admin/8damon-Blackbird-Platform
1
0
Fork 0
mirror of https://github.com/8damon/Blackbird-Platform synced 2026-06-21 13:41:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

ui/interop: add Tempus bucket types, launch integrity constants, and updated P/Invoke bindings

Browse Source 
Add BkTempusBucket struct and extend BkStatsResponse with TempusEnabled,
TempusQpcFrequency, TempusSubsystemCount, and a 14-element Tempus bucket array.

Add IpcUserHookFlagDeferredLaunchGateRelease, RuntimeFlagNtApiHooksDisarmed, and the
LaunchIntegrity* constants (Default/Untrusted/Low/Medium/High/System) matching the
new ABI definitions.

Remove the MarkInterfaceReady P/Invoke binding. Add IntegrityLevel as the new
penultimate parameter to the SetUserHookTarget binding.
This commit is contained in:
dutchpsycho
2026-04-18 09:00:00 +00:00
parent 8c47a778d6
commit 4ec2690201
2 changed files with 36 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Client/analysis/Interop/BlackbirdNative.cs
+24 -4
View File
@@ -57,6 +57,7 @@ namespace BlackbirdInterface
internal const uint IpcUserHookTargetAttach = 1;
internal const uint IpcUserHookTargetLaunch = 2;
internal const uint IpcUserHookFlagLaunchEarlybirdApc = 0x00000001;
internal const uint IpcUserHookFlagDeferredLaunchGateRelease = 0x00000002;
internal const uint IpcHookEventUnknown = 0;
internal const uint IpcHookEventNt = 1;
internal const uint IpcHookEventWinsock = 2;
@@ -69,9 +70,17 @@ namespace BlackbirdInterface
internal const uint RuntimeFlagSelfHide = 0x00000002;
internal const uint RuntimeFlagInterfaceProtectedAccess = 0x00000004;
internal const uint RuntimeFlagControllerProtectedAccess = 0x00000008;
internal const uint RuntimeFlagNtApiHooksDisarmed = 0x00000010;
internal const uint RuntimeModeLoiter = 0;
internal const uint RuntimeModeGuided = 1;
internal const uint LaunchIntegrityDefault = 0;
internal const uint LaunchIntegrityUntrusted = 1;
internal const uint LaunchIntegrityLow = 2;
internal const uint LaunchIntegrityMedium = 3;
internal const uint LaunchIntegrityHigh = 4;
internal const uint LaunchIntegritySystem = 5;
private const int MaxIpcEventNameChars = 96;
private const int MaxIpcDetectionNameChars = 128;
private const int MaxIpcReasonChars = 256;
@@ -137,7 +146,21 @@ namespace BlackbirdInterface
public uint SubscriptionCount;
public uint QueueDepth;
public uint DroppedEvents;
public uint TempusEnabled;
public ulong TempusQpcFrequency;
public uint TempusSubsystemCount;
public uint Reserved;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 14)]
public BkTempusBucket[] Tempus;
}
[StructLayout(LayoutKind.Sequential, Pack = 8)]
internal struct BkTempusBucket
{
public ulong SampleCount;
public ulong TotalQpc;
public ulong MaxQpc;
public ulong LastQpc;
}
[StructLayout(LayoutKind.Sequential, Pack = 8)]
@@ -305,10 +328,6 @@ namespace BlackbirdInterface
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool GetRuntimeConfig(IntPtr device, out BkRuntimeConfigResponse response);
[DllImport("J58.dll", EntryPoint = "BLACKBIRDSCMarkInterfaceReady", CallingConvention = CallingConvention.Cdecl, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool MarkInterfaceReady(IntPtr device, uint processId);
[DllImport("J58.dll", EntryPoint = "BLACKBIRDSCSetUserHookTarget", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Unicode, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
internal static extern bool SetUserHookTarget(
@@ -324,6 +343,7 @@ namespace BlackbirdInterface
uint priorityClass,
ulong affinityMask,
[MarshalAs(UnmanagedType.Bool)] bool inheritHandles,
uint integrityLevel,
out BkSetUserHookTargetResponse response);
internal static string WideBufferToString(ushort[]? buffer)
Client/analysis/Interop/Kernel32Native.cs
+12
View File
@@ -6,6 +6,8 @@ namespace BlackbirdInterface
internal static class Kernel32Native
{
private static readonly IntPtr InvalidHandleValue = new(-1);
internal const uint EventModifyState = 0x0002;
internal const uint Synchronize = 0x00100000;
internal static IntPtr OpenProcess(uint desiredAccess, bool inheritHandle, uint processId)
{
@@ -25,6 +27,9 @@ namespace BlackbirdInterface
internal static int NtSuspendProcess(IntPtr processHandle) => NtSuspendProcessNative(processHandle);
internal static int NtResumeProcess(IntPtr processHandle) => NtResumeProcessNative(processHandle);
internal static bool TerminateProcess(IntPtr processHandle, uint exitCode) => TerminateProcessNative(processHandle, exitCode);
internal static IntPtr OpenEvent(uint desiredAccess, bool inheritHandle, string name) =>
OpenEventNative(desiredAccess, inheritHandle, name);
internal static bool SetEvent(IntPtr handle) => SetEventNative(handle);
[DllImport("kernel32.dll", EntryPoint = "OpenProcess", SetLastError = true)]
private static extern IntPtr OpenProcessNative(uint desiredAccess, bool inheritHandle, uint processId);
@@ -37,6 +42,13 @@ namespace BlackbirdInterface
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool TerminateProcessNative(IntPtr hProcess, uint uExitCode);
[DllImport("kernel32.dll", EntryPoint = "OpenEventW", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern IntPtr OpenEventNative(uint dwDesiredAccess, bool bInheritHandle, string lpName);
[DllImport("kernel32.dll", EntryPoint = "SetEvent", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool SetEventNative(IntPtr hEvent);
[DllImport("ntdll.dll", EntryPoint = "NtSuspendProcess")]
private static extern int NtSuspendProcessNative(IntPtr processHandle);