed : 1;
|
||||||
|
ULONG ProtectDelayLoad : 1;
|
||||||
|
ULONG ReservedFlags3 : 2;
|
||||||
|
ULONG DontCallForThreads : 1;
|
||||||
|
ULONG ProcessAttachCalled : 1;
|
||||||
|
ULONG ProcessAttachFailed : 1;
|
||||||
|
ULONG CorDeferredValidate : 1;
|
||||||
|
ULONG CorImage : 1;
|
||||||
|
ULONG DontRelocate : 1;
|
||||||
|
ULONG CorILOnly : 1;
|
||||||
|
ULONG ReservedFlags5 : 3;
|
||||||
|
ULONG Redirected : 1;
|
||||||
|
ULONG ReservedFlags6 : 2;
|
||||||
|
ULONG CompatDatabaseProcessed : 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
USHORT ObsoleteLoadCount;
|
||||||
|
USHORT TlsIndex;
|
||||||
|
LIST_ENTRY32 HashLinks;
|
||||||
|
ULONG TimeDateStamp;
|
||||||
|
WOW64_POINTER(struct _ACTIVATION_CONTEXT *) EntryPointActivationContext;
|
||||||
|
WOW64_POINTER(PVOID) Lock;
|
||||||
|
WOW64_POINTER(PLDR_DDAG_NODE) DdagNode;
|
||||||
|
LIST_ENTRY32 NodeModuleLink;
|
||||||
|
WOW64_POINTER(struct _LDRP_LOAD_CONTEXT *) LoadContext;
|
||||||
|
WOW64_POINTER(PVOID) ParentDllBase;
|
||||||
|
WOW64_POINTER(PVOID) SwitchBackContext;
|
||||||
|
RTL_BALANCED_NODE32 BaseAddressIndexNode;
|
||||||
|
RTL_BALANCED_NODE32 MappingInfoIndexNode;
|
||||||
|
WOW64_POINTER(ULONG_PTR) OriginalBase;
|
||||||
|
LARGE_INTEGER LoadTime;
|
||||||
|
ULONG BaseNameHashValue;
|
||||||
|
LDR_DLL_LOAD_REASON LoadReason;
|
||||||
|
ULONG ImplicitPathOptions;
|
||||||
|
ULONG ReferenceCount;
|
||||||
|
ULONG DependentLoadFlags;
|
||||||
|
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32;
|
||||||
|
|
||||||
|
typedef struct _CURDIR32
|
||||||
|
{
|
||||||
|
UNICODE_STRING32 DosPath;
|
||||||
|
WOW64_POINTER(HANDLE) Handle;
|
||||||
|
} CURDIR32, *PCURDIR32;
|
||||||
|
|
||||||
|
typedef struct _RTL_DRIVE_LETTER_CURDIR32
|
||||||
|
{
|
||||||
|
USHORT Flags;
|
||||||
|
USHORT Length;
|
||||||
|
ULONG TimeStamp;
|
||||||
|
STRING32 DosPath;
|
||||||
|
} RTL_DRIVE_LETTER_CURDIR32, *PRTL_DRIVE_LETTER_CURDIR32;
|
||||||
|
|
||||||
|
typedef struct _RTL_USER_PROCESS_PARAMETERS32
|
||||||
|
{
|
||||||
|
ULONG MaximumLength;
|
||||||
|
ULONG Length;
|
||||||
|
|
||||||
|
ULONG Flags;
|
||||||
|
ULONG DebugFlags;
|
||||||
|
|
||||||
|
WOW64_POINTER(HANDLE) ConsoleHandle;
|
||||||
|
ULONG ConsoleFlags;
|
||||||
|
WOW64_POINTER(HANDLE) StandardInput;
|
||||||
|
WOW64_POINTER(HANDLE) StandardOutput;
|
||||||
|
WOW64_POINTER(HANDLE) StandardError;
|
||||||
|
|
||||||
|
CURDIR32 CurrentDirectory;
|
||||||
|
UNICODE_STRING32 DllPath;
|
||||||
|
UNICODE_STRING32 ImagePathName;
|
||||||
|
UNICODE_STRING32 CommandLine;
|
||||||
|
WOW64_POINTER(PVOID) Environment;
|
||||||
|
|
||||||
|
ULONG StartingX;
|
||||||
|
ULONG StartingY;
|
||||||
|
ULONG CountX;
|
||||||
|
ULONG CountY;
|
||||||
|
ULONG CountCharsX;
|
||||||
|
ULONG CountCharsY;
|
||||||
|
ULONG FillAttribute;
|
||||||
|
|
||||||
|
ULONG WindowFlags;
|
||||||
|
ULONG ShowWindowFlags;
|
||||||
|
UNICODE_STRING32 WindowTitle;
|
||||||
|
UNICODE_STRING32 DesktopInfo;
|
||||||
|
UNICODE_STRING32 ShellInfo;
|
||||||
|
UNICODE_STRING32 RuntimeData;
|
||||||
|
RTL_DRIVE_LETTER_CURDIR32 CurrentDirectories[RTL_MAX_DRIVE_LETTERS];
|
||||||
|
|
||||||
|
WOW64_POINTER(ULONG_PTR) EnvironmentSize;
|
||||||
|
WOW64_POINTER(ULONG_PTR) EnvironmentVersion;
|
||||||
|
WOW64_POINTER(PVOID) PackageDependencyData;
|
||||||
|
ULONG ProcessGroupId;
|
||||||
|
ULONG LoaderThreads;
|
||||||
|
} RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32;
|
||||||
|
|
||||||
|
typedef struct _PEB32
|
||||||
|
{
|
||||||
|
BOOLEAN InheritedAddressSpace;
|
||||||
|
BOOLEAN ReadImageFileExecOptions;
|
||||||
|
BOOLEAN BeingDebugged;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
BOOLEAN BitField;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
BOOLEAN ImageUsesLargePages : 1;
|
||||||
|
BOOLEAN IsProtectedProcess : 1;
|
||||||
|
BOOLEAN IsImageDynamicallyRelocated : 1;
|
||||||
|
BOOLEAN SkipPatchingUser32Forwarders : 1;
|
||||||
|
BOOLEAN IsPackagedProcess : 1;
|
||||||
|
BOOLEAN IsAppContainer : 1;
|
||||||
|
BOOLEAN IsProtectedProcessLight : 1;
|
||||||
|
BOOLEAN IsLongPathAwareProcess : 1;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
WOW64_POINTER(HANDLE) Mutant;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) ImageBaseAddress;
|
||||||
|
WOW64_POINTER(PPEB_LDR_DATA) Ldr;
|
||||||
|
WOW64_POINTER(PRTL_USER_PROCESS_PARAMETERS) ProcessParameters;
|
||||||
|
WOW64_POINTER(PVOID) SubSystemData;
|
||||||
|
WOW64_POINTER(PVOID) ProcessHeap;
|
||||||
|
WOW64_POINTER(PRTL_CRITICAL_SECTION) FastPebLock;
|
||||||
|
WOW64_POINTER(PVOID) AtlThunkSListPtr;
|
||||||
|
WOW64_POINTER(PVOID) IFEOKey;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG CrossProcessFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG ProcessInJob : 1;
|
||||||
|
ULONG ProcessInitializing : 1;
|
||||||
|
ULONG ProcessUsingVEH : 1;
|
||||||
|
ULONG ProcessUsingVCH : 1;
|
||||||
|
ULONG ProcessUsingFTH : 1;
|
||||||
|
ULONG ReservedBits0 : 27;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
WOW64_POINTER(PVOID) KernelCallbackTable;
|
||||||
|
WOW64_POINTER(PVOID) UserSharedInfoPtr;
|
||||||
|
};
|
||||||
|
ULONG SystemReserved[1];
|
||||||
|
ULONG AtlThunkSListPtr32;
|
||||||
|
WOW64_POINTER(PVOID) ApiSetMap;
|
||||||
|
ULONG TlsExpansionCounter;
|
||||||
|
WOW64_POINTER(PVOID) TlsBitmap;
|
||||||
|
ULONG TlsBitmapBits[2];
|
||||||
|
WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase;
|
||||||
|
WOW64_POINTER(PVOID) HotpatchInformation;
|
||||||
|
WOW64_POINTER(PVOID *) ReadOnlyStaticServerData;
|
||||||
|
WOW64_POINTER(PVOID) AnsiCodePageData;
|
||||||
|
WOW64_POINTER(PVOID) OemCodePageData;
|
||||||
|
WOW64_POINTER(PVOID) UnicodeCaseTableData;
|
||||||
|
|
||||||
|
ULONG NumberOfProcessors;
|
||||||
|
ULONG NtGlobalFlag;
|
||||||
|
|
||||||
|
LARGE_INTEGER CriticalSectionTimeout;
|
||||||
|
WOW64_POINTER(SIZE_T) HeapSegmentReserve;
|
||||||
|
WOW64_POINTER(SIZE_T) HeapSegmentCommit;
|
||||||
|
WOW64_POINTER(SIZE_T) HeapDeCommitTotalFreeThreshold;
|
||||||
|
WOW64_POINTER(SIZE_T) HeapDeCommitFreeBlockThreshold;
|
||||||
|
|
||||||
|
ULONG NumberOfHeaps;
|
||||||
|
ULONG MaximumNumberOfHeaps;
|
||||||
|
WOW64_POINTER(PVOID *) ProcessHeaps;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) GdiSharedHandleTable;
|
||||||
|
WOW64_POINTER(PVOID) ProcessStarterHelper;
|
||||||
|
ULONG GdiDCAttributeList;
|
||||||
|
|
||||||
|
WOW64_POINTER(PRTL_CRITICAL_SECTION) LoaderLock;
|
||||||
|
|
||||||
|
ULONG OSMajorVersion;
|
||||||
|
ULONG OSMinorVersion;
|
||||||
|
USHORT OSBuildNumber;
|
||||||
|
USHORT OSCSDVersion;
|
||||||
|
ULONG OSPlatformId;
|
||||||
|
ULONG ImageSubsystem;
|
||||||
|
ULONG ImageSubsystemMajorVersion;
|
||||||
|
ULONG ImageSubsystemMinorVersion;
|
||||||
|
WOW64_POINTER(ULONG_PTR) ActiveProcessAffinityMask;
|
||||||
|
GDI_HANDLE_BUFFER32 GdiHandleBuffer;
|
||||||
|
WOW64_POINTER(PVOID) PostProcessInitRoutine;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) TlsExpansionBitmap;
|
||||||
|
ULONG TlsExpansionBitmapBits[32];
|
||||||
|
|
||||||
|
ULONG SessionId;
|
||||||
|
|
||||||
|
ULARGE_INTEGER AppCompatFlags;
|
||||||
|
ULARGE_INTEGER AppCompatFlagsUser;
|
||||||
|
WOW64_POINTER(PVOID) pShimData;
|
||||||
|
WOW64_POINTER(PVOID) AppCompatInfo;
|
||||||
|
|
||||||
|
UNICODE_STRING32 CSDVersion;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) ActivationContextData;
|
||||||
|
WOW64_POINTER(PVOID) ProcessAssemblyStorageMap;
|
||||||
|
WOW64_POINTER(PVOID) SystemDefaultActivationContextData;
|
||||||
|
WOW64_POINTER(PVOID) SystemAssemblyStorageMap;
|
||||||
|
|
||||||
|
WOW64_POINTER(SIZE_T) MinimumStackCommit;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID *) FlsCallback;
|
||||||
|
LIST_ENTRY32 FlsListHead;
|
||||||
|
WOW64_POINTER(PVOID) FlsBitmap;
|
||||||
|
ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
|
||||||
|
ULONG FlsHighIndex;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) WerRegistrationData;
|
||||||
|
WOW64_POINTER(PVOID) WerShipAssertPtr;
|
||||||
|
WOW64_POINTER(PVOID) pContextData;
|
||||||
|
WOW64_POINTER(PVOID) pImageHeaderHash;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG TracingFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
ULONG HeapTracingEnabled : 1;
|
||||||
|
ULONG CritSecTracingEnabled : 1;
|
||||||
|
ULONG LibLoaderTracingEnabled : 1;
|
||||||
|
ULONG SpareTracingBits : 29;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
ULONGLONG CsrServerReadOnlySharedMemoryBase;
|
||||||
|
WOW64_POINTER(PVOID) TppWorkerpListLock;
|
||||||
|
LIST_ENTRY32 TppWorkerpList;
|
||||||
|
WOW64_POINTER(PVOID) WaitOnAddressHashTable[128];
|
||||||
|
} PEB32, *PPEB32;
|
||||||
|
|
||||||
|
C_ASSERT(FIELD_OFFSET(PEB32, IFEOKey) == 0x024);
|
||||||
|
C_ASSERT(FIELD_OFFSET(PEB32, UnicodeCaseTableData) == 0x060);
|
||||||
|
C_ASSERT(FIELD_OFFSET(PEB32, SystemAssemblyStorageMap) == 0x204);
|
||||||
|
C_ASSERT(FIELD_OFFSET(PEB32, pImageHeaderHash) == 0x23c);
|
||||||
|
C_ASSERT(FIELD_OFFSET(PEB32, WaitOnAddressHashTable) == 0x25c);
|
||||||
|
C_ASSERT(sizeof(PEB32) == 0x460);
|
||||||
|
|
||||||
|
#define GDI_BATCH_BUFFER_SIZE 310
|
||||||
|
|
||||||
|
typedef struct _GDI_TEB_BATCH32
|
||||||
|
{
|
||||||
|
ULONG Offset;
|
||||||
|
WOW64_POINTER(ULONG_PTR) HDC;
|
||||||
|
ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
|
||||||
|
} GDI_TEB_BATCH32, *PGDI_TEB_BATCH32;
|
||||||
|
|
||||||
|
typedef struct _TEB32
|
||||||
|
{
|
||||||
|
NT_TIB32 NtTib;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) EnvironmentPointer;
|
||||||
|
CLIENT_ID32 ClientId;
|
||||||
|
WOW64_POINTER(PVOID) ActiveRpcHandle;
|
||||||
|
WOW64_POINTER(PVOID) ThreadLocalStoragePointer;
|
||||||
|
WOW64_POINTER(PPEB) ProcessEnvironmentBlock;
|
||||||
|
|
||||||
|
ULONG LastErrorValue;
|
||||||
|
ULONG CountOfOwnedCriticalSections;
|
||||||
|
WOW64_POINTER(PVOID) CsrClientThread;
|
||||||
|
WOW64_POINTER(PVOID) Win32ThreadInfo;
|
||||||
|
ULONG User32Reserved[26];
|
||||||
|
ULONG UserReserved[5];
|
||||||
|
WOW64_POINTER(PVOID) WOW32Reserved;
|
||||||
|
LCID CurrentLocale;
|
||||||
|
ULONG FpSoftwareStatusRegister;
|
||||||
|
WOW64_POINTER(PVOID) ReservedForDebuggerInstrumentation[16];
|
||||||
|
WOW64_POINTER(PVOID) SystemReserved1[36];
|
||||||
|
UCHAR WorkingOnBehalfTicket[8];
|
||||||
|
NTSTATUS ExceptionCode;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) ActivationContextStackPointer;
|
||||||
|
WOW64_POINTER(ULONG_PTR) InstrumentationCallbackSp;
|
||||||
|
WOW64_POINTER(ULONG_PTR) InstrumentationCallbackPreviousPc;
|
||||||
|
WOW64_POINTER(ULONG_PTR) InstrumentationCallbackPreviousSp;
|
||||||
|
BOOLEAN InstrumentationCallbackDisabled;
|
||||||
|
UCHAR SpareBytes[23];
|
||||||
|
ULONG TxFsContext;
|
||||||
|
|
||||||
|
GDI_TEB_BATCH32 GdiTebBatch;
|
||||||
|
CLIENT_ID32 RealClientId;
|
||||||
|
WOW64_POINTER(HANDLE) GdiCachedProcessHandle;
|
||||||
|
ULONG GdiClientPID;
|
||||||
|
ULONG GdiClientTID;
|
||||||
|
WOW64_POINTER(PVOID) GdiThreadLocalInfo;
|
||||||
|
WOW64_POINTER(ULONG_PTR) Win32ClientInfo[62];
|
||||||
|
WOW64_POINTER(PVOID) glDispatchTable[233];
|
||||||
|
WOW64_POINTER(ULONG_PTR) glReserved1[29];
|
||||||
|
WOW64_POINTER(PVOID) glReserved2;
|
||||||
|
WOW64_POINTER(PVOID) glSectionInfo;
|
||||||
|
WOW64_POINTER(PVOID) glSection;
|
||||||
|
WOW64_POINTER(PVOID) glTable;
|
||||||
|
WOW64_POINTER(PVOID) glCurrentRC;
|
||||||
|
WOW64_POINTER(PVOID) glContext;
|
||||||
|
|
||||||
|
NTSTATUS LastStatusValue;
|
||||||
|
UNICODE_STRING32 StaticUnicodeString;
|
||||||
|
WCHAR StaticUnicodeBuffer[261];
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) DeallocationStack;
|
||||||
|
WOW64_POINTER(PVOID) TlsSlots[64];
|
||||||
|
LIST_ENTRY32 TlsLinks;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) Vdm;
|
||||||
|
WOW64_POINTER(PVOID) ReservedForNtRpc;
|
||||||
|
WOW64_POINTER(PVOID) DbgSsReserved[2];
|
||||||
|
|
||||||
|
ULONG HardErrorMode;
|
||||||
|
WOW64_POINTER(PVOID) Instrumentation[9];
|
||||||
|
GUID ActivityId;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) SubProcessTag;
|
||||||
|
WOW64_POINTER(PVOID) PerflibData;
|
||||||
|
WOW64_POINTER(PVOID) EtwTraceData;
|
||||||
|
WOW64_POINTER(PVOID) WinSockData;
|
||||||
|
ULONG GdiBatchCount;
|
||||||
|
|
||||||
|
union
|
||||||
|
{
|
||||||
|
PROCESSOR_NUMBER CurrentIdealProcessor;
|
||||||
|
ULONG IdealProcessorValue;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
UCHAR ReservedPad0;
|
||||||
|
UCHAR ReservedPad1;
|
||||||
|
UCHAR ReservedPad2;
|
||||||
|
UCHAR IdealProcessor;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
ULONG GuaranteedStackBytes;
|
||||||
|
WOW64_POINTER(PVOID) ReservedForPerf;
|
||||||
|
WOW64_POINTER(PVOID) ReservedForOle;
|
||||||
|
ULONG WaitingOnLoaderLock;
|
||||||
|
WOW64_POINTER(PVOID) SavedPriorityState;
|
||||||
|
WOW64_POINTER(ULONG_PTR) ReservedForCodeCoverage;
|
||||||
|
WOW64_POINTER(PVOID) ThreadPoolData;
|
||||||
|
WOW64_POINTER(PVOID *) TlsExpansionSlots;
|
||||||
|
|
||||||
|
ULONG MuiGeneration;
|
||||||
|
ULONG IsImpersonating;
|
||||||
|
WOW64_POINTER(PVOID) NlsCache;
|
||||||
|
WOW64_POINTER(PVOID) pShimData;
|
||||||
|
USHORT HeapVirtualAffinity;
|
||||||
|
USHORT LowFragHeapDataSlot;
|
||||||
|
WOW64_POINTER(HANDLE) CurrentTransactionHandle;
|
||||||
|
WOW64_POINTER(PTEB_ACTIVE_FRAME) ActiveFrame;
|
||||||
|
WOW64_POINTER(PVOID) FlsData;
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) PreferredLanguages;
|
||||||
|
WOW64_POINTER(PVOID) UserPrefLanguages;
|
||||||
|
WOW64_POINTER(PVOID) MergedPrefLanguages;
|
||||||
|
ULONG MuiImpersonation;
|
||||||
|
|
||||||
|
union
|
||||||
|
{
|
||||||
|
USHORT CrossTebFlags;
|
||||||
|
USHORT SpareCrossTebBits : 16;
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
USHORT SameTebFlags;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT SafeThunkCall : 1;
|
||||||
|
USHORT InDebugPrint : 1;
|
||||||
|
USHORT HasFiberData : 1;
|
||||||
|
USHORT SkipThreadAttach : 1;
|
||||||
|
USHORT WerInShipAssertCode : 1;
|
||||||
|
USHORT RanProcessInit : 1;
|
||||||
|
USHORT ClonedThread : 1;
|
||||||
|
USHORT SuppressDebugMsg : 1;
|
||||||
|
USHORT DisableUserStackWalk : 1;
|
||||||
|
USHORT RtlExceptionAttached : 1;
|
||||||
|
USHORT InitialThread : 1;
|
||||||
|
USHORT SessionAware : 1;
|
||||||
|
USHORT LoadOwner : 1;
|
||||||
|
USHORT LoaderWorker : 1;
|
||||||
|
USHORT SpareSameTebBits : 2;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
WOW64_POINTER(PVOID) TxnScopeEnterCallback;
|
||||||
|
WOW64_POINTER(PVOID) TxnScopeExitCallback;
|
||||||
|
WOW64_POINTER(PVOID) TxnScopeContext;
|
||||||
|
ULONG LockCount;
|
||||||
|
LONG WowTebOffset;
|
||||||
|
WOW64_POINTER(PVOID) ResourceRetValue;
|
||||||
|
WOW64_POINTER(PVOID) ReservedForWdf;
|
||||||
|
ULONGLONG ReservedForCrt;
|
||||||
|
GUID EffectiveContainerId;
|
||||||
|
} TEB32, *PTEB32;
|
||||||
|
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, ProcessEnvironmentBlock) == 0x030);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, ExceptionCode) == 0x1a4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, TxFsContext) == 0x1d0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, glContext) == 0xbf0);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, StaticUnicodeBuffer) == 0xc00);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, TlsLinks) == 0xf10);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, DbgSsReserved) == 0xf20);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, ActivityId) == 0xf50);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, GdiBatchCount) == 0xf70);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, TlsExpansionSlots) == 0xf94);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, FlsData) == 0xfb4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, MuiImpersonation) == 0xfc4);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, ReservedForCrt) == 0xfe8);
|
||||||
|
C_ASSERT(FIELD_OFFSET(TEB32, EffectiveContainerId) == 0xff0);
|
||||||
|
C_ASSERT(sizeof(TEB32) == 0x1000);
|
||||||
|
|
||||||
|
// Conversion
|
||||||
|
|
||||||
|
FORCEINLINE VOID UStr32ToUStr(
|
||||||
|
_Out_ PUNICODE_STRING Destination,
|
||||||
|
_In_ PUNICODE_STRING32 Source
|
||||||
|
)
|
||||||
|
{
|
||||||
|
Destination->Length = Source->Length;
|
||||||
|
Destination->MaximumLength = Source->MaximumLength;
|
||||||
|
Destination->Buffer = (PWCH)UlongToPtr(Source->Buffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
FORCEINLINE VOID UStrToUStr32(
|
||||||
|
_Out_ PUNICODE_STRING32 Destination,
|
||||||
|
_In_ PUNICODE_STRING Source
|
||||||
|
)
|
||||||
|
{
|
||||||
|
Destination->Length = Source->Length;
|
||||||
|
Destination->MaximumLength = Source->MaximumLength;
|
||||||
|
Destination->Buffer = PtrToUlong(Source->Buffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif
|
||||||
44
phnt/include/ntxcapi.h
Normal file
44
phnt/include/ntxcapi.h
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
#ifndef _NTXCAPI_H
|
||||||
|
#define _NTXCAPI_H
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
BOOLEAN
|
||||||
|
NTAPI
|
||||||
|
RtlDispatchException(
|
||||||
|
_In_ PEXCEPTION_RECORD ExceptionRecord,
|
||||||
|
_In_ PCONTEXT ContextRecord
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
DECLSPEC_NORETURN
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
RtlRaiseStatus(
|
||||||
|
_In_ NTSTATUS Status
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSAPI
|
||||||
|
VOID
|
||||||
|
NTAPI
|
||||||
|
RtlRaiseException(
|
||||||
|
_In_ PEXCEPTION_RECORD ExceptionRecord
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtContinue(
|
||||||
|
_In_ PCONTEXT ContextRecord,
|
||||||
|
_In_ BOOLEAN TestAlert
|
||||||
|
);
|
||||||
|
|
||||||
|
NTSYSCALLAPI
|
||||||
|
NTSTATUS
|
||||||
|
NTAPI
|
||||||
|
NtRaiseException(
|
||||||
|
_In_ PEXCEPTION_RECORD ExceptionRecord,
|
||||||
|
_In_ PCONTEXT ContextRecord,
|
||||||
|
_In_ BOOLEAN FirstChance
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
4442
phnt/include/ntzwapi.h
Normal file
4442
phnt/include/ntzwapi.h
Normal file
File diff suppressed because it is too large
Load Diff
102
phnt/include/phnt.h
Normal file
102
phnt/include/phnt.h
Normal file
@@ -0,0 +1,102 @@
|
|||||||
|
#ifndef _PHNT_H
|
||||||
|
#define _PHNT_H
|
||||||
|
|
||||||
|
// This header file provides access to NT APIs.
|
||||||
|
|
||||||
|
// Definitions are annotated to indicate their source. If a definition is not annotated, it has been
|
||||||
|
// retrieved from an official Microsoft source (NT headers, DDK headers, winnt.h).
|
||||||
|
|
||||||
|
// * "winbase" indicates that a definition has been reconstructed from a Win32-ized NT definition in
|
||||||
|
// winbase.h.
|
||||||
|
// * "rev" indicates that a definition has been reverse-engineered.
|
||||||
|
// * "dbg" indicates that a definition has been obtained from a debug message or assertion in a
|
||||||
|
// checked build of the kernel or file.
|
||||||
|
|
||||||
|
// Reliability:
|
||||||
|
// 1. No annotation.
|
||||||
|
// 2. dbg.
|
||||||
|
// 3. symbols, private. Types may be incorrect.
|
||||||
|
// 4. winbase. Names and types may be incorrect.
|
||||||
|
// 5. rev.
|
||||||
|
|
||||||
|
// Mode
|
||||||
|
#define PHNT_MODE_KERNEL 0
|
||||||
|
#define PHNT_MODE_USER 1
|
||||||
|
|
||||||
|
// Version
|
||||||
|
#define PHNT_WIN2K 50
|
||||||
|
#define PHNT_WINXP 51
|
||||||
|
#define PHNT_WS03 52
|
||||||
|
#define PHNT_VISTA 60
|
||||||
|
#define PHNT_WIN7 61
|
||||||
|
#define PHNT_WIN8 62
|
||||||
|
#define PHNT_WINBLUE 63
|
||||||
|
#define PHNT_THRESHOLD 100
|
||||||
|
#define PHNT_THRESHOLD2 101
|
||||||
|
#define PHNT_REDSTONE 102
|
||||||
|
#define PHNT_REDSTONE2 103
|
||||||
|
|
||||||
|
#ifndef PHNT_MODE
|
||||||
|
#define PHNT_MODE PHNT_MODE_USER
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifndef PHNT_VERSION
|
||||||
|
#define PHNT_VERSION PHNT_WIN7
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Options
|
||||||
|
|
||||||
|
//#define PHNT_NO_INLINE_INIT_STRING
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
extern "C" {
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#include <phnt_ntdef.h>
|
||||||
|
#include <ntnls.h>
|
||||||
|
#include <ntkeapi.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#include <ntldr.h>
|
||||||
|
#include <ntexapi.h>
|
||||||
|
|
||||||
|
#include <ntmmapi.h>
|
||||||
|
#include <ntobapi.h>
|
||||||
|
#include <ntpsapi.h>
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
#include <cfg.h>
|
||||||
|
#include <ntdbg.h>
|
||||||
|
#include <ntioapi.h>
|
||||||
|
#include <ntlpcapi.h>
|
||||||
|
#include <ntpfapi.h>
|
||||||
|
#include <ntpnpapi.h>
|
||||||
|
#include <ntpoapi.h>
|
||||||
|
#include <ntregapi.h>
|
||||||
|
#include <ntrtl.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||||
|
|
||||||
|
#include <ntseapi.h>
|
||||||
|
#include <nttmapi.h>
|
||||||
|
#include <nttp.h>
|
||||||
|
#include <ntxcapi.h>
|
||||||
|
|
||||||
|
#include <ntwow64.h>
|
||||||
|
|
||||||
|
#include <ntlsa.h>
|
||||||
|
#include <ntsam.h>
|
||||||
|
|
||||||
|
#include <ntmisc.h>
|
||||||
|
|
||||||
|
#include <ntzwapi.h>
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifdef __cplusplus
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
306
phnt/include/phnt_ntdef.h
Normal file
306
phnt/include/phnt_ntdef.h
Normal file
@@ -0,0 +1,306 @@
|
|||||||
|
#ifndef _PHNT_NTDEF_H
|
||||||
|
#define _PHNT_NTDEF_H
|
||||||
|
|
||||||
|
#ifndef _NTDEF_
|
||||||
|
#define _NTDEF_
|
||||||
|
|
||||||
|
// This header file provides basic NT types not included in Win32. If you have included winnt.h
|
||||||
|
// (perhaps indirectly), you must use this file instead of ntdef.h.
|
||||||
|
|
||||||
|
#ifndef NOTHING
|
||||||
|
#define NOTHING
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Basic types
|
||||||
|
|
||||||
|
typedef struct _QUAD
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
__int64 UseThisFieldToCopy;
|
||||||
|
double DoNotUseThisField;
|
||||||
|
};
|
||||||
|
} QUAD, *PQUAD;
|
||||||
|
|
||||||
|
// This isn't in NT, but it's useful.
|
||||||
|
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _QUAD_PTR
|
||||||
|
{
|
||||||
|
ULONG_PTR DoNotUseThisField1;
|
||||||
|
ULONG_PTR DoNotUseThisField2;
|
||||||
|
} QUAD_PTR, *PQUAD_PTR;
|
||||||
|
|
||||||
|
typedef ULONG LOGICAL;
|
||||||
|
typedef ULONG *PLOGICAL;
|
||||||
|
|
||||||
|
typedef _Success_(return >= 0) LONG NTSTATUS;
|
||||||
|
typedef NTSTATUS *PNTSTATUS;
|
||||||
|
|
||||||
|
// Cardinal types
|
||||||
|
|
||||||
|
typedef char CCHAR;
|
||||||
|
typedef short CSHORT;
|
||||||
|
typedef ULONG CLONG;
|
||||||
|
|
||||||
|
typedef CCHAR *PCCHAR;
|
||||||
|
typedef CSHORT *PCSHORT;
|
||||||
|
typedef CLONG *PCLONG;
|
||||||
|
|
||||||
|
typedef PCSTR PCSZ;
|
||||||
|
|
||||||
|
// Specific
|
||||||
|
|
||||||
|
typedef UCHAR KIRQL, *PKIRQL;
|
||||||
|
typedef LONG KPRIORITY;
|
||||||
|
typedef USHORT RTL_ATOM, *PRTL_ATOM;
|
||||||
|
|
||||||
|
typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
|
||||||
|
|
||||||
|
// NT status macros
|
||||||
|
|
||||||
|
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
|
||||||
|
#define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1)
|
||||||
|
#define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2)
|
||||||
|
#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)
|
||||||
|
|
||||||
|
#define NT_FACILITY_MASK 0xfff
|
||||||
|
#define NT_FACILITY_SHIFT 16
|
||||||
|
#define NT_FACILITY(Status) ((((ULONG)(Status)) >> NT_FACILITY_SHIFT) & NT_FACILITY_MASK)
|
||||||
|
|
||||||
|
#define NT_NTWIN32(Status) (NT_FACILITY(Status) == FACILITY_NTWIN32)
|
||||||
|
#define WIN32_FROM_NTSTATUS(Status) (((ULONG)(Status)) & 0xffff)
|
||||||
|
|
||||||
|
// Functions
|
||||||
|
|
||||||
|
#ifndef _WIN64
|
||||||
|
#define FASTCALL __fastcall
|
||||||
|
#else
|
||||||
|
#define FASTCALL
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Synchronization enumerations
|
||||||
|
|
||||||
|
typedef enum _EVENT_TYPE
|
||||||
|
{
|
||||||
|
NotificationEvent,
|
||||||
|
SynchronizationEvent
|
||||||
|
} EVENT_TYPE;
|
||||||
|
|
||||||
|
typedef enum _TIMER_TYPE
|
||||||
|
{
|
||||||
|
NotificationTimer,
|
||||||
|
SynchronizationTimer
|
||||||
|
} TIMER_TYPE;
|
||||||
|
|
||||||
|
typedef enum _WAIT_TYPE
|
||||||
|
{
|
||||||
|
WaitAll,
|
||||||
|
WaitAny,
|
||||||
|
WaitNotification
|
||||||
|
} WAIT_TYPE;
|
||||||
|
|
||||||
|
// Strings
|
||||||
|
|
||||||
|
typedef struct _STRING
|
||||||
|
{
|
||||||
|
USHORT Length;
|
||||||
|
USHORT MaximumLength;
|
||||||
|
_Field_size_bytes_part_opt_(MaximumLength, Length) PCHAR Buffer;
|
||||||
|
} STRING, *PSTRING, ANSI_STRING, *PANSI_STRING, OEM_STRING, *POEM_STRING;
|
||||||
|
|
||||||
|
typedef const STRING *PCSTRING;
|
||||||
|
typedef const ANSI_STRING *PCANSI_STRING;
|
||||||
|
typedef const OEM_STRING *PCOEM_STRING;
|
||||||
|
|
||||||
|
typedef struct _UNICODE_STRING
|
||||||
|
{
|
||||||
|
USHORT Length;
|
||||||
|
USHORT MaximumLength;
|
||||||
|
_Field_size_bytes_part_(MaximumLength, Length) PWCH Buffer;
|
||||||
|
} UNICODE_STRING, *PUNICODE_STRING;
|
||||||
|
|
||||||
|
typedef const UNICODE_STRING *PCUNICODE_STRING;
|
||||||
|
|
||||||
|
#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }
|
||||||
|
|
||||||
|
// Balanced tree node
|
||||||
|
|
||||||
|
#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3
|
||||||
|
|
||||||
|
typedef struct _RTL_BALANCED_NODE
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct _RTL_BALANCED_NODE *Children[2];
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
struct _RTL_BALANCED_NODE *Left;
|
||||||
|
struct _RTL_BALANCED_NODE *Right;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
union
|
||||||
|
{
|
||||||
|
UCHAR Red : 1;
|
||||||
|
UCHAR Balance : 2;
|
||||||
|
ULONG_PTR ParentValue;
|
||||||
|
};
|
||||||
|
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
|
||||||
|
|
||||||
|
#define RTL_BALANCED_NODE_GET_PARENT_POINTER(Node) \
|
||||||
|
((PRTL_BALANCED_NODE)((Node)->ParentValue & ~RTL_BALANCED_NODE_RESERVED_PARENT_MASK))
|
||||||
|
|
||||||
|
// Portability
|
||||||
|
|
||||||
|
typedef struct _SINGLE_LIST_ENTRY32
|
||||||
|
{
|
||||||
|
ULONG Next;
|
||||||
|
} SINGLE_LIST_ENTRY32, *PSINGLE_LIST_ENTRY32;
|
||||||
|
|
||||||
|
typedef struct _STRING32
|
||||||
|
{
|
||||||
|
USHORT Length;
|
||||||
|
USHORT MaximumLength;
|
||||||
|
ULONG Buffer;
|
||||||
|
} STRING32, *PSTRING32;
|
||||||
|
|
||||||
|
typedef STRING32 UNICODE_STRING32, *PUNICODE_STRING32;
|
||||||
|
typedef STRING32 ANSI_STRING32, *PANSI_STRING32;
|
||||||
|
|
||||||
|
typedef struct _STRING64
|
||||||
|
{
|
||||||
|
USHORT Length;
|
||||||
|
USHORT MaximumLength;
|
||||||
|
ULONGLONG Buffer;
|
||||||
|
} STRING64, *PSTRING64;
|
||||||
|
|
||||||
|
typedef STRING64 UNICODE_STRING64, *PUNICODE_STRING64;
|
||||||
|
typedef STRING64 ANSI_STRING64, *PANSI_STRING64;
|
||||||
|
|
||||||
|
// Object attributes
|
||||||
|
|
||||||
|
#define OBJ_INHERIT 0x00000002
|
||||||
|
#define OBJ_PERMANENT 0x00000010
|
||||||
|
#define OBJ_EXCLUSIVE 0x00000020
|
||||||
|
#define OBJ_CASE_INSENSITIVE 0x00000040
|
||||||
|
#define OBJ_OPENIF 0x00000080
|
||||||
|
#define OBJ_OPENLINK 0x00000100
|
||||||
|
#define OBJ_KERNEL_HANDLE 0x00000200
|
||||||
|
#define OBJ_FORCE_ACCESS_CHECK 0x00000400
|
||||||
|
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800
|
||||||
|
#define OBJ_DONT_REPARSE 0x00001000
|
||||||
|
#define OBJ_VALID_ATTRIBUTES 0x00001ff2
|
||||||
|
|
||||||
|
typedef struct _OBJECT_ATTRIBUTES
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
HANDLE RootDirectory;
|
||||||
|
PUNICODE_STRING ObjectName;
|
||||||
|
ULONG Attributes;
|
||||||
|
PVOID SecurityDescriptor; // PSECURITY_DESCRIPTOR;
|
||||||
|
PVOID SecurityQualityOfService; // PSECURITY_QUALITY_OF_SERVICE
|
||||||
|
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
|
||||||
|
|
||||||
|
typedef const OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
|
||||||
|
|
||||||
|
#define InitializeObjectAttributes(p, n, a, r, s) { \
|
||||||
|
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
|
||||||
|
(p)->RootDirectory = r; \
|
||||||
|
(p)->Attributes = a; \
|
||||||
|
(p)->ObjectName = n; \
|
||||||
|
(p)->SecurityDescriptor = s; \
|
||||||
|
(p)->SecurityQualityOfService = NULL; \
|
||||||
|
}
|
||||||
|
|
||||||
|
#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a) { sizeof(OBJECT_ATTRIBUTES), NULL, n, a, NULL, NULL }
|
||||||
|
#define RTL_INIT_OBJECT_ATTRIBUTES(n, a) RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
|
||||||
|
|
||||||
|
// Portability
|
||||||
|
|
||||||
|
typedef struct _OBJECT_ATTRIBUTES64
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
ULONG64 RootDirectory;
|
||||||
|
ULONG64 ObjectName;
|
||||||
|
ULONG Attributes;
|
||||||
|
ULONG64 SecurityDescriptor;
|
||||||
|
ULONG64 SecurityQualityOfService;
|
||||||
|
} OBJECT_ATTRIBUTES64, *POBJECT_ATTRIBUTES64;
|
||||||
|
|
||||||
|
typedef const OBJECT_ATTRIBUTES64 *PCOBJECT_ATTRIBUTES64;
|
||||||
|
|
||||||
|
typedef struct _OBJECT_ATTRIBUTES32
|
||||||
|
{
|
||||||
|
ULONG Length;
|
||||||
|
ULONG RootDirectory;
|
||||||
|
ULONG ObjectName;
|
||||||
|
ULONG Attributes;
|
||||||
|
ULONG SecurityDescriptor;
|
||||||
|
ULONG SecurityQualityOfService;
|
||||||
|
} OBJECT_ATTRIBUTES32, *POBJECT_ATTRIBUTES32;
|
||||||
|
|
||||||
|
typedef const OBJECT_ATTRIBUTES32 *PCOBJECT_ATTRIBUTES32;
|
||||||
|
|
||||||
|
// Product types
|
||||||
|
|
||||||
|
typedef enum _NT_PRODUCT_TYPE
|
||||||
|
{
|
||||||
|
NtProductWinNt = 1,
|
||||||
|
NtProductLanManNt,
|
||||||
|
NtProductServer
|
||||||
|
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
|
||||||
|
|
||||||
|
typedef enum _SUITE_TYPE
|
||||||
|
{
|
||||||
|
SmallBusiness,
|
||||||
|
Enterprise,
|
||||||
|
BackOffice,
|
||||||
|
CommunicationServer,
|
||||||
|
TerminalServer,
|
||||||
|
SmallBusinessRestricted,
|
||||||
|
EmbeddedNT,
|
||||||
|
DataCenter,
|
||||||
|
SingleUserTS,
|
||||||
|
Personal,
|
||||||
|
Blade,
|
||||||
|
EmbeddedRestricted,
|
||||||
|
SecurityAppliance,
|
||||||
|
StorageServer,
|
||||||
|
ComputeServer,
|
||||||
|
WHServer,
|
||||||
|
PhoneNT,
|
||||||
|
MaxSuiteType
|
||||||
|
} SUITE_TYPE;
|
||||||
|
|
||||||
|
// Specific
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID
|
||||||
|
{
|
||||||
|
HANDLE UniqueProcess;
|
||||||
|
HANDLE UniqueThread;
|
||||||
|
} CLIENT_ID, *PCLIENT_ID;
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID32
|
||||||
|
{
|
||||||
|
ULONG UniqueProcess;
|
||||||
|
ULONG UniqueThread;
|
||||||
|
} CLIENT_ID32, *PCLIENT_ID32;
|
||||||
|
|
||||||
|
typedef struct _CLIENT_ID64
|
||||||
|
{
|
||||||
|
ULONGLONG UniqueProcess;
|
||||||
|
ULONGLONG UniqueThread;
|
||||||
|
} CLIENT_ID64, *PCLIENT_ID64;
|
||||||
|
|
||||||
|
#include <pshpack4.h>
|
||||||
|
|
||||||
|
typedef struct _KSYSTEM_TIME
|
||||||
|
{
|
||||||
|
ULONG LowPart;
|
||||||
|
LONG High1Time;
|
||||||
|
LONG High2Time;
|
||||||
|
} KSYSTEM_TIME, *PKSYSTEM_TIME;
|
||||||
|
|
||||||
|
#include <poppack.h>
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#endif
|
||||||
53
phnt/include/phnt_windows.h
Normal file
53
phnt/include/phnt_windows.h
Normal file
@@ -0,0 +1,53 @@
|
|||||||
|
#ifndef _PHNT_WINDOWS_H
|
||||||
|
#define _PHNT_WINDOWS_H
|
||||||
|
|
||||||
|
// This header file provides access to Win32, plus NTSTATUS values and some access mask values.
|
||||||
|
|
||||||
|
#define WIN32_LEAN_AND_MEAN
|
||||||
|
#define WIN32_NO_STATUS
|
||||||
|
#include <windows.h>
|
||||||
|
#undef WIN32_NO_STATUS
|
||||||
|
#include <ntstatus.h>
|
||||||
|
#include <winioctl.h>
|
||||||
|
|
||||||
|
typedef double DOUBLE;
|
||||||
|
typedef GUID *PGUID;
|
||||||
|
|
||||||
|
// Desktop access rights
|
||||||
|
#define DESKTOP_ALL_ACCESS \
|
||||||
|
(DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_ENUMERATE | \
|
||||||
|
DESKTOP_HOOKCONTROL | DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | \
|
||||||
|
DESKTOP_READOBJECTS | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS | \
|
||||||
|
STANDARD_RIGHTS_REQUIRED)
|
||||||
|
#define DESKTOP_GENERIC_READ \
|
||||||
|
(DESKTOP_ENUMERATE | DESKTOP_READOBJECTS | STANDARD_RIGHTS_READ)
|
||||||
|
#define DESKTOP_GENERIC_WRITE \
|
||||||
|
(DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_HOOKCONTROL | \
|
||||||
|
DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | DESKTOP_WRITEOBJECTS | \
|
||||||
|
STANDARD_RIGHTS_WRITE)
|
||||||
|
#define DESKTOP_GENERIC_EXECUTE \
|
||||||
|
(DESKTOP_SWITCHDESKTOP | STANDARD_RIGHTS_EXECUTE)
|
||||||
|
|
||||||
|
// Window station access rights
|
||||||
|
#define WINSTA_GENERIC_READ \
|
||||||
|
(WINSTA_ENUMDESKTOPS | WINSTA_ENUMERATE | WINSTA_READATTRIBUTES | \
|
||||||
|
WINSTA_READSCREEN | STANDARD_RIGHTS_READ)
|
||||||
|
#define WINSTA_GENERIC_WRITE \
|
||||||
|
(WINSTA_ACCESSCLIPBOARD | WINSTA_CREATEDESKTOP | WINSTA_WRITEATTRIBUTES | \
|
||||||
|
STANDARD_RIGHTS_WRITE)
|
||||||
|
#define WINSTA_GENERIC_EXECUTE \
|
||||||
|
(WINSTA_ACCESSGLOBALATOMS | WINSTA_EXITWINDOWS | STANDARD_RIGHTS_EXECUTE)
|
||||||
|
|
||||||
|
// WMI access rights
|
||||||
|
#define WMIGUID_GENERIC_READ \
|
||||||
|
(WMIGUID_QUERY | WMIGUID_NOTIFICATION | WMIGUID_READ_DESCRIPTION | \
|
||||||
|
STANDARD_RIGHTS_READ)
|
||||||
|
#define WMIGUID_GENERIC_WRITE \
|
||||||
|
(WMIGUID_SET | TRACELOG_CREATE_REALTIME | TRACELOG_CREATE_ONDISK | \
|
||||||
|
STANDARD_RIGHTS_WRITE)
|
||||||
|
#define WMIGUID_GENERIC_EXECUTE \
|
||||||
|
(WMIGUID_EXECUTE | TRACELOG_GUID_ENABLE | TRACELOG_LOG_EVENT | \
|
||||||
|
TRACELOG_ACCESS_REALTIME | TRACELOG_REGISTER_GUIDS | \
|
||||||
|
STANDARD_RIGHTS_EXECUTE)
|
||||||
|
|
||||||
|
#endif
|
||||||
96
phnt/include/subprocesstag.h
Normal file
96
phnt/include/subprocesstag.h
Normal file
@@ -0,0 +1,96 @@
|
|||||||
|
#ifndef _SUBPROCESSTAG_H
|
||||||
|
#define _SUBPROCESSTAG_H
|
||||||
|
|
||||||
|
// Subprocess tag information
|
||||||
|
|
||||||
|
typedef enum _TAG_INFO_LEVEL
|
||||||
|
{
|
||||||
|
eTagInfoLevelNameFromTag = 1, // TAG_INFO_NAME_FROM_TAG
|
||||||
|
eTagInfoLevelNamesReferencingModule, // TAG_INFO_NAMES_REFERENCING_MODULE
|
||||||
|
eTagInfoLevelNameTagMapping, // TAG_INFO_NAME_TAG_MAPPING
|
||||||
|
eTagInfoLevelMax
|
||||||
|
} TAG_INFO_LEVEL;
|
||||||
|
|
||||||
|
typedef enum _TAG_TYPE
|
||||||
|
{
|
||||||
|
eTagTypeService = 1,
|
||||||
|
eTagTypeMax
|
||||||
|
} TAG_TYPE;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_FROM_TAG_IN_PARAMS
|
||||||
|
{
|
||||||
|
DWORD dwPid;
|
||||||
|
DWORD dwTag;
|
||||||
|
} TAG_INFO_NAME_FROM_TAG_IN_PARAMS, *PTAG_INFO_NAME_FROM_TAG_IN_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_FROM_TAG_OUT_PARAMS
|
||||||
|
{
|
||||||
|
DWORD eTagType;
|
||||||
|
LPWSTR pszName;
|
||||||
|
} TAG_INFO_NAME_FROM_TAG_OUT_PARAMS, *PTAG_INFO_NAME_FROM_TAG_OUT_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_FROM_TAG
|
||||||
|
{
|
||||||
|
TAG_INFO_NAME_FROM_TAG_IN_PARAMS InParams;
|
||||||
|
TAG_INFO_NAME_FROM_TAG_OUT_PARAMS OutParams;
|
||||||
|
} TAG_INFO_NAME_FROM_TAG, *PTAG_INFO_NAME_FROM_TAG;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS
|
||||||
|
{
|
||||||
|
DWORD dwPid;
|
||||||
|
LPWSTR pszModule;
|
||||||
|
} TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS
|
||||||
|
{
|
||||||
|
DWORD eTagType;
|
||||||
|
LPWSTR pmszNames;
|
||||||
|
} TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS, *PTAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAMES_REFERENCING_MODULE
|
||||||
|
{
|
||||||
|
TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS InParams;
|
||||||
|
TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS OutParams;
|
||||||
|
} TAG_INFO_NAMES_REFERENCING_MODULE, *PTAG_INFO_NAMES_REFERENCING_MODULE;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS
|
||||||
|
{
|
||||||
|
DWORD dwPid;
|
||||||
|
} TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_IN_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_TAG_MAPPING_ELEMENT
|
||||||
|
{
|
||||||
|
DWORD eTagType;
|
||||||
|
DWORD dwTag;
|
||||||
|
LPWSTR pszName;
|
||||||
|
LPWSTR pszGroupName;
|
||||||
|
} TAG_INFO_NAME_TAG_MAPPING_ELEMENT, *PTAG_INFO_NAME_TAG_MAPPING_ELEMENT;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS
|
||||||
|
{
|
||||||
|
DWORD cElements;
|
||||||
|
PTAG_INFO_NAME_TAG_MAPPING_ELEMENT pNameTagMappingElements;
|
||||||
|
} TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS, *PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS;
|
||||||
|
|
||||||
|
typedef struct _TAG_INFO_NAME_TAG_MAPPING
|
||||||
|
{
|
||||||
|
TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS InParams;
|
||||||
|
PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS pOutParams;
|
||||||
|
} TAG_INFO_NAME_TAG_MAPPING, *PTAG_INFO_NAME_TAG_MAPPING;
|
||||||
|
|
||||||
|
_Must_inspect_result_
|
||||||
|
DWORD
|
||||||
|
WINAPI
|
||||||
|
I_QueryTagInformation(
|
||||||
|
_In_opt_ LPCWSTR pszMachineName,
|
||||||
|
_In_ TAG_INFO_LEVEL eInfoLevel,
|
||||||
|
_Inout_ PVOID pTagInfo
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef DWORD (WINAPI *PQUERY_TAG_INFORMATION)(
|
||||||
|
_In_opt_ LPCWSTR pszMachineName,
|
||||||
|
_In_ TAG_INFO_LEVEL eInfoLevel,
|
||||||
|
_Inout_ PVOID pTagInfo
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
748
phnt/include/winsta.h
Normal file
748
phnt/include/winsta.h
Normal file
@@ -0,0 +1,748 @@
|
|||||||
|
#ifndef _WINSTA_H
|
||||||
|
#define _WINSTA_H
|
||||||
|
|
||||||
|
// begin_msdn:http://msdn.microsoft.com/en-us/library/cc248779%28PROT.10%29.aspx
|
||||||
|
|
||||||
|
// Access rights
|
||||||
|
|
||||||
|
#define WINSTATION_QUERY 0x00000001 // WinStationQueryInformation
|
||||||
|
#define WINSTATION_SET 0x00000002 // WinStationSetInformation
|
||||||
|
#define WINSTATION_RESET 0x00000004 // WinStationReset
|
||||||
|
#define WINSTATION_VIRTUAL 0x00000008 //read/write direct data
|
||||||
|
#define WINSTATION_SHADOW 0x00000010 // WinStationShadow
|
||||||
|
#define WINSTATION_LOGON 0x00000020 // logon to WinStation
|
||||||
|
#define WINSTATION_LOGOFF 0x00000040 // WinStationLogoff
|
||||||
|
#define WINSTATION_MSG 0x00000080 // WinStationMsg
|
||||||
|
#define WINSTATION_CONNECT 0x00000100 // WinStationConnect
|
||||||
|
#define WINSTATION_DISCONNECT 0x00000200 // WinStationDisconnect
|
||||||
|
#define WINSTATION_GUEST_ACCESS WINSTATION_LOGON
|
||||||
|
|
||||||
|
#define WINSTATION_CURRENT_GUEST_ACCESS (WINSTATION_VIRTUAL | WINSTATION_LOGOFF)
|
||||||
|
#define WINSTATION_USER_ACCESS (WINSTATION_GUEST_ACCESS | WINSTATION_QUERY | WINSTATION_CONNECT)
|
||||||
|
#define WINSTATION_CURRENT_USER_ACCESS \
|
||||||
|
(WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
|
||||||
|
WINSTATION_LOGOFF | WINSTATION_DISCONNECT)
|
||||||
|
#define WINSTATION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | WINSTATION_QUERY | \
|
||||||
|
WINSTATION_SET | WINSTATION_RESET | WINSTATION_VIRTUAL | \
|
||||||
|
WINSTATION_SHADOW | WINSTATION_LOGON | WINSTATION_MSG | \
|
||||||
|
WINSTATION_CONNECT | WINSTATION_DISCONNECT)
|
||||||
|
|
||||||
|
#define WDPREFIX_LENGTH 12
|
||||||
|
#define STACK_ADDRESS_LENGTH 128
|
||||||
|
#define MAX_BR_NAME 65
|
||||||
|
#define DIRECTORY_LENGTH 256
|
||||||
|
#define INITIALPROGRAM_LENGTH 256
|
||||||
|
#define USERNAME_LENGTH 20
|
||||||
|
#define DOMAIN_LENGTH 17
|
||||||
|
#define PASSWORD_LENGTH 14
|
||||||
|
#define NASISPECIFICNAME_LENGTH 14
|
||||||
|
#define NASIUSERNAME_LENGTH 47
|
||||||
|
#define NASIPASSWORD_LENGTH 24
|
||||||
|
#define NASISESSIONNAME_LENGTH 16
|
||||||
|
#define NASIFILESERVER_LENGTH 47
|
||||||
|
|
||||||
|
#define CLIENTDATANAME_LENGTH 7
|
||||||
|
#define CLIENTNAME_LENGTH 20
|
||||||
|
#define CLIENTADDRESS_LENGTH 30
|
||||||
|
#define IMEFILENAME_LENGTH 32
|
||||||
|
#define DIRECTORY_LENGTH 256
|
||||||
|
#define CLIENTLICENSE_LENGTH 32
|
||||||
|
#define CLIENTMODEM_LENGTH 40
|
||||||
|
#define CLIENT_PRODUCT_ID_LENGTH 32
|
||||||
|
#define MAX_COUNTER_EXTENSIONS 2
|
||||||
|
#define WINSTATIONNAME_LENGTH 32
|
||||||
|
|
||||||
|
#define TERMSRV_TOTAL_SESSIONS 1
|
||||||
|
#define TERMSRV_DISC_SESSIONS 2
|
||||||
|
#define TERMSRV_RECON_SESSIONS 3
|
||||||
|
#define TERMSRV_CURRENT_ACTIVE_SESSIONS 4
|
||||||
|
#define TERMSRV_CURRENT_DISC_SESSIONS 5
|
||||||
|
#define TERMSRV_PENDING_SESSIONS 6
|
||||||
|
#define TERMSRV_SUCC_TOTAL_LOGONS 7
|
||||||
|
#define TERMSRV_SUCC_LOCAL_LOGONS 8
|
||||||
|
#define TERMSRV_SUCC_REMOTE_LOGONS 9
|
||||||
|
#define TERMSRV_SUCC_SESSION0_LOGONS 10
|
||||||
|
#define TERMSRV_CURRENT_TERMINATING_SESSIONS 11
|
||||||
|
#define TERMSRV_CURRENT_LOGGEDON_SESSIONS 12
|
||||||
|
|
||||||
|
typedef RTL_TIME_ZONE_INFORMATION TS_TIME_ZONE_INFORMATION, *PTS_TIME_ZONE_INFORMATION;
|
||||||
|
|
||||||
|
typedef WCHAR WINSTATIONNAME[WINSTATIONNAME_LENGTH + 1];
|
||||||
|
|
||||||
|
// Variable length data descriptor (not needed)
|
||||||
|
typedef struct _VARDATA_WIRE
|
||||||
|
{
|
||||||
|
USHORT Size;
|
||||||
|
USHORT Offset;
|
||||||
|
} VARDATA_WIRE, *PVARDATA_WIRE;
|
||||||
|
|
||||||
|
typedef enum _WINSTATIONSTATECLASS
|
||||||
|
{
|
||||||
|
State_Active = 0,
|
||||||
|
State_Connected = 1,
|
||||||
|
State_ConnectQuery = 2,
|
||||||
|
State_Shadow = 3,
|
||||||
|
State_Disconnected = 4,
|
||||||
|
State_Idle = 5,
|
||||||
|
State_Listen = 6,
|
||||||
|
State_Reset = 7,
|
||||||
|
State_Down = 8,
|
||||||
|
State_Init = 9
|
||||||
|
} WINSTATIONSTATECLASS;
|
||||||
|
|
||||||
|
typedef struct _SESSIONIDW
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
ULONG SessionId;
|
||||||
|
ULONG LogonId;
|
||||||
|
};
|
||||||
|
WINSTATIONNAME WinStationName;
|
||||||
|
WINSTATIONSTATECLASS State;
|
||||||
|
} SESSIONIDW, *PSESSIONIDW;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef enum _WINSTATIONINFOCLASS
|
||||||
|
{
|
||||||
|
WinStationCreateData,
|
||||||
|
WinStationConfiguration,
|
||||||
|
WinStationPdParams,
|
||||||
|
WinStationWd,
|
||||||
|
WinStationPd,
|
||||||
|
WinStationPrinter,
|
||||||
|
WinStationClient,
|
||||||
|
WinStationModules,
|
||||||
|
WinStationInformation,
|
||||||
|
WinStationTrace,
|
||||||
|
WinStationBeep,
|
||||||
|
WinStationEncryptionOff,
|
||||||
|
WinStationEncryptionPerm,
|
||||||
|
WinStationNtSecurity,
|
||||||
|
WinStationUserToken,
|
||||||
|
WinStationUnused1,
|
||||||
|
WinStationVideoData,
|
||||||
|
WinStationInitialProgram,
|
||||||
|
WinStationCd,
|
||||||
|
WinStationSystemTrace,
|
||||||
|
WinStationVirtualData,
|
||||||
|
WinStationClientData,
|
||||||
|
WinStationSecureDesktopEnter,
|
||||||
|
WinStationSecureDesktopExit,
|
||||||
|
WinStationLoadBalanceSessionTarget,
|
||||||
|
WinStationLoadIndicator,
|
||||||
|
WinStationShadowInfo,
|
||||||
|
WinStationDigProductId,
|
||||||
|
WinStationLockedState,
|
||||||
|
WinStationRemoteAddress,
|
||||||
|
WinStationIdleTime,
|
||||||
|
WinStationLastReconnectType,
|
||||||
|
WinStationDisallowAutoReconnect,
|
||||||
|
WinStationMprNotifyInfo,
|
||||||
|
WinStationExecSrvSystemPipe,
|
||||||
|
WinStationSmartCardAutoLogon,
|
||||||
|
WinStationIsAdminLoggedOn,
|
||||||
|
WinStationReconnectedFromId,
|
||||||
|
WinStationEffectsPolicy,
|
||||||
|
WinStationType,
|
||||||
|
WinStationInformationEx,
|
||||||
|
WinStationValidationInfo
|
||||||
|
} WINSTATIONINFOCLASS;
|
||||||
|
|
||||||
|
// WinStationCreateData
|
||||||
|
typedef struct _WINSTATIONCREATE
|
||||||
|
{
|
||||||
|
ULONG fEnableWinStation : 1;
|
||||||
|
ULONG MaxInstanceCount;
|
||||||
|
} WINSTATIONCREATE, *PWINSTATIONCREATE;
|
||||||
|
|
||||||
|
// WinStationClient
|
||||||
|
typedef struct _WINSTATIONCLIENT
|
||||||
|
{
|
||||||
|
ULONG fTextOnly : 1;
|
||||||
|
ULONG fDisableCtrlAltDel : 1;
|
||||||
|
ULONG fMouse : 1;
|
||||||
|
ULONG fDoubleClickDetect : 1;
|
||||||
|
ULONG fINetClient : 1;
|
||||||
|
ULONG fPromptForPassword : 1;
|
||||||
|
ULONG fMaximizeShell : 1;
|
||||||
|
ULONG fEnableWindowsKey : 1;
|
||||||
|
ULONG fRemoteConsoleAudio : 1;
|
||||||
|
ULONG fPasswordIsScPin : 1;
|
||||||
|
ULONG fNoAudioPlayback : 1;
|
||||||
|
ULONG fUsingSavedCreds : 1;
|
||||||
|
WCHAR ClientName[CLIENTNAME_LENGTH + 1];
|
||||||
|
WCHAR Domain[DOMAIN_LENGTH + 1];
|
||||||
|
WCHAR UserName[USERNAME_LENGTH + 1];
|
||||||
|
WCHAR Password[PASSWORD_LENGTH + 1];
|
||||||
|
WCHAR WorkDirectory[DIRECTORY_LENGTH + 1];
|
||||||
|
WCHAR InitialProgram[INITIALPROGRAM_LENGTH + 1];
|
||||||
|
ULONG SerialNumber;
|
||||||
|
BYTE EncryptionLevel;
|
||||||
|
ULONG ClientAddressFamily;
|
||||||
|
WCHAR ClientAddress[CLIENTADDRESS_LENGTH + 1];
|
||||||
|
USHORT HRes;
|
||||||
|
USHORT VRes;
|
||||||
|
USHORT ColorDepth;
|
||||||
|
USHORT ProtocolType;
|
||||||
|
ULONG KeyboardLayout;
|
||||||
|
ULONG KeyboardType;
|
||||||
|
ULONG KeyboardSubType;
|
||||||
|
ULONG KeyboardFunctionKey;
|
||||||
|
WCHAR ImeFileName[IMEFILENAME_LENGTH + 1];
|
||||||
|
WCHAR ClientDirectory[DIRECTORY_LENGTH + 1];
|
||||||
|
WCHAR ClientLicense[CLIENTLICENSE_LENGTH + 1];
|
||||||
|
WCHAR ClientModem[CLIENTMODEM_LENGTH + 1];
|
||||||
|
ULONG ClientBuildNumber;
|
||||||
|
ULONG ClientHardwareId;
|
||||||
|
USHORT ClientProductId;
|
||||||
|
USHORT OutBufCountHost;
|
||||||
|
USHORT OutBufCountClient;
|
||||||
|
USHORT OutBufLength;
|
||||||
|
WCHAR AudioDriverName[9];
|
||||||
|
TS_TIME_ZONE_INFORMATION ClientTimeZone;
|
||||||
|
ULONG ClientSessionId;
|
||||||
|
WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];
|
||||||
|
ULONG PerformanceFlags;
|
||||||
|
ULONG ActiveInputLocale;
|
||||||
|
} WINSTATIONCLIENT, *PWINSTATIONCLIENT;
|
||||||
|
|
||||||
|
typedef struct _TSHARE_COUNTERS
|
||||||
|
{
|
||||||
|
ULONG Reserved;
|
||||||
|
} TSHARE_COUNTERS, *PTSHARE_COUNTERS;
|
||||||
|
|
||||||
|
typedef struct _PROTOCOLCOUNTERS
|
||||||
|
{
|
||||||
|
ULONG WdBytes;
|
||||||
|
ULONG WdFrames;
|
||||||
|
ULONG WaitForOutBuf;
|
||||||
|
ULONG Frames;
|
||||||
|
ULONG Bytes;
|
||||||
|
ULONG CompressedBytes;
|
||||||
|
ULONG CompressFlushes;
|
||||||
|
ULONG Errors;
|
||||||
|
ULONG Timeouts;
|
||||||
|
ULONG AsyncFramingError;
|
||||||
|
ULONG AsyncOverrunError;
|
||||||
|
ULONG AsyncOverflowError;
|
||||||
|
ULONG AsyncParityError;
|
||||||
|
ULONG TdErrors;
|
||||||
|
USHORT ProtocolType;
|
||||||
|
USHORT Length;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
TSHARE_COUNTERS TShareCounters;
|
||||||
|
ULONG Reserved[100];
|
||||||
|
} Specific;
|
||||||
|
} PROTOCOLCOUNTERS, *PPROTOCOLCOUNTERS;
|
||||||
|
|
||||||
|
typedef struct _THINWIRECACHE
|
||||||
|
{
|
||||||
|
ULONG CacheReads;
|
||||||
|
ULONG CacheHits;
|
||||||
|
} THINWIRECACHE, *PTHINWIRECACHE;
|
||||||
|
|
||||||
|
#define MAX_THINWIRECACHE 4
|
||||||
|
|
||||||
|
typedef struct _RESERVED_CACHE
|
||||||
|
{
|
||||||
|
THINWIRECACHE ThinWireCache[MAX_THINWIRECACHE];
|
||||||
|
} RESERVED_CACHE, *PRESERVED_CACHE;
|
||||||
|
|
||||||
|
typedef struct _TSHARE_CACHE
|
||||||
|
{
|
||||||
|
ULONG Reserved;
|
||||||
|
} TSHARE_CACHE, *PTSHARE_CACHE;
|
||||||
|
|
||||||
|
typedef struct CACHE_STATISTICS
|
||||||
|
{
|
||||||
|
USHORT ProtocolType;
|
||||||
|
USHORT Length;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
RESERVED_CACHE ReservedCacheStats;
|
||||||
|
TSHARE_CACHE TShareCacheStats;
|
||||||
|
ULONG Reserved[20];
|
||||||
|
} Specific;
|
||||||
|
} CACHE_STATISTICS, *PCACHE_STATISTICS;
|
||||||
|
|
||||||
|
typedef struct _PROTOCOLSTATUS
|
||||||
|
{
|
||||||
|
PROTOCOLCOUNTERS Output;
|
||||||
|
PROTOCOLCOUNTERS Input;
|
||||||
|
CACHE_STATISTICS Cache;
|
||||||
|
ULONG AsyncSignal;
|
||||||
|
ULONG AsyncSignalMask;
|
||||||
|
} PROTOCOLSTATUS, *PPROTOCOLSTATUS;
|
||||||
|
|
||||||
|
// WinStationInformation
|
||||||
|
typedef struct _WINSTATIONINFORMATION
|
||||||
|
{
|
||||||
|
WINSTATIONSTATECLASS ConnectState;
|
||||||
|
WINSTATIONNAME WinStationName;
|
||||||
|
ULONG LogonId;
|
||||||
|
LARGE_INTEGER ConnectTime;
|
||||||
|
LARGE_INTEGER DisconnectTime;
|
||||||
|
LARGE_INTEGER LastInputTime;
|
||||||
|
LARGE_INTEGER LogonTime;
|
||||||
|
PROTOCOLSTATUS Status;
|
||||||
|
WCHAR Domain[DOMAIN_LENGTH + 1];
|
||||||
|
WCHAR UserName[USERNAME_LENGTH + 1];
|
||||||
|
LARGE_INTEGER CurrentTime;
|
||||||
|
} WINSTATIONINFORMATION, *PWINSTATIONINFORMATION;
|
||||||
|
|
||||||
|
// WinStationUserToken
|
||||||
|
typedef struct _WINSTATIONUSERTOKEN
|
||||||
|
{
|
||||||
|
HANDLE ProcessId;
|
||||||
|
HANDLE ThreadId;
|
||||||
|
HANDLE UserToken;
|
||||||
|
} WINSTATIONUSERTOKEN, *PWINSTATIONUSERTOKEN;
|
||||||
|
|
||||||
|
// WinStationVideoData
|
||||||
|
typedef struct _WINSTATIONVIDEODATA
|
||||||
|
{
|
||||||
|
USHORT HResolution;
|
||||||
|
USHORT VResolution;
|
||||||
|
USHORT fColorDepth;
|
||||||
|
} WINSTATIONVIDEODATA, *PWINSTATIONVIDEODATA;
|
||||||
|
|
||||||
|
// WinStationDigProductId
|
||||||
|
typedef struct _WINSTATIONPRODID
|
||||||
|
{
|
||||||
|
WCHAR DigProductId[CLIENT_PRODUCT_ID_LENGTH];
|
||||||
|
WCHAR ClientDigProductId[CLIENT_PRODUCT_ID_LENGTH];
|
||||||
|
WCHAR OuterMostDigProductId[CLIENT_PRODUCT_ID_LENGTH];
|
||||||
|
ULONG CurrentSessionId;
|
||||||
|
ULONG ClientSessionId;
|
||||||
|
ULONG OuterMostSessionId;
|
||||||
|
} WINSTATIONPRODID, *PWINSTATIONPRODID;
|
||||||
|
|
||||||
|
// WinStationRemoteAddress
|
||||||
|
typedef struct _WINSTATIONREMOTEADDRESS
|
||||||
|
{
|
||||||
|
USHORT sin_family;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT sin_port;
|
||||||
|
ULONG sin_addr;
|
||||||
|
UCHAR sin_zero[8];
|
||||||
|
} ipv4;
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
USHORT sin6_port;
|
||||||
|
ULONG sin6_flowinfo;
|
||||||
|
USHORT sin6_addr[8];
|
||||||
|
ULONG sin6_scope_id;
|
||||||
|
} ipv6;
|
||||||
|
};
|
||||||
|
} WINSTATIONREMOTEADDRESS, *PWINSTATIONREMOTEADDRESS;
|
||||||
|
|
||||||
|
// WinStationInformationEx
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _WINSTATIONINFORMATIONEX_LEVEL1
|
||||||
|
{
|
||||||
|
ULONG SessionId;
|
||||||
|
WINSTATIONSTATECLASS SessionState;
|
||||||
|
LONG SessionFlags;
|
||||||
|
WINSTATIONNAME WinStationName;
|
||||||
|
WCHAR UserName[USERNAME_LENGTH + 1];
|
||||||
|
WCHAR DomainName[DOMAIN_LENGTH + 1];
|
||||||
|
LARGE_INTEGER LogonTime;
|
||||||
|
LARGE_INTEGER ConnectTime;
|
||||||
|
LARGE_INTEGER DisconnectTime;
|
||||||
|
LARGE_INTEGER LastInputTime;
|
||||||
|
LARGE_INTEGER CurrentTime;
|
||||||
|
PROTOCOLSTATUS ProtocolStatus;
|
||||||
|
} WINSTATIONINFORMATIONEX_LEVEL1, *PWINSTATIONINFORMATIONEX_LEVEL1;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _WINSTATIONINFORMATIONEX_LEVEL2
|
||||||
|
{
|
||||||
|
ULONG SessionId;
|
||||||
|
WINSTATIONSTATECLASS SessionState;
|
||||||
|
LONG SessionFlags;
|
||||||
|
WINSTATIONNAME WinStationName;
|
||||||
|
WCHAR SamCompatibleUserName[USERNAME_LENGTH + 1];
|
||||||
|
WCHAR SamCompatibleDomainName[DOMAIN_LENGTH + 1];
|
||||||
|
LARGE_INTEGER LogonTime;
|
||||||
|
LARGE_INTEGER ConnectTime;
|
||||||
|
LARGE_INTEGER DisconnectTime;
|
||||||
|
LARGE_INTEGER LastInputTime;
|
||||||
|
LARGE_INTEGER CurrentTime;
|
||||||
|
PROTOCOLSTATUS ProtocolStatus;
|
||||||
|
WCHAR UserName[257];
|
||||||
|
WCHAR DomainName[256];
|
||||||
|
} WINSTATIONINFORMATIONEX_LEVEL2, *PWINSTATIONINFORMATIONEX_LEVEL2;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef union _WINSTATIONINFORMATIONEX_LEVEL
|
||||||
|
{
|
||||||
|
WINSTATIONINFORMATIONEX_LEVEL1 WinStationInfoExLevel1;
|
||||||
|
WINSTATIONINFORMATIONEX_LEVEL2 WinStationInfoExLevel2;
|
||||||
|
} WINSTATIONINFORMATIONEX_LEVEL, *PWINSTATIONINFORMATIONEX_LEVEL;
|
||||||
|
|
||||||
|
// private
|
||||||
|
typedef struct _WINSTATIONINFORMATIONEX
|
||||||
|
{
|
||||||
|
ULONG Level;
|
||||||
|
WINSTATIONINFORMATIONEX_LEVEL Data;
|
||||||
|
} WINSTATIONINFORMATIONEX, *PWINSTATIONINFORMATIONEX;
|
||||||
|
|
||||||
|
#define TS_PROCESS_INFO_MAGIC_NT4 0x23495452
|
||||||
|
|
||||||
|
typedef struct _TS_PROCESS_INFORMATION_NT4
|
||||||
|
{
|
||||||
|
ULONG MagicNumber;
|
||||||
|
ULONG LogonId;
|
||||||
|
PVOID ProcessSid;
|
||||||
|
ULONG Pad;
|
||||||
|
} TS_PROCESS_INFORMATION_NT4, *PTS_PROCESS_INFORMATION_NT4;
|
||||||
|
|
||||||
|
#define SIZEOF_TS4_SYSTEM_THREAD_INFORMATION 64
|
||||||
|
#define SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION 136
|
||||||
|
|
||||||
|
typedef struct _TS_SYS_PROCESS_INFORMATION
|
||||||
|
{
|
||||||
|
ULONG NextEntryOffset;
|
||||||
|
ULONG NumberOfThreads;
|
||||||
|
LARGE_INTEGER SpareLi1;
|
||||||
|
LARGE_INTEGER SpareLi2;
|
||||||
|
LARGE_INTEGER SpareLi3;
|
||||||
|
LARGE_INTEGER CreateTime;
|
||||||
|
LARGE_INTEGER UserTime;
|
||||||
|
LARGE_INTEGER KernelTime;
|
||||||
|
UNICODE_STRING ImageName;
|
||||||
|
LONG BasePriority;
|
||||||
|
ULONG UniqueProcessId;
|
||||||
|
ULONG InheritedFromUniqueProcessId;
|
||||||
|
ULONG HandleCount;
|
||||||
|
ULONG SessionId;
|
||||||
|
ULONG SpareUl3;
|
||||||
|
SIZE_T PeakVirtualSize;
|
||||||
|
SIZE_T VirtualSize;
|
||||||
|
ULONG PageFaultCount;
|
||||||
|
ULONG PeakWorkingSetSize;
|
||||||
|
ULONG WorkingSetSize;
|
||||||
|
SIZE_T QuotaPeakPagedPoolUsage;
|
||||||
|
SIZE_T QuotaPagedPoolUsage;
|
||||||
|
SIZE_T QuotaPeakNonPagedPoolUsage;
|
||||||
|
SIZE_T QuotaNonPagedPoolUsage;
|
||||||
|
SIZE_T PagefileUsage;
|
||||||
|
SIZE_T PeakPagefileUsage;
|
||||||
|
SIZE_T PrivatePageCount;
|
||||||
|
} TS_SYS_PROCESS_INFORMATION, *PTS_SYS_PROCESS_INFORMATION;
|
||||||
|
|
||||||
|
typedef struct _TS_ALL_PROCESSES_INFO
|
||||||
|
{
|
||||||
|
PTS_SYS_PROCESS_INFORMATION pTsProcessInfo;
|
||||||
|
ULONG SizeOfSid;
|
||||||
|
PSID pSid;
|
||||||
|
} TS_ALL_PROCESSES_INFO, *PTS_ALL_PROCESSES_INFO;
|
||||||
|
|
||||||
|
typedef struct _TS_COUNTER_HEADER
|
||||||
|
{
|
||||||
|
DWORD dwCounterID;
|
||||||
|
BOOLEAN bResult;
|
||||||
|
} TS_COUNTER_HEADER, *PTS_COUNTER_HEADER;
|
||||||
|
|
||||||
|
typedef struct _TS_COUNTER
|
||||||
|
{
|
||||||
|
TS_COUNTER_HEADER CounterHead;
|
||||||
|
DWORD dwValue;
|
||||||
|
LARGE_INTEGER StartTime;
|
||||||
|
} TS_COUNTER, *PTS_COUNTER;
|
||||||
|
|
||||||
|
// Flags for WinStationShutdownSystem
|
||||||
|
#define WSD_LOGOFF 0x1
|
||||||
|
#define WSD_SHUTDOWN 0x2
|
||||||
|
#define WSD_REBOOT 0x4
|
||||||
|
#define WSD_POWEROFF 0x8
|
||||||
|
|
||||||
|
// Flags for WinStationWaitSystemEvent
|
||||||
|
#define WEVENT_NONE 0x0
|
||||||
|
#define WEVENT_CREATE 0x1
|
||||||
|
#define WEVENT_DELETE 0x2
|
||||||
|
#define WEVENT_RENAME 0x4
|
||||||
|
#define WEVENT_CONNECT 0x8
|
||||||
|
#define WEVENT_DISCONNECT 0x10
|
||||||
|
#define WEVENT_LOGON 0x20
|
||||||
|
#define WEVENT_LOGOFF 0x40
|
||||||
|
#define WEVENT_STATECHANGE 0x80
|
||||||
|
#define WEVENT_LICENSE 0x100
|
||||||
|
#define WEVENT_ALL 0x7fffffff
|
||||||
|
#define WEVENT_FLUSH 0x80000000
|
||||||
|
|
||||||
|
// Hotkey modifiers for WinStationShadow
|
||||||
|
#define KBDSHIFT 0x1
|
||||||
|
#define KBDCTRL 0x2
|
||||||
|
#define KBDALT 0x4
|
||||||
|
|
||||||
|
// begin_rev
|
||||||
|
// Flags for WinStationRegisterConsoleNotification
|
||||||
|
#define WNOTIFY_ALL_SESSIONS 0x1
|
||||||
|
// end_rev
|
||||||
|
|
||||||
|
// In the functions below, memory returned can be freed using LocalFree. NULL can be specified for
|
||||||
|
// server handles to indicate the local server. -1 can be specified for session IDs to indicate the
|
||||||
|
// current session ID.
|
||||||
|
|
||||||
|
#define LOGONID_CURRENT (-1)
|
||||||
|
#define SERVERNAME_CURRENT (NULL)
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationFreeMemory(
|
||||||
|
_In_ PVOID Buffer
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
HANDLE
|
||||||
|
WINAPI
|
||||||
|
WinStationOpenServerW(
|
||||||
|
_In_ PWSTR ServerName
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationCloseServer(
|
||||||
|
_In_ HANDLE hServer
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationServerPing(
|
||||||
|
_In_opt_ HANDLE hServer
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationGetTermSrvCountersValue(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG Count,
|
||||||
|
_Inout_ PTS_COUNTER Counters // set counter IDs before calling
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationShutdownSystem(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG ShutdownFlags // WSD_*
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationWaitSystemEvent(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG EventMask, // WEVENT_*
|
||||||
|
_Out_ PULONG EventFlags
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationRegisterConsoleNotification(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ HWND WindowHandle,
|
||||||
|
_In_ ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationUnRegisterConsoleNotification(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ HWND WindowHandle
|
||||||
|
);
|
||||||
|
|
||||||
|
// Sessions
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationEnumerateW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_Out_ PSESSIONIDW *SessionIds,
|
||||||
|
_Out_ PULONG Count
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationQueryInformationW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
|
||||||
|
_Out_writes_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
|
||||||
|
_In_ ULONG WinStationInformationLength,
|
||||||
|
_Out_ PULONG pReturnLength
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationSetInformationW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ WINSTATIONINFOCLASS WinStationInformationClass,
|
||||||
|
_In_reads_bytes_(WinStationInformationLength) PVOID pWinStationInformation,
|
||||||
|
_In_ ULONG WinStationInformationLength
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationNameFromLogonIdW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_Out_writes_(WINSTATIONNAME_LENGTH + 1) PWSTR pWinStationName
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationSendMessageW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ PWSTR Title,
|
||||||
|
_In_ ULONG TitleLength,
|
||||||
|
_In_ PWSTR Message,
|
||||||
|
_In_ ULONG MessageLength,
|
||||||
|
_In_ ULONG Style,
|
||||||
|
_In_ ULONG Timeout,
|
||||||
|
_Out_ PULONG Response,
|
||||||
|
_In_ BOOLEAN DoNotWait
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationConnectW(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ ULONG TargetSessionId,
|
||||||
|
_In_opt_ PWSTR pPassword,
|
||||||
|
_In_ BOOLEAN bWait
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationDisconnect(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ BOOLEAN bWait
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationReset(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ BOOLEAN bWait
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationShadow(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ PWSTR TargetServerName,
|
||||||
|
_In_ ULONG TargetSessionId,
|
||||||
|
_In_ UCHAR HotKeyVk,
|
||||||
|
_In_ USHORT HotkeyModifiers // KBD*
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationShadowStop(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG SessionId,
|
||||||
|
_In_ BOOLEAN bWait // ignored
|
||||||
|
);
|
||||||
|
|
||||||
|
// Processes
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationEnumerateProcesses(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_Out_ PVOID *Processes
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationGetAllProcesses(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG Level,
|
||||||
|
_Out_ PULONG NumberOfProcesses,
|
||||||
|
_Out_ PTS_ALL_PROCESSES_INFO *Processes
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationFreeGAPMemory(
|
||||||
|
_In_ ULONG Level,
|
||||||
|
_In_ PTS_ALL_PROCESSES_INFO Processes,
|
||||||
|
_In_ ULONG NumberOfProcesses
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationTerminateProcess(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG ProcessId,
|
||||||
|
_In_ ULONG ExitCode
|
||||||
|
);
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationGetProcessSid(
|
||||||
|
_In_opt_ HANDLE hServer,
|
||||||
|
_In_ ULONG ProcessId,
|
||||||
|
_In_ FILETIME ProcessStartTime,
|
||||||
|
_Out_ PVOID pProcessUserSid,
|
||||||
|
_Inout_ PULONG dwSidSize
|
||||||
|
);
|
||||||
|
|
||||||
|
// Services isolation
|
||||||
|
|
||||||
|
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationSwitchToServicesSession(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
// rev
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
WinStationRevertFromServicesSession(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
// Misc.
|
||||||
|
|
||||||
|
BOOLEAN
|
||||||
|
WINAPI
|
||||||
|
_WinStationWaitForConnect(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
// end_msdn
|
||||||
|
|
||||||
|
#endif
|
||||||
5
phnt/zw_options.txt
Normal file
5
phnt/zw_options.txt
Normal file
@@ -0,0 +1,5 @@
|
|||||||
|
base=include
|
||||||
|
in=ntdbg.h;ntexapi.h;ntgdi.h;ntioapi.h;ntkeapi.h;ntldr.h;ntlpcapi.h;ntmisc.h;ntmmapi.h;ntnls.h;ntobapi.h;ntpebteb.h;ntpfapi.h;ntpnpapi.h;ntpoapi.h;ntpsapi.h;ntregapi.h;ntrtl.h;ntsam.h;ntseapi.h;nttmapi.h;nttp.h;ntwow64.h;ntxcapi.h
|
||||||
|
out=ntzwapi.h
|
||||||
|
header=#ifndef _NTZWAPI_H\r\n#define _NTZWAPI_H\r\n\r\n// This file was automatically generated. Do not edit.\r\n\r\n
|
||||||
|
footer=#endif\r\n
|
||||||
@@ -1,26 +1,22 @@
|
|||||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
<DOCUMENT Type="Advanced Installer" CreateVersion="14.1.1" version="14.2" Modules="enterprise" RootPath="." Language="en" Id="{6DF9A5D1-044E-44C4-9CC3-E4E93457870A}">
|
<DOCUMENT Type="Advanced Installer" CreateVersion="14.1.1" version="14.3" Modules="enterprise" RootPath="." Language="en" Id="{6DF9A5D1-044E-44C4-9CC3-E4E93457870A}">
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.ProjectOptionsComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.ProjectOptionsComponent">
|
||||||
<ROW Name="HiddenItems" Value="AppXProductDetailsComponent;AppXDependenciesComponent;AppXAppDetailsComponent;AppXVisualAssetsComponent;AppXCapabilitiesComponent;AppXAppDeclarationsComponent;AppXUriRulesComponent;SccmComponent;ActSyncAppComponent"/>
|
<ROW Name="HiddenItems" Value="AppXProductDetailsComponent;AppXDependenciesComponent;AppXAppDetailsComponent;AppXVisualAssetsComponent;AppXCapabilitiesComponent;AppXAppDeclarationsComponent;AppXUriRulesComponent;SccmComponent;ActSyncAppComponent"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiPropsComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiPropsComponent">
|
||||||
<ROW Property="AI_BITMAP_DISPLAY_MODE" Value="0"/>
|
<ROW Property="AI_BITMAP_DISPLAY_MODE" Value="0"/>
|
||||||
<ROW Property="AI_CLEAN_RESOURCES_DISABLE_UPGRADE" Value="1"/>
|
|
||||||
<ROW Property="AI_CLEAN_RESOURCES_UNINSTALL" Value="1"/>
|
<ROW Property="AI_CLEAN_RESOURCES_UNINSTALL" Value="1"/>
|
||||||
<ROW Property="AI_CLEAN_RESOURCES_USER_PROMPT_BASIC_UI" Value="1"/>
|
|
||||||
<ROW Property="AI_CLEAN_RESOURCES_USER_PROMPT_FULL_UI" Value="1"/>
|
|
||||||
<ROW Property="AI_PROPPATH_PERBUILD_wufuc.dll" Value="..\wufuc\bin\Release\x64\wufuc64.dll" MultiBuildValue="MsiBuild:..\wufuc\bin\Release\x86\wufuc32.dll"/>
|
|
||||||
<ROW Property="AI_ThemeStyle" Value="default" MultiBuildValue="DefaultBuild:classic#MsiBuild:classic" MsiKey="AI_ThemeStyle"/>
|
<ROW Property="AI_ThemeStyle" Value="default" MultiBuildValue="DefaultBuild:classic#MsiBuild:classic" MsiKey="AI_ThemeStyle"/>
|
||||||
<ROW Property="ALLUSERS" Value="1"/>
|
<ROW Property="ALLUSERS" Value="1"/>
|
||||||
<ROW Property="ARPCOMMENTS" Value="This installer database contains the logic and data required to install [|ProductName]." ValueLocId="*"/>
|
<ROW Property="ARPCOMMENTS" Value="Disables the "Unsupported Hardware" message in Windows Update, and allows you to continue installing updates on Windows 7 and 8.1 systems with Intel Kaby Lake, AMD Ryzen, or other unsupported processors." ValueLocId="*"/>
|
||||||
<ROW Property="ARPHELPLINK" Value="https://github.com/zeffy/wufuc/issues"/>
|
<ROW Property="ARPHELPLINK" Value="https://github.com/zeffy/wufuc/issues"/>
|
||||||
<ROW Property="ARPURLINFOABOUT" Value="https://github.com/zeffy/wufuc"/>
|
<ROW Property="ARPURLINFOABOUT" Value="https://github.com/zeffy/wufuc"/>
|
||||||
<ROW Property="ARPURLUPDATEINFO" Value="https://github.com/zeffy/wufuc/releases"/>
|
<ROW Property="ARPURLUPDATEINFO" Value="https://github.com/zeffy/wufuc/releases"/>
|
||||||
<ROW Property="Manufacturer" Value="zeffy"/>
|
<ROW Property="Manufacturer" Value="zeffy"/>
|
||||||
<ROW Property="ProductCode" Value="1028:{375EEFF0-5E5A-442E-9F6E-BEEBE3E8ECF9} 1030:{E230204D-CE8F-41E1-A4DB-C4207D93F885} 1031:{FCA8704C-D5A0-4D3D-8397-025D19DDAEBD} 1033:{689BF70E-4EB8-4214-8DD9-FADD6C8C985A} 1035:{E61C5090-D156-4AEB-8A5A-D64C4E0CCDF2} 1036:{E81BF4E2-06A5-4E0F-9CFC-B5FD9801D26D} 1038:{E64712EE-46A4-4288-A691-6FF577879C6A} 1040:{0A7AD69F-0738-472F-B123-4A85D96A645B} 1041:{4A754EE6-CEDC-4EB3-BB51-059852714F83} 1042:{AE3758C2-C229-44E3-BDB9-0EDAF467BCFA} 1043:{4D7C4256-58FA-431C-9915-7C8044D95F66} 1045:{41D27F42-A6E8-4A57-8467-CE6F61535741} 1046:{B4A1DEB5-BC54-44F3-9108-2C7EF60DB651} 1049:{F976B57F-4FAC-4BF1-A09B-CA4590FC65D0} 1060:{4E27F130-256F-41B0-9FE5-8DEF1A553773} 2052:{010DEDF4-F79D-45F6-B747-D1473531B13A} 3082:{EF04B4CE-48FD-4409-A855-437835A2E31F} " Type="16"/>
|
<ROW Property="ProductCode" Value="1028:{67C2FA95-3545-407B-A128-65F147BDCD9D} 1030:{777C03CD-81D5-4814-A017-4202941C18B6} 1031:{2CFFB2DA-F84D-4CAC-A55C-C1B705686E5F} 1033:{668AE540-8190-45D9-8700-591F74740E57} 1035:{D7CF2434-1562-4A4A-9157-A9D22A2E35DD} 1036:{A6DDFD02-0E54-4EAF-9C49-D455B20E93DF} 1038:{B75CF6D1-39BE-4A07-9560-83B50E4B6B8C} 1040:{83F3E2E1-F3E1-4B40-9271-E68F23B5E2AF} 1041:{4AE82B11-334B-4AE0-89F1-AC656FD66516} 1042:{62095350-5B1D-4369-B2D7-F8B5CD2BCB70} 1043:{18B293EA-BB20-4CE1-A63E-7F1040EE8F42} 1045:{D7525928-DF4F-4881-B5D8-E29BD6C7453A} 1046:{4E19CF1A-BB85-41BD-9979-07C566DE2B9A} 1049:{7A6C50D8-1C06-4A81-98C3-AD9614B8FC89} 1060:{1106EDB3-BEDD-4C0C-9155-5ECD10FF5496} 2052:{12DFA8CF-A28E-4A8F-A1EE-8834AF51221C} 3082:{1258875E-32AF-48CB-AFEA-A20B4A44C752} " Type="16"/>
|
||||||
<ROW Property="ProductLanguage" Value="1033"/>
|
<ROW Property="ProductLanguage" Value="1033"/>
|
||||||
<ROW Property="ProductName" Value="wufuc"/>
|
<ROW Property="ProductName" Value="wufuc"/>
|
||||||
<ROW Property="ProductVersion" Value="0.7.2.0" Type="32" TargetFile="wufuc.dll"/>
|
<ROW Property="ProductVersion" Value="0.8.0.0" Type="32"/>
|
||||||
<ROW Property="SecureCustomProperties" Value="OLDPRODUCTS;AI_NEWERPRODUCTFOUND"/>
|
<ROW Property="SecureCustomProperties" Value="OLDPRODUCTS;AI_NEWERPRODUCTFOUND"/>
|
||||||
<ROW Property="SysnativeFolder" Value=" "/>
|
<ROW Property="SysnativeFolder" Value=" "/>
|
||||||
<ROW Property="UpgradeCode" Value="{4C52972C-251E-4D1B-AD09-EAA765719DCC}"/>
|
<ROW Property="UpgradeCode" Value="{4C52972C-251E-4D1B-AD09-EAA765719DCC}"/>
|
||||||
@@ -40,36 +36,17 @@
|
|||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiDirsComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiDirsComponent">
|
||||||
<ROW Directory="APPDIR" Directory_Parent="TARGETDIR" DefaultDir="APPDIR:." IsPseudoRoot="1"/>
|
<ROW Directory="APPDIR" Directory_Parent="TARGETDIR" DefaultDir="APPDIR:." IsPseudoRoot="1"/>
|
||||||
<ROW Directory="HelperScripts_1_Dir" Directory_Parent="SHORTCUTDIR" DefaultDir="HELPER~1|Helper Scripts"/>
|
|
||||||
<ROW Directory="HelperScripts_Dir" Directory_Parent="APPDIR" DefaultDir="HELPER~1|Helper Scripts"/>
|
|
||||||
<ROW Directory="SHORTCUTDIR" Directory_Parent="TARGETDIR" DefaultDir="SHORTC~1|SHORTCUTDIR" IsPseudoRoot="1"/>
|
<ROW Directory="SHORTCUTDIR" Directory_Parent="TARGETDIR" DefaultDir="SHORTC~1|SHORTCUTDIR" IsPseudoRoot="1"/>
|
||||||
<ROW Directory="TARGETDIR" DefaultDir="SourceDir"/>
|
<ROW Directory="TARGETDIR" DefaultDir="SourceDir"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiCompsComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiCompsComponent">
|
||||||
<ROW Component="HelperScripts" ComponentId="{9DDAD4F0-6AA7-4612-923D-9E87DDF7848A}" Directory_="HelperScripts_1_Dir" Attributes="0"/>
|
|
||||||
<ROW Component="LICENSE" ComponentId="{E016843D-3214-45D2-974B-81D825257BB4}" Directory_="APPDIR" Attributes="0" KeyPath="LICENSE" Type="0"/>
|
|
||||||
<ROW Component="ProductInformation" ComponentId="{7F087121-20CE-4473-99C5-3A43F26A3999}" Directory_="APPDIR" Attributes="4" KeyPath="Version"/>
|
<ROW Component="ProductInformation" ComponentId="{7F087121-20CE-4473-99C5-3A43F26A3999}" Directory_="APPDIR" Attributes="4" KeyPath="Version"/>
|
||||||
<ROW Component="SHORTCUTDIR" ComponentId="{9235D9D8-D094-4373-BA66-6BBFC6432379}" Directory_="SHORTCUTDIR" Attributes="0"/>
|
<ROW Component="SHORTCUTDIR" ComponentId="{9235D9D8-D094-4373-BA66-6BBFC6432379}" Directory_="SHORTCUTDIR" Attributes="0"/>
|
||||||
<ROW Component="disable_wufuc.bat" ComponentId="{BF30EB3B-EC70-45E8-9782-1C1611F9DA0A}" Directory_="HelperScripts_Dir" Attributes="0" KeyPath="disable_wufuc.bat"/>
|
|
||||||
<ROW Component="enable_wufuc.bat" ComponentId="{80D35CE8-A771-41A3-9D02-FE8BC05B96AF}" Directory_="HelperScripts_Dir" Attributes="0" KeyPath="enable_wufuc.bat"/>
|
|
||||||
<ROW Component="wufuc.dll" ComponentId="{46FC4526-127A-4682-8904-55D81259CC42}" Directory_="APPDIR" Attributes="256" KeyPath="wufuc.dll"/>
|
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiFeatsComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiFeatsComponent">
|
||||||
<ROW Feature="MainFeature" Title="MainFeature" Description="Description" Display="1" Level="1" Directory_="APPDIR" Attributes="0" Components="HelperScripts LICENSE ProductInformation SHORTCUTDIR disable_wufuc.bat enable_wufuc.bat wufuc.dll"/>
|
<ROW Feature="MainFeature" Title="MainFeature" Description="Description" Display="1" Level="1" Directory_="APPDIR" Attributes="0" Components="ProductInformation SHORTCUTDIR"/>
|
||||||
<ATTRIBUTE name="CurrentFeature" value="MainFeature"/>
|
<ATTRIBUTE name="CurrentFeature" value="MainFeature"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiFilesComponent">
|
|
||||||
<ROW File="LICENSE" Component_="LICENSE" FileName="COPYING.txt" Attributes="0" SourcePath="..\LICENSE" SelfReg="false"/>
|
|
||||||
<ROW File="disable_wufuc.bat" Component_="disable_wufuc.bat" FileName="DISABL~1.BAT|disable_wufuc.bat" Attributes="0" SourcePath="Helper Scripts\disable_wufuc.bat" SelfReg="false" NextFile="enable_wufuc.bat"/>
|
|
||||||
<ROW File="enable_wufuc.bat" Component_="enable_wufuc.bat" FileName="ENABLE~1.BAT|enable_wufuc.bat" Attributes="0" SourcePath="Helper Scripts\enable_wufuc.bat" SelfReg="false" NextFile="LICENSE"/>
|
|
||||||
<ROW File="wufuc.dll" Component_="wufuc.dll" FileName="wufuc.dll" Attributes="512" SourcePath="<AI_APPPATH_PERBUILD_wufuc.dll>" SelfReg="false" NextFile="disable_wufuc.bat"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.AiRemoveFileComponent">
|
|
||||||
<ROW RemoveFile="_" Condition="(AI_CLEAN_RESOURCES_UNINSTALL = "1") AND (NOT UPGRADINGPRODUCTCODE)" Options="3"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.AppPathsComponent">
|
|
||||||
<ROW Name="AI_APPPATH_PERBUILD_wufuc.dll" Path="[|AI_PROPPATH_PERBUILD_wufuc.dll]" Type="2" Content="0"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.BuildComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.BuildComponent">
|
||||||
<ROW BuildKey="DefaultBuild" BuildName="x64" BuildOrder="1" BuildType="1" PackageFileName="wufuc_setup_x64" Languages="en;zh;zh_TW;fr;ja;ko;pl;ru;es;it;de;fi;nl;hu;da;sl;pt_BR" LangOpt="1" InstallationType="4" UseLargeSchema="true" MsiPackageType="x64"/>
|
<ROW BuildKey="DefaultBuild" BuildName="x64" BuildOrder="1" BuildType="1" PackageFileName="wufuc_setup_x64" Languages="en;zh;zh_TW;fr;ja;ko;pl;ru;es;it;de;fi;nl;hu;da;sl;pt_BR" LangOpt="1" InstallationType="4" UseLargeSchema="true" MsiPackageType="x64"/>
|
||||||
<ROW BuildKey="MsiBuild" BuildName="x86" BuildOrder="2" BuildType="1" PackageFileName="wufuc_setup_x86" Languages="en;zh;zh_TW;fr;ja;ko;pl;ru;es;it;de;fi;nl;hu;da;sl;pt_BR" LangOpt="1" InstallationType="4" UseLargeSchema="true"/>
|
<ROW BuildKey="MsiBuild" BuildName="x86" BuildOrder="2" BuildType="1" PackageFileName="wufuc_setup_x86" Languages="en;zh;zh_TW;fr;ja;ko;pl;ru;es;it;de;fi;nl;hu;da;sl;pt_BR" LangOpt="1" InstallationType="4" UseLargeSchema="true"/>
|
||||||
@@ -109,35 +86,10 @@
|
|||||||
<ROW Fragment="VerifyRepairDlg.aip" Path="<AI_THEMES>classic\fragments\VerifyRepairDlg.aip"/>
|
<ROW Fragment="VerifyRepairDlg.aip" Path="<AI_THEMES>classic\fragments\VerifyRepairDlg.aip"/>
|
||||||
<ROW Fragment="WelcomeDlg.aip" Path="<AI_THEMES>classic\fragments\WelcomeDlg.aip"/>
|
<ROW Fragment="WelcomeDlg.aip" Path="<AI_THEMES>classic\fragments\WelcomeDlg.aip"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiActionTextComponent">
|
|
||||||
<ROW Action="AI_AiRemoveFilesCommit" Description="Executing file removal operations" DescriptionLocId="ActionText.Description.AI_AiRemoveFilesCommit" Template="Executing file removal: [1]" TemplateLocId="ActionText.Template.AI_AiRemoveFilesCommit"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesDeferred_Permanent" Description="Preparing files for removal" DescriptionLocId="ActionText.Description.AI_AiRemoveFilesDeferred_Permanent" Template="Preparing file: [1]" TemplateLocId="ActionText.Template.AI_AiRemoveFilesDeferred_Permanent"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesDeferred_Undoable" Description="Preparing files for removal" DescriptionLocId="ActionText.Description.AI_AiRemoveFilesDeferred_Undoable" Template="Preparing file: [1]" TemplateLocId="ActionText.Template.AI_AiRemoveFilesDeferred_Undoable"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesImmediate" Description="Preparing files for removal" DescriptionLocId="ActionText.Description.AI_AiRemoveFilesImmediate" Template="Preparing file: [1]" TemplateLocId="ActionText.Template.AI_AiRemoveFilesImmediate"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesRollback" Description="Restoring removed files" DescriptionLocId="ActionText.Description.AI_AiRemoveFilesRollback" Template="Restoring file: [1]" TemplateLocId="ActionText.Template.AI_AiRemoveFilesRollback"/>
|
|
||||||
<ROW Action="AI_ProcessTasks" Description="Generating actions to schedule tasks on the local computer:" DescriptionLocId="ActionText.Description.AI_ProcessTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_ProcessTasks"/>
|
|
||||||
<ROW Action="AI_ProcessTasks2" Description="Generating actions to schedule tasks on the local computer:" DescriptionLocId="ActionText.Description.AI_ProcessTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_ProcessTasks"/>
|
|
||||||
<ROW Action="AI_RemoveTasks" Description="Removing scheduled task from the local computer" DescriptionLocId="ActionText.Description.AI_RemoveTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_RemoveTasks"/>
|
|
||||||
<ROW Action="AI_RemoveTasks2" Description="Removing scheduled task from the local computer" DescriptionLocId="ActionText.Description.AI_RemoveTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_RemoveTasks"/>
|
|
||||||
<ROW Action="AI_RollbackTasks" Description="Rolling back scheduled task on the local computer" DescriptionLocId="ActionText.Description.AI_RollbackTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_RollbackTasks"/>
|
|
||||||
<ROW Action="AI_RollbackTasks2" Description="Rolling back scheduled task on the local computer" DescriptionLocId="ActionText.Description.AI_RollbackTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_RollbackTasks"/>
|
|
||||||
<ROW Action="AI_ScheduleTasks" Description="Scheduling task on the local computer" DescriptionLocId="ActionText.Description.AI_ScheduleTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_ScheduleTasks"/>
|
|
||||||
<ROW Action="AI_ScheduleTasks2" Description="Scheduling task on the local computer" DescriptionLocId="ActionText.Description.AI_ScheduleTasks" Template="Task Name: [1]" TemplateLocId="ActionText.Template.AI_ScheduleTasks"/>
|
|
||||||
<ROW Action="AI_UninstallTasks" Description="Generating actions to remove scheduled tasks from the local computer:" DescriptionLocId="ActionText.Description.AI_UninstallTasks"/>
|
|
||||||
<ROW Action="AI_UninstallTasks2" Description="Generating actions to remove scheduled tasks from the local computer:" DescriptionLocId="ActionText.Description.AI_UninstallTasks"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiAppSearchComponent">
|
|
||||||
<ROW Property="RESULT_WUAUENG.DLL_WIN7" Signature_="FileSearchSign"/>
|
|
||||||
<ROW Property="RESULT_WUAUENG.DLL_WIN81" Signature_="FileSearchSign_1"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiBinaryComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiBinaryComponent">
|
||||||
<ROW Name="ResourceCleaner.dll" SourcePath="<AI_CUSTACTS>ResourceCleaner.dll"/>
|
|
||||||
<ROW Name="ShortcutFlags.dll" SourcePath="<AI_CUSTACTS>ShortcutFlags.dll"/>
|
<ROW Name="ShortcutFlags.dll" SourcePath="<AI_CUSTACTS>ShortcutFlags.dll"/>
|
||||||
<ROW Name="aicustact.dll" SourcePath="<AI_CUSTACTS>aicustact.dll"/>
|
<ROW Name="aicustact.dll" SourcePath="<AI_CUSTACTS>aicustact.dll"/>
|
||||||
<ROW Name="aischeduler.dll" SourcePath="<AI_CUSTACTS>aischeduler.dll"/>
|
|
||||||
<ROW Name="aischeduler2.dll" SourcePath="<AI_CUSTACTS>aischeduler2.dll"/>
|
|
||||||
<ROW Name="viewer.exe" SourcePath="<AI_CUSTACTS>viewer.exe"/>
|
<ROW Name="viewer.exe" SourcePath="<AI_CUSTACTS>viewer.exe"/>
|
||||||
<ROW Name="wufuc_aihelper.dll" SourcePath="..\wufuc_aihelper\bin\Release\x86\wufuc_aihelper.dll"/>
|
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiCheckBoxComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiCheckBoxComponent">
|
||||||
<ROW Property="AI_CLEAN_RESOURCES_UNINSTALL" Value="1"/>
|
<ROW Property="AI_CLEAN_RESOURCES_UNINSTALL" Value="1"/>
|
||||||
@@ -186,15 +138,8 @@
|
|||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiCreateFolderComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiCreateFolderComponent">
|
||||||
<ROW Directory_="SHORTCUTDIR" Component_="SHORTCUTDIR" ManualDelete="false"/>
|
<ROW Directory_="SHORTCUTDIR" Component_="SHORTCUTDIR" ManualDelete="false"/>
|
||||||
<ROW Directory_="HelperScripts_1_Dir" Component_="HelperScripts" ManualDelete="false"/>
|
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiCustActComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiCustActComponent">
|
||||||
<ROW Action="AIHelper_SetUnloadEvent" Type="3137" Source="wufuc_aihelper.dll" Target="AIHelper_SetUnloadEvent"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesCommit" Type="11777" Source="ResourceCleaner.dll" Target="OnAiRemoveFilesCommit" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesDeferred_Permanent" Type="11265" Source="ResourceCleaner.dll" Target="OnAiRemoveFilesPermanent" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesDeferred_Undoable" Type="11265" Source="ResourceCleaner.dll" Target="OnAiRemoveFilesUndoable" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesImmediate" Type="1" Source="ResourceCleaner.dll" Target="OnAiRemoveFilesImmediate"/>
|
|
||||||
<ROW Action="AI_AiRemoveFilesRollback" Type="11521" Source="ResourceCleaner.dll" Target="OnAiUndoRemoveFiles"/>
|
|
||||||
<ROW Action="AI_ApplyShortcutFlags" Type="3073" Source="ShortcutFlags.dll" Target="UpdateShortcutFlags" WithoutSeq="true"/>
|
<ROW Action="AI_ApplyShortcutFlags" Type="3073" Source="ShortcutFlags.dll" Target="UpdateShortcutFlags" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_DOWNGRADE" Type="19" Target="4010"/>
|
<ROW Action="AI_DOWNGRADE" Type="19" Target="4010"/>
|
||||||
<ROW Action="AI_DpiContentScale" Type="1" Source="aicustact.dll" Target="DpiContentScale"/>
|
<ROW Action="AI_DpiContentScale" Type="1" Source="aicustact.dll" Target="DpiContentScale"/>
|
||||||
@@ -205,27 +150,15 @@
|
|||||||
<ROW Action="AI_PinToStartScreen" Type="1025" Source="ShortcutFlags.dll" Target="PinToStartScreen" WithoutSeq="true"/>
|
<ROW Action="AI_PinToStartScreen" Type="1025" Source="ShortcutFlags.dll" Target="PinToStartScreen" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_PinToTaskbar" Type="1025" Source="ShortcutFlags.dll" Target="PinToTaskbar" WithoutSeq="true"/>
|
<ROW Action="AI_PinToTaskbar" Type="1025" Source="ShortcutFlags.dll" Target="PinToTaskbar" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_PrepareShortcutFlags" Type="1" Source="ShortcutFlags.dll" Target="PrepareActionData"/>
|
<ROW Action="AI_PrepareShortcutFlags" Type="1" Source="ShortcutFlags.dll" Target="PrepareActionData"/>
|
||||||
<ROW Action="AI_ProcessTasks" Type="1" Source="aischeduler.dll" Target="ProcessTasks"/>
|
|
||||||
<ROW Action="AI_ProcessTasks2" Type="1" Source="aischeduler2.dll" Target="ProcessTasks"/>
|
|
||||||
<ROW Action="AI_PromptUserBasicUI" Type="1" Source="ResourceCleaner.dll" Target="OnPromptUserBasicUI"/>
|
|
||||||
<ROW Action="AI_RESTORE_LOCATION" Type="65" Source="aicustact.dll" Target="RestoreLocation"/>
|
<ROW Action="AI_RESTORE_LOCATION" Type="65" Source="aicustact.dll" Target="RestoreLocation"/>
|
||||||
<ROW Action="AI_RemoveTasks" Type="11265" Source="aischeduler.dll" Target="DeleteTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_RemoveTasks2" Type="11265" Source="aischeduler2.dll" Target="DeleteTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_ResolveKnownFolders" Type="1" Source="aicustact.dll" Target="AI_ResolveKnownFolders"/>
|
<ROW Action="AI_ResolveKnownFolders" Type="1" Source="aicustact.dll" Target="AI_ResolveKnownFolders"/>
|
||||||
<ROW Action="AI_RollbackTasks" Type="11521" Source="aischeduler.dll" Target="DeleteTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_RollbackTasks2" Type="11521" Source="aischeduler2.dll" Target="DeleteTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_SHOW_LOG" Type="65" Source="aicustact.dll" Target="LaunchLogFile" WithoutSeq="true"/>
|
<ROW Action="AI_SHOW_LOG" Type="65" Source="aicustact.dll" Target="LaunchLogFile" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_STORE_LOCATION" Type="51" Source="ARPINSTALLLOCATION" Target="[APPDIR]"/>
|
<ROW Action="AI_STORE_LOCATION" Type="51" Source="ARPINSTALLLOCATION" Target="[APPDIR]"/>
|
||||||
<ROW Action="AI_ScheduleTasks" Type="11265" Source="aischeduler.dll" Target="ScheduleTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_ScheduleTasks2" Type="11265" Source="aischeduler2.dll" Target="ScheduleTasks" WithoutSeq="true"/>
|
|
||||||
<ROW Action="AI_UninstallTasks" Type="1" Source="aischeduler.dll" Target="UninstallTasks"/>
|
|
||||||
<ROW Action="AI_UninstallTasks2" Type="1" Source="aischeduler2.dll" Target="UninstallTasks"/>
|
|
||||||
<ROW Action="AI_UnpinFromStartScreen" Type="1025" Source="ShortcutFlags.dll" Target="UnpinFromStartScreen" WithoutSeq="true"/>
|
<ROW Action="AI_UnpinFromStartScreen" Type="1025" Source="ShortcutFlags.dll" Target="UnpinFromStartScreen" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_UnpinFromTaskbar" Type="1025" Source="ShortcutFlags.dll" Target="UnpinFromTaskbar" WithoutSeq="true"/>
|
<ROW Action="AI_UnpinFromTaskbar" Type="1025" Source="ShortcutFlags.dll" Target="UnpinFromTaskbar" WithoutSeq="true"/>
|
||||||
<ROW Action="AI_UnpinShortcuts" Type="1" Source="ShortcutFlags.dll" Target="UnpinShortcuts"/>
|
<ROW Action="AI_UnpinShortcuts" Type="1" Source="ShortcutFlags.dll" Target="UnpinShortcuts"/>
|
||||||
<ROW Action="Pause" Type="1602" Source="viewer.exe" Target="/HideWindow "[SysnativeFolder]timeout" /nobreak /t 3" Options="1"/>
|
<ROW Action="Pause" Type="1602" Source="viewer.exe" Target="/HideWindow "[SysnativeFolder]timeout" /nobreak /t 3" Options="1"/>
|
||||||
<ROW Action="RunSFCScan" Type="3138" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]sfc.exe" /SCANFILE="[SysnativeFolder]wuaueng.dll"" Options="1"/>
|
<ROW Action="RunSFCScan" Type="3138" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]sfc.exe" /SCANFILE="[SysnativeFolder]wuaueng.dll"" Options="1"/>
|
||||||
<ROW Action="RunScheduledTask" Type="3650" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]schtasks.exe" /Run /TN "[wufuc_TaskName]"" Options="1"/>
|
|
||||||
<ROW Action="SET_APPDIR" Type="307" Source="APPDIR" Target="[ProgramFilesFolder][Manufacturer]\[ProductName]" MultiBuildTarget="DefaultBuild:[ProgramFiles64Folder]\[ProductName]#MsiBuild:[ProgramFilesFolder]\[ProductName]"/>
|
<ROW Action="SET_APPDIR" Type="307" Source="APPDIR" Target="[ProgramFilesFolder][Manufacturer]\[ProductName]" MultiBuildTarget="DefaultBuild:[ProgramFiles64Folder]\[ProductName]#MsiBuild:[ProgramFilesFolder]\[ProductName]"/>
|
||||||
<ROW Action="SET_SHORTCUTDIR" Type="307" Source="SHORTCUTDIR" Target="[ProgramMenuFolder][ProductName]"/>
|
<ROW Action="SET_SHORTCUTDIR" Type="307" Source="SHORTCUTDIR" Target="[ProgramMenuFolder][ProductName]"/>
|
||||||
<ROW Action="SET_TARGETDIR_TO_APPDIR" Type="51" Source="TARGETDIR" Target="[APPDIR]"/>
|
<ROW Action="SET_TARGETDIR_TO_APPDIR" Type="51" Source="TARGETDIR" Target="[APPDIR]"/>
|
||||||
@@ -235,10 +168,6 @@
|
|||||||
<ROW Action="StartWindowsUpdateService" Type="3650" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]net.exe" start wuauserv" Options="1"/>
|
<ROW Action="StartWindowsUpdateService" Type="3650" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]net.exe" start wuauserv" Options="1"/>
|
||||||
<ROW Action="StopWindowsUpdateService" Type="3650" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]net.exe" stop wuauserv" Options="1"/>
|
<ROW Action="StopWindowsUpdateService" Type="3650" Source="viewer.exe" Target="/RunAsAdmin /HideWindow "[SysnativeFolder]net.exe" stop wuauserv" Options="1"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiDrLocatorComponent">
|
|
||||||
<ROW Signature_="FileSearchSign" Path="[SysnativeFolder]" Depth="0"/>
|
|
||||||
<ROW Signature_="FileSearchSign_1" Path="[SysnativeFolder]" Depth="0"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiIniFileComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiIniFileComponent">
|
||||||
<ROW IniFile="URL" FileName="WUFUCO~1.URL|wufuc on GitHub.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc" Action="0" Component_="ProductInformation"/>
|
<ROW IniFile="URL" FileName="WUFUCO~1.URL|wufuc on GitHub.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc" Action="0" Component_="ProductInformation"/>
|
||||||
<ROW IniFile="URL_1" FileName="DONATE~1.URL|Donate to wufuc on Pledgie!.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://pledgie.com/campaigns/34055" Action="0" Component_="ProductInformation"/>
|
<ROW IniFile="URL_1" FileName="DONATE~1.URL|Donate to wufuc on Pledgie!.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://pledgie.com/campaigns/34055" Action="0" Component_="ProductInformation"/>
|
||||||
@@ -252,25 +181,16 @@
|
|||||||
<ROW Action="AI_PREPARE_UPGRADE" Condition="AI_UPGRADE="No" AND (Not Installed)" Sequence="1399"/>
|
<ROW Action="AI_PREPARE_UPGRADE" Condition="AI_UPGRADE="No" AND (Not Installed)" Sequence="1399"/>
|
||||||
<ROW Action="AI_ResolveKnownFolders" Sequence="55"/>
|
<ROW Action="AI_ResolveKnownFolders" Sequence="55"/>
|
||||||
<ROW Action="AI_EnableDebugLog" Sequence="54"/>
|
<ROW Action="AI_EnableDebugLog" Sequence="54"/>
|
||||||
<ROW Action="RunScheduledTask" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE <> "ALL" AND AI_INSTALL_MODE <> "Remove" ) )" Sequence="6403"/>
|
|
||||||
<ROW Action="StopWindowsUpdateService" Sequence="6401"/>
|
<ROW Action="StopWindowsUpdateService" Sequence="6401"/>
|
||||||
<ROW Action="StartScheduleService" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE <> "ALL" AND AI_INSTALL_MODE <> "Remove" ) )" Sequence="6402"/>
|
<ROW Action="StartScheduleService" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE <> "ALL" AND AI_INSTALL_MODE <> "Remove" ) )" Sequence="6402"/>
|
||||||
<ROW Action="AI_AiRemoveFilesRollback" Sequence="3099"/>
|
|
||||||
<ROW Action="AI_PromptUserBasicUI" Condition="((REMOVE = "ALL") AND (NOT UPGRADINGPRODUCTCODE))" Sequence="2501"/>
|
|
||||||
<ROW Action="AIHelper_SetUnloadEvent" Sequence="1602"/>
|
|
||||||
<ROW Action="AI_PrepareShortcutFlags" Condition="(VersionNT > 501) AND ((NOT Installed) OR (Installed AND (REMOVE<>"ALL") AND (AI_INSTALL_MODE<>"Remove")))" Sequence="4501"/>
|
<ROW Action="AI_PrepareShortcutFlags" Condition="(VersionNT > 501) AND ((NOT Installed) OR (Installed AND (REMOVE<>"ALL") AND (AI_INSTALL_MODE<>"Remove")))" Sequence="4501"/>
|
||||||
<ROW Action="AI_PinShortcuts" Condition="(VersionNT > 600) AND ((NOT Installed) OR (Installed AND (REMOVE<>"ALL") AND (AI_INSTALL_MODE<>"Remove")))" Sequence="6498"/>
|
<ROW Action="AI_PinShortcuts" Condition="(VersionNT > 600) AND ((NOT Installed) OR (Installed AND (REMOVE<>"ALL") AND (AI_INSTALL_MODE<>"Remove")))" Sequence="6498"/>
|
||||||
<ROW Action="AI_UnpinShortcuts" Condition="(VersionNT > 600) AND (REMOVE = "ALL")" Sequence="3199"/>
|
<ROW Action="AI_UnpinShortcuts" Condition="(VersionNT > 600) AND (REMOVE = "ALL")" Sequence="3199"/>
|
||||||
<ROW Action="SetSysnativeFolderProperty32" Condition="NOT VersionNT64" Sequence="51"/>
|
<ROW Action="SetSysnativeFolderProperty32" Condition="NOT VersionNT64" Sequence="51"/>
|
||||||
<ROW Action="SetSysnativeFolderProperty64" Condition="VersionNT64" Sequence="53"/>
|
<ROW Action="SetSysnativeFolderProperty64" Condition="VersionNT64" Sequence="53"/>
|
||||||
<ROW Action="AI_ProcessTasks" Condition="REMOVE<>"ALL"" Sequence="1622"/>
|
|
||||||
<ROW Action="AI_UninstallTasks" Condition="REMOVE="ALL"" Sequence="1698"/>
|
|
||||||
<ROW Action="AI_ProcessTasks2" Condition="(VersionNT >= 600) AND (REMOVE<>"ALL")" Sequence="1623"/>
|
|
||||||
<ROW Action="AI_UninstallTasks2" Condition="(VersionNT >= 600) AND (REMOVE="ALL")" Sequence="1699"/>
|
|
||||||
<ROW Action="RunSFCScan" Condition="( NOT Installed ) AND ( (Not Installed) )" Sequence="1601"/>
|
<ROW Action="RunSFCScan" Condition="( NOT Installed ) AND ( (Not Installed) )" Sequence="1601"/>
|
||||||
<ROW Action="StartWindowsUpdateService" Sequence="6499"/>
|
<ROW Action="StartWindowsUpdateService" Sequence="6499"/>
|
||||||
<ROW Action="Pause" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE <> "ALL" AND AI_INSTALL_MODE <> "Remove" ) )" Sequence="6404"/>
|
<ROW Action="Pause" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE <> "ALL" AND AI_INSTALL_MODE <> "Remove" ) )" Sequence="6403"/>
|
||||||
<ROW Action="AI_AiRemoveFilesImmediate" Sequence="3499"/>
|
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiInstallUISequenceComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiInstallUISequenceComponent">
|
||||||
<ROW Action="AI_RESTORE_LOCATION" Condition="APPDIR=""" Sequence="749"/>
|
<ROW Action="AI_RESTORE_LOCATION" Condition="APPDIR=""" Sequence="749"/>
|
||||||
@@ -287,8 +207,6 @@
|
|||||||
<ROW Condition="( Version9X OR VersionNT64 OR ( VersionNT AND ((VersionNT <> 501) OR (ServicePackLevel <> 3)) AND ((VersionNT <> 502) OR (ServicePackLevel <> 2)) AND ((VersionNT <> 600) OR (MsiNTProductType <> 1)) AND ((VersionNT <> 600) OR (MsiNTProductType = 1)) AND (VersionNT <> 602) AND (VersionNT <> 1000) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNTDisplay]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT" IsPredefined="true" Builds="MsiBuild"/>
|
<ROW Condition="( Version9X OR VersionNT64 OR ( VersionNT AND ((VersionNT <> 501) OR (ServicePackLevel <> 3)) AND ((VersionNT <> 502) OR (ServicePackLevel <> 2)) AND ((VersionNT <> 600) OR (MsiNTProductType <> 1)) AND ((VersionNT <> 600) OR (MsiNTProductType = 1)) AND (VersionNT <> 602) AND (VersionNT <> 1000) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNTDisplay]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT" IsPredefined="true" Builds="MsiBuild"/>
|
||||||
<ROW Condition="(VersionNT <> 400)" Description="[ProductName] cannot be installed on [WindowsTypeNT40Display]." DescriptionLocId="AI.LaunchCondition.NoNT40" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
<ROW Condition="(VersionNT <> 400)" Description="[ProductName] cannot be installed on [WindowsTypeNT40Display]." DescriptionLocId="AI.LaunchCondition.NoNT40" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
||||||
<ROW Condition="(VersionNT <> 500)" Description="[ProductName] cannot be installed on [WindowsTypeNT50Display]." DescriptionLocId="AI.LaunchCondition.NoNT50" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
<ROW Condition="(VersionNT <> 500)" Description="[ProductName] cannot be installed on [WindowsTypeNT50Display]." DescriptionLocId="AI.LaunchCondition.NoNT50" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
||||||
<ROW Condition="(VersionNT = 601 AND RESULT_WUAUENG.DLL_WIN7) OR (VersionNT = 603 AND RESULT_WUAUENG.DLL_WIN81)" Description="File wuaueng.dll is below the minimum supported version. You must first run Windows Update until the "Unsupported Hardware" window pops up, then try again." Builds="MsiBuild"/>
|
|
||||||
<ROW Condition="(VersionNT64 = 601 AND RESULT_WUAUENG.DLL_WIN7) OR (VersionNT64 = 603 AND RESULT_WUAUENG.DLL_WIN81)" Description="File wuaueng.dll is below the minimum supported version. You must first run Windows Update until the "Unsupported Hardware" window pops up, then try again." Builds="DefaultBuild"/>
|
|
||||||
<ROW Condition="(VersionNT64 OR ((VersionNT <> 501) OR (ServicePackLevel = 3))) AND ((VersionNT <> 502) OR (ServicePackLevel = 2))" Description="[ProductName] cannot be installed on [WindowsTypeNT5XDisplay]." DescriptionLocId="AI.LaunchCondition.NoNT5X" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
<ROW Condition="(VersionNT64 OR ((VersionNT <> 501) OR (ServicePackLevel = 3))) AND ((VersionNT <> 502) OR (ServicePackLevel = 2))" Description="[ProductName] cannot be installed on [WindowsTypeNT5XDisplay]." DescriptionLocId="AI.LaunchCondition.NoNT5X" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
||||||
<ROW Condition="VersionNT" Description="[ProductName] cannot be installed on [WindowsType9XDisplay]." DescriptionLocId="AI.LaunchCondition.No9X" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
<ROW Condition="VersionNT" Description="[ProductName] cannot be installed on [WindowsType9XDisplay]." DescriptionLocId="AI.LaunchCondition.No9X" IsPredefined="true" Builds="DefaultBuild;MsiBuild"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
@@ -296,17 +214,6 @@
|
|||||||
<ROW Registry="Path" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Path" Value="[APPDIR]" Component_="ProductInformation"/>
|
<ROW Registry="Path" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Path" Value="[APPDIR]" Component_="ProductInformation"/>
|
||||||
<ROW Registry="Version" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Version" Value="[ProductVersion]" Component_="ProductInformation"/>
|
<ROW Registry="Version" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Version" Value="[ProductVersion]" Component_="ProductInformation"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiRemoveFileComponent">
|
|
||||||
<ROW FileKey="_" Component_="ProductInformation" DirProperty="APPDIR" InstallMode="2"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiShortsComponent">
|
|
||||||
<ROW Shortcut="DisablewufucAdmin" Directory_="HelperScripts_1_Dir" Name="DISABL~1|Disable wufuc (Admin)" Component_="disable_wufuc.bat" Target="[#disable_wufuc.bat]" Description="Unloads wufuc and disables its scheduled task" Hotkey="0" IconIndex="0" ShowCmd="1" WkDir="HelperScripts_Dir" CustomFlags="1"/>
|
|
||||||
<ROW Shortcut="EnablewufucAdmin" Directory_="HelperScripts_1_Dir" Name="ENABLE~1|Enable wufuc (Admin)" Component_="enable_wufuc.bat" Target="[#enable_wufuc.bat]" Description="Enables wufuc and starts its scheduled task" Hotkey="0" IconIndex="0" ShowCmd="1" WkDir="HelperScripts_Dir" CustomFlags="1"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiSignatureComponent">
|
|
||||||
<ROW Signature="FileSearchSign" FileName="wuaueng.dll" MinVersion="7.6.7601.23714"/>
|
|
||||||
<ROW Signature="FileSearchSign_1" FileName="wuaueng.dll" MinVersion="7.9.9600.18621"/>
|
|
||||||
</COMPONENT>
|
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.MsiThemeComponent">
|
<COMPONENT cid="caphyon.advinst.msicomp.MsiThemeComponent">
|
||||||
<ATTRIBUTE name="UsedTheme" value="classic"/>
|
<ATTRIBUTE name="UsedTheme" value="classic"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
@@ -314,7 +221,4 @@
|
|||||||
<ROW UpgradeCode="[|UpgradeCode]" VersionMin="0.0.1" VersionMax="[|ProductVersion]" Attributes="257" ActionProperty="OLDPRODUCTS"/>
|
<ROW UpgradeCode="[|UpgradeCode]" VersionMin="0.0.1" VersionMax="[|ProductVersion]" Attributes="257" ActionProperty="OLDPRODUCTS"/>
|
||||||
<ROW UpgradeCode="[|UpgradeCode]" VersionMin="[|ProductVersion]" Attributes="2" ActionProperty="AI_NEWERPRODUCTFOUND"/>
|
<ROW UpgradeCode="[|UpgradeCode]" VersionMin="[|ProductVersion]" Attributes="2" ActionProperty="AI_NEWERPRODUCTFOUND"/>
|
||||||
</COMPONENT>
|
</COMPONENT>
|
||||||
<COMPONENT cid="caphyon.advinst.msicomp.ScheduledTasksComponent">
|
|
||||||
<ROW TaskId="wufuc" TaskName="[wufuc_TaskName]" Run="[SysnativeFolder]rundll32.exe" CmdLine=""[#wufuc.dll]",Rundll32Entry" UserProp="SYSTEM" StartTime="0" Comments="wufuc disables the "Unsupported Hardware" message in Windows Update, and allows you to continue installing updates on Windows 7 and 8.1 systems with Intel Kaby Lake, AMD Ryzen, or other unsupported processors. https://github.com/zeffy/wufuc" Flags="49152" Trigger="5|1|1|1|0|0|0|" Condition="1" TaskVersion="2.0"/>
|
|
||||||
</COMPONENT>
|
|
||||||
</DOCUMENT>
|
</DOCUMENT>
|
||||||
|
|||||||
44
wufuc/appverifier.h
Normal file
44
wufuc/appverifier.h
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <phnt_windows.h>
|
||||||
|
|
||||||
|
#define DLL_PROCESS_VERIFIER 4
|
||||||
|
|
||||||
|
typedef VOID(NTAPI *RTL_VERIFIER_DLL_LOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
|
||||||
|
typedef VOID(NTAPI *RTL_VERIFIER_DLL_UNLOAD_CALLBACK)(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
|
||||||
|
typedef VOID(NTAPI *RTL_VERIFIER_NTDLLHEAPFREE_CALLBACK)(PVOID AllocationBase, SIZE_T AllocationSize);
|
||||||
|
|
||||||
|
typedef struct tagRTL_VERIFIER_THUNK_DESCRIPTOR
|
||||||
|
{
|
||||||
|
PCHAR ThunkName;
|
||||||
|
PVOID ThunkOldAddress;
|
||||||
|
PVOID ThunkNewAddress;
|
||||||
|
} RTL_VERIFIER_THUNK_DESCRIPTOR, *PRTL_VERIFIER_THUNK_DESCRIPTOR;
|
||||||
|
|
||||||
|
typedef struct tagRTL_VERIFIER_DLL_DESCRIPTOR
|
||||||
|
{
|
||||||
|
PWCHAR DllName;
|
||||||
|
DWORD DllFlags;
|
||||||
|
PVOID DllAddress;
|
||||||
|
PRTL_VERIFIER_THUNK_DESCRIPTOR DllThunks;
|
||||||
|
} RTL_VERIFIER_DLL_DESCRIPTOR, *PRTL_VERIFIER_DLL_DESCRIPTOR;
|
||||||
|
|
||||||
|
typedef struct tagRTL_VERIFIER_PROVIDER_DESCRIPTOR
|
||||||
|
{
|
||||||
|
DWORD Length;
|
||||||
|
PRTL_VERIFIER_DLL_DESCRIPTOR ProviderDlls;
|
||||||
|
RTL_VERIFIER_DLL_LOAD_CALLBACK ProviderDllLoadCallback;
|
||||||
|
RTL_VERIFIER_DLL_UNLOAD_CALLBACK ProviderDllUnloadCallback;
|
||||||
|
PWSTR VerifierImage;
|
||||||
|
DWORD VerifierFlags;
|
||||||
|
DWORD VerifierDebug;
|
||||||
|
PVOID RtlpGetStackTraceAddress;
|
||||||
|
PVOID RtlpDebugPageHeapCreate;
|
||||||
|
PVOID RtlpDebugPageHeapDestroy;
|
||||||
|
RTL_VERIFIER_NTDLLHEAPFREE_CALLBACK ProviderNtdllHeapFreeCallback;
|
||||||
|
} RTL_VERIFIER_PROVIDER_DESCRIPTOR, *PRTL_VERIFIER_PROVIDER_DESCRIPTOR;
|
||||||
|
|
||||||
|
extern RTL_VERIFIER_THUNK_DESCRIPTOR g_vfADVAPIThunkDescriptors[];
|
||||||
|
extern RTL_VERIFIER_THUNK_DESCRIPTOR g_vfK32ThunkDescriptors[];
|
||||||
|
extern RTL_VERIFIER_DLL_DESCRIPTOR g_vfDllDescriptors[];
|
||||||
|
extern RTL_VERIFIER_PROVIDER_DESCRIPTOR g_vfProviderDescriptor;
|
||||||
@@ -1,55 +1,15 @@
|
|||||||
#include "callbacks.h"
|
#include "callbacks.h"
|
||||||
|
|
||||||
#include "iathook.h"
|
|
||||||
#include "hooks.h"
|
|
||||||
#include "helpers.h"
|
|
||||||
#include "service.h"
|
|
||||||
#include "tracing.h"
|
#include "tracing.h"
|
||||||
|
|
||||||
#include <windows.h>
|
#include <phnt_windows.h>
|
||||||
#include <tchar.h>
|
|
||||||
#include <sddl.h>
|
|
||||||
|
|
||||||
DWORD WINAPI ThreadProcCallback(LPVOID *lpParam) {
|
VOID NTAPI VerifierDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
|
||||||
OSVERSIONINFO osvi = { 0 };
|
{
|
||||||
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
|
trace(L"dll load %ls, DllBase=%p, DllSize=%Iu", DllName, DllBase, DllSize);
|
||||||
#pragma warning(suppress : 4996)
|
}
|
||||||
if ( GetVersionEx(&osvi) )
|
|
||||||
trace(_T("Windows version: %d.%d.%d (%zu-bit)"), osvi.dwMajorVersion, osvi.dwMinorVersion, osvi.dwBuildNumber, sizeof(uintptr_t) * 8);
|
VOID NTAPI VerifierDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved)
|
||||||
else trace(_T("Failed to get Windows version (error code=%08X)"), GetLastError());
|
{
|
||||||
|
trace(L"dll unload %ls, DllBase=%p, DllSize=%Iu", DllName, DllBase, DllSize);
|
||||||
char brand[0x31];
|
|
||||||
trace(_T("Processor: %hs"), get_cpuid_brand(brand, _countof(brand)));
|
|
||||||
|
|
||||||
LPTSTR lpCommandLine = GetCommandLine();
|
|
||||||
TCHAR lpServiceCommandLine[0x8000];
|
|
||||||
if ( GetServiceCommandLine(NULL, _T("wuauserv"), lpServiceCommandLine, _countof(lpServiceCommandLine))
|
|
||||||
&& !_tcsicmp(lpCommandLine, lpServiceCommandLine) ) {
|
|
||||||
|
|
||||||
SECURITY_ATTRIBUTES sa = { 0 };
|
|
||||||
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
|
|
||||||
sa.bInheritHandle = FALSE;
|
|
||||||
if ( ConvertStringSecurityDescriptorToSecurityDescriptor(_T("D:(A;;0x001F0003;;;BA)"), SDDL_REVISION_1, &sa.lpSecurityDescriptor, NULL) ) {
|
|
||||||
HANDLE hEvent = CreateEvent(&sa, TRUE, FALSE, _T("Global\\wufuc_UnloadEvent"));
|
|
||||||
if ( hEvent ) {
|
|
||||||
HANDLE threads[0x1000];
|
|
||||||
|
|
||||||
size_t count = suspend_other_threads(threads, _countof(threads));
|
|
||||||
iat_hook(GetModuleHandle(NULL), "RegQueryValueExW", (LPVOID)&pfnRegQueryValueExW, RegQueryValueExW_hook);
|
|
||||||
iat_hook(GetModuleHandle(NULL), "LoadLibraryExW", (LPVOID)&pfnLoadLibraryExW, LoadLibraryExW_hook);
|
|
||||||
resume_and_close_threads(threads, count);
|
|
||||||
|
|
||||||
WaitForSingleObject(hEvent, INFINITE);
|
|
||||||
trace(_T("Unload event was set, removing hooks and unloading..."));
|
|
||||||
|
|
||||||
count = suspend_other_threads(threads, _countof(threads));
|
|
||||||
iat_hook(GetModuleHandle(NULL), "LoadLibraryExW", NULL, pfnLoadLibraryExW);
|
|
||||||
iat_hook(GetModuleHandle(NULL), "RegQueryValueExW", NULL, pfnRegQueryValueExW);
|
|
||||||
resume_and_close_threads(threads, count);
|
|
||||||
CloseHandle(hEvent);
|
|
||||||
} else trace(_T("Failed to create unload event (error code=%08X)"), GetLastError());
|
|
||||||
} else trace(_T("Failed to convert string security descriptor to security descriptor (error code=%08X)"), GetLastError());
|
|
||||||
} else trace(_T("Current process command line is incorrect: %s != %s"), lpCommandLine, lpServiceCommandLine);
|
|
||||||
trace(_T("Bye bye!"));
|
|
||||||
FreeLibraryAndExitThread((HMODULE)lpParam, 0);
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,8 +1,6 @@
|
|||||||
#ifndef CALLBACKS_H_INCLUDED
|
|
||||||
#define CALLBACKS_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <phnt_windows.h>
|
||||||
|
|
||||||
DWORD WINAPI ThreadProcCallback(LPVOID *lpParam);
|
VOID NTAPI VerifierDllLoadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
|
||||||
#endif
|
VOID NTAPI VerifierDllUnloadCallback(PWSTR DllName, PVOID DllBase, SIZE_T DllSize, PVOID Reserved);
|
||||||
|
|||||||
@@ -1,29 +1,63 @@
|
|||||||
|
#include "appverifier.h"
|
||||||
|
#include "hooks.h"
|
||||||
#include "callbacks.h"
|
#include "callbacks.h"
|
||||||
#include "helpers.h"
|
#include "helpers.h"
|
||||||
#include "ntdllhelper.h"
|
|
||||||
#include "tracing.h"
|
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <stdbool.h>
|
||||||
|
|
||||||
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
|
#include <phnt_windows.h>
|
||||||
switch ( ul_reason_for_call ) {
|
#include <phnt.h>
|
||||||
case DLL_PROCESS_ATTACH:
|
|
||||||
{
|
|
||||||
if ( !IsOperatingSystemSupported() /*|| IsWow64()*/ )
|
|
||||||
return FALSE;
|
|
||||||
|
|
||||||
HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadProcCallback, (LPVOID)hModule, 0, NULL);
|
RTL_VERIFIER_THUNK_DESCRIPTOR g_vfK32ThunkDescriptors[] = {
|
||||||
CloseHandle(hThread);
|
{ "RegQueryValueExW", NULL, (PVOID)&RegQueryValueExW_Hook },
|
||||||
break;
|
{ "LoadLibraryExW", NULL, (PVOID)&LoadLibraryExW_Hook },
|
||||||
}
|
{ 0 } };
|
||||||
case DLL_PROCESS_DETACH:
|
RTL_VERIFIER_DLL_DESCRIPTOR g_vfDllDescriptors[] = {
|
||||||
DeinitTracing();
|
{ L"kernel32.dll", 0, NULL, g_vfK32ThunkDescriptors },
|
||||||
break;
|
{ 0 } };
|
||||||
case DLL_THREAD_ATTACH:
|
RTL_VERIFIER_DLL_DESCRIPTOR g_vfNullDllDescriptor[] = { { 0 } };
|
||||||
case DLL_THREAD_DETACH:
|
RTL_VERIFIER_PROVIDER_DESCRIPTOR g_vfProviderDescriptor = {
|
||||||
break;
|
sizeof(RTL_VERIFIER_PROVIDER_DESCRIPTOR),
|
||||||
}
|
g_vfNullDllDescriptor,
|
||||||
return TRUE;
|
//(RTL_VERIFIER_DLL_LOAD_CALLBACK)&VerifierDllLoadCallback,
|
||||||
|
//(RTL_VERIFIER_DLL_UNLOAD_CALLBACK)&VerifierDllUnloadCallback
|
||||||
|
};
|
||||||
|
|
||||||
|
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
|
||||||
|
{
|
||||||
|
switch ( ul_reason_for_call ) {
|
||||||
|
case DLL_PROCESS_ATTACH:
|
||||||
|
LdrDisableThreadCalloutsForDll((PVOID)hModule);
|
||||||
|
break;
|
||||||
|
case DLL_PROCESS_DETACH:
|
||||||
|
break;
|
||||||
|
case DLL_PROCESS_VERIFIER:;
|
||||||
|
if ( verify_winver(6, 1, 0, 0, 0, VER_EQUAL, VER_EQUAL, 0, 0, 0)
|
||||||
|
|| verify_winver(6, 3, 0, 0, 0, VER_EQUAL, VER_EQUAL, 0, 0, 0) ) {
|
||||||
|
|
||||||
|
RTL_QUERY_REGISTRY_TABLE QueryTable[1];
|
||||||
|
RtlSecureZeroMemory(&QueryTable, sizeof(QueryTable));
|
||||||
|
QueryTable[0].Name = L"ImagePath";
|
||||||
|
QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
|
||||||
|
UNICODE_STRING ImagePath;
|
||||||
|
RtlInitUnicodeString(&ImagePath, NULL);
|
||||||
|
QueryTable[0].EntryContext = &ImagePath;
|
||||||
|
NTSTATUS Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,
|
||||||
|
L"wuauserv",
|
||||||
|
QueryTable,
|
||||||
|
NULL,
|
||||||
|
NULL);
|
||||||
|
|
||||||
|
// TODO: check status and maybe fix implementation? idk...
|
||||||
|
if ( !RtlCompareUnicodeString(&NtCurrentPeb()->ProcessParameters->CommandLine, &ImagePath, TRUE) ) {
|
||||||
|
g_vfProviderDescriptor.ProviderDlls = g_vfDllDescriptors;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
*(PRTL_VERIFIER_PROVIDER_DESCRIPTOR *)lpReserved = &g_vfProviderDescriptor;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
return TRUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
194
wufuc/helpers.c
194
wufuc/helpers.c
@@ -1,140 +1,84 @@
|
|||||||
#include "helpers.h"
|
#include "helpers.h"
|
||||||
|
|
||||||
#include "tracing.h"
|
|
||||||
|
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
#include <stdbool.h>
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <phnt_windows.h>
|
||||||
#include <tchar.h>
|
#include <phnt.h>
|
||||||
#include <TlHelp32.h>
|
|
||||||
|
|
||||||
static BOOL CompareWindowsVersion(BYTE Operator, DWORD dwMajorVersion, DWORD dwMinorVersion, WORD wServicePackMajor, WORD wServicePackMinor, DWORD dwTypeMask) {
|
bool verify_winver(
|
||||||
OSVERSIONINFOEX osvi = { 0 };
|
DWORD dwMajorVersion,
|
||||||
osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
|
DWORD dwMinorVersion,
|
||||||
osvi.dwMajorVersion = dwMajorVersion;
|
DWORD dwBuildNumber,
|
||||||
osvi.dwMinorVersion = dwMinorVersion;
|
WORD wServicePackMajor,
|
||||||
osvi.wServicePackMajor = wServicePackMajor;
|
WORD wServicePackMinor,
|
||||||
osvi.wServicePackMinor = wServicePackMinor;
|
BYTE MajorVersionCondition,
|
||||||
|
BYTE MinorVersionCondition,
|
||||||
|
BYTE BuildNumberCondition,
|
||||||
|
BYTE ServicePackMajorCondition,
|
||||||
|
BYTE ServicePackMinorCondition
|
||||||
|
)
|
||||||
|
{
|
||||||
|
RTL_OSVERSIONINFOEXW osvi = { 0 };
|
||||||
|
osvi.dwOSVersionInfoSize = sizeof(RTL_OSVERSIONINFOEXW);
|
||||||
|
|
||||||
DWORDLONG dwlConditionMask = 0;
|
osvi.dwMajorVersion = dwMajorVersion;
|
||||||
VER_SET_CONDITION(dwlConditionMask, VER_MAJORVERSION, Operator);
|
osvi.dwMinorVersion = dwMinorVersion;
|
||||||
VER_SET_CONDITION(dwlConditionMask, VER_MINORVERSION, Operator);
|
osvi.dwBuildNumber = dwBuildNumber;
|
||||||
VER_SET_CONDITION(dwlConditionMask, VER_SERVICEPACKMAJOR, Operator);
|
osvi.wServicePackMajor = wServicePackMajor;
|
||||||
VER_SET_CONDITION(dwlConditionMask, VER_SERVICEPACKMINOR, Operator);
|
osvi.wServicePackMinor = wServicePackMinor;
|
||||||
|
|
||||||
return VerifyVersionInfo(&osvi, dwTypeMask, dwlConditionMask);
|
ULONGLONG ConditionMask = 0;
|
||||||
|
ULONG TypeMask = 0;
|
||||||
|
if ( MajorVersionCondition ) {
|
||||||
|
TypeMask |= VER_MAJORVERSION;
|
||||||
|
VER_SET_CONDITION(ConditionMask, VER_MAJORVERSION, MajorVersionCondition);
|
||||||
|
}
|
||||||
|
if ( MinorVersionCondition ) {
|
||||||
|
TypeMask |= VER_MINORVERSION;
|
||||||
|
VER_SET_CONDITION(ConditionMask, VER_MINORVERSION, MinorVersionCondition);
|
||||||
|
}
|
||||||
|
if ( BuildNumberCondition ) {
|
||||||
|
TypeMask |= VER_BUILDNUMBER;
|
||||||
|
VER_SET_CONDITION(ConditionMask, VER_BUILDNUMBER, BuildNumberCondition);
|
||||||
|
}
|
||||||
|
if ( ServicePackMajorCondition ) {
|
||||||
|
TypeMask |= VER_SERVICEPACKMAJOR;
|
||||||
|
VER_SET_CONDITION(ConditionMask, VER_SERVICEPACKMAJOR, ServicePackMajorCondition);
|
||||||
|
}
|
||||||
|
if ( ServicePackMinorCondition ) {
|
||||||
|
TypeMask |= VER_SERVICEPACKMINOR;
|
||||||
|
VER_SET_CONDITION(ConditionMask, VER_SERVICEPACKMINOR, ServicePackMinorCondition);
|
||||||
|
}
|
||||||
|
return RtlVerifyVersionInfo(&osvi, TypeMask, ConditionMask) == STATUS_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
BOOL IsWindows7(void) {
|
wchar_t *find_fname(wchar_t *pPath)
|
||||||
static BOOL checked = FALSE, isWindows7 = FALSE;
|
{
|
||||||
|
wchar_t *pwc = wcsrchr(pPath, L'\\');
|
||||||
|
if ( pwc && *(++pwc) )
|
||||||
|
return pwc;
|
||||||
|
|
||||||
if ( !checked ) {
|
return pPath;
|
||||||
isWindows7 = CompareWindowsVersion(VER_EQUAL, 6, 1, 0, 0, VER_MAJORVERSION | VER_MINORVERSION);
|
|
||||||
checked = TRUE;
|
|
||||||
}
|
|
||||||
return isWindows7;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
BOOL IsWindows8Point1(void) {
|
BOOL file_exists(const wchar_t *path)
|
||||||
static BOOL checked = FALSE, isWindows8Point1 = FALSE;
|
{
|
||||||
|
return GetFileAttributesW(path) != INVALID_FILE_ATTRIBUTES;
|
||||||
if ( !checked ) {
|
|
||||||
isWindows8Point1 = CompareWindowsVersion(VER_EQUAL, 6, 3, 0, 0, VER_MAJORVERSION | VER_MINORVERSION);
|
|
||||||
checked = TRUE;
|
|
||||||
}
|
|
||||||
return isWindows8Point1;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
BOOL IsOperatingSystemSupported(void) {
|
int compare_versions(
|
||||||
#if !defined(_AMD64_) && !defined(_X86_)
|
WORD wMajorA, WORD wMinorA, WORD wBuildA, WORD wRevisionA,
|
||||||
return FALSE;
|
WORD wMajorB, WORD wMinorB, WORD wBuildB, WORD wRevisionB
|
||||||
#else
|
)
|
||||||
return IsWindows7() || IsWindows8Point1();
|
{
|
||||||
#endif
|
if ( wMajorA < wMajorB ) return -1;
|
||||||
}
|
if ( wMajorA > wMajorB ) return 1;
|
||||||
|
if ( wMinorA < wMinorB ) return -1;
|
||||||
BOOL IsWow64(void) {
|
if ( wMinorA > wMinorB ) return 1;
|
||||||
static BOOL checked = FALSE, isWow64 = FALSE;
|
if ( wBuildA < wBuildB ) return -1;
|
||||||
static ISWOW64PROCESS pfnIsWow64Process = NULL;
|
if ( wBuildA > wBuildB ) return 1;
|
||||||
|
if ( wRevisionA < wRevisionB ) return -1;
|
||||||
if ( !checked ) {
|
if ( wRevisionA > wRevisionB ) return 1;
|
||||||
if ( !pfnIsWow64Process )
|
return 0;
|
||||||
pfnIsWow64Process = (ISWOW64PROCESS)GetProcAddress(GetModuleHandle(_T("kernel32.dll")), "IsWow64Process");
|
|
||||||
|
|
||||||
if ( pfnIsWow64Process && pfnIsWow64Process(GetCurrentProcess(), &isWow64) )
|
|
||||||
checked = TRUE;
|
|
||||||
}
|
|
||||||
return isWow64;
|
|
||||||
}
|
|
||||||
|
|
||||||
size_t suspend_other_threads(LPHANDLE lphThreads, size_t nMaxCount) {
|
|
||||||
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
|
|
||||||
THREADENTRY32 te = { 0 };
|
|
||||||
te.dwSize = sizeof(te);
|
|
||||||
size_t count = 0;
|
|
||||||
if ( Thread32First(hSnap, &te) ) {
|
|
||||||
DWORD dwProcessId = GetCurrentProcessId();
|
|
||||||
DWORD dwThreadId = GetCurrentThreadId();
|
|
||||||
WaitForTracingMutex(); // make sure we don't dead lock
|
|
||||||
do {
|
|
||||||
if ( te.th32OwnerProcessID != dwProcessId || te.th32ThreadID == dwThreadId )
|
|
||||||
continue;
|
|
||||||
|
|
||||||
lphThreads[count] = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te.th32ThreadID);
|
|
||||||
SuspendThread(lphThreads[count]);
|
|
||||||
count++;
|
|
||||||
} while ( count < nMaxCount && Thread32Next(hSnap, &te) );
|
|
||||||
ReleaseTracingMutex();
|
|
||||||
}
|
|
||||||
CloseHandle(hSnap);
|
|
||||||
trace(_T("Suspended %zu other threads"), count);
|
|
||||||
return count;
|
|
||||||
}
|
|
||||||
|
|
||||||
void resume_and_close_threads(LPHANDLE lphThreads, size_t nCount) {
|
|
||||||
for ( size_t i = 0; i < nCount; i++ ) {
|
|
||||||
ResumeThread(lphThreads[i]);
|
|
||||||
CloseHandle(lphThreads[i]);
|
|
||||||
}
|
|
||||||
trace(_T("Resumed %zu threads"), nCount);
|
|
||||||
}
|
|
||||||
|
|
||||||
char *get_cpuid_brand(char *brand, size_t nMaxCount) {
|
|
||||||
int info[4];
|
|
||||||
__cpuidex(info, 0x80000000, 0);
|
|
||||||
if ( info[0] < 0x80000004 ) {
|
|
||||||
brand[0] = '\0';
|
|
||||||
return brand;
|
|
||||||
}
|
|
||||||
uint32_t *char_as_int = (uint32_t *)brand;
|
|
||||||
for ( int op = 0x80000002; op <= 0x80000004; op++ ) {
|
|
||||||
__cpuidex(info, op, 0);
|
|
||||||
for ( int i = 0; i < 4; i++ )
|
|
||||||
*(char_as_int++) = info[i];
|
|
||||||
}
|
|
||||||
size_t i = 0;
|
|
||||||
while ( i < nMaxCount && isspace(brand[i]) )
|
|
||||||
i++;
|
|
||||||
|
|
||||||
return brand + i;
|
|
||||||
}
|
|
||||||
|
|
||||||
wchar_t *find_fname(wchar_t *pPath) {
|
|
||||||
wchar_t *pwc = wcsrchr(pPath, L'\\');
|
|
||||||
if ( pwc && *(++pwc) )
|
|
||||||
return pwc;
|
|
||||||
|
|
||||||
return pPath;
|
|
||||||
}
|
|
||||||
|
|
||||||
int compare_versions(WORD ma1, WORD mi1, WORD b1, WORD r1, WORD ma2, WORD mi2, WORD b2, WORD r2) {
|
|
||||||
if ( ma1 < ma2 ) return -1;
|
|
||||||
if ( ma1 > ma2 ) return 1;
|
|
||||||
if ( mi1 < mi2 ) return -1;
|
|
||||||
if ( mi1 > mi2 ) return 1;
|
|
||||||
if ( b1 < b2 ) return -1;
|
|
||||||
if ( b1 > b2 ) return 1;
|
|
||||||
if ( r1 < r2 ) return -1;
|
|
||||||
if ( r1 > r2 ) return 1;
|
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,20 +1,25 @@
|
|||||||
#ifndef HELPERS_H_INCLUDED
|
|
||||||
#define HELPERS_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <stdbool.h>
|
||||||
|
|
||||||
typedef BOOL(WINAPI *ISWOW64PROCESS)(HANDLE, PBOOL);
|
#include <phnt_windows.h>
|
||||||
|
|
||||||
BOOL IsWindows7(void);
|
bool verify_winver(
|
||||||
BOOL IsWindows8Point1(void);
|
DWORD dwMajorVersion,
|
||||||
BOOL IsOperatingSystemSupported(void);
|
DWORD dwMinorVersion,
|
||||||
BOOL IsWow64(void);
|
DWORD dwBuildNumber,
|
||||||
|
WORD wServicePackMajor,
|
||||||
|
WORD wServicePackMinor,
|
||||||
|
BYTE MajorVersionCondition,
|
||||||
|
BYTE MinorVersionCondition,
|
||||||
|
BYTE BuildNumberCondition,
|
||||||
|
BYTE ServicePackMajorCondition,
|
||||||
|
BYTE ServicePackMinorCondition
|
||||||
|
);
|
||||||
|
|
||||||
size_t suspend_other_threads(LPHANDLE lphThreads, size_t nMaxCount);
|
|
||||||
void resume_and_close_threads(LPHANDLE lphThreads, size_t nCount);
|
|
||||||
|
|
||||||
char *get_cpuid_brand(char *brand, size_t nMaxCount);
|
|
||||||
wchar_t *find_fname(wchar_t *pPath);
|
wchar_t *find_fname(wchar_t *pPath);
|
||||||
int compare_versions(WORD ma1, WORD mi1, WORD b1, WORD r1, WORD ma2, WORD mi2, WORD b2, WORD r2);
|
BOOL file_exists(const wchar_t *path);
|
||||||
#endif
|
int compare_versions(
|
||||||
|
WORD wMajorA, WORD wMinorA, WORD wBuildA, WORD wRevisionA,
|
||||||
|
WORD wMajorB, WORD wMinorB, WORD wBuildB, WORD wRevisionB);
|
||||||
|
|
||||||
|
|||||||
202
wufuc/hooks.c
202
wufuc/hooks.c
@@ -1,121 +1,141 @@
|
|||||||
#include "hooks.h"
|
#include "hooks.h"
|
||||||
|
|
||||||
#include "helpers.h"
|
#include "appverifier.h"
|
||||||
#include "patchwua.h"
|
#include "patchwua.h"
|
||||||
#include "ntdllhelper.h"
|
#include "helpers.h"
|
||||||
#include "tracing.h"
|
#include "tracing.h"
|
||||||
|
#include "rtl_malloc.h"
|
||||||
|
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
|
||||||
#define WIN32_NO_STATUS
|
#include <phnt_windows.h>
|
||||||
#include <Windows.h>
|
#include <phnt.h>
|
||||||
#undef WIN32_NO_STATUS
|
|
||||||
|
|
||||||
#include <ntstatus.h>
|
|
||||||
#include <tchar.h>
|
|
||||||
#include <Psapi.h>
|
#include <Psapi.h>
|
||||||
|
|
||||||
REGQUERYVALUEEXW pfnRegQueryValueExW = NULL;
|
|
||||||
LOADLIBRARYEXW pfnLoadLibraryExW = NULL;
|
|
||||||
|
|
||||||
LRESULT WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) {
|
LSTATUS WINAPI RegQueryValueExW_Hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
|
||||||
size_t nMaxCount = *lpcbData / sizeof(wchar_t);
|
{
|
||||||
|
LSTATUS result;
|
||||||
|
|
||||||
LRESULT result = pfnRegQueryValueExW(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData);
|
if ( (lpData && lpcbData)
|
||||||
|
&& (lpValueName && !_wcsicmp(lpValueName, L"ServiceDll")) ) {
|
||||||
|
|
||||||
NTSTATUS status;
|
DWORD cbData = *lpcbData;
|
||||||
ULONG ResultLength;
|
size_t MaxCount = cbData / sizeof(wchar_t);
|
||||||
if ( !_wcsicmp(lpValueName, L"ServiceDll")
|
|
||||||
&& TryNtQueryKey((HANDLE)hKey, KeyNameInformation, NULL, 0, &ResultLength, &status)
|
|
||||||
&& (status == STATUS_BUFFER_OVERFLOW || status == STATUS_BUFFER_TOO_SMALL) ) {
|
|
||||||
|
|
||||||
PKEY_NAME_INFORMATION pkni = malloc(ResultLength);
|
// this way the dll path is garunteed to be null terminated
|
||||||
if ( TryNtQueryKey((HANDLE)hKey, KeyNameInformation, (PVOID)pkni, ResultLength, &ResultLength, &status)
|
result = RegGetValueW(hKey, NULL, lpValueName, RRF_RT_REG_EXPAND_SZ | RRF_NOEXPAND, lpType, lpData, lpcbData);
|
||||||
&& NT_SUCCESS(status) ) {
|
if ( result != ERROR_SUCCESS )
|
||||||
|
goto L_ret;
|
||||||
|
|
||||||
size_t nBufferCount = pkni->NameLength / sizeof(wchar_t);
|
ULONG ResultLength;
|
||||||
int current, pos;
|
NTSTATUS Status = NtQueryKey((HANDLE)hKey, KeyNameInformation, NULL, 0, &ResultLength);
|
||||||
if ( _snwscanf_s(pkni->Name, nBufferCount, L"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet%03d\\services\\wuauserv\\Parameters%n", ¤t, &pos) == 1
|
if ( Status != STATUS_BUFFER_OVERFLOW && Status != STATUS_BUFFER_TOO_SMALL )
|
||||||
&& pos == nBufferCount ) {
|
goto L_ret;
|
||||||
|
|
||||||
size_t nCount = nMaxCount + 1;
|
PKEY_NAME_INFORMATION pkni = rtl_malloc(ResultLength);
|
||||||
wchar_t *path = calloc(nCount, sizeof(wchar_t));
|
Status = NtQueryKey((HANDLE)hKey, KeyNameInformation, (PVOID)pkni, ResultLength, &ResultLength);
|
||||||
wcsncpy_s(path, nCount, (wchar_t *)lpData, *lpcbData / sizeof(wchar_t));
|
if ( Status == STATUS_SUCCESS ) {
|
||||||
|
size_t BufferCount = pkni->NameLength / sizeof(wchar_t);
|
||||||
|
int current, pos;
|
||||||
|
if ( _snwscanf_s(pkni->Name, BufferCount, L"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet%03d\\services\\wuauserv\\Parameters%n", ¤t, &pos) == 1
|
||||||
|
&& pos == BufferCount ) {
|
||||||
|
|
||||||
wchar_t *fname = find_fname(path);
|
wchar_t drive[_MAX_DRIVE], dir[_MAX_DIR], fname[_MAX_FNAME], ext[_MAX_EXT];
|
||||||
if ( !_wcsicmp(fname, L"wuaueng2.dll") // UpdatePack7R2
|
_wsplitpath_s((wchar_t *)lpData,
|
||||||
|| !_wcsicmp(fname, L"WuaCpuFix64.dll") // WuaCpuFix
|
drive, _countof(drive),
|
||||||
|| !_wcsicmp(fname, L"WuaCpuFix.dll") ) {
|
dir, _countof(dir),
|
||||||
|
fname, _countof(fname),
|
||||||
|
ext, _countof(ext));
|
||||||
|
|
||||||
wcscpy_s(fname, nMaxCount - (fname - path), L"wuaueng.dll");
|
if ( !_wcsicmp(ext, L".dll")
|
||||||
|
&& (!_wcsicmp(fname, L"wuaueng2") // UpdatePack7R2
|
||||||
|
|| !_wcsicmp(fname, L"WuaCpuFix64") // WuaCpuFix
|
||||||
|
|| !_wcsicmp(fname, L"WuaCpuFix")) ) {
|
||||||
|
|
||||||
DWORD nSize = ExpandEnvironmentStringsW(path, NULL, 0);
|
wchar_t *tmp = rtl_malloc(cbData);
|
||||||
wchar_t *lpDst = calloc(nSize, sizeof(wchar_t));
|
|
||||||
ExpandEnvironmentStringsW(path, lpDst, nSize);
|
_wmakepath_s(tmp, MaxCount, drive, dir, L"wuaueng", ext);
|
||||||
if ( GetFileAttributesW(lpDst) != INVALID_FILE_ATTRIBUTES ) {
|
DWORD nSize = ExpandEnvironmentStringsW(tmp, NULL, 0);
|
||||||
trace(_T("Compatibility fix: %.*ls -> %ls"), *lpcbData / sizeof(wchar_t), (wchar_t *)lpData, path);
|
|
||||||
size_t nLength = wcsnlen_s(path, nMaxCount);
|
wchar_t *lpDst = rtl_calloc(nSize, sizeof(wchar_t));
|
||||||
wcsncpy_s((wchar_t *)lpData, nMaxCount, path, nLength);
|
ExpandEnvironmentStringsW(tmp, lpDst, nSize);
|
||||||
*lpcbData = (DWORD)(nLength * sizeof(wchar_t));
|
|
||||||
}
|
rtl_free(tmp);
|
||||||
free(lpDst);
|
|
||||||
|
if ( file_exists(lpDst) ) {
|
||||||
|
_wmakepath_s((wchar_t *)lpData, MaxCount, drive, dir, L"wuaueng", ext);
|
||||||
|
*lpcbData = (DWORD)((wcslen((wchar_t *)lpData) + 1) * sizeof(wchar_t));
|
||||||
|
trace(L"Fixed wuauserv ServiceDll path: %ls", lpDst);
|
||||||
|
}
|
||||||
|
rtl_free(lpDst);
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
free(path);
|
rtl_free(pkni);
|
||||||
}
|
} else {
|
||||||
|
// handle normally
|
||||||
|
result = ((LPFN_REGQUERYVALUEEXW)g_vfK32ThunkDescriptors[0].ThunkOldAddress)(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData);
|
||||||
}
|
}
|
||||||
free(pkni);
|
L_ret:
|
||||||
}
|
return result;
|
||||||
return result;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
HMODULE WINAPI LoadLibraryExW_hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags) {
|
HMODULE WINAPI LoadLibraryExW_Hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags)
|
||||||
HMODULE result = pfnLoadLibraryExW(lpFileName, hFile, dwFlags);
|
{
|
||||||
trace(_T("Loaded library: %ls"), lpFileName);
|
HMODULE result = ((LPFN_LOADLIBRARYEXW)g_vfK32ThunkDescriptors[1].ThunkOldAddress)(lpFileName, hFile, dwFlags);
|
||||||
|
if ( !result ) {
|
||||||
DWORD dwLen = GetFileVersionInfoSizeW(lpFileName, NULL);
|
trace(L"Failed to load library: %ls (error code=%08X)", lpFileName, GetLastError());
|
||||||
if ( dwLen ) {
|
goto L_ret;
|
||||||
LPVOID pBlock = malloc(dwLen);
|
}
|
||||||
|
trace(L"Loaded library: %ls", lpFileName);
|
||||||
|
DWORD dwLen = GetFileVersionInfoSizeW(lpFileName, NULL);
|
||||||
|
if ( !dwLen ) {
|
||||||
|
trace(L"Failed to get file version info size for file %ls (error code=%08X)", lpFileName, GetLastError());
|
||||||
|
goto L_ret;
|
||||||
|
}
|
||||||
|
LPVOID pBlock = rtl_malloc(dwLen);
|
||||||
if ( GetFileVersionInfoW(lpFileName, 0, dwLen, pBlock) ) {
|
if ( GetFileVersionInfoW(lpFileName, 0, dwLen, pBlock) ) {
|
||||||
PLANGANDCODEPAGE ptl;
|
PLANGANDCODEPAGE ptl;
|
||||||
UINT cb;
|
UINT cb;
|
||||||
if ( VerQueryValueW(pBlock, L"\\VarFileInfo\\Translation", (LPVOID *)&ptl, &cb) ) {
|
if ( VerQueryValueW(pBlock, L"\\VarFileInfo\\Translation", (LPVOID *)&ptl, &cb) ) {
|
||||||
wchar_t lpSubBlock[38];
|
wchar_t lpSubBlock[38];
|
||||||
for ( size_t i = 0; i < (cb / sizeof(LANGANDCODEPAGE)); i++ ) {
|
for ( size_t i = 0; i < (cb / sizeof(LANGANDCODEPAGE)); i++ ) {
|
||||||
swprintf_s(lpSubBlock, _countof(lpSubBlock), L"\\StringFileInfo\\%04x%04x\\InternalName", ptl[i].wLanguage, ptl[i].wCodePage);
|
swprintf_s(lpSubBlock, _countof(lpSubBlock), L"\\StringFileInfo\\%04x%04x\\InternalName", ptl[i].wLanguage, ptl[i].wCodePage);
|
||||||
wchar_t *lpszInternalName;
|
wchar_t *lpszInternalName;
|
||||||
UINT uLen;
|
UINT uLen;
|
||||||
if ( VerQueryValueW(pBlock, lpSubBlock, (LPVOID *)&lpszInternalName, &uLen)
|
if ( VerQueryValueW(pBlock, lpSubBlock, (LPVOID *)&lpszInternalName, &uLen)
|
||||||
&& !_wcsicmp(lpszInternalName, L"wuaueng.dll") ) {
|
&& !_wcsicmp(lpszInternalName, L"wuaueng.dll") ) {
|
||||||
|
|
||||||
VS_FIXEDFILEINFO *pffi;
|
VS_FIXEDFILEINFO *pffi;
|
||||||
VerQueryValueW(pBlock, L"\\", (LPVOID *)&pffi, &uLen);
|
VerQueryValueW(pBlock, L"\\", (LPVOID *)&pffi, &uLen);
|
||||||
WORD wMajor = HIWORD(pffi->dwProductVersionMS);
|
WORD wMajor = HIWORD(pffi->dwProductVersionMS);
|
||||||
WORD wMinor = LOWORD(pffi->dwProductVersionMS);
|
WORD wMinor = LOWORD(pffi->dwProductVersionMS);
|
||||||
WORD wBuild = HIWORD(pffi->dwProductVersionLS);
|
WORD wBuild = HIWORD(pffi->dwProductVersionLS);
|
||||||
WORD wRevision = LOWORD(pffi->dwProductVersionLS);
|
WORD wRevision = LOWORD(pffi->dwProductVersionLS);
|
||||||
|
|
||||||
TCHAR fname[MAX_PATH];
|
wchar_t path[MAX_PATH];
|
||||||
GetModuleBaseName(GetCurrentProcess(), result, fname, _countof(fname));
|
GetModuleFileNameW(result, path, _countof(path));
|
||||||
|
wchar_t *fname = find_fname(path);
|
||||||
|
|
||||||
if ( (IsWindows7() && compare_versions(wMajor, wMinor, wBuild, wRevision, 7, 6, 7601, 23714) != -1)
|
if ( (verify_winver(6, 1, 0, 0, 0, VER_EQUAL, VER_EQUAL, 0, 0, 0) && compare_versions(wMajor, wMinor, wBuild, wRevision, 7, 6, 7601, 23714) != -1)
|
||||||
|| (IsWindows8Point1() && compare_versions(wMajor, wMinor, wBuild, wRevision, 7, 9, 9600, 18621) != -1) ) {
|
|| (verify_winver(6, 3, 0, 0, 0, VER_EQUAL, VER_EQUAL, 0, 0, 0) && compare_versions(wMajor, wMinor, wBuild, wRevision, 7, 9, 9600, 18621) != -1) ) {
|
||||||
|
|
||||||
trace(_T("%s version: %d.%d.%d.%d"), fname, wMajor, wMinor, wBuild, wRevision);
|
trace(L"%ls version: %d.%d.%d.%d", fname, wMajor, wMinor, wBuild, wRevision);
|
||||||
MODULEINFO modinfo;
|
MODULEINFO modinfo;
|
||||||
if ( GetModuleInformation(GetCurrentProcess(), result, &modinfo, sizeof(MODULEINFO)) ) {
|
if ( GetModuleInformation(GetCurrentProcess(), result, &modinfo, sizeof(MODULEINFO)) ) {
|
||||||
if ( PatchWUA(modinfo.lpBaseOfDll, modinfo.SizeOfImage) )
|
if ( !patch_wua(modinfo.lpBaseOfDll, modinfo.SizeOfImage) )
|
||||||
trace(_T("Successfully patched %s!"), fname);
|
trace(L"Failed to patch %ls!", fname);
|
||||||
else trace(_T("Failed to patch %s!"), fname);
|
} else trace(L"Failed to get module information for %ls (%p) (couldn't patch)", fname, result);
|
||||||
}
|
} else trace(L"Unsupported version of %ls: %d.%d.%d.%d (patching skipped)", fname, wMajor, wMinor, wBuild, wRevision);
|
||||||
|
break;
|
||||||
else trace(_T("Failed to get module information for %s (%p) (couldn't patch)"), fname, result);
|
}
|
||||||
} else trace(_T("Unsupported version of %s: %d.%d.%d.%d (patching skipped)"), fname, wMajor, wMinor, wBuild, wRevision);
|
}
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
}
|
}
|
||||||
free(pBlock);
|
rtl_free(pBlock);
|
||||||
}
|
L_ret:
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,23 +1,15 @@
|
|||||||
#ifndef HOOKS_H_INCLUDED
|
|
||||||
#define HOOKS_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#define WIN32_NO_STATUS
|
#include <phnt_windows.h>
|
||||||
#include <Windows.h>
|
|
||||||
#undef WIN32_NO_STATUS
|
|
||||||
|
|
||||||
typedef struct tagLANGANDCODEPAGE {
|
typedef struct tagLANGANDCODEPAGE
|
||||||
WORD wLanguage;
|
{
|
||||||
WORD wCodePage;
|
WORD wLanguage;
|
||||||
|
WORD wCodePage;
|
||||||
} LANGANDCODEPAGE, *PLANGANDCODEPAGE;
|
} LANGANDCODEPAGE, *PLANGANDCODEPAGE;
|
||||||
|
|
||||||
typedef LRESULT(WINAPI *REGQUERYVALUEEXW)(HKEY, LPCWSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD);
|
typedef LSTATUS(WINAPI *LPFN_REGQUERYVALUEEXW)(HKEY, LPCWSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD);
|
||||||
typedef HMODULE(WINAPI *LOADLIBRARYEXW)(LPCWSTR, HANDLE, DWORD);
|
typedef HMODULE(WINAPI *LPFN_LOADLIBRARYEXW)(LPCWSTR, HANDLE, DWORD);
|
||||||
|
|
||||||
extern REGQUERYVALUEEXW pfnRegQueryValueExW;
|
LSTATUS WINAPI RegQueryValueExW_Hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
|
||||||
extern LOADLIBRARYEXW pfnLoadLibraryExW;
|
HMODULE WINAPI LoadLibraryExW_Hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags);
|
||||||
|
|
||||||
LRESULT WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
|
|
||||||
HMODULE WINAPI LoadLibraryExW_hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|||||||
@@ -1,42 +0,0 @@
|
|||||||
#include "iathook.h"
|
|
||||||
|
|
||||||
#include "tracing.h"
|
|
||||||
|
|
||||||
#include <Windows.h>
|
|
||||||
#include <tchar.h>
|
|
||||||
|
|
||||||
static LPVOID *iat_find(HMODULE hModule, LPCSTR lpFunctionName) {
|
|
||||||
uintptr_t hm = (uintptr_t)hModule;
|
|
||||||
|
|
||||||
for ( PIMAGE_IMPORT_DESCRIPTOR iid = (PIMAGE_IMPORT_DESCRIPTOR)(hm + ((PIMAGE_NT_HEADERS)(hm + ((PIMAGE_DOS_HEADER)hm)->e_lfanew))
|
|
||||||
->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); iid->Name; iid++ ) {
|
|
||||||
|
|
||||||
LPVOID *pp;
|
|
||||||
for ( size_t i = 0; *(pp = i + (LPVOID *)(hm + iid->FirstThunk)); i++ ) {
|
|
||||||
LPSTR fn = (LPSTR)(hm + *(i + (PSIZE_T)(hm + iid->OriginalFirstThunk)) + 2);
|
|
||||||
if ( !((uintptr_t)fn & IMAGE_ORDINAL_FLAG) && !_stricmp((const char *)lpFunctionName, (char *)fn) )
|
|
||||||
return pp;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
void iat_hook(HMODULE hModule, LPCSTR lpFuncName, LPVOID *lpOldAddress, LPVOID lpNewAddress) {
|
|
||||||
LPVOID *lpAddress = iat_find(hModule, lpFuncName);
|
|
||||||
if ( !lpAddress || *lpAddress == lpNewAddress )
|
|
||||||
return;
|
|
||||||
|
|
||||||
if ( !hModule )
|
|
||||||
hModule = GetModuleHandle(NULL);
|
|
||||||
|
|
||||||
trace(_T("Modified IAT: hModule=%p, Name=%hs, OldAddress=%p, NewAddress=%p"), hModule, lpFuncName, *lpAddress, lpNewAddress);
|
|
||||||
|
|
||||||
DWORD flOldProtect;
|
|
||||||
if ( VirtualProtect(lpAddress, sizeof(LPVOID), PAGE_READWRITE, &flOldProtect) ) {
|
|
||||||
if ( lpOldAddress )
|
|
||||||
*lpOldAddress = *lpAddress;
|
|
||||||
*lpAddress = lpNewAddress;
|
|
||||||
if ( !VirtualProtect(lpAddress, sizeof(LPVOID), flOldProtect, &flOldProtect) )
|
|
||||||
trace(_T("Failed to restore memory region permissions at %p (error code=%08x)"), lpAddress, GetLastError());
|
|
||||||
} else trace(_T("Failed to change memory region permissions at %p (error code=%08x)"), lpAddress, GetLastError());
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#ifndef IATHOOK_H_INCLUDED
|
|
||||||
#define IATHOOK_H_INCLUDED
|
|
||||||
#pragma once
|
|
||||||
|
|
||||||
#include <Windows.h>
|
|
||||||
|
|
||||||
void iat_hook(HMODULE hModule, LPCSTR lpFuncName, LPVOID *lpOldAddress, LPVOID lpNewAddress);
|
|
||||||
#endif
|
|
||||||
20
wufuc/ntcstr.h
Normal file
20
wufuc/ntcstr.h
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include <phnt_windows.h>
|
||||||
|
|
||||||
|
#define _countof(_Array) (sizeof(_Array) / sizeof(_Array[0]))
|
||||||
|
#define _max(a,b) (((a) > (b)) ? (a) : (b))
|
||||||
|
#define _min(a,b) (((a) < (b)) ? (a) : (b))
|
||||||
|
|
||||||
|
#define _MAX_PATH 260 // max. length of full pathname
|
||||||
|
#define _MAX_DRIVE 3 // max. length of drive component
|
||||||
|
#define _MAX_DIR 256 // max. length of path component
|
||||||
|
#define _MAX_FNAME 256 // max. length of file name component
|
||||||
|
#define _MAX_EXT 256 // max. length of extension component
|
||||||
|
|
||||||
|
typedef int(__cdecl *LPFN__WCSICMP_NTDLL)(const wchar_t *string1, const wchar_t *string2);
|
||||||
|
|
||||||
|
int _wcsicmp_Ntdll(
|
||||||
|
const wchar_t *string1,
|
||||||
|
const wchar_t *string2
|
||||||
|
);
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
#include "ntdllhelper.h"
|
|
||||||
|
|
||||||
#define WIN32_NO_STATUS
|
|
||||||
#include <windows.h>
|
|
||||||
#undef WIN32_NO_STATUS
|
|
||||||
|
|
||||||
#include <winternl.h>
|
|
||||||
#include <tchar.h>
|
|
||||||
|
|
||||||
static HMODULE g_hNTDLL = NULL;
|
|
||||||
|
|
||||||
static BOOL InitNTDLL(void) {
|
|
||||||
if ( !g_hNTDLL )
|
|
||||||
g_hNTDLL = GetModuleHandle(_T("ntdll"));
|
|
||||||
return !!g_hNTDLL;
|
|
||||||
}
|
|
||||||
|
|
||||||
BOOL TryNtQueryKey(HANDLE KeyHandle, KEY_INFORMATION_CLASS KeyInformationClass, PVOID KeyInformation, ULONG Length, PULONG ResultLength, PNTSTATUS status) {
|
|
||||||
static NTQUERYKEY pfnNtQueryKey = NULL;
|
|
||||||
|
|
||||||
if ( InitNTDLL() ) {
|
|
||||||
if ( !pfnNtQueryKey )
|
|
||||||
pfnNtQueryKey = (NTQUERYKEY)GetProcAddress(g_hNTDLL, "NtQueryKey");
|
|
||||||
|
|
||||||
if ( pfnNtQueryKey ) {
|
|
||||||
*status = pfnNtQueryKey(KeyHandle, KeyInformationClass, KeyInformation, Length, ResultLength);
|
|
||||||
return TRUE;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return FALSE;
|
|
||||||
}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
#ifndef NTDLLHELPER_H_INCLUDED
|
|
||||||
#define NTDLLHELPER_H_INCLUDED
|
|
||||||
#pragma once
|
|
||||||
|
|
||||||
#define WIN32_NO_STATUS
|
|
||||||
#include <windows.h>
|
|
||||||
#undef WIN32_NO_STATUS
|
|
||||||
|
|
||||||
#include <winternl.h>
|
|
||||||
|
|
||||||
typedef enum tagKEY_INFORMATION_CLASS {
|
|
||||||
KeyBasicInformation = 0,
|
|
||||||
KeyNodeInformation = 1,
|
|
||||||
KeyFullInformation = 2,
|
|
||||||
KeyNameInformation = 3,
|
|
||||||
KeyCachedInformation = 4,
|
|
||||||
KeyFlagsInformation = 5,
|
|
||||||
KeyVirtualizationInformation = 6,
|
|
||||||
KeyHandleTagsInformation = 7,
|
|
||||||
MaxKeyInfoClass = 8
|
|
||||||
} KEY_INFORMATION_CLASS;
|
|
||||||
|
|
||||||
typedef struct tagKEY_NAME_INFORMATION {
|
|
||||||
ULONG NameLength;
|
|
||||||
WCHAR Name[1];
|
|
||||||
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
|
|
||||||
|
|
||||||
typedef NTSTATUS(NTAPI *NTQUERYKEY)(HANDLE, KEY_INFORMATION_CLASS, PVOID, ULONG, PULONG);
|
|
||||||
|
|
||||||
BOOL TryNtQueryKey(HANDLE KeyHandle, KEY_INFORMATION_CLASS KeyInformationClass, PVOID KeyInformation, ULONG Length, PULONG ResultLength, PNTSTATUS status);
|
|
||||||
#endif
|
|
||||||
119
wufuc/patchwua.c
119
wufuc/patchwua.c
@@ -4,67 +4,70 @@
|
|||||||
#include "patternfind.h"
|
#include "patternfind.h"
|
||||||
#include "tracing.h"
|
#include "tracing.h"
|
||||||
|
|
||||||
|
#include <stdlib.h>
|
||||||
#include <stdint.h>
|
#include <stdint.h>
|
||||||
|
#include <stdbool.h>
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <phnt_windows.h>
|
||||||
#include <tchar.h>
|
#include <phnt.h>
|
||||||
#include <Psapi.h>
|
|
||||||
|
|
||||||
BOOL PatchWUA(void *lpBaseOfDll, size_t SizeOfImage) {
|
bool patch_wua(void *lpBaseOfDll, size_t SizeOfImage)
|
||||||
char *pattern;
|
{
|
||||||
size_t offset1, offset2;
|
char *pattern;
|
||||||
#ifdef _AMD64_
|
size_t offset1, offset2;
|
||||||
pattern = "FFF3 4883EC?? 33DB 391D???????? 7508 8B05????????";
|
#ifdef _M_AMD64
|
||||||
offset1 = 10;
|
pattern = "FFF3 4883EC?? 33DB 391D???????? 7508 8B05????????";
|
||||||
offset2 = 18;
|
offset1 = 10;
|
||||||
#elif defined(_X86_)
|
offset2 = 18;
|
||||||
if ( IsWindows7() ) {
|
#elif defined(_M_IX86)
|
||||||
pattern = "833D????????00 743E E8???????? A3????????";
|
if ( IsWindows7() ) {
|
||||||
offset1 = 2;
|
pattern = "833D????????00 743E E8???????? A3????????";
|
||||||
offset2 = 15;
|
offset1 = 2;
|
||||||
} else if ( IsWindows8Point1() ) {
|
offset2 = 15;
|
||||||
pattern = "8BFF 51 833D????????00 7507 A1????????";
|
} else if ( IsWindows8Point1() ) {
|
||||||
offset1 = 5;
|
pattern = "8BFF 51 833D????????00 7507 A1????????";
|
||||||
offset2 = 13;
|
offset1 = 5;
|
||||||
}
|
offset2 = 13;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
unsigned char *ptr = patternfind(lpBaseOfDll, SizeOfImage, pattern);
|
||||||
|
if ( !ptr ) {
|
||||||
|
trace(L"No pattern match! (couldn't patch)");
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
|
wchar_t path[MAX_PATH];
|
||||||
|
GetModuleFileName((HMODULE)lpBaseOfDll, path, _countof(path));
|
||||||
|
wchar_t *fname = find_fname(path);
|
||||||
|
trace(L"Matched pattern at %ls!%p",
|
||||||
|
fname,
|
||||||
|
ptr);
|
||||||
|
LPBOOL lpb1, lpb2;
|
||||||
|
#ifdef _M_AMD64
|
||||||
|
lpb1 = (LPBOOL)(ptr + offset1 + sizeof(uint32_t) + *(uint32_t *)(ptr + offset1));
|
||||||
|
lpb2 = (LPBOOL)(ptr + offset2 + sizeof(uint32_t) + *(uint32_t *)(ptr + offset2));
|
||||||
|
#elif defined(_M_IX86)
|
||||||
|
lpb1 = (LPBOOL)(*(uintptr_t *)(ptr + offset1));
|
||||||
|
lpb2 = (LPBOOL)(*(uintptr_t *)(ptr + offset2));
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
unsigned char *ptr = patternfind(lpBaseOfDll, SizeOfImage, 0, pattern);
|
DWORD flOldProtect;
|
||||||
if ( !ptr ) {
|
if ( *lpb1 == TRUE ) {
|
||||||
trace(_T("No pattern match! (couldn't patch)"));
|
if ( VirtualProtect(lpb1, sizeof(BOOL), PAGE_READWRITE, &flOldProtect) ) {
|
||||||
return FALSE;
|
*lpb1 = FALSE;
|
||||||
}
|
trace(L"Patched value #1 at %ls!%p: %08X", fname, lpb1, *lpb1);
|
||||||
TCHAR fname[MAX_PATH];
|
if ( !VirtualProtect(lpb1, sizeof(BOOL), flOldProtect, &flOldProtect) )
|
||||||
GetModuleBaseName(GetCurrentProcess(), (HMODULE)lpBaseOfDll, fname, _countof(fname));
|
trace(L"Failed to restore memory region permissions at %ls!%p (error code=%08X)", fname, lpb1, GetLastError());
|
||||||
trace(_T("Matched pattern for IsDeviceServiceable at %s+0x%zx"), fname,
|
} else trace(L"Failed to change memory region permissions at %ls!%p (error code=%08X)", fname, lpb1, GetLastError());
|
||||||
(size_t)((uintptr_t)ptr - (uintptr_t)lpBaseOfDll));
|
}
|
||||||
LPBOOL lpb1, lpb2;
|
if ( *lpb2 == FALSE ) {
|
||||||
#ifdef _AMD64_
|
if ( VirtualProtect(lpb2, sizeof(BOOL), PAGE_READWRITE, &flOldProtect) ) {
|
||||||
lpb1 = (LPBOOL)(ptr + offset1 + sizeof(uint32_t) + *(uint32_t *)(ptr + offset1));
|
*lpb2 = TRUE;
|
||||||
lpb2 = (LPBOOL)(ptr + offset2 + sizeof(uint32_t) + *(uint32_t *)(ptr + offset2));
|
trace(L"Patched value #2 at %ls!%p: %08X", fname, lpb2, *lpb2);
|
||||||
#elif defined(_X86_)
|
if ( !VirtualProtect(lpb2, sizeof(BOOL), flOldProtect, &flOldProtect) )
|
||||||
lpb1 = (LPBOOL)(*(uintptr_t *)(ptr + offset1));
|
trace(L"Failed to restore memory region permissions at %ls!%p: (error code=%08X)", fname, lpb2, GetLastError());
|
||||||
lpb2 = (LPBOOL)(*(uintptr_t *)(ptr + offset2));
|
} else trace(L"Failed to change memory region permissions at %ls!%p (error code=%08X)", fname, lpb2, GetLastError());
|
||||||
#endif
|
}
|
||||||
offset1 = (size_t)((uintptr_t)lpb1 - (uintptr_t)lpBaseOfDll);
|
return !*lpb1 && *lpb2;
|
||||||
offset2 = (size_t)((uintptr_t)lpb2 - (uintptr_t)lpBaseOfDll);
|
|
||||||
|
|
||||||
DWORD flOldProtect;
|
|
||||||
if ( *lpb1 ) {
|
|
||||||
if ( VirtualProtect(lpb1, sizeof(BOOL), PAGE_READWRITE, &flOldProtect) ) {
|
|
||||||
*lpb1 = FALSE;
|
|
||||||
trace(_T("Patched value #1 at %s+0x%zx: %08x"), fname, offset1, *lpb1);
|
|
||||||
if ( !VirtualProtect(lpb1, sizeof(BOOL), flOldProtect, &flOldProtect) )
|
|
||||||
trace(_T("Failed to restore memory region permissions at %s+0x%zx (error code=%08x)"), fname, offset1, GetLastError());
|
|
||||||
} else trace(_T("Failed to change memory region permissions at %s+0x%zx (error code=%08x)"), fname, offset1, GetLastError());
|
|
||||||
}
|
|
||||||
if ( !*lpb2 ) {
|
|
||||||
if ( VirtualProtect(lpb2, sizeof(BOOL), PAGE_READWRITE, &flOldProtect) ) {
|
|
||||||
*lpb2 = TRUE;
|
|
||||||
trace(_T("Patched value #2 at %s+0x%zx: %08x"), fname, offset2, *lpb2);
|
|
||||||
if ( !VirtualProtect(lpb2, sizeof(BOOL), flOldProtect, &flOldProtect) )
|
|
||||||
trace(_T("Failed to restore memory region permissions at %s+0x%zx (error code=%08x)"), fname, offset2, GetLastError());
|
|
||||||
} else trace(_T("Failed to change memory region permissions at %s+0x%zx (error code=%08x)"), fname, offset2, GetLastError());
|
|
||||||
}
|
|
||||||
return !*lpb1 && *lpb2;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -1,8 +1,7 @@
|
|||||||
#ifndef PATCHWUA_H_INCLUDED
|
|
||||||
#define PATCHWUA_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <stdbool.h>
|
||||||
|
|
||||||
BOOL PatchWUA(void *lpBaseOfDll, size_t SizeOfImage);
|
#include <phnt_windows.h>
|
||||||
#endif
|
|
||||||
|
bool patch_wua(void *lpBaseOfDll, size_t SizeOfImage);
|
||||||
|
|||||||
@@ -1,133 +1,179 @@
|
|||||||
#include "patternfind.h"
|
#include "patternfind.h"
|
||||||
|
|
||||||
#include <Windows.h>
|
#include "rtl_malloc.h"
|
||||||
|
|
||||||
/* Ported to Win32 C from x64dbg's patternfind.cpp:
|
#include <stddef.h>
|
||||||
* https://github.com/x64dbg/x64dbg/blob/development/src/dbg/patternfind.cpp
|
#include <stdbool.h>
|
||||||
*
|
#include <string.h>
|
||||||
* x64dbg license (GPL-3.0):
|
|
||||||
* https://github.com/x64dbg/x64dbg/blob/development/LICENSE
|
|
||||||
*/
|
|
||||||
|
|
||||||
static int hexchtoint(char c) {
|
static inline bool isHex(char ch)
|
||||||
int result = -1;
|
{
|
||||||
if ( c >= '0' && c <= '9' )
|
return (ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'F') || (ch >= 'a' && ch <= 'f');
|
||||||
result = c - '0';
|
|
||||||
else if ( c >= 'A' && c <= 'F' )
|
|
||||||
result = c - 'A' + 10;
|
|
||||||
else if ( c >= 'a' && c <= 'f' )
|
|
||||||
result = c - 'a' + 10;
|
|
||||||
|
|
||||||
return result;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static size_t formathexpattern(const char *patterntext, char *formattext, size_t formattextsize) {
|
static inline int hexchtoint(char ch)
|
||||||
size_t len = strlen(patterntext);
|
{
|
||||||
size_t result = 0;
|
if ( ch >= '0' && ch <= '9' )
|
||||||
for ( size_t i = 0; i < len && (!formattext || result < formattextsize); i++ ) {
|
return ch - '0';
|
||||||
if ( patterntext[i] == '?' || hexchtoint(patterntext[i]) != -1 ) {
|
else if ( ch >= 'A' && ch <= 'F' )
|
||||||
if ( formattext )
|
return ch - 'A' + 10;
|
||||||
formattext[result] = patterntext[i];
|
else if ( ch >= 'a' && ch <= 'f' )
|
||||||
|
return ch - 'a' + 10;
|
||||||
result++;
|
return -1;
|
||||||
}
|
|
||||||
}
|
|
||||||
return result;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static BOOL patterntransform(const char *patterntext, PPATTERNBYTE pattern, size_t *patternsize) {
|
static inline size_t formathexpattern(const char *patterntext, char *formattext, size_t formattextsize)
|
||||||
size_t cb = formathexpattern(patterntext, NULL, 0);
|
{
|
||||||
if ( !cb || cb > *patternsize )
|
size_t len = strlen(patterntext);
|
||||||
return FALSE;
|
size_t result = 0;
|
||||||
|
for ( size_t i = 0; i < len; i++ ) {
|
||||||
|
if ( patterntext[i] == '?' || hexchtoint(patterntext[i]) != -1 ) {
|
||||||
|
if ( formattext && result + 1 < formattextsize )
|
||||||
|
formattext[result] = patterntext[i];
|
||||||
|
|
||||||
char *formattext = calloc(cb, sizeof(char));
|
result++;
|
||||||
cb = formathexpattern(patterntext, formattext, cb);
|
|
||||||
|
|
||||||
if ( cb % 2 )
|
|
||||||
formattext[cb++] = '?';
|
|
||||||
|
|
||||||
formattext[cb] = '\0';
|
|
||||||
|
|
||||||
for ( size_t i = 0, j = 0, k = 0; i < cb; i++, j ^= 1, k = (i - j) >> 1 ) {
|
|
||||||
if ( formattext[i] == '?' )
|
|
||||||
pattern[k].nibble[j].wildcard = TRUE;
|
|
||||||
else {
|
|
||||||
pattern[k].nibble[j].wildcard = FALSE;
|
|
||||||
pattern[k].nibble[j].data = hexchtoint(formattext[i]) & 0xf;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
free(formattext);
|
|
||||||
*patternsize = cb >> 1;
|
|
||||||
return TRUE;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void patternwritebyte(unsigned char *byte, PPATTERNBYTE pbyte) {
|
|
||||||
unsigned char n1 = (*byte >> 4) & 0xf;
|
|
||||||
unsigned char n2 = *byte & 0xf;
|
|
||||||
if ( !pbyte->nibble[0].wildcard )
|
|
||||||
n1 = pbyte->nibble[0].data;
|
|
||||||
|
|
||||||
if ( !pbyte->nibble[1].wildcard )
|
|
||||||
n2 = pbyte->nibble[1].data;
|
|
||||||
*byte = ((n1 << 4) & 0xf0) | (n2 & 0xf);
|
|
||||||
}
|
|
||||||
|
|
||||||
static BOOL patternwrite(unsigned char *data, size_t datasize, const char *pattern) {
|
|
||||||
size_t writepatternsize = strlen(pattern);
|
|
||||||
if ( writepatternsize > datasize )
|
|
||||||
writepatternsize = datasize;
|
|
||||||
|
|
||||||
BOOL result = FALSE;
|
|
||||||
PPATTERNBYTE writepattern = calloc(writepatternsize, sizeof(PATTERNBYTE));
|
|
||||||
if ( patterntransform(pattern, writepattern, &writepatternsize) ) {
|
|
||||||
DWORD flOldProtect;
|
|
||||||
if ( result = VirtualProtect(data, writepatternsize, PAGE_READWRITE, &flOldProtect) ) {
|
|
||||||
for ( size_t i = 0; i < writepatternsize; i++ ) {
|
|
||||||
BYTE n1 = (data[i] >> 4) & 0xf;
|
|
||||||
BYTE n2 = data[i] & 0xf;
|
|
||||||
if ( !writepattern[i].nibble[0].wildcard )
|
|
||||||
n1 = writepattern[i].nibble[0].data;
|
|
||||||
|
|
||||||
if ( !writepattern[i].nibble[1].wildcard )
|
|
||||||
n2 = writepattern[i].nibble[1].data;
|
|
||||||
data[i] = ((n1 << 4) & 0xf0) | (n2 & 0xf);
|
|
||||||
result = VirtualProtect(data, writepatternsize, flOldProtect, &flOldProtect);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
free(writepattern);
|
|
||||||
return result;
|
|
||||||
}
|
|
||||||
|
|
||||||
unsigned char *patternfind(unsigned char *data, size_t datasize, size_t startindex, const char *pattern) {
|
|
||||||
unsigned char *result = NULL;
|
|
||||||
size_t searchpatternsize = strlen(pattern);
|
|
||||||
PPATTERNBYTE searchpattern = calloc(searchpatternsize, sizeof(PATTERNBYTE));
|
|
||||||
|
|
||||||
if ( patterntransform(pattern, searchpattern, &searchpatternsize) ) {
|
|
||||||
for ( size_t i = startindex, j = 0; i < datasize; i++ ) { //search for the pattern
|
|
||||||
if ( (searchpattern[j].nibble[0].wildcard || searchpattern[j].nibble[0].data == ((data[i] >> 4) & 0xf))
|
|
||||||
&& (searchpattern[j].nibble[1].wildcard || searchpattern[j].nibble[1].data == (data[i] & 0xf)) ) { //check if our pattern matches the current byte
|
|
||||||
|
|
||||||
if ( ++j == searchpatternsize ) { //everything matched
|
|
||||||
result = data + (i - searchpatternsize + 1);
|
|
||||||
break;
|
|
||||||
}
|
}
|
||||||
} else if ( j > 0 ) { //fix by Computer_Angel
|
|
||||||
i -= j;
|
|
||||||
j = 0; //reset current pattern position
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
if ( result % 2 ) { //not a multiple of 2
|
||||||
free(searchpattern);
|
if ( formattext && result + 1 < formattextsize )
|
||||||
return result;
|
formattext[result] = '?';
|
||||||
}
|
|
||||||
|
|
||||||
unsigned char *patternsnr(unsigned char *data, size_t datasize, size_t startindex, const char *searchpattern, const char *replacepattern) {
|
result++;
|
||||||
unsigned char *result = patternfind(data, datasize, startindex, searchpattern);
|
}
|
||||||
if ( !result )
|
if ( formattext ) {
|
||||||
|
if ( result <= formattextsize )
|
||||||
|
formattext[result] = '\0';
|
||||||
|
else
|
||||||
|
formattext[0] = '\0';
|
||||||
|
}
|
||||||
return result;
|
return result;
|
||||||
|
}
|
||||||
patternwrite(result, datasize, replacepattern);
|
|
||||||
return result;
|
bool patterntransform(const char *patterntext, PatternByte *pattern, size_t patternsize)
|
||||||
|
{
|
||||||
|
memset(pattern, 0, patternsize * sizeof(PatternByte));
|
||||||
|
size_t len = formathexpattern(patterntext, NULL, 0);
|
||||||
|
|
||||||
|
if ( !len || len / 2 > patternsize )
|
||||||
|
return false;
|
||||||
|
|
||||||
|
size_t size = len + 1;
|
||||||
|
char *formattext = rtl_malloc(size);
|
||||||
|
formathexpattern(patterntext, formattext, size);
|
||||||
|
PatternByte newByte;
|
||||||
|
|
||||||
|
for ( int i = 0, j = 0, k = 0; i < len && k <= patternsize; i++ ) {
|
||||||
|
if ( formattext[i] == '?' ) { //wildcard
|
||||||
|
newByte.nibble[j].wildcard = true; //match anything
|
||||||
|
} else { //hex
|
||||||
|
newByte.nibble[j].wildcard = false;
|
||||||
|
newByte.nibble[j].data = hexchtoint(formattext[i]) & 0xF;
|
||||||
|
}
|
||||||
|
|
||||||
|
j++;
|
||||||
|
if ( j == 2 ) { //two nibbles = one byte
|
||||||
|
j = 0;
|
||||||
|
pattern[k++] = newByte;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline bool patternmatchbyte(unsigned char byte, const PatternByte pbyte)
|
||||||
|
{
|
||||||
|
int matched = 0;
|
||||||
|
|
||||||
|
unsigned char n1 = (byte >> 4) & 0xF;
|
||||||
|
if ( pbyte.nibble[0].wildcard )
|
||||||
|
matched++;
|
||||||
|
else if ( pbyte.nibble[0].data == n1 )
|
||||||
|
matched++;
|
||||||
|
|
||||||
|
unsigned char n2 = byte & 0xF;
|
||||||
|
if ( pbyte.nibble[1].wildcard )
|
||||||
|
matched++;
|
||||||
|
else if ( pbyte.nibble[1].data == n2 )
|
||||||
|
matched++;
|
||||||
|
|
||||||
|
return (matched == 2);
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned char *patternfind(unsigned char *data, size_t datasize, const char *pattern)
|
||||||
|
{
|
||||||
|
size_t searchpatternsize = formathexpattern(pattern, NULL, 0) / 2;
|
||||||
|
PatternByte *searchpattern = rtl_calloc(searchpatternsize, sizeof(PatternByte));
|
||||||
|
|
||||||
|
unsigned char *result = NULL;
|
||||||
|
if ( patterntransform(pattern, searchpattern, searchpatternsize) )
|
||||||
|
result = patternfind3(data, datasize, searchpattern, searchpatternsize);
|
||||||
|
|
||||||
|
rtl_free(searchpattern);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned char *patternfind2(unsigned char *data, size_t datasize, unsigned char *pattern, size_t patternsize)
|
||||||
|
{
|
||||||
|
if ( patternsize > datasize )
|
||||||
|
patternsize = datasize;
|
||||||
|
for ( size_t i = 0, pos = 0; i < datasize; i++ ) {
|
||||||
|
if ( data[i] == pattern[pos] ) {
|
||||||
|
pos++;
|
||||||
|
if ( pos == patternsize )
|
||||||
|
return &data[i - patternsize + 1];
|
||||||
|
} else if ( pos > 0 ) {
|
||||||
|
i -= pos;
|
||||||
|
pos = 0; //reset current pattern position
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
static inline void patternwritebyte(unsigned char *byte, const PatternByte pbyte)
|
||||||
|
{
|
||||||
|
unsigned char n1 = (*byte >> 4) & 0xF;
|
||||||
|
unsigned char n2 = *byte & 0xF;
|
||||||
|
if ( !pbyte.nibble[0].wildcard )
|
||||||
|
n1 = pbyte.nibble[0].data;
|
||||||
|
if ( !pbyte.nibble[1].wildcard )
|
||||||
|
n2 = pbyte.nibble[1].data;
|
||||||
|
*byte = ((n1 << 4) & 0xF0) | (n2 & 0xF);
|
||||||
|
}
|
||||||
|
|
||||||
|
void patternwrite(unsigned char *data, size_t datasize, const char *pattern)
|
||||||
|
{
|
||||||
|
size_t writepatternsize = formathexpattern(pattern, NULL, 0) / 2;
|
||||||
|
PatternByte *writepattern = rtl_calloc(writepatternsize, sizeof(PatternByte));
|
||||||
|
|
||||||
|
if ( patterntransform(pattern, writepattern, writepatternsize) ) {
|
||||||
|
if ( writepatternsize > datasize )
|
||||||
|
writepatternsize = datasize;
|
||||||
|
for ( size_t i = 0; i < writepatternsize; i++ )
|
||||||
|
patternwritebyte(&data[i], writepattern[i]);
|
||||||
|
}
|
||||||
|
|
||||||
|
rtl_free(writepattern);
|
||||||
|
}
|
||||||
|
|
||||||
|
bool patternsnr(unsigned char *data, size_t datasize, const char *searchpattern, const char *replacepattern)
|
||||||
|
{
|
||||||
|
unsigned char *found = patternfind(data, datasize, searchpattern);
|
||||||
|
if ( !found )
|
||||||
|
return false;
|
||||||
|
patternwrite(found, datasize - (found - data), replacepattern);
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned char *patternfind3(unsigned char *data, size_t datasize, const PatternByte *pattern, size_t searchpatternsize)
|
||||||
|
{
|
||||||
|
for ( size_t i = 0, pos = 0; i < datasize; i++ ) { //search for the pattern
|
||||||
|
if ( patternmatchbyte(data[i], pattern[pos]) ) { //check if our pattern matches the current byte
|
||||||
|
pos++;
|
||||||
|
if ( pos == searchpatternsize ) //everything matched
|
||||||
|
return &data[i - searchpatternsize + 1];
|
||||||
|
} else if ( pos > 0 ) { //fix by Computer_Angel
|
||||||
|
i -= pos;
|
||||||
|
pos = 0; //reset current pattern position
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
}
|
}
|
||||||
@@ -1,16 +1,57 @@
|
|||||||
#ifndef PATTERNFIND_H_INCLUDED
|
|
||||||
#define PATTERNFIND_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <stdbool.h>
|
||||||
|
|
||||||
typedef struct tagPATTERNBYTE {
|
typedef struct tagPatternByte
|
||||||
struct tagPATTERNNIBBLE {
|
{
|
||||||
unsigned char data;
|
struct PatternNibble
|
||||||
BOOL wildcard;
|
{
|
||||||
} nibble[2];
|
unsigned char data;
|
||||||
} PATTERNBYTE, *PPATTERNBYTE;
|
bool wildcard;
|
||||||
|
} nibble[2];
|
||||||
|
} PatternByte;
|
||||||
|
|
||||||
unsigned char *patternfind(unsigned char *data, size_t datasize, size_t startindex, const char *pattern);
|
//returns: pointer to data when found, NULL when not found
|
||||||
unsigned char *patternsnr(unsigned char *data, size_t datasize, size_t startindex, const char *searchpattern, const char *replacepattern);
|
unsigned char *patternfind(
|
||||||
#endif
|
unsigned char *data, //data
|
||||||
|
size_t datasize, //size of data
|
||||||
|
const char *pattern //pattern to search
|
||||||
|
);
|
||||||
|
|
||||||
|
//returns: pointer to data when found, NULL when not found
|
||||||
|
unsigned char *patternfind2(
|
||||||
|
unsigned char *data, //data
|
||||||
|
size_t datasize, //size of data
|
||||||
|
unsigned char *pattern, //bytes to search
|
||||||
|
size_t patternsize //size of bytes to search
|
||||||
|
);
|
||||||
|
|
||||||
|
//returns: nothing
|
||||||
|
void patternwrite(
|
||||||
|
unsigned char *data, //data
|
||||||
|
size_t datasize, //size of data
|
||||||
|
const char *pattern //pattern to write
|
||||||
|
);
|
||||||
|
|
||||||
|
//returns: true on success, false on failure
|
||||||
|
bool patternsnr(
|
||||||
|
unsigned char *data, //data
|
||||||
|
size_t datasize, //size of data
|
||||||
|
const char *searchpattern, //pattern to search
|
||||||
|
const char *replacepattern //pattern to write
|
||||||
|
);
|
||||||
|
|
||||||
|
//returns: true on success, false on failure
|
||||||
|
bool patterntransform(
|
||||||
|
const char *patterntext, //pattern string
|
||||||
|
PatternByte *pattern, //pattern to feed to patternfind
|
||||||
|
size_t patternsize //size of pattern
|
||||||
|
);
|
||||||
|
|
||||||
|
//returns: pointer to data when found, NULL when not found
|
||||||
|
unsigned char *patternfind3(
|
||||||
|
unsigned char *data, //data
|
||||||
|
size_t datasize, //size of data
|
||||||
|
const PatternByte *pattern, //pattern to search
|
||||||
|
size_t searchpatternsize //size of pattern to search
|
||||||
|
);
|
||||||
|
|||||||
70
wufuc/rtl_malloc.c
Normal file
70
wufuc/rtl_malloc.c
Normal file
@@ -0,0 +1,70 @@
|
|||||||
|
#include "rtl_malloc.h"
|
||||||
|
|
||||||
|
#include <phnt_windows.h>
|
||||||
|
#include <phnt.h>
|
||||||
|
|
||||||
|
void *rtl_malloc(size_t size)
|
||||||
|
{
|
||||||
|
return RtlAllocateHeap(RtlProcessHeap(), 0, size);
|
||||||
|
}
|
||||||
|
|
||||||
|
void rtl_free(void *memblock)
|
||||||
|
{
|
||||||
|
RtlFreeHeap(RtlProcessHeap(), 0, memblock);
|
||||||
|
}
|
||||||
|
|
||||||
|
void *rtl_calloc(size_t num, size_t size)
|
||||||
|
{
|
||||||
|
return RtlAllocateHeap(RtlProcessHeap(), HEAP_ZERO_MEMORY, num * size);
|
||||||
|
}
|
||||||
|
|
||||||
|
void *rtl_realloc(void *memblock, size_t size)
|
||||||
|
{
|
||||||
|
if ( !memblock )
|
||||||
|
return rtl_malloc(size);
|
||||||
|
|
||||||
|
if ( !size ) {
|
||||||
|
rtl_free(memblock);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
return RtlReAllocateHeap(RtlProcessHeap(), 0, memblock, size);
|
||||||
|
}
|
||||||
|
|
||||||
|
void *_rtl_recalloc(void *memblock, size_t num, size_t size)
|
||||||
|
{
|
||||||
|
if ( !memblock )
|
||||||
|
return rtl_calloc(num, size);
|
||||||
|
|
||||||
|
if ( !num || !size ) {
|
||||||
|
rtl_free(memblock);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
return RtlReAllocateHeap(RtlProcessHeap(), HEAP_ZERO_MEMORY, memblock, num * size);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void *_rtl_expand(void *memblock, size_t size)
|
||||||
|
{
|
||||||
|
return RtlReAllocateHeap(RtlProcessHeap(), HEAP_REALLOC_IN_PLACE_ONLY, memblock, size);
|
||||||
|
}
|
||||||
|
|
||||||
|
size_t _rtl_msize(void *memblock)
|
||||||
|
{
|
||||||
|
return RtlSizeHeap(RtlProcessHeap(), 0, memblock);
|
||||||
|
}
|
||||||
|
|
||||||
|
int _rtl_heapchk(void)
|
||||||
|
{
|
||||||
|
if ( !RtlValidateHeap(RtlProcessHeap(), 0, NULL) )
|
||||||
|
return -1;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int _rtl_heapmin(void)
|
||||||
|
{
|
||||||
|
if ( !RtlCompactHeap(RtlProcessHeap(), 0) )
|
||||||
|
return -1;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
19
wufuc/rtl_malloc.h
Normal file
19
wufuc/rtl_malloc.h
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
void *rtl_malloc(size_t size);
|
||||||
|
|
||||||
|
void rtl_free(void *memblock);
|
||||||
|
|
||||||
|
void *rtl_calloc(size_t num, size_t size);
|
||||||
|
|
||||||
|
void *rtl_realloc(void *memblock, size_t size);
|
||||||
|
|
||||||
|
void *_rtl_recalloc(void *memblock, size_t num, size_t size);
|
||||||
|
|
||||||
|
void *_rtl_expand(void *memblock, size_t size);
|
||||||
|
|
||||||
|
size_t _rtl_msize(void *memblock);
|
||||||
|
|
||||||
|
int _rtl_heapchk(void);
|
||||||
|
|
||||||
|
int _rtl_heapmin(void);
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
#include "service.h"
|
|
||||||
#include "tracing.h"
|
|
||||||
|
|
||||||
#include <Windows.h>
|
|
||||||
#include <tchar.h>
|
|
||||||
|
|
||||||
void CALLBACK Rundll32Unload(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
|
|
||||||
HANDLE hEvent = OpenEvent(EVENT_MODIFY_STATE, FALSE, _T("Global\\wufuc_UnloadEvent"));
|
|
||||||
if ( hEvent ) {
|
|
||||||
trace(_T("Setting unload event..."));
|
|
||||||
SetEvent(hEvent);
|
|
||||||
CloseHandle(hEvent);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
#include "service.h"
|
|
||||||
|
|
||||||
#include <Windows.h>
|
|
||||||
#include <tchar.h>
|
|
||||||
|
|
||||||
BOOL GetServiceCommandLine(SC_HANDLE hSCManager, LPCTSTR lpServiceName, LPTSTR lpCommandLine, SIZE_T dwSize) {
|
|
||||||
BOOL result = FALSE;
|
|
||||||
if ( !hSCManager && !(hSCManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_CONNECT)) )
|
|
||||||
return result;
|
|
||||||
|
|
||||||
HANDLE hService = OpenService(hSCManager, lpServiceName, SERVICE_QUERY_CONFIG);
|
|
||||||
if ( !hService )
|
|
||||||
return result;
|
|
||||||
|
|
||||||
DWORD cbBytesNeeded;
|
|
||||||
if ( !QueryServiceConfig(hService, NULL, 0, &cbBytesNeeded)
|
|
||||||
&& GetLastError() == ERROR_INSUFFICIENT_BUFFER ) {
|
|
||||||
|
|
||||||
LPQUERY_SERVICE_CONFIG sc = malloc(cbBytesNeeded);
|
|
||||||
if ( QueryServiceConfig(hService, sc, cbBytesNeeded, &cbBytesNeeded)
|
|
||||||
&& !_tcscpy_s(lpCommandLine, dwSize, sc->lpBinaryPathName) )
|
|
||||||
result = TRUE;
|
|
||||||
free(sc);
|
|
||||||
}
|
|
||||||
CloseServiceHandle(hService);
|
|
||||||
return result;
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
#ifndef SERVICE_H_INCLUDED
|
|
||||||
#define SERVICE_H_INCLUDED
|
|
||||||
#pragma once
|
|
||||||
|
|
||||||
#include <Windows.h>
|
|
||||||
|
|
||||||
BOOL GetServiceCommandLine(SC_HANDLE hSCManager, LPCTSTR lpServiceName, LPTSTR lpBinaryPathName, SIZE_T dwSize);
|
|
||||||
#endif
|
|
||||||
35
wufuc/shimlib.c
Normal file
35
wufuc/shimlib.c
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
#include "shimlib.h"
|
||||||
|
#include "hooks.h"
|
||||||
|
|
||||||
|
#include <Windows.h>
|
||||||
|
|
||||||
|
PHOOKAPI g_pHookApiArray;
|
||||||
|
|
||||||
|
PHOOKAPI WINAPI GetHookAPIs(LPCSTR szCommandLine, LPCWSTR wszShimName, PDWORD pdwHookCount) {
|
||||||
|
g_pHookApiArray = calloc(2, sizeof(HOOKAPI));
|
||||||
|
|
||||||
|
if ( g_pHookApiArray ) {
|
||||||
|
g_pHookApiArray[0].LibraryName = "advapi32.dll";
|
||||||
|
g_pHookApiArray[0].FunctionName = "RegQueryValueExW";
|
||||||
|
g_pHookApiArray[0].ReplacementFunction = RegQueryValueExW_hook;
|
||||||
|
g_pHookApiArray[1].LibraryName = "kernel32.dll";
|
||||||
|
g_pHookApiArray[1].FunctionName = "LoadLibraryExW";
|
||||||
|
g_pHookApiArray[1].ReplacementFunction = LoadLibraryExW_hook;
|
||||||
|
*pdwHookCount = 2;
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOL WINAPI NotifyShims(DWORD fdwReason, PLDR_DATA_TABLE_ENTRY pLdrEntry) {
|
||||||
|
switch ( fdwReason ) {
|
||||||
|
case SHIM_NOTIFY_ATTACH:
|
||||||
|
break;
|
||||||
|
case SHIM_NOTIFY_DETACH:
|
||||||
|
break;
|
||||||
|
case SHIM_NOTIFY_DLL_LOAD:
|
||||||
|
break;
|
||||||
|
case SHIM_NOTIFY_DLL_UNLOAD:
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
33
wufuc/shimlib.h
Normal file
33
wufuc/shimlib.h
Normal file
@@ -0,0 +1,33 @@
|
|||||||
|
#ifndef SHIM_H
|
||||||
|
#define SHIM_H
|
||||||
|
#pragma once
|
||||||
|
|
||||||
|
#define WIN32_NO_STATUS
|
||||||
|
#include <windows.h>
|
||||||
|
#undef WIN32_NO_STATUS
|
||||||
|
|
||||||
|
#include <winternl.h>
|
||||||
|
|
||||||
|
typedef struct tagHOOKAPI {
|
||||||
|
PCSTR LibraryName;
|
||||||
|
PCSTR FunctionName;
|
||||||
|
PVOID ReplacementFunction;
|
||||||
|
PVOID OriginalFunction;
|
||||||
|
PVOID Reserved[2];
|
||||||
|
} HOOKAPI, *PHOOKAPI;
|
||||||
|
|
||||||
|
#define SHIM_REASON_INIT 100
|
||||||
|
#define SHIM_REASON_DEINIT 101
|
||||||
|
#define SHIM_REASON_DLL_LOAD 102 /* Arg: PLDR_DATA_TABLE_ENTRY */
|
||||||
|
#define SHIM_REASON_DLL_UNLOAD 103 /* Arg: PLDR_DATA_TABLE_ENTRY */
|
||||||
|
|
||||||
|
#define SHIM_NOTIFY_ATTACH 1
|
||||||
|
#define SHIM_NOTIFY_DETACH 2
|
||||||
|
#define SHIM_NOTIFY_DLL_LOAD 3 /* Arg: PLDR_DATA_TABLE_ENTRY */
|
||||||
|
#define SHIM_NOTIFY_DLL_UNLOAD 4 /* Arg: PLDR_DATA_TABLE_ENTRY */
|
||||||
|
|
||||||
|
extern PHOOKAPI g_pHookApiArray;
|
||||||
|
|
||||||
|
PHOOKAPI WINAPI GetHookAPIs(LPCSTR szCommandLine, LPCWSTR wszShimName, PDWORD pdwHookCount);
|
||||||
|
BOOL WINAPI NotifyShims(DWORD fdwReason, PLDR_DATA_TABLE_ENTRY pLdrEntry);
|
||||||
|
#endif
|
||||||
115
wufuc/tracing.c
115
wufuc/tracing.c
@@ -1,72 +1,63 @@
|
|||||||
#include "tracing.h"
|
#include "tracing.h"
|
||||||
|
|
||||||
|
#include "helpers.h"
|
||||||
|
#include "rtl_malloc.h"
|
||||||
|
|
||||||
|
#include <stdlib.h>
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include <time.h>
|
#include <stdint.h>
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <phnt_windows.h>
|
||||||
#include <tchar.h>
|
#include <phnt.h>
|
||||||
|
|
||||||
static FILE *m_pStream;
|
void trace_sysinfo(void)
|
||||||
static HANDLE m_hMutex;
|
{
|
||||||
static BOOL m_bDeinitializing;
|
RTL_OSVERSIONINFOW osvi = { 0 };
|
||||||
|
osvi.dwOSVersionInfoSize = sizeof(RTL_OSVERSIONINFOW);
|
||||||
|
NTSTATUS status = RtlGetVersion(&osvi);
|
||||||
|
if ( NT_SUCCESS(status) ) {
|
||||||
|
trace(L"Windows version: %d.%d.%d (%Iu-bit)",
|
||||||
|
osvi.dwMajorVersion,
|
||||||
|
osvi.dwMinorVersion,
|
||||||
|
osvi.dwBuildNumber,
|
||||||
|
sizeof(uintptr_t) * 8);
|
||||||
|
} else trace(L"Failed to get Windows version (status=%08X)", status);
|
||||||
|
|
||||||
BOOL InitTracing(void) {
|
int CPUInfo[4];
|
||||||
if ( m_bDeinitializing )
|
__cpuidex(CPUInfo, 0x80000000, 0);
|
||||||
return FALSE;
|
if ( CPUInfo[0] < 0x80000004 ) {
|
||||||
|
trace(L"This processor does not support the brand identification feature.");
|
||||||
if ( !m_hMutex )
|
return;
|
||||||
m_hMutex = CreateMutex(NULL, FALSE, _T("Global\\wufuc_TracingMutex"));
|
|
||||||
|
|
||||||
if ( m_hMutex && !m_pStream ) {
|
|
||||||
TCHAR path[MAX_PATH];
|
|
||||||
GetModuleFileName(HINST_THISCOMPONENT, path, _countof(path));
|
|
||||||
|
|
||||||
TCHAR drive[_MAX_DRIVE], dir[_MAX_DIR], fname[_MAX_FNAME];
|
|
||||||
_tsplitpath_s(path, drive, _countof(drive), dir, _countof(dir), fname, _countof(fname), NULL, 0);
|
|
||||||
_tmakepath_s(path, _countof(path), drive, dir, fname, _T(".log"));
|
|
||||||
|
|
||||||
m_pStream = _tfsopen(path, _T("at"), _SH_DENYNO);
|
|
||||||
}
|
|
||||||
return m_pStream && m_hMutex;
|
|
||||||
}
|
|
||||||
|
|
||||||
DWORD WaitForTracingMutex(void) {
|
|
||||||
return WaitForSingleObject(m_hMutex, INFINITE);
|
|
||||||
}
|
|
||||||
|
|
||||||
BOOL ReleaseTracingMutex(void) {
|
|
||||||
return ReleaseMutex(m_hMutex);
|
|
||||||
}
|
|
||||||
|
|
||||||
void trace_(LPCTSTR format, ...) {
|
|
||||||
if ( InitTracing() ) {
|
|
||||||
TCHAR datebuf[9], timebuf[9];
|
|
||||||
_tstrdate_s(datebuf, _countof(datebuf));
|
|
||||||
_tstrtime_s(timebuf, _countof(timebuf));
|
|
||||||
if ( !WaitForTracingMutex() ) {
|
|
||||||
_ftprintf_s(m_pStream, _T("%s %s [PID: %d TID: %d] "), datebuf, timebuf, GetCurrentProcessId(), GetCurrentThreadId());
|
|
||||||
|
|
||||||
va_list argptr;
|
|
||||||
va_start(argptr, format);
|
|
||||||
_vftprintf_s(m_pStream, format, argptr);
|
|
||||||
va_end(argptr);
|
|
||||||
fflush(m_pStream);
|
|
||||||
}
|
}
|
||||||
ReleaseTracingMutex();
|
char brand[0x31];
|
||||||
}
|
uint32_t *u32ptr = (uint32_t *)&brand;
|
||||||
|
for ( int func = 0x80000002; func <= 0x80000004; func++ ) {
|
||||||
|
__cpuidex(CPUInfo, func, 0);
|
||||||
|
for ( int i = 0; i < 4; i++ )
|
||||||
|
*(u32ptr++) = CPUInfo[i];
|
||||||
|
}
|
||||||
|
size_t c = 0;
|
||||||
|
do {
|
||||||
|
if ( !isspace(brand[c]) )
|
||||||
|
break;
|
||||||
|
c++;
|
||||||
|
} while ( c < _countof(brand) );
|
||||||
|
trace(L"Processor: %hs", &brand[c]);
|
||||||
}
|
}
|
||||||
|
|
||||||
BOOL DeinitTracing(void) {
|
void trace_(const wchar_t *const format, ...)
|
||||||
m_bDeinitializing = TRUE;
|
{
|
||||||
|
static int shown_sysinfo = 0;
|
||||||
BOOL result = TRUE;
|
if ( !shown_sysinfo ) {
|
||||||
if ( m_hMutex ) {
|
shown_sysinfo = 1;
|
||||||
result = CloseHandle(m_hMutex);
|
trace_sysinfo();
|
||||||
m_hMutex = NULL;
|
}
|
||||||
}
|
va_list argptr;
|
||||||
if ( m_pStream ) {
|
va_start(argptr, format);
|
||||||
result = result && !fclose(m_pStream);
|
int count = _vscwprintf(format, argptr) + 1;
|
||||||
m_pStream = NULL;
|
wchar_t *buffer = rtl_calloc(count, sizeof(wchar_t));
|
||||||
}
|
vswprintf_s(buffer, count, format, argptr);
|
||||||
return result;
|
va_end(argptr);
|
||||||
|
OutputDebugStringW(buffer);
|
||||||
|
rtl_free(buffer);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,22 +1,14 @@
|
|||||||
#ifndef LOGGING_H_INCLUDED
|
|
||||||
#define LOGGING_H_INCLUDED
|
|
||||||
#pragma once
|
#pragma once
|
||||||
|
|
||||||
#include <Windows.h>
|
#include <phnt_windows.h>
|
||||||
#include <tchar.h>
|
|
||||||
|
|
||||||
extern IMAGE_DOS_HEADER __ImageBase;
|
extern IMAGE_DOS_HEADER __ImageBase;
|
||||||
#define HINST_THISCOMPONENT ((HINSTANCE)&__ImageBase)
|
#define HMODULE_THISCOMPONENT ((HMODULE)&__ImageBase);
|
||||||
|
|
||||||
BOOL InitTracing(void);
|
void trace_(const wchar_t *const format, ...);
|
||||||
DWORD WaitForTracingMutex(void);
|
|
||||||
BOOL ReleaseTracingMutex(void);
|
|
||||||
void trace_(LPCTSTR format, ...);
|
|
||||||
BOOL DeinitTracing(void);
|
|
||||||
|
|
||||||
#define STRINGIZE_(x) #x
|
#define STRINGIZEW_(x) L#x
|
||||||
#define STRINGIZE(x) STRINGIZE_(x)
|
#define STRINGIZEW(x) STRINGIZEW_(x)
|
||||||
|
|
||||||
#define LINESTR STRINGIZE(__LINE__)
|
#define LINEWSTR STRINGIZEW(__LINE__)
|
||||||
#define trace(format, ...) trace_(_T(__FILE__) _T(":") _T(LINESTR) _T("(") _T(__FUNCTION__) _T("): ") format _T("\n"), ##__VA_ARGS__)
|
#define trace(format, ...) trace_(__FILEW__ L":" LINEWSTR L"(" __FUNCTIONW__ L"): " format L"\n", ##__VA_ARGS__)
|
||||||
#endif
|
|
||||||
|
|||||||
@@ -1,2 +0,0 @@
|
|||||||
EXPORTS
|
|
||||||
Rundll32Unload
|
|
||||||
BIN
wufuc/wufuc.rc
BIN
wufuc/wufuc.rc
Binary file not shown.
@@ -19,42 +19,32 @@
|
|||||||
</ProjectConfiguration>
|
</ProjectConfiguration>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
|
<ClInclude Include="appverifier.h" />
|
||||||
<ClInclude Include="callbacks.h" />
|
<ClInclude Include="callbacks.h" />
|
||||||
<ClInclude Include="helpers.h" />
|
<ClInclude Include="helpers.h" />
|
||||||
<ClInclude Include="hooks.h" />
|
<ClInclude Include="hooks.h" />
|
||||||
<ClInclude Include="iathook.h" />
|
<ClInclude Include="rtl_malloc.h" />
|
||||||
<ClInclude Include="tracing.h" />
|
<ClInclude Include="tracing.h" />
|
||||||
<ClInclude Include="ntdllhelper.h" />
|
|
||||||
<ClInclude Include="patchwua.h" />
|
<ClInclude Include="patchwua.h" />
|
||||||
<ClInclude Include="patternfind.h" />
|
<ClInclude Include="patternfind.h" />
|
||||||
<ClInclude Include="service.h" />
|
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClCompile Include="callbacks.c" />
|
<ClCompile Include="callbacks.c" />
|
||||||
<ClCompile Include="dllmain.c" />
|
<ClCompile Include="dllmain.c" />
|
||||||
<ClCompile Include="helpers.c" />
|
<ClCompile Include="helpers.c" />
|
||||||
<ClCompile Include="hooks.c" />
|
<ClCompile Include="hooks.c" />
|
||||||
<ClCompile Include="iathook.c" />
|
<ClCompile Include="rtl_malloc.c" />
|
||||||
<ClCompile Include="tracing.c" />
|
<ClCompile Include="tracing.c" />
|
||||||
<ClCompile Include="ntdllhelper.c" />
|
|
||||||
<ClCompile Include="patchwua.c" />
|
<ClCompile Include="patchwua.c" />
|
||||||
<ClCompile Include="patternfind.c" />
|
<ClCompile Include="patternfind.c" />
|
||||||
<ClCompile Include="rundll32.c" />
|
|
||||||
<ClCompile Include="service.c" />
|
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<None Include="wufuc.def" />
|
|
||||||
<None Include="wufuc.rch">
|
<None Include="wufuc.rch">
|
||||||
<FileType>Document</FileType>
|
<FileType>Document</FileType>
|
||||||
</None>
|
</None>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ResourceCompile Include="wufuc.rc">
|
<ResourceCompile Include="wufuc.rc" />
|
||||||
<PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">X64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Release|x64'">X64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">X86;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">X86;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
</ResourceCompile>
|
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<PropertyGroup Label="Globals">
|
<PropertyGroup Label="Globals">
|
||||||
<VCProjectVersion>15.0</VCProjectVersion>
|
<VCProjectVersion>15.0</VCProjectVersion>
|
||||||
@@ -114,6 +104,7 @@
|
|||||||
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
||||||
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
||||||
<GenerateManifest>false</GenerateManifest>
|
<GenerateManifest>false</GenerateManifest>
|
||||||
|
<IncludePath>$(SolutionDir)phnt\include;$(IncludePath)</IncludePath>
|
||||||
</PropertyGroup>
|
</PropertyGroup>
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
<LinkIncremental>true</LinkIncremental>
|
<LinkIncremental>true</LinkIncremental>
|
||||||
@@ -121,6 +112,7 @@
|
|||||||
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
||||||
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
||||||
<GenerateManifest>false</GenerateManifest>
|
<GenerateManifest>false</GenerateManifest>
|
||||||
|
<IncludePath>$(SolutionDir)phnt\include;$(IncludePath)</IncludePath>
|
||||||
</PropertyGroup>
|
</PropertyGroup>
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
<LinkIncremental>false</LinkIncremental>
|
<LinkIncremental>false</LinkIncremental>
|
||||||
@@ -128,6 +120,7 @@
|
|||||||
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
||||||
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
||||||
<GenerateManifest>false</GenerateManifest>
|
<GenerateManifest>false</GenerateManifest>
|
||||||
|
<IncludePath>$(SolutionDir)phnt\include;$(IncludePath)</IncludePath>
|
||||||
</PropertyGroup>
|
</PropertyGroup>
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
<LinkIncremental>false</LinkIncremental>
|
<LinkIncremental>false</LinkIncremental>
|
||||||
@@ -135,34 +128,53 @@
|
|||||||
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
<IntDir>$(ProjectDir)$(BaseIntermediateOutputPath)$(Configuration)\$(PlatformShortName)\</IntDir>
|
||||||
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
<TargetName>$(ProjectName)$(PlatformArchitecture)</TargetName>
|
||||||
<GenerateManifest>false</GenerateManifest>
|
<GenerateManifest>false</GenerateManifest>
|
||||||
|
<IncludePath>$(SolutionDir)phnt\include;$(IncludePath)</IncludePath>
|
||||||
</PropertyGroup>
|
</PropertyGroup>
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
<WarningLevel>Level3</WarningLevel>
|
<WarningLevel>Level3</WarningLevel>
|
||||||
<Optimization>Disabled</Optimization>
|
<Optimization>Disabled</Optimization>
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;_NO_CRT_STDIO_INLINE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
|
||||||
<CompileAs>CompileAsC</CompileAs>
|
<CompileAs>CompileAsC</CompileAs>
|
||||||
|
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<Link>
|
<Link>
|
||||||
<SubSystem>Windows</SubSystem>
|
<SubSystem>Windows</SubSystem>
|
||||||
<AdditionalDependencies>version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
<ModuleDefinitionFile>
|
||||||
<ModuleDefinitionFile>wufuc.def</ModuleDefinitionFile>
|
</ModuleDefinitionFile>
|
||||||
|
<EntryPointSymbol>DllMain</EntryPointSymbol>
|
||||||
|
<AdditionalDependencies>ntdll.lib;ntdllp.lib;version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
|
<AdditionalLibraryDirectories>
|
||||||
|
</AdditionalLibraryDirectories>
|
||||||
|
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
|
||||||
</Link>
|
</Link>
|
||||||
|
<PreBuildEvent />
|
||||||
|
<ResourceCompile>
|
||||||
|
<PreprocessorDefinitions>X86;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
</ResourceCompile>
|
||||||
</ItemDefinitionGroup>
|
</ItemDefinitionGroup>
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
<WarningLevel>Level3</WarningLevel>
|
<WarningLevel>Level3</WarningLevel>
|
||||||
<Optimization>Disabled</Optimization>
|
<Optimization>Disabled</Optimization>
|
||||||
<PreprocessorDefinitions>_DEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>_DEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;_NO_CRT_STDIO_INLINE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
|
||||||
<CompileAs>CompileAsC</CompileAs>
|
<CompileAs>CompileAsC</CompileAs>
|
||||||
|
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<Link>
|
<Link>
|
||||||
<SubSystem>Windows</SubSystem>
|
<SubSystem>Windows</SubSystem>
|
||||||
<AdditionalDependencies>version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
<AdditionalDependencies>ntdll.lib;ntdllp.lib;version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
<ModuleDefinitionFile>wufuc.def</ModuleDefinitionFile>
|
<ModuleDefinitionFile>
|
||||||
|
</ModuleDefinitionFile>
|
||||||
|
<EntryPointSymbol>DllMain</EntryPointSymbol>
|
||||||
|
<AdditionalLibraryDirectories>
|
||||||
|
</AdditionalLibraryDirectories>
|
||||||
|
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
|
||||||
</Link>
|
</Link>
|
||||||
|
<PreBuildEvent />
|
||||||
|
<ResourceCompile>
|
||||||
|
<PreprocessorDefinitions>X64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
</ResourceCompile>
|
||||||
</ItemDefinitionGroup>
|
</ItemDefinitionGroup>
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
@@ -170,10 +182,10 @@
|
|||||||
<Optimization>Full</Optimization>
|
<Optimization>Full</Optimization>
|
||||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;_NO_CRT_STDIO_INLINE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
|
||||||
<CompileAs>CompileAsC</CompileAs>
|
<CompileAs>CompileAsC</CompileAs>
|
||||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||||
|
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ResourceCompile Condition="'$(APPVEYOR)'=='True'">
|
<ResourceCompile Condition="'$(APPVEYOR)'=='True'">
|
||||||
<PreprocessorDefinitions>BUILD_COMMIT_VERSION=$(BUILD_COMMIT_VERSION);BUILD_VERSION_COMMA=$(BUILD_VERSION_COMMA);$(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>BUILD_COMMIT_VERSION=$(BUILD_COMMIT_VERSION);BUILD_VERSION_COMMA=$(BUILD_VERSION_COMMA);$(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
@@ -183,13 +195,22 @@
|
|||||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||||
<OptimizeReferences>true</OptimizeReferences>
|
<OptimizeReferences>true</OptimizeReferences>
|
||||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||||
<AdditionalDependencies>version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
<ModuleDefinitionFile>
|
||||||
<ModuleDefinitionFile>wufuc.def</ModuleDefinitionFile>
|
</ModuleDefinitionFile>
|
||||||
|
<EntryPointSymbol>DllMain</EntryPointSymbol>
|
||||||
|
<AdditionalDependencies>ntdll.lib;ntdllp.lib;version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
|
<AdditionalLibraryDirectories>
|
||||||
|
</AdditionalLibraryDirectories>
|
||||||
|
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
|
||||||
</Link>
|
</Link>
|
||||||
<PostBuildEvent>
|
<PostBuildEvent>
|
||||||
<Command>
|
<Command>
|
||||||
</Command>
|
</Command>
|
||||||
</PostBuildEvent>
|
</PostBuildEvent>
|
||||||
|
<PreBuildEvent />
|
||||||
|
<ResourceCompile>
|
||||||
|
<PreprocessorDefinitions>X86;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
</ResourceCompile>
|
||||||
</ItemDefinitionGroup>
|
</ItemDefinitionGroup>
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
@@ -197,10 +218,10 @@
|
|||||||
<Optimization>Full</Optimization>
|
<Optimization>Full</Optimization>
|
||||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
<PreprocessorDefinitions>NDEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>NDEBUG;_WINDOWS;_USRDLL;WUFUC_EXPORTS;_NO_CRT_STDIO_INLINE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
|
||||||
<CompileAs>CompileAsC</CompileAs>
|
<CompileAs>CompileAsC</CompileAs>
|
||||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||||
|
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ResourceCompile Condition="'$(APPVEYOR)'=='True'">
|
<ResourceCompile Condition="'$(APPVEYOR)'=='True'">
|
||||||
<PreprocessorDefinitions>BUILD_COMMIT_VERSION=$(BUILD_COMMIT_VERSION);BUILD_VERSION_COMMA=$(BUILD_VERSION_COMMA);$(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>BUILD_COMMIT_VERSION=$(BUILD_COMMIT_VERSION);BUILD_VERSION_COMMA=$(BUILD_VERSION_COMMA);$(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
@@ -210,13 +231,22 @@
|
|||||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||||
<OptimizeReferences>true</OptimizeReferences>
|
<OptimizeReferences>true</OptimizeReferences>
|
||||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||||
<AdditionalDependencies>version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
<AdditionalDependencies>ntdll.lib;ntdllp.lib;version.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
<ModuleDefinitionFile>wufuc.def</ModuleDefinitionFile>
|
<ModuleDefinitionFile>
|
||||||
|
</ModuleDefinitionFile>
|
||||||
|
<EntryPointSymbol>DllMain</EntryPointSymbol>
|
||||||
|
<AdditionalLibraryDirectories>
|
||||||
|
</AdditionalLibraryDirectories>
|
||||||
|
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
|
||||||
</Link>
|
</Link>
|
||||||
<PostBuildEvent>
|
<PostBuildEvent>
|
||||||
<Command>
|
<Command>
|
||||||
</Command>
|
</Command>
|
||||||
</PostBuildEvent>
|
</PostBuildEvent>
|
||||||
|
<PreBuildEvent />
|
||||||
|
<ResourceCompile>
|
||||||
|
<PreprocessorDefinitions>X64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
</ResourceCompile>
|
||||||
</ItemDefinitionGroup>
|
</ItemDefinitionGroup>
|
||||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||||
<ImportGroup Label="ExtensionTargets">
|
<ImportGroup Label="ExtensionTargets">
|
||||||
|
|||||||
@@ -15,18 +15,12 @@
|
|||||||
</Filter>
|
</Filter>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClInclude Include="ntdllhelper.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="patchwua.h">
|
<ClInclude Include="patchwua.h">
|
||||||
<Filter>Header Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
<ClInclude Include="patternfind.h">
|
<ClInclude Include="patternfind.h">
|
||||||
<Filter>Header Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
<ClInclude Include="service.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="callbacks.h">
|
<ClInclude Include="callbacks.h">
|
||||||
<Filter>Header Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
@@ -36,32 +30,23 @@
|
|||||||
<ClInclude Include="hooks.h">
|
<ClInclude Include="hooks.h">
|
||||||
<Filter>Header Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
<ClInclude Include="iathook.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="tracing.h">
|
<ClInclude Include="tracing.h">
|
||||||
<Filter>Header Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
<ClInclude Include="wufuc.rch">
|
<ClInclude Include="appverifier.h">
|
||||||
<Filter>Resource Files</Filter>
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="rtl_malloc.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClCompile Include="ntdllhelper.c">
|
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
<ClCompile Include="patchwua.c">
|
<ClCompile Include="patchwua.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ClCompile Include="patternfind.c">
|
<ClCompile Include="patternfind.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ClCompile Include="rundll32.c">
|
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
<ClCompile Include="service.c">
|
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
<ClCompile Include="callbacks.c">
|
<ClCompile Include="callbacks.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
@@ -74,17 +59,15 @@
|
|||||||
<ClCompile Include="hooks.c">
|
<ClCompile Include="hooks.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ClCompile Include="iathook.c">
|
<ClCompile Include="tracing.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
<ClCompile Include="tracing.c">
|
<ClCompile Include="rtl_malloc.c">
|
||||||
<Filter>Source Files</Filter>
|
<Filter>Source Files</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<None Include="wufuc.def">
|
<None Include="wufuc.rch" />
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</None>
|
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ResourceCompile Include="wufuc.rc">
|
<ResourceCompile Include="wufuc.rc">
|
||||||
|
|||||||
Reference in New Issue
Block a user