mirror of
https://github.com/SafeBreach-Labs/PoolParty
synced 2026-06-06 16:44:29 +00:00
Alon Leviev
385 lines
9.5 KiB
C++
385 lines
9.5 KiB
C++
#pragma once
|
|
|
|
#include <Windows.h>
|
|
|
|
#include "Native.hpp"
|
|
#include "Misc.hpp"
|
|
|
|
// ---------//
|
|
// Structs //
|
|
// --------//
|
|
|
|
typedef struct _TP_TASK_CALLBACKS
|
|
{
|
|
void* ExecuteCallback;
|
|
void* Unposted;
|
|
} TP_TASK_CALLBACKS, * PTP_TASK_CALLBACKS;
|
|
|
|
typedef struct _TP_TASK
|
|
{
|
|
struct _TP_TASK_CALLBACKS* Callbacks;
|
|
UINT32 NumaNode;
|
|
UINT8 IdealProcessor;
|
|
char Padding_242[3];
|
|
struct _LIST_ENTRY ListEntry;
|
|
} TP_TASK, * PTP_TASK;
|
|
|
|
typedef struct _TPP_REFCOUNT
|
|
{
|
|
volatile INT32 Refcount;
|
|
} TPP_REFCOUNT, * PTPP_REFCOUNT;
|
|
|
|
typedef struct _TPP_CALLER
|
|
{
|
|
void* ReturnAddress;
|
|
} TPP_CALLER, * PTPP_CALLER;
|
|
|
|
typedef struct _TPP_PH
|
|
{
|
|
struct _TPP_PH_LINKS* Root;
|
|
} TPP_PH, * PTPP_PH;
|
|
|
|
typedef struct _TP_DIRECT
|
|
{
|
|
struct _TP_TASK Task;
|
|
UINT64 Lock;
|
|
struct _LIST_ENTRY IoCompletionInformationList;
|
|
void* Callback;
|
|
UINT32 NumaNode;
|
|
UINT8 IdealProcessor;
|
|
char __PADDING__[3];
|
|
} TP_DIRECT, * PTP_DIRECT;
|
|
|
|
typedef struct _TPP_TIMER_SUBQUEUE
|
|
{
|
|
INT64 Expiration;
|
|
struct _TPP_PH WindowStart;
|
|
struct _TPP_PH WindowEnd;
|
|
void* Timer;
|
|
void* TimerPkt;
|
|
struct _TP_DIRECT Direct;
|
|
UINT32 ExpirationWindow;
|
|
INT32 __PADDING__[1];
|
|
} TPP_TIMER_SUBQUEUE, * PTPP_TIMER_SUBQUEUE;
|
|
|
|
typedef struct _TPP_TIMER_QUEUE
|
|
{
|
|
struct _RTL_SRWLOCK Lock;
|
|
struct _TPP_TIMER_SUBQUEUE AbsoluteQueue;
|
|
struct _TPP_TIMER_SUBQUEUE RelativeQueue;
|
|
INT32 AllocatedTimerCount;
|
|
INT32 __PADDING__[1];
|
|
} TPP_TIMER_QUEUE, * PTPP_TIMER_QUEUE;
|
|
|
|
typedef struct _TPP_NUMA_NODE
|
|
{
|
|
INT32 WorkerCount;
|
|
} TPP_NUMA_NODE, * PTPP_NUMA_NODE;
|
|
|
|
typedef union _TPP_POOL_QUEUE_STATE
|
|
{
|
|
union
|
|
{
|
|
INT64 Exchange;
|
|
struct
|
|
{
|
|
INT32 RunningThreadGoal : 16;
|
|
UINT32 PendingReleaseCount : 16;
|
|
UINT32 QueueLength;
|
|
};
|
|
};
|
|
} TPP_POOL_QUEUE_STATE, * PTPP_POOL_QUEUE_STATE;
|
|
|
|
typedef struct _TPP_QUEUE
|
|
{
|
|
struct _LIST_ENTRY Queue;
|
|
struct _RTL_SRWLOCK Lock;
|
|
} TPP_QUEUE, * PTPP_QUEUE;
|
|
|
|
typedef struct _FULL_TP_POOL
|
|
{
|
|
struct _TPP_REFCOUNT Refcount;
|
|
long Padding_239;
|
|
union _TPP_POOL_QUEUE_STATE QueueState;
|
|
struct _TPP_QUEUE* TaskQueue[3];
|
|
struct _TPP_NUMA_NODE* NumaNode;
|
|
struct _GROUP_AFFINITY* ProximityInfo;
|
|
void* WorkerFactory;
|
|
void* CompletionPort;
|
|
struct _RTL_SRWLOCK Lock;
|
|
struct _LIST_ENTRY PoolObjectList;
|
|
struct _LIST_ENTRY WorkerList;
|
|
struct _TPP_TIMER_QUEUE TimerQueue;
|
|
struct _RTL_SRWLOCK ShutdownLock;
|
|
UINT8 ShutdownInitiated;
|
|
UINT8 Released;
|
|
UINT16 PoolFlags;
|
|
long Padding_240;
|
|
struct _LIST_ENTRY PoolLinks;
|
|
struct _TPP_CALLER AllocCaller;
|
|
struct _TPP_CALLER ReleaseCaller;
|
|
volatile INT32 AvailableWorkerCount;
|
|
volatile INT32 LongRunningWorkerCount;
|
|
UINT32 LastProcCount;
|
|
volatile INT32 NodeStatus;
|
|
volatile INT32 BindingCount;
|
|
UINT32 CallbackChecksDisabled : 1;
|
|
UINT32 TrimTarget : 11;
|
|
UINT32 TrimmedThrdCount : 11;
|
|
UINT32 SelectedCpuSetCount;
|
|
long Padding_241;
|
|
struct _RTL_CONDITION_VARIABLE TrimComplete;
|
|
struct _LIST_ENTRY TrimmedWorkerList;
|
|
} FULL_TP_POOL, * PFULL_TP_POOL;
|
|
|
|
typedef struct _ALPC_WORK_ON_BEHALF_TICKET
|
|
{
|
|
UINT32 ThreadId;
|
|
UINT32 ThreadCreationTimeLow;
|
|
} ALPC_WORK_ON_BEHALF_TICKET, * PALPC_WORK_ON_BEHALF_TICKET;
|
|
|
|
typedef union _TPP_WORK_STATE
|
|
{
|
|
union
|
|
{
|
|
INT32 Exchange;
|
|
UINT32 Insertable : 1;
|
|
UINT32 PendingCallbackCount : 31;
|
|
};
|
|
} TPP_WORK_STATE, * PTPP_WORK_STATE;
|
|
|
|
typedef struct _TPP_ITE_WAITER
|
|
{
|
|
struct _TPP_ITE_WAITER* Next;
|
|
void* ThreadId;
|
|
} TPP_ITE_WAITER, * PTPP_ITE_WAITER;
|
|
|
|
typedef struct _TPP_PH_LINKS
|
|
{
|
|
struct _LIST_ENTRY Siblings;
|
|
struct _LIST_ENTRY Children;
|
|
INT64 Key;
|
|
} TPP_PH_LINKS, * PTPP_PH_LINKS;
|
|
|
|
typedef struct _TPP_ITE
|
|
{
|
|
struct _TPP_ITE_WAITER* First;
|
|
} TPP_ITE, * PTPP_ITE;
|
|
|
|
typedef union _TPP_FLAGS_COUNT
|
|
{
|
|
union
|
|
{
|
|
UINT64 Count : 60;
|
|
UINT64 Flags : 4;
|
|
INT64 Data;
|
|
};
|
|
} TPP_FLAGS_COUNT, * PTPP_FLAGS_COUNT;
|
|
|
|
typedef struct _TPP_BARRIER
|
|
{
|
|
volatile union _TPP_FLAGS_COUNT Ptr;
|
|
struct _RTL_SRWLOCK WaitLock;
|
|
struct _TPP_ITE WaitList;
|
|
} TPP_BARRIER, * PTPP_BARRIER;
|
|
|
|
typedef struct _TP_CLEANUP_GROUP
|
|
{
|
|
struct _TPP_REFCOUNT Refcount;
|
|
INT32 Released;
|
|
struct _RTL_SRWLOCK MemberLock;
|
|
struct _LIST_ENTRY MemberList;
|
|
struct _TPP_BARRIER Barrier;
|
|
struct _RTL_SRWLOCK CleanupLock;
|
|
struct _LIST_ENTRY CleanupList;
|
|
} TP_CLEANUP_GROUP, * PTP_CLEANUP_GROUP;
|
|
|
|
|
|
typedef struct _TPP_CLEANUP_GROUP_MEMBER
|
|
{
|
|
struct _TPP_REFCOUNT Refcount;
|
|
long Padding_233;
|
|
const struct _TPP_CLEANUP_GROUP_MEMBER_VFUNCS* VFuncs;
|
|
struct _TP_CLEANUP_GROUP* CleanupGroup;
|
|
void* CleanupGroupCancelCallback;
|
|
void* FinalizationCallback;
|
|
struct _LIST_ENTRY CleanupGroupMemberLinks;
|
|
struct _TPP_BARRIER CallbackBarrier;
|
|
union
|
|
{
|
|
void* Callback;
|
|
void* WorkCallback;
|
|
void* SimpleCallback;
|
|
void* TimerCallback;
|
|
void* WaitCallback;
|
|
void* IoCallback;
|
|
void* AlpcCallback;
|
|
void* AlpcCallbackEx;
|
|
void* JobCallback;
|
|
};
|
|
void* Context;
|
|
struct _ACTIVATION_CONTEXT* ActivationContext;
|
|
void* SubProcessTag;
|
|
struct _GUID ActivityId;
|
|
struct _ALPC_WORK_ON_BEHALF_TICKET WorkOnBehalfTicket;
|
|
void* RaceDll;
|
|
FULL_TP_POOL* Pool;
|
|
struct _LIST_ENTRY PoolObjectLinks;
|
|
union
|
|
{
|
|
volatile INT32 Flags;
|
|
UINT32 LongFunction : 1;
|
|
UINT32 Persistent : 1;
|
|
UINT32 UnusedPublic : 14;
|
|
UINT32 Released : 1;
|
|
UINT32 CleanupGroupReleased : 1;
|
|
UINT32 InCleanupGroupCleanupList : 1;
|
|
UINT32 UnusedPrivate : 13;
|
|
};
|
|
long Padding_234;
|
|
struct _TPP_CALLER AllocCaller;
|
|
struct _TPP_CALLER ReleaseCaller;
|
|
enum _TP_CALLBACK_PRIORITY CallbackPriority;
|
|
INT32 __PADDING__[1];
|
|
} TPP_CLEANUP_GROUP_MEMBER, * PTPP_CLEANUP_GROUP_MEMBER;
|
|
|
|
typedef struct _FULL_TP_WORK
|
|
{
|
|
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
|
|
struct _TP_TASK Task;
|
|
volatile union _TPP_WORK_STATE WorkState;
|
|
INT32 __PADDING__[1];
|
|
} FULL_TP_WORK, * PFULL_TP_WORK;
|
|
|
|
typedef struct _FULL_TP_TIMER
|
|
{
|
|
struct _FULL_TP_WORK Work;
|
|
struct _RTL_SRWLOCK Lock;
|
|
union
|
|
{
|
|
struct _TPP_PH_LINKS WindowEndLinks;
|
|
struct _LIST_ENTRY ExpirationLinks;
|
|
};
|
|
struct _TPP_PH_LINKS WindowStartLinks;
|
|
INT64 DueTime;
|
|
struct _TPP_ITE Ite;
|
|
UINT32 Window;
|
|
UINT32 Period;
|
|
UINT8 Inserted;
|
|
UINT8 WaitTimer;
|
|
union
|
|
{
|
|
UINT8 TimerStatus;
|
|
UINT8 InQueue : 1;
|
|
UINT8 Absolute : 1;
|
|
UINT8 Cancelled : 1;
|
|
};
|
|
UINT8 BlockInsert;
|
|
INT32 __PADDING__[1];
|
|
} FULL_TP_TIMER, * PFULL_TP_TIMER;
|
|
|
|
typedef struct _FULL_TP_WAIT
|
|
{
|
|
struct _FULL_TP_TIMER Timer;
|
|
void* Handle;
|
|
void* WaitPkt;
|
|
void* NextWaitHandle;
|
|
union _LARGE_INTEGER NextWaitTimeout;
|
|
struct _TP_DIRECT Direct;
|
|
union
|
|
{
|
|
union
|
|
{
|
|
UINT8 AllFlags;
|
|
UINT8 NextWaitActive : 1;
|
|
UINT8 NextTimeoutActive : 1;
|
|
UINT8 CallbackCounted : 1;
|
|
UINT8 Spare : 5;
|
|
};
|
|
} WaitFlags;
|
|
char __PADDING__[7];
|
|
} FULL_TP_WAIT, * PFULL_TP_WAIT;
|
|
|
|
typedef struct _FULL_TP_IO
|
|
{
|
|
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
|
|
struct _TP_DIRECT Direct;
|
|
void* File;
|
|
volatile INT32 PendingIrpCount;
|
|
INT32 __PADDING__[1];
|
|
} FULL_TP_IO, * PFULL_TP_IO;
|
|
|
|
typedef struct _FULL_TP_ALPC
|
|
{
|
|
struct _TP_DIRECT Direct;
|
|
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
|
|
void* AlpcPort;
|
|
INT32 DeferredSendCount;
|
|
INT32 LastConcurrencyCount;
|
|
union
|
|
{
|
|
UINT32 Flags;
|
|
UINT32 ExTypeCallback : 1;
|
|
UINT32 CompletionListRegistered : 1;
|
|
UINT32 Reserved : 30;
|
|
};
|
|
INT32 __PADDING__[1];
|
|
} FULL_TP_ALPC, * PFULL_TP_ALPC;
|
|
|
|
typedef struct _FULL_TP_JOB
|
|
{
|
|
struct _TP_DIRECT Direct;
|
|
struct _TPP_CLEANUP_GROUP_MEMBER CleanupGroupMember;
|
|
void* JobHandle;
|
|
union
|
|
{
|
|
volatile int64_t CompletionState;
|
|
int64_t Rundown : 1;
|
|
int64_t CompletionCount : 63;
|
|
};
|
|
struct _RTL_SRWLOCK RundownLock;
|
|
} FULL_TP_JOB, * PFULL_TP_JOB;
|
|
|
|
typedef VOID(NTAPI* PTP_ALPC_CALLBACK)(
|
|
_Inout_ PTP_CALLBACK_INSTANCE Instance,
|
|
_Inout_opt_ PVOID Context,
|
|
_In_ PFULL_TP_ALPC Alpc
|
|
);
|
|
|
|
// -------------------------------------//
|
|
// NTDLL Internal functions definitions //
|
|
// -------------------------------------//
|
|
|
|
EXTERN_C
|
|
NTSTATUS NTAPI TpAllocAlpcCompletion(
|
|
_Out_ PFULL_TP_ALPC* AlpcReturn,
|
|
_In_ HANDLE AlpcPort,
|
|
_In_ PTP_ALPC_CALLBACK Callback,
|
|
_Inout_opt_ PVOID Context,
|
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
|
);
|
|
|
|
EXTERN_C
|
|
NTSTATUS NTAPI TpAllocJobNotification(
|
|
_Out_ PFULL_TP_JOB* JobReturn,
|
|
_In_ HANDLE HJob,
|
|
_In_ PVOID Callback,
|
|
_Inout_opt_ PVOID Context,
|
|
_In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron
|
|
);
|
|
|
|
// ------------//
|
|
// Proto types //
|
|
// ------------//
|
|
|
|
PFULL_TP_WORK w_CreateThreadpoolWork(PTP_WORK_CALLBACK pWorkCallback, PVOID pWorkContext, PTP_CALLBACK_ENVIRON pCallbackEnviron);
|
|
|
|
PFULL_TP_WAIT w_CreateThreadpoolWait(PTP_WAIT_CALLBACK pWaitCallback, PVOID pWaitContext, PTP_CALLBACK_ENVIRON pCallbackEnviron);
|
|
|
|
PFULL_TP_IO w_CreateThreadpoolIo(HANDLE hFile, PTP_WIN32_IO_CALLBACK pCallback, PVOID pContext, PTP_CALLBACK_ENVIRON pCallbackEnviron);
|
|
|
|
PFULL_TP_ALPC w_TpAllocAlpcCompletion(HANDLE hAlpc, PTP_ALPC_CALLBACK pCallback, PVOID pContext, PTP_CALLBACK_ENVIRON pCallbackEnviron);
|
|
|
|
PFULL_TP_JOB w_TpAllocJobNotification(HANDLE hJob, PVOID pCallback, PVOID pContext, PTP_CALLBACK_ENVIRON pCallbackEnviron);
|
|
|
|
PFULL_TP_TIMER w_CreateThreadpoolTimer(PTP_TIMER_CALLBACK pTimerCallback, PVOID pTimerContext, PTP_CALLBACK_ENVIRON pCallbackEnviron); |