mirror of
https://github.com/eversinc33/Banshee
synced 2026-06-08 14:08:04 +00:00
eversinc33
316 lines
10 KiB
C++
316 lines
10 KiB
C++
#pragma once
|
|
|
|
#include <ntifs.h>
|
|
#include <wdf.h>
|
|
|
|
#define ASM_CALL_NEAR 0xE8
|
|
#define ASM_JMP_NEAR 0xE9
|
|
#define ASM_LEA_R13_BYTE1 0x4C
|
|
#define ASM_LEA_R13_BYTE2 0x8D
|
|
#define ASM_LEA_RCX_BYTE1 0x48
|
|
#define ASM_LEA_RCX_BYTE2 0x8D
|
|
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0
|
|
#define IMAGE_NT_SIGNATURE 0x00004550
|
|
#define MAX_PATH 256
|
|
|
|
typedef UCHAR BYTE;
|
|
typedef USHORT WORD;
|
|
typedef ULONG DWORD;
|
|
|
|
enum CALLBACK_TYPE {
|
|
CallbackTypeNone = 0,
|
|
CreateProcessNotifyRoutine = 1,
|
|
CreateThreadNotifyRoutine = 2
|
|
};
|
|
|
|
// --------------------------------------------------------------------------------------------------------
|
|
|
|
typedef struct _NON_PAGED_DEBUG_INFO
|
|
{
|
|
USHORT Signature; //0x0
|
|
USHORT Flags; //0x2
|
|
ULONG Size; //0x4
|
|
USHORT Machine; //0x8
|
|
USHORT Characteristics; //0xa
|
|
ULONG TimeDateStamp; //0xc
|
|
ULONG CheckSum; //0x10
|
|
ULONG SizeOfImage; //0x14
|
|
ULONGLONG ImageBase; //0x18
|
|
} NON_PAGED_DEBUG_INFO;
|
|
|
|
typedef struct _KLDR_DATA_TABLE_ENTRY
|
|
{
|
|
LIST_ENTRY InLoadOrderLinks;
|
|
PVOID ExceptionTable;
|
|
UINT32 ExceptionTableSize;
|
|
PVOID GpValue;
|
|
NON_PAGED_DEBUG_INFO* NonPagedDebugInfo;
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
UINT32 SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
UINT32 Flags;
|
|
UINT16 LoadCount;
|
|
UINT16 SignatureInfo;
|
|
PVOID SectionPointer;
|
|
UINT32 CheckSum;
|
|
UINT32 CoverageSectionSize;
|
|
PVOID CoverageSection;
|
|
PVOID LoadedImports;
|
|
PVOID Spare;
|
|
UINT32 SizeOfImageNotRounded;
|
|
UINT32 TimeDateStamp;
|
|
} KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;
|
|
|
|
// Windows versions
|
|
#define WIN_1507 10240
|
|
#define WIN_1511 10586
|
|
#define WIN_1607 14393
|
|
#define WIN_1703 15063
|
|
#define WIN_1709 16299
|
|
#define WIN_1803 17134
|
|
#define WIN_1809 17763
|
|
#define WIN_1903 18362
|
|
#define WIN_1909 18363
|
|
#define WIN_2004 19041
|
|
#define WIN_20H2 19042
|
|
#define WIN_21H1 19043
|
|
#define WIN_21H2 19044
|
|
#define WIN_22H2 19045
|
|
#define WIN_1121H2 22000
|
|
#define WIN_1122H2 22621
|
|
|
|
// Protection Levels - Windows Internals Part 1 - Page 115 (7th english edition)
|
|
#define PS_PROTECTED_SYSTEM 0x72; // Geschützt WinSystem
|
|
#define PS_PROTECTED_WULONGCB 0x62; // Geschützt WinTcb
|
|
#define PS_PROTECTED_WULONGCB_LIGHT 0x61; // PPL WinTcb
|
|
#define PS_PROTECTED_WINDOWS 0x52; // Geschützt Windows
|
|
#define PS_PROTECTED_WINDOWS_LIGHT 0x51; // PPL Windows
|
|
#define PS_PROTECTED_LSA_LIGHT 0x41; // PPL Lsa
|
|
#define PS_PROTECTED_ANTIMALWARE_LIGHT 0x31; // PPL Anti - malware
|
|
#define PS_PROTECTED_AUTHENTICODE 0x21; // Geschützt Authenticode
|
|
#define PS_PROTECTED_AUTHENTICODE_LIGHT 0x11; // PPL Authenticode
|
|
#define PS_PROTECTED_NONE 0x00; // Keine Keine
|
|
|
|
// reactos kernel callback structs
|
|
|
|
typedef struct _EX_CALLBACK_ROUTINE_BLOCK
|
|
{
|
|
EX_RUNDOWN_REF RundownProtect;
|
|
PEX_CALLBACK_FUNCTION Function;
|
|
PVOID Context;
|
|
} EX_CALLBACK_ROUTINE_BLOCK, * PEX_CALLBACK_ROUTINE_BLOCK;
|
|
|
|
// PE headers
|
|
|
|
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
|
|
WORD e_magic; // Magic number
|
|
WORD e_cblp; // Bytes on last page of file
|
|
WORD e_cp; // Pages file
|
|
WORD e_crlc; // Relocations
|
|
WORD e_cparhdr; // Size of header paragraphs
|
|
WORD e_minalloc; // Minimum extra paragraphs needed
|
|
WORD e_maxalloc; // Maximum extra paragraphs needed
|
|
WORD e_ss; // Initial (relative) SS value
|
|
WORD e_sp; // Initial SP value
|
|
WORD e_csum; // Checksum
|
|
WORD e_ip; // Initial IP value
|
|
WORD e_cs; // Initial (relative) CS value
|
|
WORD e_lfarlc; // File address of relocation table
|
|
WORD e_ovno; // Overlay number
|
|
WORD e_res[4]; // Reserved words
|
|
WORD e_oemid; // OEM identifier (for e_oeminfo)
|
|
WORD e_oeminfo; // OEM information; e_oemid specific
|
|
WORD e_res2[10]; // Reserved words
|
|
LONG e_lfanew; // File address of new exe header
|
|
} IMAGE_DOS_HEADER, * PIMAGE_DOS_HEADER;
|
|
|
|
typedef struct _IMAGE_FILE_HEADER {
|
|
WORD Machine;
|
|
WORD NumberOfSections;
|
|
DWORD TimeDateStamp;
|
|
DWORD PointerToSymbolTable;
|
|
DWORD NumberOfSymbols;
|
|
WORD SizeOfOptionalHeader;
|
|
WORD Characteristics;
|
|
} IMAGE_FILE_HEADER, * PIMAGE_FILE_HEADER;
|
|
|
|
typedef struct _IMAGE_DATA_DIRECTORY {
|
|
ULONG VirtualAddress;
|
|
ULONG Size;
|
|
} IMAGE_DATA_DIRECTORY, * PIMAGE_DATA_DIRECTORY;
|
|
|
|
typedef struct _IMAGE_EXPORT_DIRECTORY {
|
|
DWORD Characteristics;
|
|
DWORD TimeDateStamp;
|
|
WORD MajorVersion;
|
|
WORD MinorVersion;
|
|
DWORD Name;
|
|
DWORD Base;
|
|
DWORD NumberOfFunctions;
|
|
DWORD NumberOfNames;
|
|
DWORD AddressOfFunctions; // RVA from base of image
|
|
DWORD AddressOfNames; // RVA from base of image
|
|
DWORD AddressOfNameOrdinals; // RVA from base of image
|
|
} IMAGE_EXPORT_DIRECTORY, * PIMAGE_EXPORT_DIRECTORY;
|
|
|
|
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
|
|
|
|
typedef struct _IMAGE_OPTIONAL_HEADER {
|
|
WORD Magic;
|
|
BYTE MajorLinkerVersion;
|
|
BYTE MinorLinkerVersion;
|
|
DWORD SizeOfCode;
|
|
DWORD SizeOfInitializedData;
|
|
DWORD SizeOfUninitializedData;
|
|
DWORD AddressOfEntryPoint;
|
|
DWORD BaseOfCode;
|
|
ULONGLONG ImageBase;
|
|
DWORD SectionAlignment;
|
|
DWORD FileAlignment;
|
|
WORD MajorOperatingSystemVersion;
|
|
WORD MinorOperatingSystemVersion;
|
|
WORD MajorImageVersion;
|
|
WORD MinorImageVersion;
|
|
WORD MajorSubsystemVersion;
|
|
WORD MinorSubsystemVersion;
|
|
DWORD Win32VersionValue;
|
|
DWORD SizeOfImage;
|
|
DWORD SizeOfHeaders;
|
|
DWORD CheckSum;
|
|
WORD Subsystem;
|
|
WORD DllCharacteristics;
|
|
ULONGLONG SizeOfStackReserve;
|
|
ULONGLONG SizeOfStackCommit;
|
|
ULONGLONG SizeOfHeapReserve;
|
|
ULONGLONG SizeOfHeapCommit;
|
|
DWORD LoaderFlags;
|
|
DWORD NumberOfRvaAndSizes;
|
|
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
|
} IMAGE_OPTIONAL_HEADER, * PIMAGE_OPTIONAL_HEADER;
|
|
|
|
typedef struct _FULL_IMAGE_NT_HEADERS {
|
|
DWORD Signature;
|
|
IMAGE_FILE_HEADER FileHeader;
|
|
IMAGE_OPTIONAL_HEADER OptionalHeader;
|
|
} FULL_IMAGE_NT_HEADERS, * PFULL_IMAGE_NT_HEADERS;
|
|
|
|
typedef struct _IMAGE_SECTION_HEADER
|
|
{
|
|
UCHAR Name[8];
|
|
union
|
|
{
|
|
ULONG PhysicalAddress;
|
|
ULONG VirtualSize;
|
|
} Misc;
|
|
ULONG VirtualAddress;
|
|
ULONG SizeOfRawData;
|
|
ULONG PointerToRawData;
|
|
ULONG PointerToRelocations;
|
|
ULONG PointerToLinenumbers;
|
|
USHORT NumberOfRelocations;
|
|
USHORT NumberOfLinenumbers;
|
|
ULONG Characteristics;
|
|
} IMAGE_SECTION_HEADER, * PIMAGE_SECTION_HEADER;
|
|
|
|
typedef enum _SYSTEM_INFORMATION_CLASS {
|
|
SystemBasicInformation = 0,
|
|
SystemPerformanceInformation = 2,
|
|
SystemTimeOfDayInformation = 3,
|
|
SystemProcessInformation = 5,
|
|
SystemProcessorPerformanceInformation = 8,
|
|
SystemInterruptInformation = 23,
|
|
SystemExceptionInformation = 33,
|
|
SystemRegistryQuotaInformation = 37,
|
|
SystemLookasideInformation = 45,
|
|
SystemCodeIntegrityInformation = 103,
|
|
SystemPolicyInformation = 134,
|
|
} SYSTEM_INFORMATION_CLASS;
|
|
|
|
// TODO: is this portable?
|
|
typedef struct _SYSTEM_PROCESS_INFORMATION {
|
|
ULONG NextEntryOffset;
|
|
ULONG NumberOfThreads;
|
|
LARGE_INTEGER Reserved[3];
|
|
LARGE_INTEGER CreateTime;
|
|
LARGE_INTEGER UserTime;
|
|
LARGE_INTEGER KernelTime;
|
|
UNICODE_STRING ImageName;
|
|
ULONG BasePriority;
|
|
HANDLE ProcessId;
|
|
HANDLE InheritedFromProcessId;
|
|
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;
|
|
|
|
typedef struct _PS_ATTRIBUTE {
|
|
ULONG Attribute;
|
|
SIZE_T Size;
|
|
union
|
|
{
|
|
ULONG Value;
|
|
PVOID ValuePtr;
|
|
};
|
|
PSIZE_T ReturnLength;
|
|
} PS_ATTRIBUTE, * PPS_ATTRIBUTE;
|
|
|
|
typedef struct _PS_ATTRIBUTE_LIST {
|
|
SIZE_T TotalLength;
|
|
PS_ATTRIBUTE Attributes[1];
|
|
} PS_ATTRIBUTE_LIST, * PPS_ATTRIBUTE_LIST;
|
|
|
|
typedef NTSTATUS(NTAPI* FnZwCreateThreadEx)(
|
|
PHANDLE ThreadHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
HANDLE ProcessHandle,
|
|
PVOID StartRoutine,
|
|
PVOID Argument,
|
|
SIZE_T CreateFlags,
|
|
SIZE_T ZeroBits,
|
|
SIZE_T StackSize,
|
|
SIZE_T MaximumStackSize,
|
|
PPS_ATTRIBUTE_LIST AttributeList
|
|
);
|
|
|
|
typedef struct _IMAGE_OPTIONAL_HEADER64 {
|
|
USHORT Magic;
|
|
UCHAR MajorLinkerVersion;
|
|
UCHAR MinorLinkerVersion;
|
|
ULONG SizeOfCode;
|
|
ULONG SizeOfInitializedData;
|
|
ULONG SizeOfUninitializedData;
|
|
ULONG AddressOfEntryPoint;
|
|
ULONG BaseOfCode;
|
|
ULONGLONG ImageBase;
|
|
ULONG SectionAlignment;
|
|
ULONG FileAlignment;
|
|
USHORT MajorOperatingSystemVersion;
|
|
USHORT MinorOperatingSystemVersion;
|
|
USHORT MajorImageVersion;
|
|
USHORT MinorImageVersion;
|
|
USHORT MajorSubsystemVersion;
|
|
USHORT MinorSubsystemVersion;
|
|
ULONG Win32VersionValue;
|
|
ULONG SizeOfImage;
|
|
ULONG SizeOfHeaders;
|
|
ULONG CheckSum;
|
|
USHORT Subsystem;
|
|
USHORT DllCharacteristics;
|
|
ULONGLONG SizeOfStackReserve;
|
|
ULONGLONG SizeOfStackCommit;
|
|
ULONGLONG SizeOfHeapReserve;
|
|
ULONGLONG SizeOfHeapCommit;
|
|
ULONG LoaderFlags;
|
|
ULONG NumberOfRvaAndSizes;
|
|
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
|
} IMAGE_OPTIONAL_HEADER64, * PIMAGE_OPTIONAL_HEADER64;
|
|
|
|
typedef struct _IMAGE_NT_HEADERS64 {
|
|
DWORD Signature;
|
|
IMAGE_FILE_HEADER FileHeader;
|
|
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
|
} IMAGE_NT_HEADERS64, * PIMAGE_NT_HEADERS64;
|
|
|
|
EXTERN_C POBJECT_TYPE* IoDriverObjectType;
|
|
EXTERN_C PLIST_ENTRY PsLoadedModuleList;
|
|
EXTERN_C PERESOURCE PsLoadedModuleResource; |