mirror of
https://github.com/Vith0r/StackSentry
synced 2026-06-21 13:46:19 +00:00
Vith0r
187 lines
6.6 KiB
C++
187 lines
6.6 KiB
C++
#pragma once
|
|
|
|
#include <stdint.h>
|
|
#include <wchar.h>
|
|
|
|
constexpr uint32_t kCallstackProtocolMagic = 0x4353414B;
|
|
constexpr uint32_t kCallstackProtocolVersion = 11;
|
|
|
|
constexpr uint32_t kMonitorMaxFrames = 64;
|
|
constexpr uint32_t kMonitorMaxWatchedDlls = 64;
|
|
constexpr uint32_t kMonitorPipeNameChars = 256;
|
|
constexpr uint32_t kMonitorPathChars = 260;
|
|
constexpr uint32_t kMonitorEventNameChars = 64;
|
|
constexpr uint32_t kMonitorTargetNameChars = 260;
|
|
constexpr uint32_t kMonitorWatchedDllNameChars = 64;
|
|
constexpr uint32_t kMonitorFrameContextBytes = 64;
|
|
constexpr uint32_t kMonitorMaxOriginRecords = 16;
|
|
|
|
constexpr uint32_t kMonitorEventDllLoad = 1;
|
|
constexpr uint32_t kMonitorEventSleepWait = 2;
|
|
constexpr uint32_t kMonitorEventCallback = 3;
|
|
constexpr uint32_t kMonitorEventMemoryApi = 4;
|
|
constexpr uint32_t kMonitorEventUnwindTable = 5;
|
|
constexpr uint32_t kMonitorEventRemoteFollow = 6;
|
|
constexpr uint32_t kMonitorEventNetReset = 7;
|
|
constexpr uint32_t kMonitorEventLdrIntegrity = 8;
|
|
constexpr uint32_t kMonitorEventNetworkApi = 9;
|
|
|
|
constexpr uint32_t kMonitorEventFlagTimeoutInfinite = 0x00000001;
|
|
constexpr uint32_t kMonitorEventFlagLdrEntryPointOutsideImage = 0x00000002;
|
|
constexpr uint32_t kMonitorEventFlagLdrEntryPointNotImage = 0x00000004;
|
|
constexpr uint32_t kMonitorEventFlagLdrOriginalBaseSuspicious = 0x00000008;
|
|
constexpr uint32_t kMonitorEventFlagLdrEntryPointMismatch = 0x00000010;
|
|
|
|
constexpr uint32_t kMonitorHookSleep = 0x00000001;
|
|
constexpr uint32_t kMonitorHookMsgWait = 0x00000002;
|
|
constexpr uint32_t kMonitorHookWaitObjects = 0x00000004;
|
|
constexpr uint32_t kMonitorHookThreadStarts = 0x00000008;
|
|
constexpr uint32_t kMonitorHookThreadPool = 0x00000010;
|
|
constexpr uint32_t kMonitorHookMemoryApis = 0x00000020;
|
|
constexpr uint32_t kMonitorHookUnwindTables = 0x00000040;
|
|
constexpr uint32_t kMonitorHookOriginTrace = 0x00000080;
|
|
constexpr uint32_t kMonitorHookRegisterTrace = 0x00000100;
|
|
constexpr uint32_t kMonitorHookFollowRemote = 0x00000200;
|
|
constexpr uint32_t kMonitorHookNetReset = 0x00000400;
|
|
constexpr uint32_t kMonitorHookLdrIntegrity = 0x00000800;
|
|
constexpr uint32_t kMonitorHookDispatchTrace = 0x00001000;
|
|
constexpr uint32_t kMonitorHookThreadpoolChainTrace = 0x00002000;
|
|
constexpr uint32_t kMonitorHookByoudTrace = 0x00004000;
|
|
constexpr uint32_t kMonitorHookTemporalImageTrace = 0x00008000;
|
|
constexpr uint32_t kMonitorHookShadowStack = 0x00010000;
|
|
constexpr uint32_t kMonitorHookNetworkUseTrace = 0x00020000;
|
|
|
|
constexpr uint32_t kMonitorOriginNone = 0;
|
|
constexpr uint32_t kMonitorOriginLoaderApiPointer = 1;
|
|
constexpr uint32_t kMonitorOriginDllStringPointer = 2;
|
|
constexpr uint32_t kMonitorOriginGadgetPointer = 3;
|
|
constexpr uint32_t kMonitorOriginProxyTransfer = 4;
|
|
constexpr uint32_t kMonitorOriginShadowStackFrame = 5;
|
|
|
|
constexpr uint32_t kMonitorOriginFlagDispatchWaitObserved = 0x00000001;
|
|
|
|
constexpr uint32_t kMonitorRegNone = 0;
|
|
constexpr uint32_t kMonitorRegRax = 1;
|
|
constexpr uint32_t kMonitorRegRbx = 2;
|
|
constexpr uint32_t kMonitorRegRcx = 3;
|
|
constexpr uint32_t kMonitorRegRdx = 4;
|
|
constexpr uint32_t kMonitorRegRsi = 5;
|
|
constexpr uint32_t kMonitorRegRdi = 6;
|
|
constexpr uint32_t kMonitorRegRbp = 7;
|
|
constexpr uint32_t kMonitorRegRsp = 8;
|
|
constexpr uint32_t kMonitorRegR8 = 9;
|
|
constexpr uint32_t kMonitorRegR9 = 10;
|
|
constexpr uint32_t kMonitorRegR10 = 11;
|
|
constexpr uint32_t kMonitorRegR11 = 12;
|
|
constexpr uint32_t kMonitorRegR12 = 13;
|
|
constexpr uint32_t kMonitorRegR13 = 14;
|
|
constexpr uint32_t kMonitorRegR14 = 15;
|
|
constexpr uint32_t kMonitorRegR15 = 16;
|
|
constexpr uint32_t kMonitorRegRip = 17;
|
|
|
|
constexpr uint32_t kMonitorInitOk = 0;
|
|
constexpr uint32_t kMonitorInitBadConfig = 1;
|
|
constexpr uint32_t kMonitorInitPipeFailed = 2;
|
|
constexpr uint32_t kMonitorInitMinHookFailed = 3;
|
|
constexpr uint32_t kMonitorInitTargetMissing = 4;
|
|
|
|
#pragma pack(push, 8)
|
|
struct MonitorConfig {
|
|
uint32_t magic;
|
|
uint32_t version;
|
|
wchar_t pipe_name[kMonitorPipeNameChars];
|
|
uint32_t max_frames;
|
|
uint32_t watched_dll_count;
|
|
uint32_t long_sleep_ms;
|
|
uint32_t hook_flags;
|
|
wchar_t monitor_path[kMonitorPathChars];
|
|
wchar_t watched_dlls[kMonitorMaxWatchedDlls][kMonitorWatchedDllNameChars];
|
|
};
|
|
|
|
struct MonitorRegisterSnapshot {
|
|
uint64_t rip;
|
|
uint64_t rsp;
|
|
uint64_t rax;
|
|
uint64_t rbx;
|
|
uint64_t rcx;
|
|
uint64_t rdx;
|
|
uint64_t rsi;
|
|
uint64_t rdi;
|
|
uint64_t rbp;
|
|
uint64_t r8;
|
|
uint64_t r9;
|
|
uint64_t r10;
|
|
uint64_t r11;
|
|
uint64_t r12;
|
|
uint64_t r13;
|
|
uint64_t r14;
|
|
uint64_t r15;
|
|
};
|
|
|
|
struct MonitorOriginRecord {
|
|
uint32_t kind;
|
|
uint32_t reg;
|
|
uint64_t writer_rip;
|
|
uint64_t value;
|
|
uint64_t target_rip;
|
|
uint64_t tick_ms;
|
|
uint32_t source_tid;
|
|
uint32_t target_tid;
|
|
uint32_t message;
|
|
uint32_t origin_flags;
|
|
uint64_t dispatch_wparam;
|
|
uint64_t dispatch_lparam;
|
|
wchar_t name[kMonitorEventNameChars];
|
|
wchar_t value_name[kMonitorTargetNameChars];
|
|
};
|
|
|
|
struct MonitorEvent {
|
|
uint32_t magic;
|
|
uint32_t version;
|
|
uint32_t size;
|
|
uint32_t pid;
|
|
uint32_t tid;
|
|
int32_t status;
|
|
uint32_t frame_count;
|
|
uint32_t event_type;
|
|
uint32_t event_flags;
|
|
uint64_t event_value;
|
|
uint64_t callback_address;
|
|
wchar_t event_name[kMonitorEventNameChars];
|
|
wchar_t target_name[kMonitorTargetNameChars];
|
|
uint64_t frames[kMonitorMaxFrames];
|
|
uint64_t frame_region_base[kMonitorMaxFrames];
|
|
uint64_t frame_region_size[kMonitorMaxFrames];
|
|
uint64_t frame_allocation_base[kMonitorMaxFrames];
|
|
uint64_t frame_allocation_size[kMonitorMaxFrames];
|
|
uint64_t frame_module_base[kMonitorMaxFrames];
|
|
uint32_t frame_state[kMonitorMaxFrames];
|
|
uint32_t frame_protect[kMonitorMaxFrames];
|
|
uint32_t frame_allocation_protect[kMonitorMaxFrames];
|
|
uint32_t frame_type[kMonitorMaxFrames];
|
|
wchar_t frame_module_name[kMonitorMaxFrames][kMonitorEventNameChars];
|
|
uint8_t frame_context_size[kMonitorMaxFrames];
|
|
uint8_t frame_context[kMonitorMaxFrames][kMonitorFrameContextBytes];
|
|
uint64_t event_value_module_size;
|
|
wchar_t event_value_module_path[kMonitorPathChars];
|
|
MonitorRegisterSnapshot registers;
|
|
uint32_t origin_record_count;
|
|
uint32_t reserved0;
|
|
MonitorOriginRecord origin_records[kMonitorMaxOriginRecords];
|
|
uint64_t ldr_table_entry;
|
|
uint64_t ldr_dll_base;
|
|
uint64_t ldr_size_of_image;
|
|
uint64_t ldr_entrypoint;
|
|
uint64_t ldr_expected_entrypoint;
|
|
uint64_t ldr_original_base;
|
|
uint64_t ldr_entrypoint_region_base;
|
|
uint64_t ldr_entrypoint_region_size;
|
|
uint32_t ldr_entrypoint_protect;
|
|
uint32_t ldr_entrypoint_type;
|
|
uint64_t ldr_original_base_region_base;
|
|
uint64_t ldr_original_base_region_size;
|
|
uint32_t ldr_original_base_protect;
|
|
uint32_t ldr_original_base_type;
|
|
};
|
|
#pragma pack(pop)
|