#pragma once

#include <stdint.h>
#include <wchar.h>

constexpr uint32_t kCallstackProtocolMagic = 0x4353414B;
constexpr uint32_t kCallstackProtocolVersion = 11;

constexpr uint32_t kMonitorMaxFrames = 64;
constexpr uint32_t kMonitorMaxWatchedDlls = 64;
constexpr uint32_t kMonitorPipeNameChars = 256;
constexpr uint32_t kMonitorPathChars = 260;
constexpr uint32_t kMonitorEventNameChars = 64;
constexpr uint32_t kMonitorTargetNameChars = 260;
constexpr uint32_t kMonitorWatchedDllNameChars = 64;
constexpr uint32_t kMonitorFrameContextBytes = 64;
constexpr uint32_t kMonitorMaxOriginRecords = 16;

constexpr uint32_t kMonitorEventDllLoad = 1;
constexpr uint32_t kMonitorEventSleepWait = 2;
constexpr uint32_t kMonitorEventCallback = 3;
constexpr uint32_t kMonitorEventMemoryApi = 4;
constexpr uint32_t kMonitorEventUnwindTable = 5;
constexpr uint32_t kMonitorEventRemoteFollow = 6;
constexpr uint32_t kMonitorEventNetReset = 7;
constexpr uint32_t kMonitorEventLdrIntegrity = 8;
constexpr uint32_t kMonitorEventNetworkApi = 9;

constexpr uint32_t kMonitorEventFlagTimeoutInfinite = 0x00000001;
constexpr uint32_t kMonitorEventFlagLdrEntryPointOutsideImage = 0x00000002;
constexpr uint32_t kMonitorEventFlagLdrEntryPointNotImage = 0x00000004;
constexpr uint32_t kMonitorEventFlagLdrOriginalBaseSuspicious = 0x00000008;
constexpr uint32_t kMonitorEventFlagLdrEntryPointMismatch = 0x00000010;

constexpr uint32_t kMonitorHookSleep = 0x00000001;
constexpr uint32_t kMonitorHookMsgWait = 0x00000002;
constexpr uint32_t kMonitorHookWaitObjects = 0x00000004;
constexpr uint32_t kMonitorHookThreadStarts = 0x00000008;
constexpr uint32_t kMonitorHookThreadPool = 0x00000010;
constexpr uint32_t kMonitorHookMemoryApis = 0x00000020;
constexpr uint32_t kMonitorHookUnwindTables = 0x00000040;
constexpr uint32_t kMonitorHookOriginTrace = 0x00000080;
constexpr uint32_t kMonitorHookRegisterTrace = 0x00000100;
constexpr uint32_t kMonitorHookFollowRemote = 0x00000200;
constexpr uint32_t kMonitorHookNetReset = 0x00000400;
constexpr uint32_t kMonitorHookLdrIntegrity = 0x00000800;
constexpr uint32_t kMonitorHookDispatchTrace = 0x00001000;
constexpr uint32_t kMonitorHookThreadpoolChainTrace = 0x00002000;
constexpr uint32_t kMonitorHookByoudTrace = 0x00004000;
constexpr uint32_t kMonitorHookTemporalImageTrace = 0x00008000;
constexpr uint32_t kMonitorHookShadowStack = 0x00010000;
constexpr uint32_t kMonitorHookNetworkUseTrace = 0x00020000;

constexpr uint32_t kMonitorOriginNone = 0;
constexpr uint32_t kMonitorOriginLoaderApiPointer = 1;
constexpr uint32_t kMonitorOriginDllStringPointer = 2;
constexpr uint32_t kMonitorOriginGadgetPointer = 3;
constexpr uint32_t kMonitorOriginProxyTransfer = 4;
constexpr uint32_t kMonitorOriginShadowStackFrame = 5;

constexpr uint32_t kMonitorOriginFlagDispatchWaitObserved = 0x00000001;

constexpr uint32_t kMonitorRegNone = 0;
constexpr uint32_t kMonitorRegRax = 1;
constexpr uint32_t kMonitorRegRbx = 2;
constexpr uint32_t kMonitorRegRcx = 3;
constexpr uint32_t kMonitorRegRdx = 4;
constexpr uint32_t kMonitorRegRsi = 5;
constexpr uint32_t kMonitorRegRdi = 6;
constexpr uint32_t kMonitorRegRbp = 7;
constexpr uint32_t kMonitorRegRsp = 8;
constexpr uint32_t kMonitorRegR8 = 9;
constexpr uint32_t kMonitorRegR9 = 10;
constexpr uint32_t kMonitorRegR10 = 11;
constexpr uint32_t kMonitorRegR11 = 12;
constexpr uint32_t kMonitorRegR12 = 13;
constexpr uint32_t kMonitorRegR13 = 14;
constexpr uint32_t kMonitorRegR14 = 15;
constexpr uint32_t kMonitorRegR15 = 16;
constexpr uint32_t kMonitorRegRip = 17;

constexpr uint32_t kMonitorInitOk = 0;
constexpr uint32_t kMonitorInitBadConfig = 1;
constexpr uint32_t kMonitorInitPipeFailed = 2;
constexpr uint32_t kMonitorInitMinHookFailed = 3;
constexpr uint32_t kMonitorInitTargetMissing = 4;

#pragma pack(push, 8)
struct MonitorConfig {
    uint32_t magic;
    uint32_t version;
    wchar_t pipe_name[kMonitorPipeNameChars];
    uint32_t max_frames;
    uint32_t watched_dll_count;
    uint32_t long_sleep_ms;
    uint32_t hook_flags;
    wchar_t monitor_path[kMonitorPathChars];
    wchar_t watched_dlls[kMonitorMaxWatchedDlls][kMonitorWatchedDllNameChars];
};

struct MonitorRegisterSnapshot {
    uint64_t rip;
    uint64_t rsp;
    uint64_t rax;
    uint64_t rbx;
    uint64_t rcx;
    uint64_t rdx;
    uint64_t rsi;
    uint64_t rdi;
    uint64_t rbp;
    uint64_t r8;
    uint64_t r9;
    uint64_t r10;
    uint64_t r11;
    uint64_t r12;
    uint64_t r13;
    uint64_t r14;
    uint64_t r15;
};

struct MonitorOriginRecord {
    uint32_t kind;
    uint32_t reg;
    uint64_t writer_rip;
    uint64_t value;
    uint64_t target_rip;
    uint64_t tick_ms;
    uint32_t source_tid;
    uint32_t target_tid;
    uint32_t message;
    uint32_t origin_flags;
    uint64_t dispatch_wparam;
    uint64_t dispatch_lparam;
    wchar_t name[kMonitorEventNameChars];
    wchar_t value_name[kMonitorTargetNameChars];
};

struct MonitorEvent {
    uint32_t magic;
    uint32_t version;
    uint32_t size;
    uint32_t pid;
    uint32_t tid;
    int32_t status;
    uint32_t frame_count;
    uint32_t event_type;
    uint32_t event_flags;
    uint64_t event_value;
    uint64_t callback_address;
    wchar_t event_name[kMonitorEventNameChars];
    wchar_t target_name[kMonitorTargetNameChars];
    uint64_t frames[kMonitorMaxFrames];
    uint64_t frame_region_base[kMonitorMaxFrames];
    uint64_t frame_region_size[kMonitorMaxFrames];
    uint64_t frame_allocation_base[kMonitorMaxFrames];
    uint64_t frame_allocation_size[kMonitorMaxFrames];
    uint64_t frame_module_base[kMonitorMaxFrames];
    uint32_t frame_state[kMonitorMaxFrames];
    uint32_t frame_protect[kMonitorMaxFrames];
    uint32_t frame_allocation_protect[kMonitorMaxFrames];
    uint32_t frame_type[kMonitorMaxFrames];
    wchar_t frame_module_name[kMonitorMaxFrames][kMonitorEventNameChars];
    uint8_t frame_context_size[kMonitorMaxFrames];
    uint8_t frame_context[kMonitorMaxFrames][kMonitorFrameContextBytes];
    uint64_t event_value_module_size;
    wchar_t event_value_module_path[kMonitorPathChars];
    MonitorRegisterSnapshot registers;
    uint32_t origin_record_count;
    uint32_t reserved0;
    MonitorOriginRecord origin_records[kMonitorMaxOriginRecords];
    uint64_t ldr_table_entry;
    uint64_t ldr_dll_base;
    uint64_t ldr_size_of_image;
    uint64_t ldr_entrypoint;
    uint64_t ldr_expected_entrypoint;
    uint64_t ldr_original_base;
    uint64_t ldr_entrypoint_region_base;
    uint64_t ldr_entrypoint_region_size;
    uint32_t ldr_entrypoint_protect;
    uint32_t ldr_entrypoint_type;
    uint64_t ldr_original_base_region_base;
    uint64_t ldr_original_base_region_size;
    uint32_t ldr_original_base_protect;
    uint32_t ldr_original_base_type;
};
#pragma pack(pop)