#pragma once #include #include #define ASM_CALL_NEAR 0xE8 #define ASM_JMP_NEAR 0xE9 #define ASM_LEA_R13_BYTE1 0x4C #define ASM_LEA_R13_BYTE2 0x8D #define ASM_LEA_RCX_BYTE1 0x48 #define ASM_LEA_RCX_BYTE2 0x8D #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 #define IMAGE_NT_SIGNATURE 0x00004550 #define MAX_PATH 256 typedef UCHAR BYTE; typedef USHORT WORD; typedef ULONG DWORD; enum CALLBACK_TYPE { CallbackTypeNone = 0, CreateProcessNotifyRoutine = 1, CreateThreadNotifyRoutine = 2 }; // -------------------------------------------------------------------------------------------------------- typedef struct _NON_PAGED_DEBUG_INFO { USHORT Signature; //0x0 USHORT Flags; //0x2 ULONG Size; //0x4 USHORT Machine; //0x8 USHORT Characteristics; //0xa ULONG TimeDateStamp; //0xc ULONG CheckSum; //0x10 ULONG SizeOfImage; //0x14 ULONGLONG ImageBase; //0x18 } NON_PAGED_DEBUG_INFO; typedef struct _KLDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; PVOID ExceptionTable; UINT32 ExceptionTableSize; PVOID GpValue; NON_PAGED_DEBUG_INFO* NonPagedDebugInfo; PVOID DllBase; PVOID EntryPoint; UINT32 SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; UINT32 Flags; UINT16 LoadCount; UINT16 SignatureInfo; PVOID SectionPointer; UINT32 CheckSum; UINT32 CoverageSectionSize; PVOID CoverageSection; PVOID LoadedImports; PVOID Spare; UINT32 SizeOfImageNotRounded; UINT32 TimeDateStamp; } KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY; // Windows versions #define WIN_1507 10240 #define WIN_1511 10586 #define WIN_1607 14393 #define WIN_1703 15063 #define WIN_1709 16299 #define WIN_1803 17134 #define WIN_1809 17763 #define WIN_1903 18362 #define WIN_1909 18363 #define WIN_2004 19041 #define WIN_20H2 19042 #define WIN_21H1 19043 #define WIN_21H2 19044 #define WIN_22H2 19045 #define WIN_1121H2 22000 #define WIN_1122H2 22621 // Protection Levels - Windows Internals Part 1 - Page 115 (7th english edition) #define PS_PROTECTED_SYSTEM 0x72; // Geschützt WinSystem #define PS_PROTECTED_WULONGCB 0x62; // Geschützt WinTcb #define PS_PROTECTED_WULONGCB_LIGHT 0x61; // PPL WinTcb #define PS_PROTECTED_WINDOWS 0x52; // Geschützt Windows #define PS_PROTECTED_WINDOWS_LIGHT 0x51; // PPL Windows #define PS_PROTECTED_LSA_LIGHT 0x41; // PPL Lsa #define PS_PROTECTED_ANTIMALWARE_LIGHT 0x31; // PPL Anti - malware #define PS_PROTECTED_AUTHENTICODE 0x21; // Geschützt Authenticode #define PS_PROTECTED_AUTHENTICODE_LIGHT 0x11; // PPL Authenticode #define PS_PROTECTED_NONE 0x00; // Keine Keine // reactos kernel callback structs typedef struct _EX_CALLBACK_ROUTINE_BLOCK { EX_RUNDOWN_REF RundownProtect; PEX_CALLBACK_FUNCTION Function; PVOID Context; } EX_CALLBACK_ROUTINE_BLOCK, * PEX_CALLBACK_ROUTINE_BLOCK; // PE headers typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header WORD e_magic; // Magic number WORD e_cblp; // Bytes on last page of file WORD e_cp; // Pages file WORD e_crlc; // Relocations WORD e_cparhdr; // Size of header paragraphs WORD e_minalloc; // Minimum extra paragraphs needed WORD e_maxalloc; // Maximum extra paragraphs needed WORD e_ss; // Initial (relative) SS value WORD e_sp; // Initial SP value WORD e_csum; // Checksum WORD e_ip; // Initial IP value WORD e_cs; // Initial (relative) CS value WORD e_lfarlc; // File address of relocation table WORD e_ovno; // Overlay number WORD e_res[4]; // Reserved words WORD e_oemid; // OEM identifier (for e_oeminfo) WORD e_oeminfo; // OEM information; e_oemid specific WORD e_res2[10]; // Reserved words LONG e_lfanew; // File address of new exe header } IMAGE_DOS_HEADER, * PIMAGE_DOS_HEADER; typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics; } IMAGE_FILE_HEADER, * PIMAGE_FILE_HEADER; typedef struct _IMAGE_DATA_DIRECTORY { ULONG VirtualAddress; ULONG Size; } IMAGE_DATA_DIRECTORY, * PIMAGE_DATA_DIRECTORY; typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; DWORD Base; DWORD NumberOfFunctions; DWORD NumberOfNames; DWORD AddressOfFunctions; // RVA from base of image DWORD AddressOfNames; // RVA from base of image DWORD AddressOfNameOrdinals; // RVA from base of image } IMAGE_EXPORT_DIRECTORY, * PIMAGE_EXPORT_DIRECTORY; #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; ULONGLONG ImageBase; DWORD SectionAlignment; DWORD FileAlignment; WORD MajorOperatingSystemVersion; WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; DWORD SizeOfHeaders; DWORD CheckSum; WORD Subsystem; WORD DllCharacteristics; ULONGLONG SizeOfStackReserve; ULONGLONG SizeOfStackCommit; ULONGLONG SizeOfHeapReserve; ULONGLONG SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER, * PIMAGE_OPTIONAL_HEADER; typedef struct _FULL_IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER OptionalHeader; } FULL_IMAGE_NT_HEADERS, * PFULL_IMAGE_NT_HEADERS; typedef struct _IMAGE_SECTION_HEADER { UCHAR Name[8]; union { ULONG PhysicalAddress; ULONG VirtualSize; } Misc; ULONG VirtualAddress; ULONG SizeOfRawData; ULONG PointerToRawData; ULONG PointerToRelocations; ULONG PointerToLinenumbers; USHORT NumberOfRelocations; USHORT NumberOfLinenumbers; ULONG Characteristics; } IMAGE_SECTION_HEADER, * PIMAGE_SECTION_HEADER; typedef enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation = 0, SystemPerformanceInformation = 2, SystemTimeOfDayInformation = 3, SystemProcessInformation = 5, SystemProcessorPerformanceInformation = 8, SystemInterruptInformation = 23, SystemExceptionInformation = 33, SystemRegistryQuotaInformation = 37, SystemLookasideInformation = 45, SystemCodeIntegrityInformation = 103, SystemPolicyInformation = 134, } SYSTEM_INFORMATION_CLASS; // TODO: is this portable? typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfThreads; LARGE_INTEGER Reserved[3]; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; ULONG BasePriority; HANDLE ProcessId; HANDLE InheritedFromProcessId; } SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION; typedef struct _PS_ATTRIBUTE { ULONG Attribute; SIZE_T Size; union { ULONG Value; PVOID ValuePtr; }; PSIZE_T ReturnLength; } PS_ATTRIBUTE, * PPS_ATTRIBUTE; typedef struct _PS_ATTRIBUTE_LIST { SIZE_T TotalLength; PS_ATTRIBUTE Attributes[1]; } PS_ATTRIBUTE_LIST, * PPS_ATTRIBUTE_LIST; typedef NTSTATUS(NTAPI* FnZwCreateThreadEx)( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ProcessHandle, PVOID StartRoutine, PVOID Argument, SIZE_T CreateFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, PPS_ATTRIBUTE_LIST AttributeList ); typedef struct _IMAGE_OPTIONAL_HEADER64 { USHORT Magic; UCHAR MajorLinkerVersion; UCHAR MinorLinkerVersion; ULONG SizeOfCode; ULONG SizeOfInitializedData; ULONG SizeOfUninitializedData; ULONG AddressOfEntryPoint; ULONG BaseOfCode; ULONGLONG ImageBase; ULONG SectionAlignment; ULONG FileAlignment; USHORT MajorOperatingSystemVersion; USHORT MinorOperatingSystemVersion; USHORT MajorImageVersion; USHORT MinorImageVersion; USHORT MajorSubsystemVersion; USHORT MinorSubsystemVersion; ULONG Win32VersionValue; ULONG SizeOfImage; ULONG SizeOfHeaders; ULONG CheckSum; USHORT Subsystem; USHORT DllCharacteristics; ULONGLONG SizeOfStackReserve; ULONGLONG SizeOfStackCommit; ULONGLONG SizeOfHeapReserve; ULONGLONG SizeOfHeapCommit; ULONG LoaderFlags; ULONG NumberOfRvaAndSizes; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } IMAGE_OPTIONAL_HEADER64, * PIMAGE_OPTIONAL_HEADER64; typedef struct _IMAGE_NT_HEADERS64 { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER64 OptionalHeader; } IMAGE_NT_HEADERS64, * PIMAGE_NT_HEADERS64; EXTERN_C POBJECT_TYPE* IoDriverObjectType; EXTERN_C PLIST_ENTRY PsLoadedModuleList; EXTERN_C PERESOURCE PsLoadedModuleResource;