diff --git a/Client/analysis/Interop/BlackbirdNative.cs b/Client/analysis/Interop/BlackbirdNative.cs index 63c0278..51df443 100644 --- a/Client/analysis/Interop/BlackbirdNative.cs +++ b/Client/analysis/Interop/BlackbirdNative.cs @@ -57,6 +57,7 @@ namespace BlackbirdInterface internal const uint IpcUserHookTargetAttach = 1; internal const uint IpcUserHookTargetLaunch = 2; internal const uint IpcUserHookFlagLaunchEarlybirdApc = 0x00000001; + internal const uint IpcUserHookFlagDeferredLaunchGateRelease = 0x00000002; internal const uint IpcHookEventUnknown = 0; internal const uint IpcHookEventNt = 1; internal const uint IpcHookEventWinsock = 2; @@ -69,9 +70,17 @@ namespace BlackbirdInterface internal const uint RuntimeFlagSelfHide = 0x00000002; internal const uint RuntimeFlagInterfaceProtectedAccess = 0x00000004; internal const uint RuntimeFlagControllerProtectedAccess = 0x00000008; + internal const uint RuntimeFlagNtApiHooksDisarmed = 0x00000010; internal const uint RuntimeModeLoiter = 0; internal const uint RuntimeModeGuided = 1; + internal const uint LaunchIntegrityDefault = 0; + internal const uint LaunchIntegrityUntrusted = 1; + internal const uint LaunchIntegrityLow = 2; + internal const uint LaunchIntegrityMedium = 3; + internal const uint LaunchIntegrityHigh = 4; + internal const uint LaunchIntegritySystem = 5; + private const int MaxIpcEventNameChars = 96; private const int MaxIpcDetectionNameChars = 128; private const int MaxIpcReasonChars = 256; @@ -137,7 +146,21 @@ namespace BlackbirdInterface public uint SubscriptionCount; public uint QueueDepth; public uint DroppedEvents; + public uint TempusEnabled; + public ulong TempusQpcFrequency; + public uint TempusSubsystemCount; public uint Reserved; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 14)] + public BkTempusBucket[] Tempus; + } + + [StructLayout(LayoutKind.Sequential, Pack = 8)] + internal struct BkTempusBucket + { + public ulong SampleCount; + public ulong TotalQpc; + public ulong MaxQpc; + public ulong LastQpc; } [StructLayout(LayoutKind.Sequential, Pack = 8)] @@ -305,10 +328,6 @@ namespace BlackbirdInterface [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool GetRuntimeConfig(IntPtr device, out BkRuntimeConfigResponse response); - [DllImport("J58.dll", EntryPoint = "BLACKBIRDSCMarkInterfaceReady", CallingConvention = CallingConvention.Cdecl, SetLastError = true)] - [return: MarshalAs(UnmanagedType.Bool)] - internal static extern bool MarkInterfaceReady(IntPtr device, uint processId); - [DllImport("J58.dll", EntryPoint = "BLACKBIRDSCSetUserHookTarget", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Unicode, SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] internal static extern bool SetUserHookTarget( @@ -324,6 +343,7 @@ namespace BlackbirdInterface uint priorityClass, ulong affinityMask, [MarshalAs(UnmanagedType.Bool)] bool inheritHandles, + uint integrityLevel, out BkSetUserHookTargetResponse response); internal static string WideBufferToString(ushort[]? buffer) diff --git a/Client/analysis/Interop/Kernel32Native.cs b/Client/analysis/Interop/Kernel32Native.cs index 4df2945..8a6c37e 100644 --- a/Client/analysis/Interop/Kernel32Native.cs +++ b/Client/analysis/Interop/Kernel32Native.cs @@ -6,6 +6,8 @@ namespace BlackbirdInterface internal static class Kernel32Native { private static readonly IntPtr InvalidHandleValue = new(-1); + internal const uint EventModifyState = 0x0002; + internal const uint Synchronize = 0x00100000; internal static IntPtr OpenProcess(uint desiredAccess, bool inheritHandle, uint processId) { @@ -25,6 +27,9 @@ namespace BlackbirdInterface internal static int NtSuspendProcess(IntPtr processHandle) => NtSuspendProcessNative(processHandle); internal static int NtResumeProcess(IntPtr processHandle) => NtResumeProcessNative(processHandle); internal static bool TerminateProcess(IntPtr processHandle, uint exitCode) => TerminateProcessNative(processHandle, exitCode); + internal static IntPtr OpenEvent(uint desiredAccess, bool inheritHandle, string name) => + OpenEventNative(desiredAccess, inheritHandle, name); + internal static bool SetEvent(IntPtr handle) => SetEventNative(handle); [DllImport("kernel32.dll", EntryPoint = "OpenProcess", SetLastError = true)] private static extern IntPtr OpenProcessNative(uint desiredAccess, bool inheritHandle, uint processId); @@ -37,6 +42,13 @@ namespace BlackbirdInterface [return: MarshalAs(UnmanagedType.Bool)] private static extern bool TerminateProcessNative(IntPtr hProcess, uint uExitCode); + [DllImport("kernel32.dll", EntryPoint = "OpenEventW", CharSet = CharSet.Unicode, SetLastError = true)] + private static extern IntPtr OpenEventNative(uint dwDesiredAccess, bool bInheritHandle, string lpName); + + [DllImport("kernel32.dll", EntryPoint = "SetEvent", SetLastError = true)] + [return: MarshalAs(UnmanagedType.Bool)] + private static extern bool SetEventNative(IntPtr hEvent); + [DllImport("ntdll.dll", EntryPoint = "NtSuspendProcess")] private static extern int NtSuspendProcessNative(IntPtr processHandle);