test
This commit is contained in:
zeffy
372
inc/phnt/ntobapi.h
Normal file
372
inc/phnt/ntobapi.h
Normal file
@@ -0,0 +1,372 @@
|
||||
#ifndef _NTOBAPI_H
|
||||
#define _NTOBAPI_H
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
#define OBJECT_TYPE_CREATE 0x0001
|
||||
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
|
||||
#endif
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
#define DIRECTORY_QUERY 0x0001
|
||||
#define DIRECTORY_TRAVERSE 0x0002
|
||||
#define DIRECTORY_CREATE_OBJECT 0x0004
|
||||
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
|
||||
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf)
|
||||
#endif
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
#define SYMBOLIC_LINK_QUERY 0x0001
|
||||
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
|
||||
#endif
|
||||
|
||||
#define OBJ_PROTECT_CLOSE 0x00000001
|
||||
#ifndef OBJ_INHERIT
|
||||
#define OBJ_INHERIT 0x00000002
|
||||
#endif
|
||||
#define OBJ_AUDIT_OBJECT_CLOSE 0x00000004
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
typedef enum _OBJECT_INFORMATION_CLASS
|
||||
{
|
||||
ObjectBasicInformation, // OBJECT_BASIC_INFORMATION
|
||||
ObjectNameInformation, // OBJECT_NAME_INFORMATION
|
||||
ObjectTypeInformation, // OBJECT_TYPE_INFORMATION
|
||||
ObjectTypesInformation, // OBJECT_TYPES_INFORMATION
|
||||
ObjectHandleFlagInformation, // OBJECT_HANDLE_FLAG_INFORMATION
|
||||
ObjectSessionInformation,
|
||||
ObjectSessionObjectInformation,
|
||||
MaxObjectInfoClass
|
||||
} OBJECT_INFORMATION_CLASS;
|
||||
#else
|
||||
#define ObjectNameInformation 1
|
||||
#define ObjectTypesInformation 3
|
||||
#define ObjectHandleFlagInformation 4
|
||||
#define ObjectSessionInformation 5
|
||||
#endif
|
||||
|
||||
typedef struct _OBJECT_BASIC_INFORMATION
|
||||
{
|
||||
ULONG Attributes;
|
||||
ACCESS_MASK GrantedAccess;
|
||||
ULONG HandleCount;
|
||||
ULONG PointerCount;
|
||||
ULONG PagedPoolCharge;
|
||||
ULONG NonPagedPoolCharge;
|
||||
ULONG Reserved[3];
|
||||
ULONG NameInfoSize;
|
||||
ULONG TypeInfoSize;
|
||||
ULONG SecurityDescriptorSize;
|
||||
LARGE_INTEGER CreationTime;
|
||||
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
typedef struct _OBJECT_NAME_INFORMATION
|
||||
{
|
||||
UNICODE_STRING Name;
|
||||
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
|
||||
#endif
|
||||
|
||||
typedef struct _OBJECT_TYPE_INFORMATION
|
||||
{
|
||||
UNICODE_STRING TypeName;
|
||||
ULONG TotalNumberOfObjects;
|
||||
ULONG TotalNumberOfHandles;
|
||||
ULONG TotalPagedPoolUsage;
|
||||
ULONG TotalNonPagedPoolUsage;
|
||||
ULONG TotalNamePoolUsage;
|
||||
ULONG TotalHandleTableUsage;
|
||||
ULONG HighWaterNumberOfObjects;
|
||||
ULONG HighWaterNumberOfHandles;
|
||||
ULONG HighWaterPagedPoolUsage;
|
||||
ULONG HighWaterNonPagedPoolUsage;
|
||||
ULONG HighWaterNamePoolUsage;
|
||||
ULONG HighWaterHandleTableUsage;
|
||||
ULONG InvalidAttributes;
|
||||
GENERIC_MAPPING GenericMapping;
|
||||
ULONG ValidAccessMask;
|
||||
BOOLEAN SecurityRequired;
|
||||
BOOLEAN MaintainHandleCount;
|
||||
UCHAR TypeIndex; // since WINBLUE
|
||||
CHAR ReservedByte;
|
||||
ULONG PoolType;
|
||||
ULONG DefaultPagedPoolCharge;
|
||||
ULONG DefaultNonPagedPoolCharge;
|
||||
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_TYPES_INFORMATION
|
||||
{
|
||||
ULONG NumberOfTypes;
|
||||
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
|
||||
|
||||
typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
|
||||
{
|
||||
BOOLEAN Inherit;
|
||||
BOOLEAN ProtectFromClose;
|
||||
} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;
|
||||
|
||||
// Objects, handles
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryObject(
|
||||
_In_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
_Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
|
||||
_In_ ULONG ObjectInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetInformationObject(
|
||||
_In_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
_In_reads_bytes_(ObjectInformationLength) PVOID ObjectInformation,
|
||||
_In_ ULONG ObjectInformationLength
|
||||
);
|
||||
|
||||
#define DUPLICATE_CLOSE_SOURCE 0x00000001
|
||||
#define DUPLICATE_SAME_ACCESS 0x00000002
|
||||
#define DUPLICATE_SAME_ATTRIBUTES 0x00000004
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtDuplicateObject(
|
||||
_In_ HANDLE SourceProcessHandle,
|
||||
_In_ HANDLE SourceHandle,
|
||||
_In_opt_ HANDLE TargetProcessHandle,
|
||||
_Out_opt_ PHANDLE TargetHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ ULONG HandleAttributes,
|
||||
_In_ ULONG Options
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtMakeTemporaryObject(
|
||||
_In_ HANDLE Handle
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtMakePermanentObject(
|
||||
_In_ HANDLE Handle
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSignalAndWaitForSingleObject(
|
||||
_In_ HANDLE SignalHandle,
|
||||
_In_ HANDLE WaitHandle,
|
||||
_In_ BOOLEAN Alertable,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtWaitForSingleObject(
|
||||
_In_ HANDLE Handle,
|
||||
_In_ BOOLEAN Alertable,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtWaitForMultipleObjects(
|
||||
_In_ ULONG Count,
|
||||
_In_reads_(Count) HANDLE Handles[],
|
||||
_In_ WAIT_TYPE WaitType,
|
||||
_In_ BOOLEAN Alertable,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
#if (PHNT_VERSION >= PHNT_WS03)
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtWaitForMultipleObjects32(
|
||||
_In_ ULONG Count,
|
||||
_In_reads_(Count) LONG Handles[],
|
||||
_In_ WAIT_TYPE WaitType,
|
||||
_In_ BOOLEAN Alertable,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
#endif
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtSetSecurityObject(
|
||||
_In_ HANDLE Handle,
|
||||
_In_ SECURITY_INFORMATION SecurityInformation,
|
||||
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQuerySecurityObject(
|
||||
_In_ HANDLE Handle,
|
||||
_In_ SECURITY_INFORMATION SecurityInformation,
|
||||
_Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
|
||||
_In_ ULONG Length,
|
||||
_Out_ PULONG LengthNeeded
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtClose(
|
||||
_In_ HANDLE Handle
|
||||
);
|
||||
|
||||
#if (PHNT_VERSION >= PHNT_THRESHOLD)
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtCompareObjects(
|
||||
_In_ HANDLE FirstObjectHandle,
|
||||
_In_ HANDLE SecondObjectHandle
|
||||
);
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
// Directory objects
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtCreateDirectoryObject(
|
||||
_Out_ PHANDLE DirectoryHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
#if (PHNT_VERSION >= PHNT_WIN8)
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtCreateDirectoryObjectEx(
|
||||
_Out_ PHANDLE DirectoryHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ HANDLE ShadowDirectoryHandle,
|
||||
_In_ ULONG Flags
|
||||
);
|
||||
#endif
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtOpenDirectoryObject(
|
||||
_Out_ PHANDLE DirectoryHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
typedef struct _OBJECT_DIRECTORY_INFORMATION
|
||||
{
|
||||
UNICODE_STRING Name;
|
||||
UNICODE_STRING TypeName;
|
||||
} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQueryDirectoryObject(
|
||||
_In_ HANDLE DirectoryHandle,
|
||||
_Out_writes_bytes_opt_(Length) PVOID Buffer,
|
||||
_In_ ULONG Length,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_ BOOLEAN RestartScan,
|
||||
_Inout_ PULONG Context,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
#endif
|
||||
|
||||
// Private namespaces
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
|
||||
#if (PHNT_VERSION >= PHNT_VISTA)
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtCreatePrivateNamespace(
|
||||
_Out_ PHANDLE NamespaceHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ PVOID BoundaryDescriptor
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtOpenPrivateNamespace(
|
||||
_Out_ PHANDLE NamespaceHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ PVOID BoundaryDescriptor
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtDeletePrivateNamespace(
|
||||
_In_ HANDLE NamespaceHandle
|
||||
);
|
||||
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
// Symbolic links
|
||||
|
||||
#if (PHNT_MODE != PHNT_MODE_KERNEL)
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtCreateSymbolicLinkObject(
|
||||
_Out_ PHANDLE LinkHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ PUNICODE_STRING LinkTarget
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtOpenSymbolicLinkObject(
|
||||
_Out_ PHANDLE LinkHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
NtQuerySymbolicLinkObject(
|
||||
_In_ HANDLE LinkHandle,
|
||||
_Inout_ PUNICODE_STRING LinkTarget,
|
||||
_Out_opt_ PULONG ReturnedLength
|
||||
);
|
||||
|
||||
#endif
|
||||
|
||||
#endif
|
||||
Reference in New Issue
Block a user