From 1303f4f49dbfca7b07eb644ed7a60150df891877 Mon Sep 17 00:00:00 2001 From: MSxDOS <15524350+MSxDOS@users.noreply.github.com> Date: Fri, 1 Mar 2019 22:44:48 +0300 Subject: [PATCH] Add new bindings --- src/ntexapi.rs | 96 ++++++++++++++++++++++++++++++------ src/ntioapi.rs | 34 +++++++++++-- src/ntmmapi.rs | 14 ++++++ src/ntpebteb.rs | 12 ++++- src/ntpsapi.rs | 45 ++++++++++++++++- src/ntrtl.rs | 14 +++++- src/ntseapi.rs | 4 +- src/winapi_local/um/winnt.rs | 30 ++++++++++- tests/layout_x86.rs | 21 ++++++-- tests/layout_x86_64.rs | 19 ++++++- 10 files changed, 257 insertions(+), 32 deletions(-) diff --git a/src/ntexapi.rs b/src/ntexapi.rs index ff2bf65..508d2a1 100644 --- a/src/ntexapi.rs +++ b/src/ntexapi.rs @@ -933,7 +933,11 @@ ENUM!{enum SYSTEM_INFORMATION_CLASS { SystemSpeculationControlInformation = 201, SystemDmaGuardPolicyInformation = 202, SystemEnclaveLaunchControlInformation = 203, - MaxSystemInfoClass = 204, + SystemWorkloadAllowedCpuSetsInformation = 204, + SystemCodeIntegrityUnlockModeInformation = 205, + SystemLeapSecondInformation = 206, + SystemFlags2Information = 207, + MaxSystemInfoClass = 208, }} STRUCT!{struct SYSTEM_BASIC_INFORMATION { Reserved: ULONG, @@ -2399,7 +2403,10 @@ BITFIELD!{SYSTEM_KERNEL_VA_SHADOW_INFORMATION Flags: ULONG [ KvaShadowInvpcid set_KvaShadowInvpcid[3..4], KvaShadowRequired set_KvaShadowRequired[4..5], KvaShadowRequiredAvailable set_KvaShadowRequiredAvailable[5..6], - Reserved set_Reserved[6..32], + InvalidPteBit set_InvalidPteBit[6..12], + L1DataCacheFlushSupported set_L1DataCacheFlushSupported[12..13], + L1TerminalFaultMitigationPresent set_L1TerminalFaultMitigationPresent[13..14], + Reserved set_Reserved[14..32], ]} pub type PSYSTEM_KERNEL_VA_SHADOW_INFORMATION = *mut SYSTEM_KERNEL_VA_SHADOW_INFORMATION; STRUCT!{struct SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION { @@ -2417,14 +2424,6 @@ pub type PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION = STRUCT!{struct SYSTEM_SPECULATION_CONTROL_INFORMATION { Flags: ULONG, }} -pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION; -STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION { - DmaGuardPolicyEnabled: BOOLEAN, -}} -pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION; -STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION { - EnclaveLaunchSigner: [UCHAR; 32], -}} BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [ BpbEnabled set_BpbEnabled[0..1], BpbDisabledSystemPolicy set_BpbDisabledSystemPolicy[1..2], @@ -2434,15 +2433,32 @@ BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [ IbrsPresent set_IbrsPresent[5..6], StibpPresent set_StibpPresent[6..7], SmepPresent set_SmepPresent[7..8], - MemoryDisambiguationDisableAvailable set_MemoryDisambiguationDisableAvailable[8..9], - MemoryDisambiguationDisableSupported set_MemoryDisambiguationDisableSupported[9..10], - MemoryDisambiguationDisabledSystemWide set_MemoryDisambiguationDisabledSystemWide[10..11], - MemoryDisambiguationDisabledKernel set_MemoryDisambiguationDisabledKernel[11..12], - MemoryDisambiguationDisableRequired set_MemoryDisambiguationDisableRequired[12..13], - Reserved set_Reserved[13..32], + SpeculativeStoreBypassDisableAvailable set_SpeculativeStoreBypassDisableAvailable[8..9], + SpeculativeStoreBypassDisableSupported set_SpeculativeStoreBypassDisableSupported[9..10], + SpeculativeStoreBypassDisabledSystemWide set_SpeculativeStoreBypassDisabledSystemWide[10..11], + SpeculativeStoreBypassDisabledKernel set_SpeculativeStoreBypassDisabledKernel[11..12], + SpeculativeStoreBypassDisableRequired set_SpeculativeStoreBypassDisableRequired[12..13], + BpbDisabledKernelToUser set_BpbDisabledKernelToUser[13..14], + SpecCtrlRetpolineEnabled set_SpecCtrlRetpolineEnabled[14..15], + SpecCtrlImportOptimizationEnabled set_SpecCtrlImportOptimizationEnabled[15..16], + Reserved set_Reserved[16..32], ]} +pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION; +STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION { + DmaGuardPolicyEnabled: BOOLEAN, +}} +pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION; +STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION { + EnclaveLaunchSigner: [UCHAR; 32], +}} pub type PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION = *mut SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION; +STRUCT!{struct SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION { + WorkloadClass: ULONGLONG, + CpuSets: [ULONGLONG; 1], +}} +pub type PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION = + *mut SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION; EXTERN!{extern "system" { fn NtQuerySystemInformation( SystemInformationClass: SYSTEM_INFORMATION_CLASS, @@ -2857,6 +2873,9 @@ EXTERN!{extern "system" { Length: ULONG, Atom: PRTL_ATOM, ) -> NTSTATUS; +}} +pub const ATOM_FLAG_GLOBAL: ULONG = 0x2; +EXTERN!{extern "system" { fn NtAddAtomEx( AtomName: PWSTR, Length: ULONG, @@ -2897,6 +2916,51 @@ EXTERN!{extern "system" { ReturnLength: PULONG, ) -> NTSTATUS; }} +pub const FLG_STOP_ON_EXCEPTION: u32 = 0x00000001; +pub const FLG_SHOW_LDR_SNAPS: u32 = 0x00000002; +pub const FLG_DEBUG_INITIAL_COMMAND: u32 = 0x00000004; +pub const FLG_STOP_ON_HUNG_GUI: u32 = 0x00000008; +pub const FLG_HEAP_ENABLE_TAIL_CHECK: u32 = 0x00000010; +pub const FLG_HEAP_ENABLE_FREE_CHECK: u32 = 0x00000020; +pub const FLG_HEAP_VALIDATE_PARAMETERS: u32 = 0x00000040; +pub const FLG_HEAP_VALIDATE_ALL: u32 = 0x00000080; +pub const FLG_APPLICATION_VERIFIER: u32 = 0x00000100; +pub const FLG_POOL_ENABLE_TAGGING: u32 = 0x00000400; +pub const FLG_HEAP_ENABLE_TAGGING: u32 = 0x00000800; +pub const FLG_USER_STACK_TRACE_DB: u32 = 0x00001000; +pub const FLG_KERNEL_STACK_TRACE_DB: u32 = 0x00002000; +pub const FLG_MAINTAIN_OBJECT_TYPELIST: u32 = 0x00004000; +pub const FLG_HEAP_ENABLE_TAG_BY_DLL: u32 = 0x00008000; +pub const FLG_DISABLE_STACK_EXTENSION: u32 = 0x00010000; +pub const FLG_ENABLE_CSRDEBUG: u32 = 0x00020000; +pub const FLG_ENABLE_KDEBUG_SYMBOL_LOAD: u32 = 0x00040000; +pub const FLG_DISABLE_PAGE_KERNEL_STACKS: u32 = 0x00080000; +pub const FLG_ENABLE_SYSTEM_CRIT_BREAKS: u32 = 0x00100000; +pub const FLG_HEAP_DISABLE_COALESCING: u32 = 0x00200000; +pub const FLG_ENABLE_CLOSE_EXCEPTIONS: u32 = 0x00400000; +pub const FLG_ENABLE_EXCEPTION_LOGGING: u32 = 0x00800000; +pub const FLG_ENABLE_HANDLE_TYPE_TAGGING: u32 = 0x01000000; +pub const FLG_HEAP_PAGE_ALLOCS: u32 = 0x02000000; +pub const FLG_DEBUG_INITIAL_COMMAND_EX: u32 = 0x04000000; +pub const FLG_DISABLE_DBGPRINT: u32 = 0x08000000; +pub const FLG_CRITSEC_EVENT_CREATION: u32 = 0x10000000; +pub const FLG_LDR_TOP_DOWN: u32 = 0x20000000; +pub const FLG_ENABLE_HANDLE_EXCEPTIONS: u32 = 0x40000000; +pub const FLG_DISABLE_PROTDLLS: u32 = 0x80000000; +pub const FLG_VALID_BITS: u32 = 0xfffffdff; +pub const FLG_USERMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS + | FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS + | FLG_HEAP_VALIDATE_ALL | FLG_APPLICATION_VERIFIER | FLG_HEAP_ENABLE_TAGGING + | FLG_USER_STACK_TRACE_DB | FLG_HEAP_ENABLE_TAG_BY_DLL | FLG_DISABLE_STACK_EXTENSION + | FLG_ENABLE_SYSTEM_CRIT_BREAKS | FLG_HEAP_DISABLE_COALESCING | FLG_DISABLE_PROTDLLS + | FLG_HEAP_PAGE_ALLOCS | FLG_CRITSEC_EVENT_CREATION | FLG_LDR_TOP_DOWN; +pub const FLG_BOOTONLY_VALID_BITS: u32 = FLG_KERNEL_STACK_TRACE_DB | FLG_MAINTAIN_OBJECT_TYPELIST + | FLG_ENABLE_CSRDEBUG | FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX + | FLG_DISABLE_PAGE_KERNEL_STACKS; +pub const FLG_KERNELMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS + | FLG_STOP_ON_HUNG_GUI | FLG_POOL_ENABLE_TAGGING | FLG_ENABLE_KDEBUG_SYMBOL_LOAD + | FLG_ENABLE_CLOSE_EXCEPTIONS | FLG_ENABLE_EXCEPTION_LOGGING | FLG_ENABLE_HANDLE_TYPE_TAGGING + | FLG_DISABLE_DBGPRINT | FLG_ENABLE_HANDLE_EXCEPTIONS; EXTERN!{extern "system" { fn NtQueryLicenseValue( ValueName: PUNICODE_STRING, diff --git a/src/ntioapi.rs b/src/ntioapi.rs index 57afbc9..48c416b 100644 --- a/src/ntioapi.rs +++ b/src/ntioapi.rs @@ -202,7 +202,11 @@ ENUM!{enum FILE_INFORMATION_CLASS { FileMemoryPartitionInformation = 69, FileStatLxInformation = 70, FileCaseSensitiveInformation = 71, - FileMaximumInformation = 72, + FileLinkInformationEx = 72, + FileLinkInformationExBypassAccessCheck = 73, + FileStorageReserveIdInformation = 74, + FileCaseSensitiveInformationForceAccessCheck = 75, + FileMaximumInformation = 76, }} pub type PFILE_INFORMATION_CLASS = *mut FILE_INFORMATION_CLASS; STRUCT!{struct FILE_BASIC_INFORMATION { @@ -784,7 +788,8 @@ ENUM!{enum FS_INFORMATION_CLASS { FileFsSectorSizeInformation = 11, FileFsDataCopyInformation = 12, FileFsMetadataSizeInformation = 13, - FileFsMaximumInformation = 14, + FileFsFullSizeInformationEx = 14, + FileFsMaximumInformation = 15, }} pub type PFS_INFORMATION_CLASS = *mut FS_INFORMATION_CLASS; STRUCT!{struct FILE_FS_LABEL_INFORMATION { @@ -874,6 +879,22 @@ STRUCT!{struct FILE_FS_METADATA_SIZE_INFORMATION { BytesPerSector: ULONG, }} pub type PFILE_FS_METADATA_SIZE_INFORMATION = *mut FILE_FS_METADATA_SIZE_INFORMATION; +STRUCT!{struct FILE_FS_FULL_SIZE_INFORMATION_EX { + ActualTotalAllocationUnits: ULONGLONG, + ActualAvailableAllocationUnits: ULONGLONG, + ActualPoolUnavailableAllocationUnits: ULONGLONG, + CallerTotalAllocationUnits: ULONGLONG, + CallerAvailableAllocationUnits: ULONGLONG, + CallerPoolUnavailableAllocationUnits: ULONGLONG, + UsedAllocationUnits: ULONGLONG, + TotalReservedAllocationUnits: ULONGLONG, + VolumeStorageReserveAllocationUnits: ULONGLONG, + AvailableCommittedAllocationUnits: ULONGLONG, + PoolAvailableAllocationUnits: ULONGLONG, + SectorsPerAllocationUnit: ULONG, + BytesPerSector: ULONG, +}} +pub type PFILE_FS_FULL_SIZE_INFORMATION_EX = *mut FILE_FS_FULL_SIZE_INFORMATION_EX; EXTERN!{extern "system" { fn NtCreateFile( FileHandle: PHANDLE, @@ -929,8 +950,6 @@ EXTERN!{extern "system" { FileHandle: HANDLE, IoStatusBlock: PIO_STATUS_BLOCK, ) -> NTSTATUS; -}} -EXTERN!{extern "system" { fn NtFlushBuffersFileEx( FileHandle: HANDLE, Flags: ULONG, @@ -945,6 +964,13 @@ EXTERN!{extern "system" { Length: ULONG, FileInformationClass: FILE_INFORMATION_CLASS, ) -> NTSTATUS; + fn NtQueryInformationByName( + ObjectAttributes: POBJECT_ATTRIBUTES, + IoStatusBlock: PIO_STATUS_BLOCK, + FileInformation: PVOID, + Length: ULONG, + FileInformationClass: FILE_INFORMATION_CLASS, + ) -> NTSTATUS; fn NtSetInformationFile( FileHandle: HANDLE, IoStatusBlock: PIO_STATUS_BLOCK, diff --git a/src/ntmmapi.rs b/src/ntmmapi.rs index 3ef3305..b173eab 100644 --- a/src/ntmmapi.rs +++ b/src/ntmmapi.rs @@ -1,3 +1,4 @@ +use crate::winapi_local::um::winnt::PMEM_EXTENDED_PARAMETER; use winapi::shared::basetsd::{PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR}; use winapi::shared::ntdef::{ BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG, @@ -390,6 +391,8 @@ STRUCT!{struct CFG_CALL_TARGET_LIST_INFORMATION { Reserved: ULONG, NumberOfEntriesProcessed: PULONG, CallTargetInfo: PCFG_CALL_TARGET_INFO, + Section: PVOID, + FileOffset: ULONGLONG, }} pub type PCFG_CALL_TARGET_LIST_INFORMATION = *mut CFG_CALL_TARGET_LIST_INFORMATION; EXTERN!{extern "system" { @@ -422,6 +425,17 @@ EXTERN!{extern "system" { AllocationAttributes: ULONG, FileHandle: HANDLE, ) -> NTSTATUS; + fn NtCreateSectionEx( + SectionHandle: PHANDLE, + DesiredAccess: ACCESS_MASK, + ObjectAttributes: POBJECT_ATTRIBUTES, + MaximumSize: PLARGE_INTEGER, + SectionPageProtection: ULONG, + AllocationAttributes: ULONG, + FileHandle: HANDLE, + ExtendedParameters: PMEM_EXTENDED_PARAMETER, + ExtendedParameterCount: ULONG, + ) -> NTSTATUS; fn NtOpenSection( SectionHandle: PHANDLE, DesiredAccess: ACCESS_MASK, diff --git a/src/ntpebteb.rs b/src/ntpebteb.rs index e5162ba..ef1ca5d 100644 --- a/src/ntpebteb.rs +++ b/src/ntpebteb.rs @@ -61,6 +61,8 @@ UNION!{union PEB_u { KernelCallbackTable: PVOID, UserSharedInfoPtr: PVOID, }} +#[repr(C)] +pub struct LEAP_SECOND_DATA([u8; 0]); //fixme STRUCT!{struct PEB { InheritedAddressSpace: BOOLEAN, ReadImageFileExecOptions: BOOLEAN, @@ -146,6 +148,9 @@ STRUCT!{struct PEB { CloudFileDiagFlags: ULONG, PlaceholderCompatibilityMode: CHAR, PlaceholderCompatibilityModeReserved: [CHAR; 7], + LeapSecondData: *mut LEAP_SECOND_DATA, + LeapSecondFlags: ULONG, + NtGlobalFlag2: ULONG, }} BITFIELD!{PEB BitField: BOOLEAN [ ImageUsesLargePages set_ImageUsesLargePages[0..1], @@ -165,7 +170,8 @@ BITFIELD!{PEB CrossProcessFlags: ULONG [ ProcessUsingFTH set_ProcessUsingFTH[4..5], ProcessPreviouslyThrottled set_ProcessPreviouslyThrottled[5..6], ProcessCurrentlyThrottled set_ProcessCurrentlyThrottled[6..7], - ReservedBits0 set_ReservedBits0[7..32], + ProcessImagesHotPatched set_ProcessImagesHotPatched[7..8], + ReservedBits0 set_ReservedBits0[8..32], ]} BITFIELD!{PEB TracingFlags: ULONG [ HeapTracingEnabled set_HeapTracingEnabled[0..1], @@ -173,6 +179,10 @@ BITFIELD!{PEB TracingFlags: ULONG [ LibLoaderTracingEnabled set_LibLoaderTracingEnabled[2..3], SpareTracingBits set_SpareTracingBits[3..32], ]} +BITFIELD!{PEB LeapSecondFlags: ULONG [ + SixtySecondEnabled set_SixtySecondEnabled[0..1], + Reserved set_Reserved[1..32], +]} pub type PPEB = *mut PEB; pub const GDI_BATCH_BUFFER_SIZE: usize = 310; STRUCT!{struct GDI_TEB_BATCH { diff --git a/src/ntpsapi.rs b/src/ntpsapi.rs index 03b3641..c71757d 100644 --- a/src/ntpsapi.rs +++ b/src/ntpsapi.rs @@ -152,7 +152,12 @@ ENUM!{enum PROCESSINFOCLASS { ProcessDebugAuthInformation = 90, ProcessSystemResourceManagement = 91, ProcessSequenceNumber = 92, - MaxProcessInfoClass = 93, + ProcessLoaderDetour = 93, + ProcessSecurityDomainInformation = 94, + ProcessCombineSecurityDomainsInformation = 95, + ProcessEnableLogging = 96, + ProcessLeapSecondInformation = 97, + MaxProcessInfoClass = 98, }} ENUM!{enum THREADINFOCLASS { ThreadBasicInformation = 0, @@ -205,7 +210,8 @@ ENUM!{enum THREADINFOCLASS { ThreadAttachContainer = 47, ThreadManageWritesToExecutableMemory = 48, ThreadPowerThrottlingState = 49, - MaxThreadInfoClass = 50, + ThreadWorkloadClass = 50, + MaxThreadInfoClass = 51, }} STRUCT!{struct PAGE_PRIORITY_INFORMATION { PagePriority: ULONG, @@ -510,6 +516,7 @@ UNION!{union PROCESS_MITIGATION_POLICY_INFORMATION_u { SystemCallFilterPolicy: PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY, PayloadRestrictionPolicy: PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY, ChildProcessPolicy: PROCESS_MITIGATION_CHILD_PROCESS_POLICY, + // SideChannelIsolationPolicy: PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY, //TODO }} STRUCT!{struct PROCESS_MITIGATION_POLICY_INFORMATION { Policy: PROCESS_MITIGATION_POLICY, @@ -705,6 +712,32 @@ BITFIELD!{PROCESS_SYSTEM_RESOURCE_MANAGEMENT Flags: ULONG [ Foreground set_Foreground[0..1], Reserved set_Reserved[1..32], ]} +STRUCT!{struct PROCESS_SECURITY_DOMAIN_INFORMATION { + SecurityDomain: ULONGLONG, +}} +pub type PPROCESS_SECURITY_DOMAIN_INFORMATION = *mut PROCESS_SECURITY_DOMAIN_INFORMATION; +STRUCT!{struct PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION { + ProcessHandle: HANDLE, +}} +pub type PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION = + *mut PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION; +STRUCT!{struct PROCESS_LOGGING_INFORMATION { + Flags: ULONG, + BitFields: ULONG, +}} +BITFIELD!{PROCESS_LOGGING_INFORMATION BitFields: ULONG [ + EnableReadVmLogging set_EnableReadVmLogging[0..1], + EnableWriteVmLogging set_EnableWriteVmLogging[1..2], + EnableProcessSuspendResumeLogging set_EnableProcessSuspendResumeLogging[2..3], + EnableThreadSuspendResumeLogging set_EnableThreadSuspendResumeLogging[3..4], + Reserved set_Reserved[4..32], +]} +pub type PPROCESS_LOGGING_INFORMATION = *mut PROCESS_LOGGING_INFORMATION; +STRUCT!{struct PROCESS_LEAP_SECOND_INFORMATION { + Flags: ULONG, + Reserved: ULONG, +}} +pub type PPROCESS_LEAP_SECOND_INFORMATION = *mut PROCESS_LEAP_SECOND_INFORMATION; STRUCT!{struct THREAD_BASIC_INFORMATION { ExitStatus: NTSTATUS, TebBaseAddress: PTEB, @@ -839,6 +872,11 @@ ENUM!{enum SUBSYSTEM_INFORMATION_TYPE { SubsystemInformationTypeWSL = 1, MaxSubsystemInformationType = 2, }} +ENUM!{enum THREAD_WORKLOAD_CLASS { + ThreadWorkloadClassDefault = 0, + ThreadWorkloadClassGraphics = 1, + MaxThreadWorkloadClass = 2, +}} EXTERN!{extern "system" { fn NtCreateProcess( ProcessHandle: PHANDLE, @@ -1191,6 +1229,9 @@ ENUM!{enum PS_MITIGATION_OPTION { PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER = 26, PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION = 27, PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION = 28, + PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE = 29, + PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY = 30, + PS_MITIGATION_OPTION_CET_SHADOW_STACKS = 31, }} ENUM!{enum PS_CREATE_STATE { PsCreateInitialState = 0, diff --git a/src/ntrtl.rs b/src/ntrtl.rs index 72057fb..c0b2495 100644 --- a/src/ntrtl.rs +++ b/src/ntrtl.rs @@ -1472,6 +1472,13 @@ EXTERN!{extern "system" { TokenHandle: HANDLE, ProcessInformation: PRTL_USER_PROCESS_INFORMATION, ) -> NTSTATUS; + fn RtlCreateUserProcessEx( + NtImagePathName: PUNICODE_STRING, + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + InheritHandles: BOOLEAN, + Flags: ULONG, + ProcessInformation: PRTL_USER_PROCESS_INFORMATION, + ) -> NTSTATUS; fn RtlExitUserProcess( ExitStatus: NTSTATUS, ); @@ -1910,6 +1917,9 @@ EXTERN!{extern "system" { fn RtlDetermineDosPathNameType_U( DosFileName: PWSTR, ) -> RTL_PATH_TYPE; + fn RtlDetermineDosPathNameType_Ustr( + DosFileName: PCUNICODE_STRING, + ) -> RTL_PATH_TYPE; fn RtlIsDosDeviceName_U( DosFileName: PWSTR, ) -> ULONG; @@ -3911,7 +3921,9 @@ EXTERN!{extern "system" { ); fn RtlGetFrame() -> PTEB_ACTIVE_FRAME; }} -pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 8; +pub const RTL_WALK_USER_MODE_STACK: ULONG = 0x00000001; +pub const RTL_WALK_VALID_FLAGS: ULONG = 0x00000001; +pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 0x00000008; EXTERN!{extern "system" { fn RtlWalkFrameChain( Callers: *mut PVOID, diff --git a/src/ntseapi.rs b/src/ntseapi.rs index 0571ebf..4cac9f4 100644 --- a/src/ntseapi.rs +++ b/src/ntseapi.rs @@ -45,7 +45,8 @@ pub const SE_RELABEL_PRIVILEGE: LONG = 32; pub const SE_INC_WORKING_SET_PRIVILEGE: LONG = 33; pub const SE_TIME_ZONE_PRIVILEGE: LONG = 34; pub const SE_CREATE_SYMBOLIC_LINK_PRIVILEGE: LONG = 35; -pub const SE_MAX_WELL_KNOWN_PRIVILEGE: LONG = SE_CREATE_SYMBOLIC_LINK_PRIVILEGE; +pub const SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE: LONG = 36; +pub const SE_MAX_WELL_KNOWN_PRIVILEGE: LONG = SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE; pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID: USHORT = 0x00; pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64: USHORT = 0x01; pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64: USHORT = 0x02; @@ -60,6 +61,7 @@ pub const TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY: USHORT = 0x0004; pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT: USHORT = 0x0008; pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED: USHORT = 0x0010; pub const TOKEN_SECURITY_ATTRIBUTE_MANDATORY: USHORT = 0x0020; +pub const TOKEN_SECURITY_ATTRIBUTE_COMPARE_IGNORE: USHORT = 0x0040; pub const TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS: USHORT = TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | TOKEN_SECURITY_ATTRIBUTE_DISABLED diff --git a/src/winapi_local/um/winnt.rs b/src/winapi_local/um/winnt.rs index 2242c9a..b6b3ec7 100644 --- a/src/winapi_local/um/winnt.rs +++ b/src/winapi_local/um/winnt.rs @@ -1,3 +1,7 @@ +use winapi::shared::basetsd::{DWORD64, SIZE_T, ULONG64}; +use winapi::shared::minwindef::DWORD; +use winapi::um::winnt::{HANDLE, PVOID}; +#[doc(hidden)] #[inline] pub const fn UInt32x32To64(a: u32, b: u32) -> u64 { a as u64 * b as u64 @@ -5,8 +9,6 @@ pub const fn UInt32x32To64(a: u32, b: u32) -> u64 { #[cfg(feature = "nightly")] IFDEF!{ use crate::ntpebteb::TEB; -use winapi::shared::basetsd::DWORD64; -use winapi::shared::minwindef::DWORD; #[inline] pub unsafe fn _bittest64(Base: *const i64, Offset: i64) -> u8 { let out: u8; @@ -52,3 +54,27 @@ pub unsafe fn NtCurrentTeb() -> *mut TEB { } } } +ENUM!{enum MEM_EXTENDED_PARAMETER_TYPE { + MemExtendedParameterInvalidType = 0, + MemExtendedParameterAddressRequirements = 1, + MemExtendedParameterNumaNode = 2, + MemExtendedParameterPartitionHandle = 3, + MemExtendedParameterMax = 4, +}} +pub type PMEM_EXTENDED_PARAMETER_TYPE = *mut MEM_EXTENDED_PARAMETER_TYPE; +UNION!{union MEM_EXTENDED_PARAMETER_u { + ULong64: DWORD64, + Pointer: PVOID, + Size: SIZE_T, + Handle: HANDLE, + ULong: DWORD, +}} +STRUCT!{struct MEM_EXTENDED_PARAMETER { + BitFields: ULONG64, + u: MEM_EXTENDED_PARAMETER_u, +}} +BITFIELD!{MEM_EXTENDED_PARAMETER BitFields: ULONG64 [ + Type set_Type[0..8], + Reserved set_Reserved[8..64], +]} +pub type PMEM_EXTENDED_PARAMETER = *mut MEM_EXTENDED_PARAMETER; diff --git a/tests/layout_x86.rs b/tests/layout_x86.rs index 1b1f77c..07c0f15 100644 --- a/tests/layout_x86.rs +++ b/tests/layout_x86.rs @@ -383,6 +383,8 @@ fn ntexapi() { assert_eq!(align_of::(), 1); assert_eq!(size_of::(), 32); assert_eq!(align_of::(), 1); + assert_eq!(size_of::(), 16); + assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 12); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 16); @@ -661,6 +663,8 @@ fn ntioapi() { assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 16); assert_eq!(align_of::(), 8); + assert_eq!(size_of::(), 96); + assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 4); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 24); @@ -837,8 +841,8 @@ fn ntmmapi() { assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 8); assert_eq!(align_of::(), 4); - assert_eq!(size_of::(), 16); - assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 32); + assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 128); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 12); @@ -891,7 +895,7 @@ fn ntpebteb() { assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 20); assert_eq!(align_of::(), 4); - assert_eq!(size_of::(), 1136); + assert_eq!(size_of::(), 1152); assert_eq!(align_of::(), 8); assert_eq!(FIELD_OFFSET!(PEB, InheritedAddressSpace), 0); assert_eq!(FIELD_OFFSET!(PEB, ReadImageFileExecOptions), 1); @@ -974,6 +978,9 @@ fn ntpebteb() { assert_eq!(FIELD_OFFSET!(PEB, CloudFileDiagFlags), 1124); assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityMode), 1128); assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityModeReserved), 1129); + assert_eq!(FIELD_OFFSET!(PEB, LeapSecondData), 1136); + assert_eq!(FIELD_OFFSET!(PEB, LeapSecondFlags), 1140); + assert_eq!(FIELD_OFFSET!(PEB, NtGlobalFlag2), 1144); assert_eq!(size_of::(), 1248); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 8); @@ -1256,6 +1263,14 @@ fn ntpsapi() { assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 4); assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 8); + assert_eq!(size_of::(), 4); + assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 28); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 16); diff --git a/tests/layout_x86_64.rs b/tests/layout_x86_64.rs index 6dc7fae..9ca61ba 100644 --- a/tests/layout_x86_64.rs +++ b/tests/layout_x86_64.rs @@ -383,6 +383,8 @@ fn ntexapi() { assert_eq!(align_of::(), 1); assert_eq!(size_of::(), 32); assert_eq!(align_of::(), 1); + assert_eq!(size_of::(), 16); + assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 24); assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 24); @@ -661,6 +663,8 @@ fn ntioapi() { assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 16); assert_eq!(align_of::(), 8); + assert_eq!(size_of::(), 96); + assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 4); assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 24); @@ -837,7 +841,7 @@ fn ntmmapi() { assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 16); assert_eq!(align_of::(), 8); - assert_eq!(size_of::(), 24); + assert_eq!(size_of::(), 40); assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 240); assert_eq!(align_of::(), 8); @@ -891,7 +895,7 @@ fn ntpebteb() { assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 20); assert_eq!(align_of::(), 4); - assert_eq!(size_of::(), 1976); + assert_eq!(size_of::(), 1992); assert_eq!(align_of::(), 8); assert_eq!(FIELD_OFFSET!(PEB, InheritedAddressSpace), 0); assert_eq!(FIELD_OFFSET!(PEB, ReadImageFileExecOptions), 1); @@ -974,6 +978,9 @@ fn ntpebteb() { assert_eq!(FIELD_OFFSET!(PEB, CloudFileDiagFlags), 1964); assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityMode), 1968); assert_eq!(FIELD_OFFSET!(PEB, PlaceholderCompatibilityModeReserved), 1969); + assert_eq!(FIELD_OFFSET!(PEB, LeapSecondData), 1976); + assert_eq!(FIELD_OFFSET!(PEB, LeapSecondFlags), 1984); + assert_eq!(FIELD_OFFSET!(PEB, NtGlobalFlag2), 1988); assert_eq!(size_of::(), 1256); assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 16); @@ -1256,6 +1263,14 @@ fn ntpsapi() { assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 4); assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 8); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 8); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 4); + assert_eq!(size_of::(), 8); + assert_eq!(align_of::(), 4); assert_eq!(size_of::(), 48); assert_eq!(align_of::(), 8); assert_eq!(size_of::(), 24);