mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Added some more ctypes defition
This commit is contained in:
hakril
@@ -0,0 +1,22 @@
|
||||
typedef struct IPersistVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
|
||||
__RPC__in IPersist * This,
|
||||
/* [in] */ __RPC__in REFIID riid,
|
||||
/* [annotation][iid_is][out] */
|
||||
__RPC__deref_out void **ppvObject);
|
||||
|
||||
ULONG ( STDMETHODCALLTYPE *AddRef )(
|
||||
__RPC__in IPersist * This);
|
||||
|
||||
ULONG ( STDMETHODCALLTYPE *Release )(
|
||||
__RPC__in IPersist * This);
|
||||
|
||||
HRESULT ( STDMETHODCALLTYPE *GetClassID )(
|
||||
__RPC__in IPersist * This,
|
||||
/* [out] */ __RPC__out CLSID *pClassID);
|
||||
|
||||
END_INTERFACE
|
||||
} IPersistVtbl;
|
||||
@@ -0,0 +1,114 @@
|
||||
//
|
||||
// Enable flags for Kernel Events on Win7 and above
|
||||
//
|
||||
#define EVENT_TRACE_FLAG_DISPATCHER 0x00000800 // scheduler (ReadyThread)
|
||||
#define EVENT_TRACE_FLAG_VIRTUAL_ALLOC 0x00004000 // VM operations
|
||||
|
||||
//
|
||||
// Enable flags for Kernel Events on Win8 and above
|
||||
//
|
||||
#define EVENT_TRACE_FLAG_VAMAP 0x00008000 // map/unmap (excluding images)
|
||||
#define EVENT_TRACE_FLAG_NO_SYSCONFIG 0x10000000 // Do not do sys config rundown
|
||||
|
||||
//
|
||||
// Pre-defined Enable flags for everybody else
|
||||
//
|
||||
#define EVENT_TRACE_FLAG_EXTENSION 0x80000000 // Indicates more flags
|
||||
#define EVENT_TRACE_FLAG_FORWARD_WMI 0x40000000 // Can forward to WMI
|
||||
#define EVENT_TRACE_FLAG_ENABLE_RESERVE 0x20000000 // Reserved
|
||||
|
||||
//
|
||||
// Logger Mode flags
|
||||
//
|
||||
#define EVENT_TRACE_FILE_MODE_NONE 0x00000000 // Logfile is off
|
||||
#define EVENT_TRACE_FILE_MODE_SEQUENTIAL 0x00000001 // Log sequentially
|
||||
#define EVENT_TRACE_FILE_MODE_CIRCULAR 0x00000002 // Log in circular manner
|
||||
#define EVENT_TRACE_FILE_MODE_APPEND 0x00000004 // Append sequential log
|
||||
|
||||
#define EVENT_TRACE_REAL_TIME_MODE 0x00000100 // Real time mode on
|
||||
#define EVENT_TRACE_DELAY_OPEN_FILE_MODE 0x00000200 // Delay opening file
|
||||
#define EVENT_TRACE_BUFFERING_MODE 0x00000400 // Buffering mode only
|
||||
#define EVENT_TRACE_PRIVATE_LOGGER_MODE 0x00000800 // Process Private Logger
|
||||
#define EVENT_TRACE_ADD_HEADER_MODE 0x00001000 // Add a logfile header
|
||||
|
||||
#define EVENT_TRACE_USE_GLOBAL_SEQUENCE 0x00004000 // Use global sequence no.
|
||||
#define EVENT_TRACE_USE_LOCAL_SEQUENCE 0x00008000 // Use local sequence no.
|
||||
|
||||
#define EVENT_TRACE_RELOG_MODE 0x00010000 // Relogger
|
||||
|
||||
#define EVENT_TRACE_USE_PAGED_MEMORY 0x01000000 // Use pageable buffers
|
||||
|
||||
//
|
||||
// Logger Mode flags on XP and above
|
||||
//
|
||||
|
||||
#define EVENT_TRACE_FILE_MODE_NEWFILE 0x00000008 // Auto-switch log file
|
||||
#define EVENT_TRACE_FILE_MODE_PREALLOCATE 0x00000020 // Pre-allocate mode
|
||||
|
||||
|
||||
//
|
||||
// ControlTrace Codes
|
||||
//
|
||||
|
||||
#define EVENT_TRACE_CONTROL_QUERY 0
|
||||
#define EVENT_TRACE_CONTROL_STOP 1
|
||||
#define EVENT_TRACE_CONTROL_UPDATE 2
|
||||
|
||||
//
|
||||
// Flush ControlTrace Codes for XP and above
|
||||
//
|
||||
|
||||
#define EVENT_TRACE_CONTROL_FLUSH 3 // Flushes all the buffers
|
||||
|
||||
|
||||
//
|
||||
// Consumer API
|
||||
//
|
||||
|
||||
#define PROCESS_TRACE_MODE_REAL_TIME 0x00000100
|
||||
#define PROCESS_TRACE_MODE_RAW_TIMESTAMP 0x00001000
|
||||
#define PROCESS_TRACE_MODE_EVENT_RECORD 0x10000000
|
||||
|
||||
|
||||
|
||||
#define EVENT_HEADER_PROPERTY_XML 0x0001
|
||||
#define EVENT_HEADER_PROPERTY_FORWARDED_XML 0x0002
|
||||
#define EVENT_HEADER_PROPERTY_LEGACY_EVENTLOG 0x0004
|
||||
|
||||
#define EVENT_HEADER_FLAG_EXTENDED_INFO 0x0001
|
||||
#define EVENT_HEADER_FLAG_PRIVATE_SESSION 0x0002
|
||||
#define EVENT_HEADER_FLAG_STRING_ONLY 0x0004
|
||||
#define EVENT_HEADER_FLAG_TRACE_MESSAGE 0x0008
|
||||
#define EVENT_HEADER_FLAG_NO_CPUTIME 0x0010
|
||||
#define EVENT_HEADER_FLAG_32_BIT_HEADER 0x0020
|
||||
#define EVENT_HEADER_FLAG_64_BIT_HEADER 0x0040
|
||||
#define EVENT_HEADER_FLAG_CLASSIC_HEADER 0x0100
|
||||
#define EVENT_HEADER_FLAG_PROCESSOR_INDEX 0x0200
|
||||
|
||||
|
||||
|
||||
// Event types for system configuration records
|
||||
//
|
||||
#define EVENT_TRACE_TYPE_CONFIG_CPU 0x0A // CPU Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK 0x0B // Physical Disk Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_LOGICALDISK 0x0C // Logical Disk Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_NIC 0x0D // NIC Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_VIDEO 0x0E // Video Adapter Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_SERVICES 0x0F // Active Services
|
||||
#define EVENT_TRACE_TYPE_CONFIG_POWER 0x10 // ACPI Configuration
|
||||
#define EVENT_TRACE_TYPE_CONFIG_NETINFO 0x11 // Networking Configuration
|
||||
|
||||
//
|
||||
// Enable flags for SystemControlGuid only
|
||||
//
|
||||
#define EVENT_TRACE_FLAG_PROCESS 0x00000001 // process start & end
|
||||
#define EVENT_TRACE_FLAG_THREAD 0x00000002 // thread start & end
|
||||
#define EVENT_TRACE_FLAG_IMAGE_LOAD 0x00000004 // image load
|
||||
#define EVENT_TRACE_FLAG_DISK_IO 0x00000100 // physical disk IO
|
||||
#define EVENT_TRACE_FLAG_DISK_FILE_IO 0x00000200 // requires disk IO
|
||||
#define EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS 0x00001000 // all page faults
|
||||
#define EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS 0x00002000 // hard faults only
|
||||
#define EVENT_TRACE_FLAG_NETWORK_TCPIP 0x00010000 // tcpip send & receive
|
||||
#define EVENT_TRACE_FLAG_REGISTRY 0x00020000 // registry calls
|
||||
#define EVENT_TRACE_FLAG_DBGPRINT 0x00040000 // DbgPrint(ex) Calls
|
||||
#define EVENT_TRACE_FLAG_VOLMGR 0x00200000 // volume manager traces
|
||||
@@ -0,0 +1,176 @@
|
||||
#define ATM_E164 0x01 /* E.164 addressing scheme */
|
||||
#define ATM_NSAP 0x02 /* NSAP-style ATM Endsystem Address scheme */
|
||||
#define ATM_AESA 0x02 /* NSAP-style ATM Endsystem Address scheme */
|
||||
#define ATM_ADDR_SIZE 20
|
||||
|
||||
#define DNS_ATMA_FORMAT_E164 ATM_E164
|
||||
#define DNS_ATMA_FORMAT_AESA ATM_AESA
|
||||
#define DNS_ATMA_MAX_ADDR_LENGTH ATM_ADDR_SIZE
|
||||
|
||||
|
||||
#define DNS_TYPE_ZERO 0x0000
|
||||
|
||||
// RFC 1034/1035
|
||||
#define DNS_TYPE_A 0x0001 // 1
|
||||
#define DNS_TYPE_NS 0x0002 // 2
|
||||
#define DNS_TYPE_MD 0x0003 // 3
|
||||
#define DNS_TYPE_MF 0x0004 // 4
|
||||
#define DNS_TYPE_CNAME 0x0005 // 5
|
||||
#define DNS_TYPE_SOA 0x0006 // 6
|
||||
#define DNS_TYPE_MB 0x0007 // 7
|
||||
#define DNS_TYPE_MG 0x0008 // 8
|
||||
#define DNS_TYPE_MR 0x0009 // 9
|
||||
#define DNS_TYPE_NULL 0x000a // 10
|
||||
#define DNS_TYPE_WKS 0x000b // 11
|
||||
#define DNS_TYPE_PTR 0x000c // 12
|
||||
#define DNS_TYPE_HINFO 0x000d // 13
|
||||
#define DNS_TYPE_MINFO 0x000e // 14
|
||||
#define DNS_TYPE_MX 0x000f // 15
|
||||
#define DNS_TYPE_TEXT 0x0010 // 16
|
||||
|
||||
// RFC 1183
|
||||
#define DNS_TYPE_RP 0x0011 // 17
|
||||
#define DNS_TYPE_AFSDB 0x0012 // 18
|
||||
#define DNS_TYPE_X25 0x0013 // 19
|
||||
#define DNS_TYPE_ISDN 0x0014 // 20
|
||||
#define DNS_TYPE_RT 0x0015 // 21
|
||||
|
||||
// RFC 1348
|
||||
#define DNS_TYPE_NSAP 0x0016 // 22
|
||||
#define DNS_TYPE_NSAPPTR 0x0017 // 23
|
||||
|
||||
// RFC 2065 (DNS security)
|
||||
#define DNS_TYPE_SIG 0x0018 // 24
|
||||
#define DNS_TYPE_KEY 0x0019 // 25
|
||||
|
||||
// RFC 1664 (X.400 mail)
|
||||
#define DNS_TYPE_PX 0x001a // 26
|
||||
|
||||
// RFC 1712 (Geographic position)
|
||||
#define DNS_TYPE_GPOS 0x001b // 27
|
||||
|
||||
// RFC 1886 (IPv6 Address)
|
||||
#define DNS_TYPE_AAAA 0x001c // 28
|
||||
|
||||
// RFC 1876 (Geographic location)
|
||||
#define DNS_TYPE_LOC 0x001d // 29
|
||||
|
||||
// RFC 2065 (Secure negative response)
|
||||
#define DNS_TYPE_NXT 0x001e // 30
|
||||
// Patton (Endpoint Identifier)
|
||||
#define DNS_TYPE_EID 0x001f // 31
|
||||
|
||||
// Patton (Nimrod Locator)
|
||||
#define DNS_TYPE_NIMLOC 0x0020 // 32
|
||||
|
||||
// RFC 2052 (Service location)
|
||||
#define DNS_TYPE_SRV 0x0021 // 33
|
||||
|
||||
// ATM Standard something-or-another (ATM Address)
|
||||
#define DNS_TYPE_ATMA 0x0022 // 34
|
||||
|
||||
// RFC 2168 (Naming Authority Pointer)
|
||||
#define DNS_TYPE_NAPTR 0x0023 // 35
|
||||
|
||||
// RFC 2230 (Key Exchanger)
|
||||
#define DNS_TYPE_KX 0x0024 // 36
|
||||
|
||||
// RFC 2538 (CERT)
|
||||
#define DNS_TYPE_CERT 0x0025 // 37
|
||||
|
||||
// A6 Draft (A6)
|
||||
#define DNS_TYPE_A6 0x0026 // 38
|
||||
|
||||
// DNAME Draft (DNAME)
|
||||
#define DNS_TYPE_DNAME 0x0027 // 39
|
||||
|
||||
// Eastlake (Kitchen Sink)
|
||||
#define DNS_TYPE_SINK 0x0028 // 40
|
||||
|
||||
// RFC 2671 (EDNS OPT)
|
||||
#define DNS_TYPE_OPT 0x0029 // 41
|
||||
|
||||
// RFC 4034 (DNSSEC DS)
|
||||
#define DNS_TYPE_DS 0x002b // 43
|
||||
|
||||
// RFC 4034 (DNSSEC RRSIG)
|
||||
#define DNS_TYPE_RRSIG 0x002e // 46
|
||||
|
||||
// RFC 4034 (DNSSEC NSEC)
|
||||
#define DNS_TYPE_NSEC 0x002f // 47
|
||||
|
||||
// RFC 4034 (DNSSEC DNSKEY)
|
||||
#define DNS_TYPE_DNSKEY 0x0030 // 48
|
||||
|
||||
// RFC 4701 (DHCID)
|
||||
#define DNS_TYPE_DHCID 0x0031 // 49
|
||||
|
||||
// RFC 5155 (DNSSEC NSEC3)
|
||||
#define DNS_TYPE_NSEC3 0x0032 // 50
|
||||
// RFC 5155 (DNSSEC NSEC3PARAM)
|
||||
#define DNS_TYPE_NSEC3PARAM 0x0033 // 51
|
||||
|
||||
//
|
||||
// IANA Reserved
|
||||
//
|
||||
|
||||
#define DNS_TYPE_UINFO 0x0064 // 100
|
||||
#define DNS_TYPE_UID 0x0065 // 101
|
||||
#define DNS_TYPE_GID 0x0066 // 102
|
||||
#define DNS_TYPE_UNSPEC 0x0067 // 103
|
||||
|
||||
//
|
||||
// Query only types (1035, 1995)
|
||||
// - Crawford (ADDRS)
|
||||
// - TKEY draft (TKEY)
|
||||
// - TSIG draft (TSIG)
|
||||
// - RFC 1995 (IXFR)
|
||||
// - RFC 1035 (AXFR up)
|
||||
//
|
||||
#define DNS_TYPE_ADDRS 0x00f8 // 248
|
||||
#define DNS_TYPE_TKEY 0x00f9 // 249
|
||||
#define DNS_TYPE_TSIG 0x00fa // 250
|
||||
#define DNS_TYPE_IXFR 0x00fb // 251
|
||||
#define DNS_TYPE_AXFR 0x00fc // 252
|
||||
#define DNS_TYPE_MAILB 0x00fd // 253
|
||||
#define DNS_TYPE_MAILA 0x00fe // 254
|
||||
#define DNS_TYPE_ALL 0x00ff // 255
|
||||
#define DNS_TYPE_ANY 0x00ff // 255
|
||||
//
|
||||
// Private use Microsoft types -- See www.iana.org/assignments/dns-parameters
|
||||
//
|
||||
#define DNS_TYPE_WINS 0xff01 // 64K - 255
|
||||
#define DNS_TYPE_WINSR 0xff02 // 64K - 254
|
||||
#define DNS_TYPE_NBSTAT (DNS_TYPE_WINSR)
|
||||
|
||||
//
|
||||
// DNS Query API
|
||||
//
|
||||
|
||||
//
|
||||
// Options for DnsQuery
|
||||
//
|
||||
|
||||
#define DNS_QUERY_STANDARD 0x00000000
|
||||
#define DNS_QUERY_ACCEPT_TRUNCATED_RESPONSE 0x00000001
|
||||
#define DNS_QUERY_USE_TCP_ONLY 0x00000002
|
||||
#define DNS_QUERY_NO_RECURSION 0x00000004
|
||||
#define DNS_QUERY_BYPASS_CACHE 0x00000008
|
||||
#define DNS_QUERY_NO_WIRE_QUERY 0x00000010
|
||||
#define DNS_QUERY_NO_LOCAL_NAME 0x00000020
|
||||
#define DNS_QUERY_NO_HOSTS_FILE 0x00000040
|
||||
#define DNS_QUERY_NO_NETBT 0x00000080
|
||||
#define DNS_QUERY_WIRE_ONLY 0x00000100
|
||||
#define DNS_QUERY_RETURN_MESSAGE 0x00000200
|
||||
#define DNS_QUERY_MULTICAST_ONLY 0x00000400
|
||||
#define DNS_QUERY_NO_MULTICAST 0x00000800
|
||||
#define DNS_QUERY_TREAT_AS_FQDN 0x00001000
|
||||
#define DNS_QUERY_ADDRCONFIG 0x00002000
|
||||
#define DNS_QUERY_DUAL_ADDR 0x00004000
|
||||
#define DNS_QUERY_DONT_RESET_TTL_VALUES 0x00100000
|
||||
#define DNS_QUERY_DISABLE_IDN_ENCODING 0x00200000
|
||||
#define DNS_QUERY_APPEND_MULTILABEL 0x00800000
|
||||
#define DNS_QUERY_DNSSEC_OK 0x01000000
|
||||
#define DNS_QUERY_DNSSEC_CHECKING_DISABLED 0x02000000
|
||||
#define DNS_QUERY_RESERVED 0xf0000000
|
||||
|
||||
@@ -269,4 +269,25 @@
|
||||
#define COM_ACTIVATE_LOCAL (0x0008)
|
||||
#define COM_ACTIVATE_REMOTE (0x0010)
|
||||
|
||||
//
|
||||
// Section Access Rights.
|
||||
//
|
||||
|
||||
|
||||
// begin_winnt
|
||||
#define SECTION_QUERY 0x0001
|
||||
#define SECTION_MAP_WRITE 0x0002
|
||||
#define SECTION_MAP_READ 0x0004
|
||||
#define SECTION_MAP_EXECUTE 0x0008
|
||||
#define SECTION_EXTEND_SIZE 0x0010
|
||||
#define SECTION_MAP_EXECUTE_EXPLICIT 0x0020 // not included in SECTION_ALL_ACCESS
|
||||
|
||||
#define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE |SECTION_MAP_READ |SECTION_MAP_EXECUTE |SECTION_EXTEND_SIZE)
|
||||
|
||||
|
||||
|
||||
#define FILE_MAP_COPY SECTION_QUERY
|
||||
#define FILE_MAP_WRITE SECTION_MAP_WRITE
|
||||
#define FILE_MAP_READ SECTION_MAP_READ
|
||||
#define FILE_MAP_ALL_ACCESS SECTION_ALL_ACCESS
|
||||
#define FILE_MAP_EXECUTE SECTION_MAP_EXECUTE_EXPLICIT
|
||||
@@ -0,0 +1,4 @@
|
||||
#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs
|
||||
#define SYMSEARCH_RECURSE 0X02 // recurse scopes
|
||||
#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols
|
||||
#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols
|
||||
@@ -442,22 +442,8 @@
|
||||
#define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L)
|
||||
#define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
|
||||
|
||||
#define SECTION_QUERY 0x0001
|
||||
#define SECTION_MAP_WRITE 0x0002
|
||||
#define SECTION_MAP_READ 0x0004
|
||||
#define SECTION_MAP_EXECUTE 0x0008
|
||||
#define SECTION_EXTEND_SIZE 0x0010
|
||||
#define SECTION_MAP_EXECUTE_EXPLICIT 0x0020
|
||||
|
||||
|
||||
#define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE)
|
||||
|
||||
#define FILE_MAP_COPY SECTION_QUERY
|
||||
#define FILE_MAP_WRITE SECTION_MAP_WRITE
|
||||
#define FILE_MAP_READ SECTION_MAP_READ
|
||||
#define FILE_MAP_ALL_ACCESS SECTION_ALL_ACCESS
|
||||
#define FILE_MAP_EXECUTE SECTION_MAP_EXECUTE_EXPLICIT
|
||||
|
||||
|
||||
#define SC_MANAGER_CONNECT 0x0001
|
||||
#define SC_MANAGER_CREATE_SERVICE 0x0002
|
||||
|
||||
@@ -508,6 +508,30 @@
|
||||
#define ERROR_RESOURCE_NAME_NOT_FOUND 1814L
|
||||
#define ERROR_RESOURCE_LANG_NOT_FOUND 1815L
|
||||
|
||||
|
||||
////////////////////////////////////
|
||||
// //
|
||||
// WMI Error Codes //
|
||||
// //
|
||||
////////////////////////////////////
|
||||
|
||||
#define ERROR_WMI_GUID_NOT_FOUND 4200L
|
||||
#define ERROR_WMI_INSTANCE_NOT_FOUND 4201L
|
||||
#define ERROR_WMI_ITEMID_NOT_FOUND 4202L
|
||||
#define ERROR_WMI_TRY_AGAIN 4203L
|
||||
#define ERROR_WMI_DP_NOT_FOUND 4204L
|
||||
#define ERROR_WMI_UNRESOLVED_INSTANCE_REF 4205L
|
||||
#define ERROR_WMI_ALREADY_ENABLED 4206L
|
||||
#define ERROR_WMI_GUID_DISCONNECTED 4207L
|
||||
#define ERROR_WMI_SERVER_UNAVAILABLE 4208L
|
||||
#define ERROR_WMI_DP_FAILED 4209L
|
||||
#define ERROR_WMI_INVALID_MOF 4210L
|
||||
#define ERROR_WMI_INVALID_REGINFO 4211L
|
||||
#define ERROR_WMI_ALREADY_DISABLED 4212L
|
||||
#define ERROR_WMI_READ_ONLY 4213L
|
||||
#define ERROR_WMI_SET_FAILURE 4214L
|
||||
|
||||
|
||||
#define ERROR_INVALID_TRANSACTION 6700
|
||||
#define ERROR_TRANSACTION_NOT_ACTIVE 6701
|
||||
#define ERROR_TRANSACTION_REQUEST_NOT_VALID 6702
|
||||
|
||||
@@ -174,3 +174,11 @@ NTSTATUS WINAPI NtAlpcImpersonateClientOfPort(
|
||||
_In_ PPORT_MESSAGE Message,
|
||||
_In_ PVOID Flags
|
||||
);
|
||||
|
||||
// Not documented
|
||||
NTSTATUS WINAPI TpCallbackSendAlpcMessageOnCompletion(
|
||||
_In_ HANDLE TpHandle,
|
||||
_In_ HANDLE PortHandle,
|
||||
_In_ ULONG Flags,
|
||||
_In_opt_ PPORT_MESSAGE SendMessage,
|
||||
);
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
ULONG WINAPI EnumerateTraceGuidsEx(
|
||||
_In_ TRACE_QUERY_INFO_CLASS TraceQueryInfoClass,
|
||||
_In_ PVOID InBuffer,
|
||||
_In_ ULONG InBufferSize,
|
||||
_Out_ PVOID OutBuffer,
|
||||
_In_ ULONG OutBufferSize,
|
||||
_Out_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI QueryAllTracesA(
|
||||
_Out_ PEVENT_TRACE_PROPERTIES *PropertyArray,
|
||||
_In_ ULONG PropertyArrayCount,
|
||||
_Out_ PULONG SessionCount
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI QueryAllTracesW(
|
||||
_Out_ PEVENT_TRACE_PROPERTIES *PropertyArray,
|
||||
_In_ ULONG PropertyArrayCount,
|
||||
_Out_ PULONG SessionCount
|
||||
);
|
||||
|
||||
|
||||
TRACEHANDLE WINAPI OpenTraceA(
|
||||
_Inout_ PEVENT_TRACE_LOGFILEA Logfile
|
||||
);
|
||||
|
||||
|
||||
TRACEHANDLE WINAPI OpenTraceW(
|
||||
_Inout_ PEVENT_TRACE_LOGFILEW Logfile
|
||||
);
|
||||
|
||||
|
||||
ULONG StartTraceA(
|
||||
PTRACEHANDLE TraceHandle,
|
||||
LPCSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties
|
||||
);
|
||||
|
||||
|
||||
ULONG StartTraceW(
|
||||
PTRACEHANDLE TraceHandle,
|
||||
LPCWSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties
|
||||
);
|
||||
|
||||
|
||||
ULONG StopTraceA(
|
||||
TRACEHANDLE TraceHandle,
|
||||
LPCSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties
|
||||
);
|
||||
|
||||
|
||||
ULONG StopTraceW(
|
||||
TRACEHANDLE TraceHandle,
|
||||
LPCWSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties
|
||||
);
|
||||
|
||||
|
||||
ULONG ControlTraceA(
|
||||
TRACEHANDLE TraceHandle,
|
||||
LPCSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties,
|
||||
ULONG ControlCode
|
||||
);
|
||||
|
||||
|
||||
ULONG ControlTraceW(
|
||||
TRACEHANDLE TraceHandle,
|
||||
LPCWSTR InstanceName,
|
||||
PEVENT_TRACE_PROPERTIES Properties,
|
||||
ULONG ControlCode
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI ProcessTrace(
|
||||
_In_ PTRACEHANDLE HandleArray,
|
||||
_In_ ULONG HandleCount,
|
||||
_In_ LPFILETIME StartTime,
|
||||
_In_ LPFILETIME EndTime
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI EnableTrace(
|
||||
_In_ ULONG Enable,
|
||||
_In_ ULONG EnableFlag,
|
||||
_In_ ULONG EnableLevel,
|
||||
_In_ LPCGUID ControlGuid,
|
||||
_In_ TRACEHANDLE SessionHandle
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI EnableTraceEx(
|
||||
_In_ LPCGUID ProviderId,
|
||||
_In_opt_ LPCGUID SourceId,
|
||||
_In_ TRACEHANDLE TraceHandle,
|
||||
_In_ ULONG IsEnabled,
|
||||
_In_ UCHAR Level,
|
||||
_In_ ULONGLONG MatchAnyKeyword,
|
||||
_In_ ULONGLONG MatchAllKeyword,
|
||||
_In_ ULONG EnableProperty,
|
||||
_In_opt_ PEVENT_FILTER_DESCRIPTOR EnableFilterDesc
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI EnableTraceEx2(
|
||||
_In_ TRACEHANDLE TraceHandle,
|
||||
_In_ LPCGUID ProviderId,
|
||||
_In_ ULONG ControlCode,
|
||||
_In_ UCHAR Level,
|
||||
_In_ ULONGLONG MatchAnyKeyword,
|
||||
_In_ ULONGLONG MatchAllKeyword,
|
||||
_In_ ULONG Timeout,
|
||||
_In_opt_ PENABLE_TRACE_PARAMETERS EnableParameters
|
||||
);
|
||||
|
||||
ULONG WINAPI TraceQueryInformation(
|
||||
_In_ TRACEHANDLE SessionHandle,
|
||||
_In_ TRACE_QUERY_INFO_CLASS InformationClass,
|
||||
_Out_ PVOID TraceInformation,
|
||||
_In_ ULONG InformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
ULONG WINAPI TraceSetInformation(
|
||||
_In_ TRACEHANDLE SessionHandle,
|
||||
_In_ TRACE_INFO_CLASS InformationClass,
|
||||
_In_ PVOID TraceInformation,
|
||||
_In_ ULONG InformationLength
|
||||
);
|
||||
@@ -0,0 +1,62 @@
|
||||
DWORD WINAPI GetExtendedTcpTable(
|
||||
_Out_ PVOID pTcpTable,
|
||||
_Inout_ PDWORD pdwSize,
|
||||
_In_ BOOL bOrder,
|
||||
_In_ ULONG ulAf,
|
||||
_In_ TCP_TABLE_CLASS TableClass,
|
||||
_In_ ULONG Reserved
|
||||
);
|
||||
|
||||
DWORD WINAPI GetExtendedUdpTable(
|
||||
_Out_ PVOID pUdpTable,
|
||||
_Inout_ PDWORD pdwSize,
|
||||
_In_ BOOL bOrder,
|
||||
_In_ ULONG ulAf,
|
||||
_In_ UDP_TABLE_CLASS TableClass,
|
||||
_In_ ULONG Reserved
|
||||
);
|
||||
|
||||
DWORD WINAPI SetTcpEntry(
|
||||
_In_ PMIB_TCPROW pTcpRow
|
||||
);
|
||||
|
||||
|
||||
DWORD DnsGetCacheDataTable(
|
||||
PDNS_CACHE_ENTRY *DnsEntries
|
||||
);
|
||||
|
||||
|
||||
VOID WINAPI DnsFree(
|
||||
_In_ PVOID pData,
|
||||
_In_ DNS_FREE_TYPE FreeType
|
||||
);
|
||||
|
||||
|
||||
DNS_STATUS DnsQuery_A(
|
||||
PCSTR pszName,
|
||||
WORD wType,
|
||||
DWORD Options,
|
||||
PVOID pExtra,
|
||||
PDNS_RECORDA *ppQueryResults,
|
||||
PVOID *pReserved
|
||||
);
|
||||
|
||||
|
||||
DNS_STATUS DnsQuery_W(
|
||||
PCWSTR pszName,
|
||||
WORD wType,
|
||||
DWORD Options,
|
||||
PVOID pExtra,
|
||||
PDNS_RECORDW *ppQueryResults,
|
||||
PVOID *pReserved
|
||||
);
|
||||
|
||||
|
||||
// DNS_STATUS DnsQuery_UTF8(
|
||||
// PCSTR pszName,
|
||||
// WORD wType,
|
||||
// DWORD Options,
|
||||
// PVOID pExtra,
|
||||
// PDNS_RECORD *ppQueryResults,
|
||||
// PVOID *pReserved
|
||||
// );
|
||||
@@ -34,6 +34,13 @@ NTSTATUS NtQueryValueKey(
|
||||
PULONG ResultLength
|
||||
);
|
||||
|
||||
NTSTATUS NtQueryKey(
|
||||
HANDLE KeyHandle,
|
||||
KEY_INFORMATION_CLASS KeyInformationClass,
|
||||
PVOID KeyInformation,
|
||||
ULONG Length,
|
||||
PULONG ResultLength
|
||||
);
|
||||
|
||||
NTSTATUS NtEnumerateValueKey(
|
||||
HANDLE KeyHandle,
|
||||
|
||||
@@ -140,4 +140,22 @@ BOOL WINAPI GetAclInformation(
|
||||
_Out_ LPVOID pAclInformation,
|
||||
_In_ DWORD nAclInformationLength,
|
||||
_In_ ACL_INFORMATION_CLASS dwAclInformationClass
|
||||
);
|
||||
);
|
||||
|
||||
/* VOID */
|
||||
PVOID MapGenericMask(
|
||||
PDWORD AccessMask,
|
||||
PGENERIC_MAPPING GenericMapping
|
||||
);
|
||||
|
||||
BOOL AccessCheck(
|
||||
PSECURITY_DESCRIPTOR pSecurityDescriptor,
|
||||
HANDLE ClientToken,
|
||||
DWORD DesiredAccess,
|
||||
PGENERIC_MAPPING GenericMapping,
|
||||
PPRIVILEGE_SET PrivilegeSet,
|
||||
LPDWORD PrivilegeSetLength,
|
||||
LPDWORD GrantedAccess,
|
||||
LPBOOL AccessStatus
|
||||
);
|
||||
|
||||
|
||||
@@ -0,0 +1,149 @@
|
||||
DWORD64 WINAPI SymLoadModuleExA(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ HANDLE hFile,
|
||||
_In_ PCSTR ImageName,
|
||||
_In_ PCSTR ModuleName,
|
||||
_In_ DWORD64 BaseOfDll,
|
||||
_In_ DWORD DllSize,
|
||||
_In_ PMODLOAD_DATA Data,
|
||||
_In_ DWORD Flags
|
||||
);
|
||||
|
||||
|
||||
DWORD64 WINAPI SymLoadModuleExW(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ HANDLE hFile,
|
||||
_In_ PCWSTR ImageName,
|
||||
_In_ PCWSTR ModuleName,
|
||||
_In_ DWORD64 BaseOfDll,
|
||||
_In_ DWORD DllSize,
|
||||
_In_ PMODLOAD_DATA Data,
|
||||
_In_ DWORD Flags
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymFromAddr(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ DWORD64 Address,
|
||||
_Out_opt_ PDWORD64 Displacement,
|
||||
_Inout_ PSYMBOL_INFO Symbol
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymGetModuleInfo64(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ DWORD64 dwAddr,
|
||||
_Out_ PIMAGEHLP_MODULE64 ModuleInfo
|
||||
);
|
||||
|
||||
BOOL WINAPI SymInitialize(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_opt_ LPCSTR UserSearchPath,
|
||||
_In_ BOOL fInvadeProcess
|
||||
);
|
||||
|
||||
BOOL WINAPI SymFromName(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ LPCSTR Name,
|
||||
_Inout_ PSYMBOL_INFO Symbol
|
||||
);
|
||||
|
||||
|
||||
|
||||
DWORD64 WINAPI SymLoadModuleEx(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ HANDLE hFile,
|
||||
_In_ LPCSTR ImageName,
|
||||
_In_ LPCSTR ModuleName,
|
||||
_In_ DWORD64 BaseOfDll,
|
||||
_In_ DWORD DllSize,
|
||||
_In_ PMODLOAD_DATA Data,
|
||||
_In_ DWORD Flags
|
||||
);
|
||||
|
||||
DWORD WINAPI SymSetOptions(
|
||||
_In_ DWORD SymOptions
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymEnumSymbols(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ ULONG64 BaseOfDll,
|
||||
_In_ PCSTR Mask,
|
||||
_In_ PVOID EnumSymbolsCallback,
|
||||
_In_ PVOID UserContext
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymEnumSymbolsEx(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ ULONG64 BaseOfDll,
|
||||
_In_ PCSTR Mask,
|
||||
_In_ PVOID EnumSymbolsCallback,
|
||||
_In_ PVOID UserContext,
|
||||
_In_ DWORD Options
|
||||
);
|
||||
|
||||
BOOL WINAPI SymEnumTypes(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ ULONG64 BaseOfDll,
|
||||
_In_ PVOID EnumSymbolsCallback,
|
||||
_In_ PVOID UserContext
|
||||
);
|
||||
|
||||
BOOL WINAPI SymEnumTypesByName(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ ULONG64 BaseOfDll,
|
||||
_In_ PCSTR mask,
|
||||
_In_ PVOID EnumSymbolsCallback,
|
||||
_In_ PVOID UserContext
|
||||
);
|
||||
|
||||
BOOL WINAPI SymEnumerateModules64(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ PVOID EnumModulesCallback,
|
||||
_In_ PVOID UserContext
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymGetTypeFromName(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ ULONG64 BaseOfDll,
|
||||
_In_ PCSTR Name,
|
||||
_Inout_ PSYMBOL_INFO Symbol
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI SymGetTypeInfo(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ DWORD64 ModBase,
|
||||
_In_ ULONG TypeId,
|
||||
_In_ IMAGEHLP_SYMBOL_TYPE_INFO GetType,
|
||||
_Out_ PVOID pInfo
|
||||
);
|
||||
|
||||
|
||||
BOOL SymSearch(
|
||||
HANDLE hProcess,
|
||||
ULONG64 BaseOfDll,
|
||||
DWORD Index,
|
||||
DWORD SymTag,
|
||||
PCSTR Mask,
|
||||
DWORD64 Address,
|
||||
PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,
|
||||
PVOID UserContext,
|
||||
DWORD Options
|
||||
);
|
||||
|
||||
|
||||
BOOL SymSearchW(
|
||||
HANDLE hProcess,
|
||||
ULONG64 BaseOfDll,
|
||||
DWORD Index,
|
||||
DWORD SymTag,
|
||||
PCWSTR Mask,
|
||||
DWORD64 Address,
|
||||
PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,
|
||||
PVOID UserContext,
|
||||
DWORD Options
|
||||
);
|
||||
@@ -0,0 +1,353 @@
|
||||
/*
|
||||
|
||||
ALPC syscall are in alpc.txt
|
||||
NtWow64* are still in winfunc (make a syswow.txt?)
|
||||
|
||||
*/
|
||||
|
||||
|
||||
NTSTATUS NtQueryLicenseValue(
|
||||
PUNICODE_STRING Name,
|
||||
ULONG *Type,
|
||||
PVOID Buffer,
|
||||
ULONG Length,
|
||||
ULONG *DataLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryEaFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_writes_bytes_(Length) PVOID Buffer,
|
||||
_In_ ULONG Length,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_reads_bytes_opt_(EaListLength) PVOID EaList,
|
||||
_In_ ULONG EaListLength,
|
||||
_In_opt_ PULONG EaIndex,
|
||||
_In_ BOOLEAN RestartScan
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtSetEaFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_reads_bytes_(Length) PVOID Buffer,
|
||||
_In_ ULONG Length
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateProcessEx(
|
||||
_Out_ PHANDLE ProcessHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ HANDLE ParentProcess,
|
||||
_In_ ULONG Flags,
|
||||
_In_ HANDLE SectionHandle,
|
||||
_In_ HANDLE DebugPort,
|
||||
_In_ HANDLE ExceptionPort,
|
||||
_In_ BOOLEAN InJob
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateNamedPipeFile(
|
||||
_Out_ PHANDLE NamedPipeFileHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_ ULONG ShareAccess,
|
||||
_In_ ULONG CreateDisposition,
|
||||
_In_ ULONG CreateOptions,
|
||||
_In_ BOOLEAN WriteModeMessage,
|
||||
_In_ BOOLEAN ReadModeMessage,
|
||||
_In_ BOOLEAN NonBlocking,
|
||||
_In_ ULONG MaxInstances,
|
||||
_In_ ULONG InBufferSize,
|
||||
_In_ ULONG OutBufferSize,
|
||||
_In_ PLARGE_INTEGER DefaultTimeOut
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateFile(
|
||||
_Out_ PHANDLE FileHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_opt_ PLARGE_INTEGER AllocationSize,
|
||||
_In_ ULONG FileAttributes,
|
||||
_In_ ULONG ShareAccess,
|
||||
_In_ ULONG CreateDisposition,
|
||||
_In_ ULONG CreateOptions,
|
||||
_In_ PVOID EaBuffer,
|
||||
_In_ ULONG EaLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtOpenFile(
|
||||
_Out_ PHANDLE FileHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_ ULONG ShareAccess,
|
||||
_In_ ULONG OpenOptions
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateSymbolicLinkObject (
|
||||
_Out_ PHANDLE pHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ PUNICODE_STRING DestinationName
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtSetInformationProcess(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
||||
_In_ PVOID ProcessInformation,
|
||||
_In_ ULONG ProcessInformationLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_opt_ PVOID BaseAddress,
|
||||
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
||||
_Out_ PVOID MemoryInformation,
|
||||
_In_ SIZE_T MemoryInformationLength,
|
||||
_Out_opt_ PSIZE_T ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryVolumeInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FsInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FS_INFORMATION_CLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS NtCreateThreadEx(
|
||||
PHANDLE ThreadHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
LPVOID ObjectAttributes,
|
||||
HANDLE ProcessHandle,
|
||||
LPTHREAD_START_ROUTINE lpStartAddress,
|
||||
LPVOID lpParameter,
|
||||
BOOL CreateSuspended,
|
||||
DWORD dwStackSize,
|
||||
DWORD Unknown1,
|
||||
DWORD Unknown2,
|
||||
LPVOID Unknown3
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtGetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__inout LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtSetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__in CONST LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationThread (
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_In_ THREAD_INFORMATION_CLASS ThreadInformationClass,
|
||||
_Out_ PVOID ThreadInformation,
|
||||
_In_ ULONG ThreadInformationLength,
|
||||
_Out_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAllocateVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_In_ ULONG_PTR ZeroBits,
|
||||
_Inout_ PSIZE_T RegionSize,
|
||||
_In_ ULONG AllocationType,
|
||||
_In_ ULONG Protect
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtProtectVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_Inout_ PULONG NumberOfBytesToProtect,
|
||||
_In_ ULONG NewAccessProtection,
|
||||
_Out_ PULONG OldAccessProtection
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQuerySystemInformation(
|
||||
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
_Inout_ PVOID SystemInformation,
|
||||
_In_ ULONG SystemInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationProcess(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PROCESSINFOCLASS ProcessInformationClass,
|
||||
_Out_ PVOID ProcessInformation,
|
||||
_In_ ULONG ProcessInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtReadVirtualMemory(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ PVOID lpBaseAddress,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ ULONG nSize,
|
||||
_Out_ PULONG lpNumberOfBytesRead
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtWriteVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PVOID BaseAddress,
|
||||
_In_ PVOID Buffer,
|
||||
_In_ ULONG NumberOfBytesToWrite,
|
||||
_Out_ PULONG NumberOfBytesWritten
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtOpenEvent(
|
||||
__out PHANDLE EventHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryObject(
|
||||
_In_opt_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
_Out_opt_ PVOID ObjectInformation,
|
||||
_In_ ULONG ObjectInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtOpenDirectoryObject(
|
||||
__out PHANDLE DirectoryHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryDirectoryObject(
|
||||
__in HANDLE DirectoryHandle,
|
||||
__out PVOID Buffer,
|
||||
__in ULONG Length,
|
||||
__in BOOLEAN ReturnSingleEntry,
|
||||
__in BOOLEAN RestartScan,
|
||||
__inout PULONG Context,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQuerySymbolicLinkObject(
|
||||
_In_ HANDLE LinkHandle,
|
||||
_Inout_ PUNICODE_STRING LinkTarget,
|
||||
_Out_opt_ PULONG ReturnedLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtOpenSymbolicLinkObject(
|
||||
_Out_ PHANDLE LinkHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryDirectoryFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_In_opt_ HANDLE Event,
|
||||
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
||||
_In_opt_ PVOID ApcContext,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_opt_ PUNICODE_STRING FileName,
|
||||
_In_ BOOLEAN RestartScan
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS NtSetInformationFile(
|
||||
HANDLE FileHandle,
|
||||
PIO_STATUS_BLOCK IoStatusBlock,
|
||||
PVOID FileInformation,
|
||||
ULONG Length,
|
||||
FILE_INFORMATION_CLASS FileInformationClass
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtEnumerateSystemEnvironmentValuesEx(
|
||||
_In_ ULONG InformationClass,
|
||||
_In_ PVOID Buffer,
|
||||
_In_ ULONG BufferLength
|
||||
);
|
||||
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtFreeVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_Inout_ PSIZE_T RegionSize,
|
||||
_In_ ULONG FreeType
|
||||
);
|
||||
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtGetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__inout LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtSetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__in CONST LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS NtCreateSection(
|
||||
PHANDLE SectionHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
PLARGE_INTEGER MaximumSize,
|
||||
ULONG SectionPageProtection,
|
||||
ULONG AllocationAttributes,
|
||||
HANDLE FileHandle
|
||||
);
|
||||
|
||||
NTSTATUS NtOpenSection(
|
||||
PHANDLE SectionHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
NTSTATUS NtMapViewOfSection(
|
||||
HANDLE SectionHandle,
|
||||
HANDLE ProcessHandle,
|
||||
PVOID *BaseAddress,
|
||||
ULONG_PTR ZeroBits,
|
||||
SIZE_T CommitSize,
|
||||
PLARGE_INTEGER SectionOffset,
|
||||
PSIZE_T ViewSize,
|
||||
SECTION_INHERIT InheritDisposition,
|
||||
ULONG AllocationType,
|
||||
ULONG Win32Protect
|
||||
);
|
||||
|
||||
NTSTATUS NtUnmapViewOfSection(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID BaseAddress
|
||||
);
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
BOOL FileTimeToSystemTime(
|
||||
FILETIME *lpFileTime,
|
||||
LPSYSTEMTIME lpSystemTime
|
||||
);
|
||||
|
||||
BOOL SystemTimeToFileTime(
|
||||
SYSTEMTIME *lpSystemTime,
|
||||
LPFILETIME lpFileTime
|
||||
);
|
||||
|
||||
// void
|
||||
PVOID GetSystemTime(
|
||||
LPSYSTEMTIME lpSystemTime
|
||||
);
|
||||
|
||||
// void
|
||||
PVOID GetSystemTimeAsFileTime(
|
||||
LPFILETIME lpSystemTimeAsFileTime
|
||||
);
|
||||
@@ -0,0 +1,4 @@
|
||||
TDHSTATUS TdhEnumerateProviders(
|
||||
PPROVIDER_ENUMERATION_INFO pBuffer,
|
||||
ULONG *pBufferSize
|
||||
);
|
||||
@@ -32,19 +32,7 @@ HANDLE WINAPI CreateFileW(
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateFile(
|
||||
_Out_ PHANDLE FileHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_opt_ PLARGE_INTEGER AllocationSize,
|
||||
_In_ ULONG FileAttributes,
|
||||
_In_ ULONG ShareAccess,
|
||||
_In_ ULONG CreateDisposition,
|
||||
_In_ ULONG CreateOptions,
|
||||
_In_ PVOID EaBuffer,
|
||||
_In_ ULONG EaLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI LdrLoadDll(
|
||||
__in_opt LPCWSTR PathToFile,
|
||||
@@ -53,67 +41,8 @@ NTSTATUS WINAPI LdrLoadDll(
|
||||
_Out_ PHANDLE ModuleHandle
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQuerySystemInformation(
|
||||
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
_Inout_ PVOID SystemInformation,
|
||||
_In_ ULONG SystemInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationProcess(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PROCESSINFOCLASS ProcessInformationClass,
|
||||
_Out_ PVOID ProcessInformation,
|
||||
_In_ ULONG ProcessInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtSetInformationProcess(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
||||
_In_ PVOID ProcessInformation,
|
||||
_In_ ULONG ProcessInformationLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_opt_ PVOID BaseAddress,
|
||||
_In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
||||
_Out_ PVOID MemoryInformation,
|
||||
_In_ SIZE_T MemoryInformationLength,
|
||||
_Out_opt_ PSIZE_T ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryVolumeInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FsInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FS_INFORMATION_CLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS NtCreateThreadEx(
|
||||
PHANDLE ThreadHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
LPVOID ObjectAttributes,
|
||||
HANDLE ProcessHandle,
|
||||
LPTHREAD_START_ROUTINE lpStartAddress,
|
||||
LPVOID lpParameter,
|
||||
BOOL CreateSuspended,
|
||||
DWORD dwStackSize,
|
||||
DWORD Unknown1,
|
||||
DWORD Unknown2,
|
||||
LPVOID Unknown3
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationThread (
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_In_ THREAD_INFORMATION_CLASS ThreadInformationClass,
|
||||
_Out_ PVOID ThreadInformation,
|
||||
_In_ ULONG ThreadInformationLength,
|
||||
_Out_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
BOOL WINAPI GetExitCodeThread(
|
||||
_In_ HANDLE hThread,
|
||||
@@ -150,24 +79,8 @@ LPVOID WINAPI VirtualAllocEx(
|
||||
_In_ DWORD flProtect
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtAllocateVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_In_ ULONG_PTR ZeroBits,
|
||||
_Inout_ PSIZE_T RegionSize,
|
||||
_In_ ULONG AllocationType,
|
||||
_In_ ULONG Protect
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtProtectVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_Inout_ PULONG NumberOfBytesToProtect,
|
||||
_In_ ULONG NewAccessProtection,
|
||||
_Out_ PULONG OldAccessProtection
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI VirtualFree(
|
||||
_In_ LPVOID lpAddress,
|
||||
@@ -183,12 +96,6 @@ BOOL WINAPI VirtualFreeEx(
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtFreeVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID *BaseAddress,
|
||||
_Inout_ PSIZE_T RegionSize,
|
||||
_In_ ULONG FreeType
|
||||
);
|
||||
|
||||
BOOL WINAPI VirtualProtect(
|
||||
_In_ LPVOID lpAddress,
|
||||
@@ -330,20 +237,12 @@ BOOL WINAPI GetThreadContext(
|
||||
__inout LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtGetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__inout LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
BOOL WINAPI SetThreadContext(
|
||||
__in HANDLE hThread,
|
||||
__in CONST LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtSetContextThread(
|
||||
__in HANDLE hThread,
|
||||
__in CONST LPCONTEXT lpContext
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI OpenThread(
|
||||
@@ -378,13 +277,7 @@ NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
|
||||
_Out_ PULONG64 lpNumberOfBytesRead
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtReadVirtualMemory(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ PVOID lpBaseAddress,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ ULONG nSize,
|
||||
_Out_ PULONG lpNumberOfBytesRead
|
||||
);
|
||||
|
||||
|
||||
|
||||
BOOL WINAPI WriteProcessMemory(
|
||||
@@ -405,13 +298,6 @@ NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtWriteVirtualMemory(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_In_ PVOID BaseAddress,
|
||||
_In_ PVOID Buffer,
|
||||
_In_ ULONG NumberOfBytesToWrite,
|
||||
_Out_ PULONG NumberOfBytesWritten
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI CreateToolhelp32Snapshot(
|
||||
@@ -625,27 +511,6 @@ BOOL WINAPI WriteFile(
|
||||
_Inout_opt_ LPOVERLAPPED lpOverlapped
|
||||
);
|
||||
|
||||
DWORD WINAPI GetExtendedTcpTable(
|
||||
_Out_ PVOID pTcpTable,
|
||||
_Inout_ PDWORD pdwSize,
|
||||
_In_ BOOL bOrder,
|
||||
_In_ ULONG ulAf,
|
||||
_In_ TCP_TABLE_CLASS TableClass,
|
||||
_In_ ULONG Reserved
|
||||
);
|
||||
|
||||
DWORD WINAPI GetExtendedUdpTable(
|
||||
_Out_ PVOID pUdpTable,
|
||||
_Inout_ PDWORD pdwSize,
|
||||
_In_ BOOL bOrder,
|
||||
_In_ ULONG ulAf,
|
||||
_In_ UDP_TABLE_CLASS TableClass,
|
||||
_In_ ULONG Reserved
|
||||
);
|
||||
|
||||
DWORD WINAPI SetTcpEntry(
|
||||
_In_ PMIB_TCPROW pTcpRow
|
||||
);
|
||||
|
||||
PVOID WINAPI AddVectoredContinueHandler(
|
||||
_In_ ULONG FirstHandler,
|
||||
@@ -981,39 +846,6 @@ NTSTATUS RtlGetCompressionWorkSpaceSize(
|
||||
PULONG CompressFragmentWorkSpaceSize
|
||||
);
|
||||
|
||||
NTSTATUS NtCreateSection(
|
||||
PHANDLE SectionHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
PLARGE_INTEGER MaximumSize,
|
||||
ULONG SectionPageProtection,
|
||||
ULONG AllocationAttributes,
|
||||
HANDLE FileHandle
|
||||
);
|
||||
|
||||
NTSTATUS NtOpenSection(
|
||||
PHANDLE SectionHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
NTSTATUS NtMapViewOfSection(
|
||||
HANDLE SectionHandle,
|
||||
HANDLE ProcessHandle,
|
||||
PVOID *BaseAddress,
|
||||
ULONG_PTR ZeroBits,
|
||||
SIZE_T CommitSize,
|
||||
PLARGE_INTEGER SectionOffset,
|
||||
PSIZE_T ViewSize,
|
||||
SECTION_INHERIT InheritDisposition,
|
||||
ULONG AllocationType,
|
||||
ULONG Win32Protect
|
||||
);
|
||||
|
||||
NTSTATUS NtUnmapViewOfSection(
|
||||
HANDLE ProcessHandle,
|
||||
PVOID BaseAddress
|
||||
);
|
||||
|
||||
HANDLE WINAPI OpenEventA(
|
||||
__in DWORD dwDesiredAccess,
|
||||
@@ -1028,11 +860,6 @@ HANDLE WINAPI OpenEventW(
|
||||
__in LPCWSTR lpName
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtOpenEvent(
|
||||
__out PHANDLE EventHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
INT WINAPI lstrcmpA(
|
||||
@@ -1237,13 +1064,7 @@ BOOL WINAPI FindNextVolumeW(
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryObject(
|
||||
_In_opt_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
_Out_opt_ PVOID ObjectInformation,
|
||||
_In_ ULONG ObjectInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI DuplicateHandle(
|
||||
_In_ HANDLE hSourceProcessHandle,
|
||||
@@ -1382,35 +1203,6 @@ DWORD WINAPI GetIpAddrTable(
|
||||
_In_ BOOL bOrder
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtOpenDirectoryObject(
|
||||
__out PHANDLE DirectoryHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryDirectoryObject(
|
||||
__in HANDLE DirectoryHandle,
|
||||
__out PVOID Buffer,
|
||||
__in ULONG Length,
|
||||
__in BOOLEAN ReturnSingleEntry,
|
||||
__in BOOLEAN RestartScan,
|
||||
__inout PULONG Context,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQuerySymbolicLinkObject(
|
||||
_In_ HANDLE LinkHandle,
|
||||
_Inout_ PUNICODE_STRING LinkTarget,
|
||||
_Out_opt_ PULONG ReturnedLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtOpenSymbolicLinkObject(
|
||||
_Out_ PHANDLE LinkHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
BOOL WINAPI GetProcessTimes(
|
||||
_In_ HANDLE hProcess,
|
||||
_Out_ LPFILETIME lpCreationTime,
|
||||
@@ -1588,29 +1380,6 @@ VOID WINAPI RtlGetUnloadEventTraceEx(
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryDirectoryFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_In_opt_ HANDLE Event,
|
||||
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
||||
_In_opt_ PVOID ApcContext,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_opt_ PUNICODE_STRING FileName,
|
||||
_In_ BOOLEAN RestartScan
|
||||
);
|
||||
|
||||
|
||||
BOOLEAN WINAPI RtlDosPathNameToNtPathName_U(
|
||||
_In_ PCWSTR DosName,
|
||||
_Out_ PUNICODE_STRING NtName,
|
||||
@@ -1661,13 +1430,7 @@ BOOL WINAPI GetProductInfo(
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS NtSetInformationFile(
|
||||
HANDLE FileHandle,
|
||||
PIO_STATUS_BLOCK IoStatusBlock,
|
||||
PVOID FileInformation,
|
||||
ULONG Length,
|
||||
FILE_INFORMATION_CLASS FileInformationClass
|
||||
);
|
||||
|
||||
|
||||
|
||||
BOOL GetProcessMemoryInfo(
|
||||
@@ -1723,10 +1486,6 @@ DWORD WINAPI GetFirmwareEnvironmentVariableExW(
|
||||
_Out_ PDWORD pdwAttribubutes
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtEnumerateSystemEnvironmentValuesEx(
|
||||
_In_ ULONG InformationClass,
|
||||
_In_ PVOID Buffer,
|
||||
_In_ ULONG BufferLength
|
||||
);
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
NTSTATUS WINAPI TpCallbackSendAlpcMessageOnCompletion(
|
||||
_In_ HANDLE TpHandle,
|
||||
_In_ HANDLE PortHandle,
|
||||
_In_ ULONG Flags,
|
||||
_In_opt_ PPORT_MESSAGE SendMessage,
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS NtQueryLicenseValue(
|
||||
PUNICODE_STRING Name,
|
||||
ULONG *Type,
|
||||
PVOID Buffer,
|
||||
ULONG Length,
|
||||
ULONG *DataLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryEaFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_writes_bytes_(Length) PVOID Buffer,
|
||||
_In_ ULONG Length,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_reads_bytes_opt_(EaListLength) PVOID EaList,
|
||||
_In_ ULONG EaListLength,
|
||||
_In_opt_ PULONG EaIndex,
|
||||
_In_ BOOLEAN RestartScan
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtSetEaFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_In_reads_bytes_(Length) PVOID Buffer,
|
||||
_In_ ULONG Length
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtCreateProcessEx(
|
||||
_Out_ PHANDLE ProcessHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_ HANDLE ParentProcess,
|
||||
_In_ ULONG Flags,
|
||||
_In_ HANDLE SectionHandle,
|
||||
_In_ HANDLE DebugPort,
|
||||
_In_ HANDLE ExceptionPort,
|
||||
_In_ BOOLEAN InJob
|
||||
);
|
||||
@@ -7,6 +7,7 @@ PSIZE_T = POINTER(SIZE_T)
|
||||
PVOID = c_void_p
|
||||
NTSTATUS = DWORD
|
||||
TDHSTATUS = ULONG
|
||||
DNS_STATUS = ULONG
|
||||
SECURITY_INFORMATION = DWORD
|
||||
PSECURITY_INFORMATION = POINTER(SECURITY_INFORMATION)
|
||||
PULONG = POINTER(ULONG)
|
||||
@@ -78,6 +79,8 @@ NCRYPT_PROV_HANDLE = ULONG_PTR
|
||||
NCRYPT_KEY_HANDLE = ULONG_PTR
|
||||
NCRYPT_HASH_HANDLE = ULONG_PTR
|
||||
NCRYPT_SECRET_HANDLE = ULONG_PTR
|
||||
TRACEHANDLE = ULONG64
|
||||
PTRACEHANDLE = POINTER(TRACEHANDLE)
|
||||
|
||||
/* INT sized*/
|
||||
|
||||
@@ -106,6 +109,10 @@ HCRYPTPROV_OR_NCRYPT_KEY_HANDLE = PULONG
|
||||
EVT_HANDLE = HANDLE
|
||||
EVT_OBJECT_ARRAY_PROPERTY_HANDLE = HANDLE
|
||||
|
||||
/* Network */
|
||||
|
||||
IP4_ADDRESS = DWORD // Make a extended struct ?
|
||||
|
||||
/* Security */
|
||||
|
||||
PSECURITY_DESCRIPTOR = PVOID
|
||||
|
||||
@@ -0,0 +1,308 @@
|
||||
typedef enum {
|
||||
TraceGuidQueryList,
|
||||
TraceGuidQueryInfo,
|
||||
TraceGuidQueryProcess,
|
||||
TraceStackTracingInfo,
|
||||
TraceSystemTraceEnableFlagsInfo,
|
||||
TraceSampledProfileIntervalInfo,
|
||||
TraceProfileSourceConfigInfo,
|
||||
TraceProfileSourceListInfo,
|
||||
TracePmcEventListInfo,
|
||||
TracePmcCounterListInfo,
|
||||
TraceSetDisallowList,
|
||||
TraceVersionInfo,
|
||||
TraceGroupQueryList,
|
||||
TraceGroupQueryInfo,
|
||||
TraceDisallowListQuery,
|
||||
TraceInfoReserved15, // Reserved, not on MSDN...
|
||||
TracePeriodicCaptureStateListInfo,
|
||||
TracePeriodicCaptureStateInfo,
|
||||
TraceProviderBinaryTracking,
|
||||
TraceMaxLoggersQuery,
|
||||
MaxTraceSetInfoClass
|
||||
} TRACE_INFO_CLASS, TRACE_QUERY_INFO_CLASS;
|
||||
|
||||
|
||||
|
||||
typedef struct _TRACE_GUID_INFO {
|
||||
ULONG InstanceCount;
|
||||
ULONG Reserved;
|
||||
} TRACE_GUID_INFO, *PTRACE_GUID_INFO;
|
||||
|
||||
|
||||
typedef struct _TRACE_PROVIDER_INSTANCE_INFO {
|
||||
ULONG NextOffset;
|
||||
ULONG EnableCount;
|
||||
ULONG Pid;
|
||||
ULONG Flags;
|
||||
} TRACE_PROVIDER_INSTANCE_INFO, *PTRACE_PROVIDER_INSTANCE_INFO;
|
||||
|
||||
|
||||
typedef struct _TRACE_ENABLE_INFO {
|
||||
ULONG IsEnabled;
|
||||
UCHAR Level;
|
||||
UCHAR Reserved1;
|
||||
USHORT LoggerId;
|
||||
ULONG EnableProperty;
|
||||
ULONG Reserved2;
|
||||
ULONGLONG MatchAnyKeyword;
|
||||
ULONGLONG MatchAllKeyword;
|
||||
} TRACE_ENABLE_INFO, *PTRACE_ENABLE_INFO;
|
||||
|
||||
|
||||
typedef struct _WNODE_HEADER {
|
||||
ULONG BufferSize;
|
||||
ULONG ProviderId;
|
||||
union {
|
||||
ULONG64 HistoricalContext;
|
||||
struct {
|
||||
ULONG Version;
|
||||
ULONG Linkage;
|
||||
};
|
||||
};
|
||||
union {
|
||||
HANDLE KernelHandle;
|
||||
LARGE_INTEGER TimeStamp;
|
||||
};
|
||||
GUID Guid;
|
||||
ULONG ClientContext;
|
||||
ULONG Flags;
|
||||
} WNODE_HEADER, *PWNODE_HEADER;
|
||||
|
||||
typedef struct _EVENT_TRACE_PROPERTIES {
|
||||
WNODE_HEADER Wnode;
|
||||
ULONG BufferSize;
|
||||
ULONG MinimumBuffers;
|
||||
ULONG MaximumBuffers;
|
||||
ULONG MaximumFileSize;
|
||||
ULONG LogFileMode;
|
||||
ULONG FlushTimer;
|
||||
ULONG EnableFlags;
|
||||
LONG AgeLimit;
|
||||
ULONG NumberOfBuffers;
|
||||
ULONG FreeBuffers;
|
||||
ULONG EventsLost;
|
||||
ULONG BuffersWritten;
|
||||
ULONG LogBuffersLost;
|
||||
ULONG RealTimeBuffersLost;
|
||||
HANDLE LoggerThreadId;
|
||||
ULONG LogFileNameOffset;
|
||||
ULONG LoggerNameOffset;
|
||||
} EVENT_TRACE_PROPERTIES, *PEVENT_TRACE_PROPERTIES;
|
||||
|
||||
typedef struct _EVENT_TRACE_HEADER {
|
||||
USHORT Size;
|
||||
union {
|
||||
USHORT FieldTypeFlags;
|
||||
struct {
|
||||
BYTE HeaderType;
|
||||
BYTE MarkerFlags;
|
||||
};
|
||||
};
|
||||
union {
|
||||
ULONG Version;
|
||||
struct {
|
||||
BYTE Type;
|
||||
BYTE Level;
|
||||
USHORT Version;
|
||||
}Class;
|
||||
};
|
||||
ULONG ThreadId;
|
||||
ULONG ProcessId;
|
||||
LARGE_INTEGER TimeStamp;
|
||||
union {
|
||||
GUID Guid;
|
||||
ULONGLONG GuidPtr;
|
||||
};
|
||||
union {
|
||||
struct {
|
||||
ULONG KernelTime;
|
||||
ULONG UserTime;
|
||||
};
|
||||
ULONG64 ProcessorTime;
|
||||
struct {
|
||||
ULONG ClientContext;
|
||||
ULONG Flags;
|
||||
};
|
||||
};
|
||||
} EVENT_TRACE_HEADER, *PEVENT_TRACE_HEADER;
|
||||
|
||||
typedef struct _ETW_BUFFER_CONTEXT {
|
||||
union {
|
||||
struct {
|
||||
BYTE ProcessorNumber;
|
||||
BYTE Alignment;
|
||||
};
|
||||
USHORT ProcessorIndex;
|
||||
};
|
||||
USHORT LoggerId;
|
||||
} ETW_BUFFER_CONTEXT, *PETW_BUFFER_CONTEXT;
|
||||
|
||||
typedef struct _EVENT_TRACE {
|
||||
EVENT_TRACE_HEADER Header;
|
||||
ULONG InstanceId;
|
||||
ULONG ParentInstanceId;
|
||||
GUID ParentGuid;
|
||||
PVOID MofData;
|
||||
ULONG MofLength;
|
||||
union {
|
||||
ULONG ClientContext;
|
||||
ETW_BUFFER_CONTEXT BufferContext;
|
||||
};
|
||||
} EVENT_TRACE, *PEVENT_TRACE;
|
||||
|
||||
|
||||
typedef struct _TRACE_LOGFILE_HEADER {
|
||||
ULONG BufferSize; // Logger buffer size in Kbytes
|
||||
union {
|
||||
ULONG Version; // Logger version
|
||||
struct {
|
||||
UCHAR MajorVersion;
|
||||
UCHAR MinorVersion;
|
||||
UCHAR SubVersion;
|
||||
UCHAR SubMinorVersion;
|
||||
} VersionDetail;
|
||||
} DUMMYUNIONNAME;
|
||||
ULONG ProviderVersion; // defaults to NT version
|
||||
ULONG NumberOfProcessors; // Number of Processors
|
||||
LARGE_INTEGER EndTime; // Time when logger stops
|
||||
ULONG TimerResolution; // assumes timer is constant!!!
|
||||
ULONG MaximumFileSize; // Maximum in Mbytes
|
||||
ULONG LogFileMode; // specify logfile mode
|
||||
ULONG BuffersWritten; // used to file start of Circular File
|
||||
union {
|
||||
GUID LogInstanceGuid; // For RealTime Buffer Delivery
|
||||
struct {
|
||||
ULONG StartBuffers; // Count of buffers written at start.
|
||||
ULONG PointerSize; // Size of pointer type in bits
|
||||
ULONG EventsLost; // Events losts during log session
|
||||
ULONG CpuSpeedInMHz; // Cpu Speed in MHz
|
||||
} DUMMYSTRUCTNAME;
|
||||
} DUMMYUNIONNAME2;
|
||||
LPWSTR LoggerName;
|
||||
LPWSTR LogFileName;
|
||||
TIME_ZONE_INFORMATION TimeZone;
|
||||
LARGE_INTEGER BootTime;
|
||||
LARGE_INTEGER PerfFreq; // Reserved
|
||||
LARGE_INTEGER StartTime; // Reserved
|
||||
ULONG ReservedFlags; // ClockType
|
||||
ULONG BuffersLost;
|
||||
} TRACE_LOGFILE_HEADER, *PTRACE_LOGFILE_HEADER;
|
||||
|
||||
|
||||
typedef struct _EVENT_TRACE_LOGFILEA {
|
||||
LPSTR LogFileName;
|
||||
LPSTR LoggerName;
|
||||
LONGLONG CurrentTime;
|
||||
ULONG BuffersRead;
|
||||
union {
|
||||
ULONG LogFileMode;
|
||||
ULONG ProcessTraceMode;
|
||||
};
|
||||
EVENT_TRACE CurrentEvent;
|
||||
TRACE_LOGFILE_HEADER LogfileHeader;
|
||||
PEVENT_TRACE_BUFFER_CALLBACKA BufferCallback;
|
||||
ULONG BufferSize;
|
||||
ULONG Filled;
|
||||
ULONG EventsLost;
|
||||
union {
|
||||
PEVENT_CALLBACK EventCallback;
|
||||
PEVENT_RECORD_CALLBACK EventRecordCallback;
|
||||
};
|
||||
ULONG IsKernelTrace;
|
||||
PVOID Context;
|
||||
} EVENT_TRACE_LOGFILEA, *PEVENT_TRACE_LOGFILEA;
|
||||
|
||||
|
||||
typedef struct _EVENT_TRACE_LOGFILEW {
|
||||
LPWSTR LogFileName;
|
||||
LPWSTR LoggerName;
|
||||
LONGLONG CurrentTime;
|
||||
ULONG BuffersRead;
|
||||
union {
|
||||
ULONG LogFileMode;
|
||||
ULONG ProcessTraceMode;
|
||||
};
|
||||
EVENT_TRACE CurrentEvent;
|
||||
TRACE_LOGFILE_HEADER LogfileHeader;
|
||||
PEVENT_TRACE_BUFFER_CALLBACKW BufferCallback;
|
||||
ULONG BufferSize;
|
||||
ULONG Filled;
|
||||
ULONG EventsLost;
|
||||
union {
|
||||
PEVENT_CALLBACK EventCallback;
|
||||
PEVENT_RECORD_CALLBACK EventRecordCallback;
|
||||
};
|
||||
ULONG IsKernelTrace;
|
||||
PVOID Context;
|
||||
} EVENT_TRACE_LOGFILEW, *PEVENT_TRACE_LOGFILEW;
|
||||
|
||||
|
||||
typedef struct _EVENT_FILTER_DESCRIPTOR {
|
||||
ULONGLONG Ptr;
|
||||
ULONG Size;
|
||||
ULONG Type;
|
||||
} EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR;
|
||||
|
||||
|
||||
|
||||
typedef struct _ENABLE_TRACE_PARAMETERS {
|
||||
ULONG Version;
|
||||
ULONG EnableProperty;
|
||||
ULONG ControlFlags;
|
||||
GUID SourceId;
|
||||
PEVENT_FILTER_DESCRIPTOR EnableFilterDesc;
|
||||
ULONG FilterDescCount;
|
||||
} ENABLE_TRACE_PARAMETERS, *PENABLE_TRACE_PARAMETERS;
|
||||
|
||||
typedef struct _EVENT_DESCRIPTOR {
|
||||
USHORT Id;
|
||||
BYTE Version;
|
||||
BYTE Channel;
|
||||
BYTE Level;
|
||||
BYTE Opcode;
|
||||
USHORT Task;
|
||||
ULONGLONG Keyword;
|
||||
} EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR;
|
||||
|
||||
typedef struct _EVENT_HEADER {
|
||||
USHORT Size;
|
||||
USHORT HeaderType;
|
||||
USHORT Flags;
|
||||
USHORT EventProperty;
|
||||
ULONG ThreadId;
|
||||
ULONG ProcessId;
|
||||
LARGE_INTEGER TimeStamp;
|
||||
GUID ProviderId;
|
||||
EVENT_DESCRIPTOR EventDescriptor;
|
||||
union {
|
||||
struct {
|
||||
ULONG KernelTime;
|
||||
ULONG UserTime;
|
||||
} DUMMYSTRUCTNAME;
|
||||
ULONG64 ProcessorTime;
|
||||
} DUMMYUNIONNAME;
|
||||
GUID ActivityId;
|
||||
} EVENT_HEADER, *PEVENT_HEADER;
|
||||
|
||||
|
||||
typedef struct _EVENT_HEADER_EXTENDED_DATA_ITEM {
|
||||
USHORT Reserved1;
|
||||
USHORT ExtType;
|
||||
struct {
|
||||
USHORT Linkage : 1;
|
||||
USHORT Reserved2 : 15;
|
||||
};
|
||||
USHORT DataSize;
|
||||
ULONGLONG DataPtr;
|
||||
} EVENT_HEADER_EXTENDED_DATA_ITEM, *PEVENT_HEADER_EXTENDED_DATA_ITEM;
|
||||
|
||||
typedef struct _EVENT_RECORD {
|
||||
EVENT_HEADER EventHeader;
|
||||
ETW_BUFFER_CONTEXT BufferContext;
|
||||
USHORT ExtendedDataCount;
|
||||
USHORT UserDataLength;
|
||||
PEVENT_HEADER_EXTENDED_DATA_ITEM ExtendedData;
|
||||
PVOID UserData;
|
||||
PVOID UserContext;
|
||||
} EVENT_RECORD, *PEVENT_RECORD;
|
||||
@@ -5,4 +5,4 @@ typedef struct _GUID {
|
||||
USHORT Data2;
|
||||
USHORT Data3;
|
||||
BYTE Data4[ 8 ];
|
||||
} GUID, IID, CLSID, *REFIID, *REFCLSID, *LPGUID, *REFGUID, *LPCLSID;
|
||||
} GUID, IID, CLSID, *REFIID, *REFCLSID, *LPGUID, *REFGUID, *LPCLSID, *LPCGUID;
|
||||
@@ -14,169 +14,130 @@ typedef enum _PROCESS_MITIGATION_POLICY {
|
||||
|
||||
// DEP Policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD {
|
||||
DWORD Enable : 1;
|
||||
DWORD DisableAtlThunkEmulation : 1;
|
||||
DWORD ReservedFlags : 30;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD anon;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_DEP_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_DEP_POLICY_UNION anon;
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD Enable : 1;
|
||||
DWORD DisableAtlThunkEmulation : 1;
|
||||
DWORD ReservedFlags : 30;
|
||||
};
|
||||
};
|
||||
BOOLEAN Permanent;
|
||||
} PROCESS_MITIGATION_DEP_POLICY, *PPROCESS_MITIGATION_DEP_POLICY;
|
||||
|
||||
|
||||
// ASLR policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD {
|
||||
typedef struct _PROCESS_MITIGATION_ASLR_POLICY {
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD EnableBottomUpRandomization : 1;
|
||||
DWORD EnableForceRelocateImages : 1;
|
||||
DWORD EnableHighEntropy : 1;
|
||||
DWORD DisallowStrippedImages : 1;
|
||||
DWORD ReservedFlags : 28;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD anon;
|
||||
};
|
||||
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_ASLR_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION anon;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_ASLR_POLICY, *PPROCESS_MITIGATION_ASLR_POLICY;
|
||||
|
||||
// Dynamic code policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD {
|
||||
DWORD ProhibitDynamicCode :1;
|
||||
DWORD AllowThreadOptOut :1;
|
||||
DWORD AllowRemoteDowngrade :1;
|
||||
DWORD ReservedFlags :30;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD anon;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION anon;
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD ProhibitDynamicCode : 1;
|
||||
DWORD AllowThreadOptOut : 1;
|
||||
DWORD AllowRemoteDowngrade : 1;
|
||||
DWORD AuditProhibitDynamicCode : 1;
|
||||
DWORD ReservedFlags : 28;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, *PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY;
|
||||
|
||||
|
||||
//Strict handle policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD {
|
||||
DWORD RaiseExceptionOnInvalidHandleReference : 1;
|
||||
DWORD HandleExceptionsPermanentlyEnabled : 1;
|
||||
DWORD ReservedFlags : 30;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION anon;
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD RaiseExceptionOnInvalidHandleReference : 1;
|
||||
DWORD HandleExceptionsPermanentlyEnabled : 1;
|
||||
DWORD ReservedFlags : 30;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, *PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY;
|
||||
|
||||
|
||||
|
||||
// System Call policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD {
|
||||
DWORD DisallowWin32kSystemCalls : 1;
|
||||
DWORD ReservedFlags : 31;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION anon;
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD DisallowWin32kSystemCalls : 1;
|
||||
DWORD AuditDisallowWin32kSystemCalls : 1;
|
||||
DWORD ReservedFlags : 30;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, *PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY;
|
||||
|
||||
|
||||
// EXTENSION POINT policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD {
|
||||
DWORD DisableExtensionPoints : 1;
|
||||
DWORD ReservedFlags : 31;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION anon;
|
||||
union {
|
||||
DWORD Flags;
|
||||
struct {
|
||||
DWORD DisableExtensionPoints : 1;
|
||||
DWORD ReservedFlags : 31;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;
|
||||
|
||||
|
||||
// CFG policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD {
|
||||
DWORD EnableControlFlowGuard :1;
|
||||
DWORD EnableExportSuppression :1;
|
||||
DWORD StrictMode :1;
|
||||
DWORD ReservedFlags :29;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION {
|
||||
typedef struct _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY {
|
||||
union {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION anon;
|
||||
struct {
|
||||
DWORD EnableControlFlowGuard : 1;
|
||||
DWORD EnableExportSuppression : 1;
|
||||
DWORD StrictMode : 1;
|
||||
DWORD ReservedFlags : 29;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, *PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY;
|
||||
|
||||
|
||||
// BINARY SIGNATURE policy
|
||||
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD {
|
||||
DWORD MicrosoftSignedOnly :1;
|
||||
DWORD StoreSignedOnly :1;
|
||||
DWORD MitigationOptIn :1;
|
||||
DWORD ReservedFlags :29;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION {
|
||||
typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY {
|
||||
union {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION anon;
|
||||
struct {
|
||||
DWORD MicrosoftSignedOnly : 1;
|
||||
DWORD StoreSignedOnly : 1;
|
||||
DWORD MitigationOptIn : 1;
|
||||
DWORD AuditMicrosoftSignedOnly : 1;
|
||||
DWORD AuditStoreSignedOnly : 1;
|
||||
DWORD ReservedFlags : 27;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, *PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY;
|
||||
|
||||
|
||||
// Font disable policy
|
||||
|
||||
struct _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD {
|
||||
DWORD NoRemoteImages :1;
|
||||
DWORD NoLowMandatoryLabelImages :1;
|
||||
DWORD PreferSystem32Images :1;
|
||||
DWORD ReservedFlags :29;
|
||||
};
|
||||
|
||||
union _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION {
|
||||
typedef struct _PROCESS_MITIGATION_IMAGE_LOAD_POLICY {
|
||||
union {
|
||||
DWORD Flags;
|
||||
_ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD ANON_STRUCT;
|
||||
};
|
||||
|
||||
typedef struct _PROCESS_MITIGATION_IMAGE_LOAD_POLICY {
|
||||
_ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION anon;
|
||||
} PROCESS_MITIGATION_IMAGE_LOAD_POLICY, *PPROCESS_MITIGATION_IMAGE_LOAD_POLICY;
|
||||
struct {
|
||||
DWORD NoRemoteImages : 1;
|
||||
DWORD NoLowMandatoryLabelImages : 1;
|
||||
DWORD PreferSystem32Images : 1;
|
||||
DWORD AuditNoRemoteImages : 1;
|
||||
DWORD AuditNoLowMandatoryLabelImages : 1;
|
||||
DWORD ReservedFlags : 27;
|
||||
};
|
||||
};
|
||||
} PROCESS_MITIGATION_IMAGE_LOAD_POLICY, *PPROCESS_MITIGATION_IMAGE_LOAD_POLICY;
|
||||
@@ -0,0 +1,822 @@
|
||||
typedef enum _TCP_TABLE_CLASS {
|
||||
TCP_TABLE_BASIC_LISTENER,
|
||||
TCP_TABLE_BASIC_CONNECTIONS,
|
||||
TCP_TABLE_BASIC_ALL,
|
||||
TCP_TABLE_OWNER_PID_LISTENER,
|
||||
TCP_TABLE_OWNER_PID_CONNECTIONS,
|
||||
TCP_TABLE_OWNER_PID_ALL,
|
||||
TCP_TABLE_OWNER_MODULE_LISTENER,
|
||||
TCP_TABLE_OWNER_MODULE_CONNECTIONS,
|
||||
TCP_TABLE_OWNER_MODULE_ALL
|
||||
} TCP_TABLE_CLASS;
|
||||
|
||||
typedef enum _MIB_TCP_STATE{
|
||||
MIB_TCP_STATE_CLOSED = 1,
|
||||
MIB_TCP_STATE_LISTEN = 2,
|
||||
MIB_TCP_STATE_SYN_SENT = 3,
|
||||
MIB_TCP_STATE_SYN_RCVD = 4,
|
||||
MIB_TCP_STATE_ESTAB = 5,
|
||||
MIB_TCP_STATE_FIN_WAIT1 = 6,
|
||||
MIB_TCP_STATE_FIN_WAIT2 = 7,
|
||||
MIB_TCP_STATE_CLOSE_WAIT = 8,
|
||||
MIB_TCP_STATE_CLOSING = 9,
|
||||
MIB_TCP_STATE_LAST_ACK = 10,
|
||||
MIB_TCP_STATE_TIME_WAIT = 11,
|
||||
MIB_TCP_STATE_DELETE_TCB = 12,
|
||||
} MIB_TCP_STATE;
|
||||
|
||||
typedef enum NET_FW_IP_PROTOCOL_ {
|
||||
NET_FW_IP_PROTOCOL_TCP = 6,
|
||||
NET_FW_IP_PROTOCOL_UDP = 17,
|
||||
NET_FW_IP_PROTOCOL_ANY = 256
|
||||
} NET_FW_IP_PROTOCOL;
|
||||
|
||||
|
||||
typedef struct {
|
||||
ULONGLONG IP6Qword[2]; // Was QWORD
|
||||
} IP6_ADDRESS, *PIP6_ADDRESS;
|
||||
|
||||
typedef struct _MIB_IPADDRROW_XP {
|
||||
DWORD dwAddr;
|
||||
IF_INDEX dwIndex;
|
||||
DWORD dwMask;
|
||||
DWORD dwBCastAddr;
|
||||
DWORD dwReasmSize;
|
||||
USHORT unused1;
|
||||
USHORT wType;
|
||||
} MIB_IPADDRROW, MIB_IPADDRROW_XP, *PMIB_IPADDRROW_XP;
|
||||
|
||||
typedef struct _MIB_IPADDRTABLE {
|
||||
DWORD dwNumEntries;
|
||||
MIB_IPADDRROW table[ANY_SIZE];
|
||||
} MIB_IPADDRTABLE, *PMIB_IPADDRTABLE;
|
||||
|
||||
|
||||
typedef enum _INTERNAL_IF_OPER_STATUS {
|
||||
IF_OPER_STATUS_NON_OPERATIONAL = 0,
|
||||
IF_OPER_STATUS_UNREACHABLE = 1,
|
||||
IF_OPER_STATUS_DISCONNECTED = 2,
|
||||
IF_OPER_STATUS_CONNECTING = 3,
|
||||
IF_OPER_STATUS_CONNECTED = 4,
|
||||
IF_OPER_STATUS_OPERATIONAL = 5,
|
||||
} INTERNAL_IF_OPER_STATUS;
|
||||
|
||||
typedef struct _MIB_IFROW {
|
||||
WCHAR wszName[MAX_INTERFACE_NAME_LEN];
|
||||
IF_INDEX dwIndex;
|
||||
IFTYPE dwType;
|
||||
DWORD dwMtu;
|
||||
DWORD dwSpeed;
|
||||
DWORD dwPhysAddrLen;
|
||||
BYTE bPhysAddr[MAXLEN_PHYSADDR];
|
||||
DWORD dwAdminStatus;
|
||||
INTERNAL_IF_OPER_STATUS dwOperStatus;
|
||||
DWORD dwLastChange;
|
||||
DWORD dwInOctets;
|
||||
DWORD dwInUcastPkts;
|
||||
DWORD dwInNUcastPkts;
|
||||
DWORD dwInDiscards;
|
||||
DWORD dwInErrors;
|
||||
DWORD dwInUnknownProtos;
|
||||
DWORD dwOutOctets;
|
||||
DWORD dwOutUcastPkts;
|
||||
DWORD dwOutNUcastPkts;
|
||||
DWORD dwOutDiscards;
|
||||
DWORD dwOutErrors;
|
||||
DWORD dwOutQLen;
|
||||
DWORD dwDescrLen;
|
||||
UCHAR bDescr[MAXLEN_IFDESCR];
|
||||
} MIB_IFROW, *PMIB_IFROW;
|
||||
|
||||
typedef struct _MIB_IFTABLE {
|
||||
DWORD dwNumEntries;
|
||||
MIB_IFROW table[ANY_SIZE];
|
||||
} MIB_IFTABLE, *PMIB_IFTABLE;
|
||||
|
||||
|
||||
typedef struct _MIB_TCPROW_OWNER_PID {
|
||||
DWORD dwState;
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwRemoteAddr;
|
||||
DWORD dwRemotePort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_TCPROW_OWNER_PID, *PMIB_TCPROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCPTABLE_OWNER_PID{
|
||||
DWORD dwNumEntries;
|
||||
MIB_TCPROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_TCPTABLE_OWNER_PID, *PMIB_TCPTABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDPROW_OWNER_PID {
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_UDPROW_OWNER_PID, *PMIB_UDPROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDPTABLE_OWNER_PID {
|
||||
DWORD dwNumEntries;
|
||||
MIB_UDPROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_UDPTABLE_OWNER_PID, *PMIB_UDPTABLE_OWNER_PID;
|
||||
|
||||
|
||||
typedef struct _MIB_UDP6ROW_OWNER_PID {
|
||||
UCHAR ucLocalAddr[16];
|
||||
DWORD dwLocalScopeId;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_UDP6ROW_OWNER_PID, *PMIB_UDP6ROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDP6TABLE_OWNER_PID{
|
||||
DWORD dwNumEntries;
|
||||
MIB_UDP6ROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_UDP6TABLE_OWNER_PID, *PMIB_UDP6TABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCP6ROW_OWNER_PID {
|
||||
UCHAR ucLocalAddr[16];
|
||||
DWORD dwLocalScopeId;
|
||||
DWORD dwLocalPort;
|
||||
UCHAR ucRemoteAddr[16];
|
||||
DWORD dwRemoteScopeId;
|
||||
DWORD dwRemotePort;
|
||||
DWORD dwState;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_TCP6ROW_OWNER_PID, *PMIB_TCP6ROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCP6TABLE_OWNER_PID {
|
||||
DWORD dwNumEntries;
|
||||
MIB_TCP6ROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_TCP6TABLE_OWNER_PID, *PMIB_TCP6TABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCPROW {
|
||||
DWORD dwState;
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwRemoteAddr;
|
||||
DWORD dwRemotePort;
|
||||
} MIB_TCPROW, *PMIB_TCPROW;
|
||||
|
||||
typedef struct _IP_ADAPTER_INDEX_MAP {
|
||||
ULONG Index;
|
||||
WCHAR Name[MAX_ADAPTER_NAME];
|
||||
} IP_ADAPTER_INDEX_MAP, *PIP_ADAPTER_INDEX_MAP;
|
||||
|
||||
typedef struct _IP_INTERFACE_INFO {
|
||||
LONG NumAdapters;
|
||||
IP_ADAPTER_INDEX_MAP Adapter[1];
|
||||
} IP_INTERFACE_INFO, *PIP_INTERFACE_INFO;
|
||||
|
||||
// DNS stuff
|
||||
|
||||
typedef enum
|
||||
{
|
||||
DnsFreeFlat = 0,
|
||||
DnsFreeRecordList,
|
||||
DnsFreeParsedMessageFields
|
||||
}
|
||||
DNS_FREE_TYPE;
|
||||
|
||||
typedef struct _DNS_CACHE_ENTRY
|
||||
{
|
||||
struct _DNS_CACHE_ENTRY* pNext;
|
||||
PCWSTR pszName;
|
||||
USHORT wType;
|
||||
USHORT wDataLength;
|
||||
ULONG dwFlags;
|
||||
} DNS_CACHE_ENTRY, *PDNS_CACHE_ENTRY;
|
||||
|
||||
|
||||
typedef struct {
|
||||
IP4_ADDRESS IpAddress;
|
||||
} DNS_A_DATA, *PDNS_A_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameHost;
|
||||
}
|
||||
DNS_PTR_DATAW, *PDNS_PTR_DATAW;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameHost;
|
||||
}
|
||||
DNS_PTR_DATAA, *PDNS_PTR_DATAA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNamePrimaryServer;
|
||||
PWSTR pNameAdministrator;
|
||||
DWORD dwSerialNo;
|
||||
DWORD dwRefresh;
|
||||
DWORD dwRetry;
|
||||
DWORD dwExpire;
|
||||
DWORD dwDefaultTtl;
|
||||
}
|
||||
DNS_SOA_DATAW, *PDNS_SOA_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNamePrimaryServer;
|
||||
PSTR pNameAdministrator;
|
||||
DWORD dwSerialNo;
|
||||
DWORD dwRefresh;
|
||||
DWORD dwRetry;
|
||||
DWORD dwExpire;
|
||||
DWORD dwDefaultTtl;
|
||||
}
|
||||
DNS_SOA_DATAA, *PDNS_SOA_DATAA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameMailbox;
|
||||
PWSTR pNameErrorsMailbox;
|
||||
}
|
||||
DNS_MINFO_DATAW, *PDNS_MINFO_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameMailbox;
|
||||
PSTR pNameErrorsMailbox;
|
||||
}
|
||||
DNS_MINFO_DATAA, *PDNS_MINFO_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameExchange;
|
||||
WORD wPreference;
|
||||
WORD Pad; // keep ptrs DWORD aligned
|
||||
}
|
||||
DNS_MX_DATAW, *PDNS_MX_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameExchange;
|
||||
WORD wPreference;
|
||||
WORD Pad; // keep ptrs DWORD aligned
|
||||
}
|
||||
DNS_MX_DATAA, *PDNS_MX_DATAA;
|
||||
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwStringCount;
|
||||
PWSTR pStringArray[1];
|
||||
}
|
||||
DNS_TXT_DATAW, *PDNS_TXT_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwStringCount;
|
||||
PSTR pStringArray[1];
|
||||
}
|
||||
DNS_TXT_DATAA, *PDNS_TXT_DATAA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwByteCount;
|
||||
BYTE Data[1];
|
||||
}
|
||||
DNS_NULL_DATA, *PDNS_NULL_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
IP4_ADDRESS IpAddress;
|
||||
UCHAR chProtocol;
|
||||
BYTE BitMask[1];
|
||||
}
|
||||
DNS_WKS_DATA, *PDNS_WKS_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
IP6_ADDRESS Ip6Address;
|
||||
}
|
||||
DNS_AAAA_DATA, *PDNS_AAAA_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wTypeCovered;
|
||||
BYTE chAlgorithm;
|
||||
BYTE chLabelCount;
|
||||
DWORD dwOriginalTtl;
|
||||
DWORD dwExpiration;
|
||||
DWORD dwTimeSigned;
|
||||
WORD wKeyTag;
|
||||
WORD wSignatureLength;
|
||||
PWSTR pNameSigner;
|
||||
BYTE Signature[1];
|
||||
}
|
||||
DNS_SIG_DATAW, *PDNS_SIG_DATAW, DNS_RRSIG_DATAW, *PDNS_RRSIG_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wTypeCovered;
|
||||
BYTE chAlgorithm;
|
||||
BYTE chLabelCount;
|
||||
DWORD dwOriginalTtl;
|
||||
DWORD dwExpiration;
|
||||
DWORD dwTimeSigned;
|
||||
WORD wKeyTag;
|
||||
WORD wSignatureLength;
|
||||
PSTR pNameSigner;
|
||||
BYTE Signature[1];
|
||||
}
|
||||
DNS_SIG_DATAA, *PDNS_SIG_DATAA, DNS_RRSIG_DATAA, *PDNS_RRSIG_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wFlags;
|
||||
BYTE chProtocol;
|
||||
BYTE chAlgorithm;
|
||||
WORD wKeyLength;
|
||||
WORD wPad; // keep byte field aligned
|
||||
BYTE Key[1];
|
||||
}
|
||||
DNS_KEY_DATA, *PDNS_KEY_DATA, DNS_DNSKEY_DATA, *PDNS_DNSKEY_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwByteCount;
|
||||
BYTE DHCID[1];
|
||||
}
|
||||
DNS_DHCID_DATA, *PDNS_DHCID_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNextDomainName;
|
||||
WORD wTypeBitMapsLength;
|
||||
WORD wPad; // keep byte field aligned
|
||||
BYTE TypeBitMaps[1];
|
||||
}
|
||||
DNS_NSEC_DATAW, *PDNS_NSEC_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNextDomainName;
|
||||
WORD wTypeBitMapsLength;
|
||||
WORD wPad; // keep byte field aligned
|
||||
BYTE TypeBitMaps[1];
|
||||
}
|
||||
DNS_NSEC_DATAA, *PDNS_NSEC_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
BYTE chAlgorithm;
|
||||
BYTE bFlags;
|
||||
WORD wIterations;
|
||||
BYTE bSaltLength;
|
||||
BYTE bHashLength;
|
||||
WORD wTypeBitMapsLength;
|
||||
BYTE chData[1];
|
||||
}
|
||||
DNS_NSEC3_DATA, *PDNS_NSEC3_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
BYTE chAlgorithm;
|
||||
BYTE bFlags;
|
||||
WORD wIterations;
|
||||
BYTE bSaltLength;
|
||||
BYTE bPad[3]; // keep salt field aligned
|
||||
BYTE pbSalt[1];
|
||||
}
|
||||
DNS_NSEC3PARAM_DATA, *PDNS_NSEC3PARAM_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wKeyTag;
|
||||
BYTE chAlgorithm;
|
||||
BYTE chDigestType;
|
||||
WORD wDigestLength;
|
||||
WORD wPad; // keep byte field aligned
|
||||
BYTE Digest[1];
|
||||
}
|
||||
DNS_DS_DATA, *PDNS_DS_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wDataLength;
|
||||
WORD wPad; // keep byte field aligned
|
||||
BYTE Data[1];
|
||||
}
|
||||
DNS_OPT_DATA, *PDNS_OPT_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wVersion;
|
||||
WORD wSize;
|
||||
WORD wHorPrec;
|
||||
WORD wVerPrec;
|
||||
DWORD dwLatitude;
|
||||
DWORD dwLongitude;
|
||||
DWORD dwAltitude;
|
||||
}
|
||||
DNS_LOC_DATA, *PDNS_LOC_DATA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameNext;
|
||||
WORD wNumTypes;
|
||||
WORD wTypes[1];
|
||||
}
|
||||
DNS_NXT_DATAW, *PDNS_NXT_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameNext;
|
||||
WORD wNumTypes;
|
||||
WORD wTypes[1];
|
||||
}
|
||||
DNS_NXT_DATAA, *PDNS_NXT_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameTarget;
|
||||
WORD wPriority;
|
||||
WORD wWeight;
|
||||
WORD wPort;
|
||||
WORD Pad; // keep ptrs DWORD aligned
|
||||
}
|
||||
DNS_SRV_DATAW, *PDNS_SRV_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameTarget;
|
||||
WORD wPriority;
|
||||
WORD wWeight;
|
||||
WORD wPort;
|
||||
WORD Pad; // keep ptrs DWORD aligned
|
||||
}
|
||||
DNS_SRV_DATAA, *PDNS_SRV_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wOrder;
|
||||
WORD wPreference;
|
||||
PWSTR pFlags;
|
||||
PWSTR pService;
|
||||
PWSTR pRegularExpression;
|
||||
PWSTR pReplacement;
|
||||
}
|
||||
DNS_NAPTR_DATAW, *PDNS_NAPTR_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD wOrder;
|
||||
WORD wPreference;
|
||||
PSTR pFlags;
|
||||
PSTR pService;
|
||||
PSTR pRegularExpression;
|
||||
PSTR pReplacement;
|
||||
}
|
||||
DNS_NAPTR_DATAA, *PDNS_NAPTR_DATAA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
BYTE AddressType;
|
||||
BYTE Address[ DNS_ATMA_MAX_ADDR_LENGTH ];
|
||||
|
||||
// E164 -- Null terminated string of less than
|
||||
// DNS_ATMA_MAX_ADDR_LENGTH
|
||||
//
|
||||
// For NSAP (AESA) BCD encoding of exactly
|
||||
// DNS_ATMA_AESA_ADDR_LENGTH
|
||||
}
|
||||
DNS_ATMA_DATA, *PDNS_ATMA_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameAlgorithm;
|
||||
PBYTE pAlgorithmPacket;
|
||||
PBYTE pKey;
|
||||
PBYTE pOtherData;
|
||||
DWORD dwCreateTime;
|
||||
DWORD dwExpireTime;
|
||||
WORD wMode;
|
||||
WORD wError;
|
||||
WORD wKeyLength;
|
||||
WORD wOtherLength;
|
||||
UCHAR cAlgNameLength;
|
||||
BOOL bPacketPointers;
|
||||
}
|
||||
DNS_TKEY_DATAW, *PDNS_TKEY_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameAlgorithm;
|
||||
PBYTE pAlgorithmPacket;
|
||||
PBYTE pKey;
|
||||
PBYTE pOtherData;
|
||||
DWORD dwCreateTime;
|
||||
DWORD dwExpireTime;
|
||||
WORD wMode;
|
||||
WORD wError;
|
||||
WORD wKeyLength;
|
||||
WORD wOtherLength;
|
||||
UCHAR cAlgNameLength;
|
||||
BOOL bPacketPointers;
|
||||
}
|
||||
DNS_TKEY_DATAA, *PDNS_TKEY_DATAA;
|
||||
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PWSTR pNameAlgorithm;
|
||||
PBYTE pAlgorithmPacket;
|
||||
PBYTE pSignature;
|
||||
PBYTE pOtherData;
|
||||
LONGLONG i64CreateTime;
|
||||
WORD wFudgeTime;
|
||||
WORD wOriginalXid;
|
||||
WORD wError;
|
||||
WORD wSigLength;
|
||||
WORD wOtherLength;
|
||||
UCHAR cAlgNameLength;
|
||||
BOOL bPacketPointers;
|
||||
}
|
||||
DNS_TSIG_DATAW, *PDNS_TSIG_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
PSTR pNameAlgorithm;
|
||||
PBYTE pAlgorithmPacket;
|
||||
PBYTE pSignature;
|
||||
PBYTE pOtherData;
|
||||
LONGLONG i64CreateTime;
|
||||
WORD wFudgeTime;
|
||||
WORD wOriginalXid;
|
||||
WORD wError;
|
||||
WORD wSigLength;
|
||||
WORD wOtherLength;
|
||||
UCHAR cAlgNameLength;
|
||||
BOOL bPacketPointers;
|
||||
}
|
||||
DNS_TSIG_DATAA, *PDNS_TSIG_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwMappingFlag;
|
||||
DWORD dwLookupTimeout;
|
||||
DWORD dwCacheTimeout;
|
||||
DWORD cWinsServerCount;
|
||||
IP4_ADDRESS WinsServers[1];
|
||||
}
|
||||
DNS_WINS_DATA, *PDNS_WINS_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwMappingFlag;
|
||||
DWORD dwLookupTimeout;
|
||||
DWORD dwCacheTimeout;
|
||||
PWSTR pNameResultDomain;
|
||||
}
|
||||
DNS_WINSR_DATAW, *PDNS_WINSR_DATAW;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwMappingFlag;
|
||||
DWORD dwLookupTimeout;
|
||||
DWORD dwCacheTimeout;
|
||||
PSTR pNameResultDomain;
|
||||
}
|
||||
DNS_WINSR_DATAA, *PDNS_WINSR_DATAA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
BYTE bCertUsage;
|
||||
BYTE bSelector;
|
||||
BYTE bMatchingType;
|
||||
WORD bCertificateAssociationDataLength;
|
||||
BYTE bPad[3]; // keep certificate association data field a ligned
|
||||
BYTE bCertificateAssociationData[1];
|
||||
} DNS_TLSA_DATA, *PDNS_TLSA_DATA;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
DWORD dwByteCount;
|
||||
BYTE bData[1];
|
||||
}
|
||||
DNS_UNKNOWN_DATA, *PDNS_UNKNOWN_DATA;
|
||||
|
||||
|
||||
typedef struct _DnsRecordFlags
|
||||
{
|
||||
DWORD Section : 2;
|
||||
DWORD Delete : 1;
|
||||
DWORD CharSet : 2;
|
||||
DWORD Unused : 3;
|
||||
|
||||
DWORD Reserved : 24;
|
||||
}
|
||||
DNS_RECORD_FLAGS;
|
||||
|
||||
|
||||
typedef struct _DnsRecordA {
|
||||
struct _DnsRecordA *pNext;
|
||||
PSTR pName;
|
||||
WORD wType;
|
||||
WORD wDataLength;
|
||||
union {
|
||||
DWORD DW;
|
||||
DNS_RECORD_FLAGS S;
|
||||
} Flags;
|
||||
DWORD dwTtl;
|
||||
DWORD dwReserved;
|
||||
union {
|
||||
DNS_A_DATA A;
|
||||
DNS_SOA_DATAA SOA;
|
||||
DNS_SOA_DATAA Soa;
|
||||
DNS_PTR_DATAA PTR;
|
||||
DNS_PTR_DATAA Ptr;
|
||||
DNS_PTR_DATAA NS;
|
||||
DNS_PTR_DATAA Ns;
|
||||
DNS_PTR_DATAA CNAME;
|
||||
DNS_PTR_DATAA Cname;
|
||||
DNS_PTR_DATAA DNAME;
|
||||
DNS_PTR_DATAA Dname;
|
||||
DNS_PTR_DATAA MB;
|
||||
DNS_PTR_DATAA Mb;
|
||||
DNS_PTR_DATAA MD;
|
||||
DNS_PTR_DATAA Md;
|
||||
DNS_PTR_DATAA MF;
|
||||
DNS_PTR_DATAA Mf;
|
||||
DNS_PTR_DATAA MG;
|
||||
DNS_PTR_DATAA Mg;
|
||||
DNS_PTR_DATAA MR;
|
||||
DNS_PTR_DATAA Mr;
|
||||
DNS_MINFO_DATAA MINFO;
|
||||
DNS_MINFO_DATAA Minfo;
|
||||
DNS_MINFO_DATAA RP;
|
||||
DNS_MINFO_DATAA Rp;
|
||||
DNS_MX_DATAA MX;
|
||||
DNS_MX_DATAA Mx;
|
||||
DNS_MX_DATAA AFSDB;
|
||||
DNS_MX_DATAA Afsdb;
|
||||
DNS_MX_DATAA RT;
|
||||
DNS_MX_DATAA Rt;
|
||||
DNS_TXT_DATAA HINFO;
|
||||
DNS_TXT_DATAA Hinfo;
|
||||
DNS_TXT_DATAA ISDN;
|
||||
DNS_TXT_DATAA Isdn;
|
||||
DNS_TXT_DATAA TXT;
|
||||
DNS_TXT_DATAA Txt;
|
||||
DNS_TXT_DATAA X25;
|
||||
DNS_NULL_DATA Null;
|
||||
DNS_WKS_DATA WKS;
|
||||
DNS_WKS_DATA Wks;
|
||||
DNS_AAAA_DATA AAAA;
|
||||
DNS_KEY_DATA KEY;
|
||||
DNS_KEY_DATA Key;
|
||||
DNS_SIG_DATAA SIG;
|
||||
DNS_SIG_DATAA Sig;
|
||||
DNS_ATMA_DATA ATMA;
|
||||
DNS_ATMA_DATA Atma;
|
||||
DNS_NXT_DATAA NXT;
|
||||
DNS_NXT_DATAA Nxt;
|
||||
DNS_SRV_DATAA SRV;
|
||||
DNS_SRV_DATAA Srv;
|
||||
DNS_NAPTR_DATAA NAPTR;
|
||||
DNS_NAPTR_DATAA Naptr;
|
||||
DNS_OPT_DATA OPT;
|
||||
DNS_OPT_DATA Opt;
|
||||
DNS_DS_DATA DS;
|
||||
DNS_DS_DATA Ds;
|
||||
DNS_RRSIG_DATAA RRSIG;
|
||||
DNS_RRSIG_DATAA Rrsig;
|
||||
DNS_NSEC_DATAA NSEC;
|
||||
DNS_NSEC_DATAA Nsec;
|
||||
DNS_DNSKEY_DATA DNSKEY;
|
||||
DNS_DNSKEY_DATA Dnskey;
|
||||
DNS_TKEY_DATAA TKEY;
|
||||
DNS_TKEY_DATAA Tkey;
|
||||
DNS_TSIG_DATAA TSIG;
|
||||
DNS_TSIG_DATAA Tsig;
|
||||
DNS_WINS_DATA WINS;
|
||||
DNS_WINS_DATA Wins;
|
||||
DNS_WINSR_DATAA WINSR;
|
||||
DNS_WINSR_DATAA WinsR;
|
||||
DNS_WINSR_DATAA NBSTAT;
|
||||
DNS_WINSR_DATAA Nbstat;
|
||||
DNS_DHCID_DATA DHCID;
|
||||
DNS_NSEC3_DATA NSEC3;
|
||||
DNS_NSEC3_DATA Nsec3;
|
||||
DNS_NSEC3PARAM_DATA NSEC3PARAM;
|
||||
DNS_NSEC3PARAM_DATA Nsec3Param;
|
||||
DNS_TLSA_DATA TLSA;
|
||||
DNS_TLSA_DATA Tlsa;
|
||||
DNS_UNKNOWN_DATA UNKNOWN;
|
||||
DNS_UNKNOWN_DATA Unknown;
|
||||
PBYTE pDataPtr;
|
||||
} Data;
|
||||
} DNS_RECORDA, *PDNS_RECORDA;
|
||||
|
||||
|
||||
typedef struct _DnsRecordW {
|
||||
struct _DnsRecordW *pNext;
|
||||
PWSTR pName;
|
||||
WORD wType;
|
||||
WORD wDataLength;
|
||||
union {
|
||||
DWORD DW;
|
||||
DNS_RECORD_FLAGS S;
|
||||
} Flags;
|
||||
DWORD dwTtl;
|
||||
DWORD dwReserved;
|
||||
union {
|
||||
DNS_A_DATA A;
|
||||
DNS_SOA_DATAW SOA;
|
||||
DNS_SOA_DATAW Soa;
|
||||
DNS_PTR_DATAW PTR;
|
||||
DNS_PTR_DATAW Ptr;
|
||||
DNS_PTR_DATAW NS;
|
||||
DNS_PTR_DATAW Ns;
|
||||
DNS_PTR_DATAW CNAME;
|
||||
DNS_PTR_DATAW Cname;
|
||||
DNS_PTR_DATAW DNAME;
|
||||
DNS_PTR_DATAW Dname;
|
||||
DNS_PTR_DATAW MB;
|
||||
DNS_PTR_DATAW Mb;
|
||||
DNS_PTR_DATAW MD;
|
||||
DNS_PTR_DATAW Md;
|
||||
DNS_PTR_DATAW MF;
|
||||
DNS_PTR_DATAW Mf;
|
||||
DNS_PTR_DATAW MG;
|
||||
DNS_PTR_DATAW Mg;
|
||||
DNS_PTR_DATAW MR;
|
||||
DNS_PTR_DATAW Mr;
|
||||
DNS_MINFO_DATAW MINFO;
|
||||
DNS_MINFO_DATAW Minfo;
|
||||
DNS_MINFO_DATAW RP;
|
||||
DNS_MINFO_DATAW Rp;
|
||||
DNS_MX_DATAW MX;
|
||||
DNS_MX_DATAW Mx;
|
||||
DNS_MX_DATAW AFSDB;
|
||||
DNS_MX_DATAW Afsdb;
|
||||
DNS_MX_DATAW RT;
|
||||
DNS_MX_DATAW Rt;
|
||||
DNS_TXT_DATAW HINFO;
|
||||
DNS_TXT_DATAW Hinfo;
|
||||
DNS_TXT_DATAW ISDN;
|
||||
DNS_TXT_DATAW Isdn;
|
||||
DNS_TXT_DATAW TXT;
|
||||
DNS_TXT_DATAW Txt;
|
||||
DNS_TXT_DATAW X25;
|
||||
DNS_NULL_DATA Null;
|
||||
DNS_WKS_DATA WKS;
|
||||
DNS_WKS_DATA Wks;
|
||||
DNS_AAAA_DATA AAAA;
|
||||
DNS_KEY_DATA KEY;
|
||||
DNS_KEY_DATA Key;
|
||||
DNS_SIG_DATAW SIG;
|
||||
DNS_SIG_DATAW Sig;
|
||||
DNS_ATMA_DATA ATMA;
|
||||
DNS_ATMA_DATA Atma;
|
||||
DNS_NXT_DATAW NXT;
|
||||
DNS_NXT_DATAW Nxt;
|
||||
DNS_SRV_DATAW SRV;
|
||||
DNS_SRV_DATAW Srv;
|
||||
DNS_NAPTR_DATAW NAPTR;
|
||||
DNS_NAPTR_DATAW Naptr;
|
||||
DNS_OPT_DATA OPT;
|
||||
DNS_OPT_DATA Opt;
|
||||
DNS_DS_DATA DS;
|
||||
DNS_DS_DATA Ds;
|
||||
DNS_RRSIG_DATAW RRSIG;
|
||||
DNS_RRSIG_DATAW Rrsig;
|
||||
DNS_NSEC_DATAW NSEC;
|
||||
DNS_NSEC_DATAW Nsec;
|
||||
DNS_DNSKEY_DATA DNSKEY;
|
||||
DNS_DNSKEY_DATA Dnskey;
|
||||
DNS_TKEY_DATAW TKEY;
|
||||
DNS_TKEY_DATAW Tkey;
|
||||
DNS_TSIG_DATAW TSIG;
|
||||
DNS_TSIG_DATAW Tsig;
|
||||
DNS_WINS_DATA WINS;
|
||||
DNS_WINS_DATA Wins;
|
||||
DNS_WINSR_DATAW WINSR;
|
||||
DNS_WINSR_DATAW WinsR;
|
||||
DNS_WINSR_DATAW NBSTAT;
|
||||
DNS_WINSR_DATAW Nbstat;
|
||||
DNS_DHCID_DATA DHCID;
|
||||
DNS_NSEC3_DATA NSEC3;
|
||||
DNS_NSEC3_DATA Nsec3;
|
||||
DNS_NSEC3PARAM_DATA NSEC3PARAM;
|
||||
DNS_NSEC3PARAM_DATA Nsec3Param;
|
||||
DNS_TLSA_DATA TLSA;
|
||||
DNS_TLSA_DATA Tlsa;
|
||||
DNS_UNKNOWN_DATA UNKNOWN;
|
||||
DNS_UNKNOWN_DATA Unknown;
|
||||
PBYTE pDataPtr;
|
||||
} Data;
|
||||
} DNS_RECORDW, *PDNS_RECORDW;
|
||||
@@ -31,4 +31,19 @@ typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
|
||||
ULONG Type;
|
||||
ULONG DataLength;
|
||||
UCHAR Data[1];
|
||||
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
|
||||
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
|
||||
|
||||
|
||||
typedef enum _KEY_INFORMATION_CLASS {
|
||||
KeyBasicInformation,
|
||||
KeyNodeInformation,
|
||||
KeyFullInformation,
|
||||
KeyNameInformation,
|
||||
KeyCachedInformation,
|
||||
KeyFlagsInformation,
|
||||
KeyVirtualizationInformation,
|
||||
KeyHandleTagsInformation,
|
||||
KeyTrustInformation,
|
||||
KeyLayerInformation,
|
||||
MaxKeyInfoClass
|
||||
} KEY_INFORMATION_CLASS;
|
||||
@@ -262,4 +262,19 @@ typedef struct _SECURITY_DESCRIPTOR {
|
||||
PSID Group;
|
||||
PACL Sacl;
|
||||
PACL Dacl;
|
||||
} SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
|
||||
} SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
|
||||
|
||||
|
||||
typedef struct _GENERIC_MAPPING {
|
||||
ACCESS_MASK GenericRead;
|
||||
ACCESS_MASK GenericWrite;
|
||||
ACCESS_MASK GenericExecute;
|
||||
ACCESS_MASK GenericAll;
|
||||
} GENERIC_MAPPING, *PGENERIC_MAPPING;
|
||||
|
||||
|
||||
typedef struct _PRIVILEGE_SET {
|
||||
DWORD PrivilegeCount;
|
||||
DWORD Control;
|
||||
LUID_AND_ATTRIBUTES Privilege[ANYSIZE_ARRAY];
|
||||
} PRIVILEGE_SET, *PPRIVILEGE_SET;
|
||||
@@ -0,0 +1,9 @@
|
||||
typedef struct _TIME_ZONE_INFORMATION {
|
||||
LONG Bias;
|
||||
WCHAR StandardName[32];
|
||||
SYSTEMTIME StandardDate;
|
||||
LONG StandardBias;
|
||||
WCHAR DaylightName[32];
|
||||
SYSTEMTIME DaylightDate;
|
||||
LONG DaylightBias;
|
||||
} TIME_ZONE_INFORMATION, *PTIME_ZONE_INFORMATION, *LPTIME_ZONE_INFORMATION;
|
||||
@@ -0,0 +1,12 @@
|
||||
typedef struct _TRACE_PROVIDER_INFO {
|
||||
GUID ProviderGuid;
|
||||
ULONG SchemaSource;
|
||||
ULONG ProviderNameOffset;
|
||||
} TRACE_PROVIDER_INFO;
|
||||
|
||||
|
||||
typedef struct _PROVIDER_ENUMERATION_INFO {
|
||||
ULONG NumberOfProviders;
|
||||
ULONG Reserved;
|
||||
TRACE_PROVIDER_INFO TraceProviderInfoArray[ANYSIZE_ARRAY];
|
||||
} PROVIDER_ENUMERATION_INFO, *PPROVIDER_ENUMERATION_INFO;
|
||||
@@ -122,7 +122,10 @@ typedef struct _PEB {
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03;
|
||||
PVOID _SYSTEM_DEPENDENT_04;
|
||||
_ANON_PEB_UNION_1 anon_union_1;
|
||||
union {
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
DWORD SystemReserved;
|
||||
DWORD _SYSTEM_DEPENDENT_05;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06;
|
||||
@@ -157,8 +160,10 @@ typedef struct _PEB {
|
||||
DWORD ImageSubsystem;
|
||||
DWORD ImageSubsystemMajorVersion;
|
||||
PVOID ImageSubsystemMinorVersion;
|
||||
|
||||
_ANON_PEB_UNION_2 anon_union_2;
|
||||
union {
|
||||
PVOID ImageProcessAffinityMask;
|
||||
PVOID ActiveProcessAffinityMask;
|
||||
};
|
||||
PVOID GdiHandleBuffer[26];
|
||||
BYTE GdiHandleBuffer2[32];
|
||||
PVOID PostProcessInitRoutine;
|
||||
@@ -483,17 +488,7 @@ typedef enum _THREAD_INFORMATION_CLASS {
|
||||
ThreadHideFromDebugger
|
||||
} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _TCP_TABLE_CLASS {
|
||||
TCP_TABLE_BASIC_LISTENER,
|
||||
TCP_TABLE_BASIC_CONNECTIONS,
|
||||
TCP_TABLE_BASIC_ALL,
|
||||
TCP_TABLE_OWNER_PID_LISTENER,
|
||||
TCP_TABLE_OWNER_PID_CONNECTIONS,
|
||||
TCP_TABLE_OWNER_PID_ALL,
|
||||
TCP_TABLE_OWNER_MODULE_LISTENER,
|
||||
TCP_TABLE_OWNER_MODULE_CONNECTIONS,
|
||||
TCP_TABLE_OWNER_MODULE_ALL
|
||||
} TCP_TABLE_CLASS;
|
||||
|
||||
|
||||
typedef enum _VARENUM{
|
||||
VT_EMPTY = 0,
|
||||
@@ -569,26 +564,6 @@ typedef enum NET_FW_PROFILE_TYPE2_ {
|
||||
NET_FW_PROFILE2_ALL = 0x7FFFFFFF
|
||||
} NET_FW_PROFILE_TYPE2;
|
||||
|
||||
typedef enum _MIB_TCP_STATE{
|
||||
MIB_TCP_STATE_CLOSED = 1,
|
||||
MIB_TCP_STATE_LISTEN = 2,
|
||||
MIB_TCP_STATE_SYN_SENT = 3,
|
||||
MIB_TCP_STATE_SYN_RCVD = 4,
|
||||
MIB_TCP_STATE_ESTAB = 5,
|
||||
MIB_TCP_STATE_FIN_WAIT1 = 6,
|
||||
MIB_TCP_STATE_FIN_WAIT2 = 7,
|
||||
MIB_TCP_STATE_CLOSE_WAIT = 8,
|
||||
MIB_TCP_STATE_CLOSING = 9,
|
||||
MIB_TCP_STATE_LAST_ACK = 10,
|
||||
MIB_TCP_STATE_TIME_WAIT = 11,
|
||||
MIB_TCP_STATE_DELETE_TCB = 12,
|
||||
} MIB_TCP_STATE;
|
||||
|
||||
typedef enum NET_FW_IP_PROTOCOL_ {
|
||||
NET_FW_IP_PROTOCOL_TCP = 6,
|
||||
NET_FW_IP_PROTOCOL_UDP = 17,
|
||||
NET_FW_IP_PROTOCOL_ANY = 256
|
||||
} NET_FW_IP_PROTOCOL;
|
||||
|
||||
|
||||
|
||||
@@ -1379,136 +1354,6 @@ typedef struct _OVERLAPPED {
|
||||
HANDLE hEvent;
|
||||
} OVERLAPPED, *LPOVERLAPPED;
|
||||
|
||||
typedef struct _MIB_IPADDRROW_XP {
|
||||
DWORD dwAddr;
|
||||
IF_INDEX dwIndex;
|
||||
DWORD dwMask;
|
||||
DWORD dwBCastAddr;
|
||||
DWORD dwReasmSize;
|
||||
USHORT unused1;
|
||||
USHORT wType;
|
||||
} MIB_IPADDRROW, MIB_IPADDRROW_XP, *PMIB_IPADDRROW_XP;
|
||||
|
||||
typedef struct _MIB_IPADDRTABLE {
|
||||
DWORD dwNumEntries;
|
||||
MIB_IPADDRROW table[ANY_SIZE];
|
||||
} MIB_IPADDRTABLE, *PMIB_IPADDRTABLE;
|
||||
|
||||
|
||||
typedef enum _INTERNAL_IF_OPER_STATUS {
|
||||
IF_OPER_STATUS_NON_OPERATIONAL = 0,
|
||||
IF_OPER_STATUS_UNREACHABLE = 1,
|
||||
IF_OPER_STATUS_DISCONNECTED = 2,
|
||||
IF_OPER_STATUS_CONNECTING = 3,
|
||||
IF_OPER_STATUS_CONNECTED = 4,
|
||||
IF_OPER_STATUS_OPERATIONAL = 5,
|
||||
} INTERNAL_IF_OPER_STATUS;
|
||||
|
||||
typedef struct _MIB_IFROW {
|
||||
WCHAR wszName[MAX_INTERFACE_NAME_LEN];
|
||||
IF_INDEX dwIndex;
|
||||
IFTYPE dwType;
|
||||
DWORD dwMtu;
|
||||
DWORD dwSpeed;
|
||||
DWORD dwPhysAddrLen;
|
||||
BYTE bPhysAddr[MAXLEN_PHYSADDR];
|
||||
DWORD dwAdminStatus;
|
||||
INTERNAL_IF_OPER_STATUS dwOperStatus;
|
||||
DWORD dwLastChange;
|
||||
DWORD dwInOctets;
|
||||
DWORD dwInUcastPkts;
|
||||
DWORD dwInNUcastPkts;
|
||||
DWORD dwInDiscards;
|
||||
DWORD dwInErrors;
|
||||
DWORD dwInUnknownProtos;
|
||||
DWORD dwOutOctets;
|
||||
DWORD dwOutUcastPkts;
|
||||
DWORD dwOutNUcastPkts;
|
||||
DWORD dwOutDiscards;
|
||||
DWORD dwOutErrors;
|
||||
DWORD dwOutQLen;
|
||||
DWORD dwDescrLen;
|
||||
UCHAR bDescr[MAXLEN_IFDESCR];
|
||||
} MIB_IFROW, *PMIB_IFROW;
|
||||
|
||||
typedef struct _MIB_IFTABLE {
|
||||
DWORD dwNumEntries;
|
||||
MIB_IFROW table[ANY_SIZE];
|
||||
} MIB_IFTABLE, *PMIB_IFTABLE;
|
||||
|
||||
|
||||
typedef struct _MIB_TCPROW_OWNER_PID {
|
||||
DWORD dwState;
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwRemoteAddr;
|
||||
DWORD dwRemotePort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_TCPROW_OWNER_PID, *PMIB_TCPROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCPTABLE_OWNER_PID{
|
||||
DWORD dwNumEntries;
|
||||
MIB_TCPROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_TCPTABLE_OWNER_PID, *PMIB_TCPTABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDPROW_OWNER_PID {
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_UDPROW_OWNER_PID, *PMIB_UDPROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDPTABLE_OWNER_PID {
|
||||
DWORD dwNumEntries;
|
||||
MIB_UDPROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_UDPTABLE_OWNER_PID, *PMIB_UDPTABLE_OWNER_PID;
|
||||
|
||||
|
||||
typedef struct _MIB_UDP6ROW_OWNER_PID {
|
||||
UCHAR ucLocalAddr[16];
|
||||
DWORD dwLocalScopeId;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_UDP6ROW_OWNER_PID, *PMIB_UDP6ROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_UDP6TABLE_OWNER_PID{
|
||||
DWORD dwNumEntries;
|
||||
MIB_UDP6ROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_UDP6TABLE_OWNER_PID, *PMIB_UDP6TABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCP6ROW_OWNER_PID {
|
||||
UCHAR ucLocalAddr[16];
|
||||
DWORD dwLocalScopeId;
|
||||
DWORD dwLocalPort;
|
||||
UCHAR ucRemoteAddr[16];
|
||||
DWORD dwRemoteScopeId;
|
||||
DWORD dwRemotePort;
|
||||
DWORD dwState;
|
||||
DWORD dwOwningPid;
|
||||
} MIB_TCP6ROW_OWNER_PID, *PMIB_TCP6ROW_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCP6TABLE_OWNER_PID {
|
||||
DWORD dwNumEntries;
|
||||
MIB_TCP6ROW_OWNER_PID table[ANY_SIZE];
|
||||
} MIB_TCP6TABLE_OWNER_PID, *PMIB_TCP6TABLE_OWNER_PID;
|
||||
|
||||
typedef struct _MIB_TCPROW {
|
||||
DWORD dwState;
|
||||
DWORD dwLocalAddr;
|
||||
DWORD dwLocalPort;
|
||||
DWORD dwRemoteAddr;
|
||||
DWORD dwRemotePort;
|
||||
} MIB_TCPROW, *PMIB_TCPROW;
|
||||
|
||||
typedef struct _IP_ADAPTER_INDEX_MAP {
|
||||
ULONG Index;
|
||||
WCHAR Name[MAX_ADAPTER_NAME];
|
||||
} IP_ADAPTER_INDEX_MAP, *PIP_ADAPTER_INDEX_MAP;
|
||||
|
||||
typedef struct _IP_INTERFACE_INFO {
|
||||
LONG NumAdapters;
|
||||
IP_ADAPTER_INDEX_MAP Adapter[1];
|
||||
} IP_INTERFACE_INFO, *PIP_INTERFACE_INFO;
|
||||
|
||||
|
||||
typedef struct _EXCEPTION_RECORD {
|
||||
DWORD ExceptionCode;
|
||||
@@ -2010,6 +1855,16 @@ typedef struct _SYSTEM_HANDLE
|
||||
}
|
||||
SYSTEM_HANDLE;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE64
|
||||
{
|
||||
DWORD dwProcessId;
|
||||
BYTE bObjectType;
|
||||
BYTE bFlags;
|
||||
WORD wValue;
|
||||
ULONG64 pAddress;
|
||||
DWORD GrantedAccess;
|
||||
} SYSTEM_HANDLE64;
|
||||
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_INFORMATION
|
||||
{
|
||||
@@ -2017,6 +1872,13 @@ typedef struct _SYSTEM_HANDLE_INFORMATION
|
||||
SYSTEM_HANDLE Handles[1];
|
||||
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_INFORMATION64
|
||||
{
|
||||
ULONG HandleCount;
|
||||
SYSTEM_HANDLE64 Handles[1];
|
||||
} SYSTEM_HANDLE_INFORMATION64, *PSYSTEM_HANDLE_INFORMATION64;
|
||||
|
||||
|
||||
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
|
||||
UNICODE_STRING TypeName;
|
||||
ULONG Reserved [22];
|
||||
|
||||
@@ -50,9 +50,8 @@ typedef enum _EVT_VARIANT_TYPE {
|
||||
} EVT_VARIANT_TYPE;
|
||||
|
||||
|
||||
|
||||
|
||||
union _ANON_evt_variant_sub_union {
|
||||
typedef struct _EVT_VARIANT {
|
||||
union {
|
||||
BOOL BooleanVal;
|
||||
INT8 SByteVal;
|
||||
INT16 Int16Val;
|
||||
@@ -72,7 +71,6 @@ union _ANON_evt_variant_sub_union {
|
||||
PBYTE BinaryVal;
|
||||
PSID SidVal;
|
||||
SIZE_T SizeTVal;
|
||||
EVT_HANDLE EvtHandleVal;
|
||||
BOOL *BooleanArr;
|
||||
INT8 *SByteArr;
|
||||
INT16 *Int16Arr;
|
||||
@@ -91,12 +89,10 @@ union _ANON_evt_variant_sub_union {
|
||||
LPSTR *AnsiStringArr;
|
||||
PSID *SidArr;
|
||||
SIZE_T *SizeTArr;
|
||||
EVT_HANDLE EvtHandleVal;
|
||||
LPCWSTR XmlVal;
|
||||
LPCWSTR* XmlValArr;
|
||||
};
|
||||
|
||||
typedef struct _EVT_VARIANT {
|
||||
_ANON_evt_variant_sub_union _VARIANT_VALUE;
|
||||
LPCWSTR *XmlValArr;
|
||||
};
|
||||
DWORD Count;
|
||||
DWORD Type;
|
||||
} EVT_VARIANT, *PEVT_VARIANT;
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
class _EVENT_DESCRIPTOR(_EVENT_DESCRIPTOR):
|
||||
def __repr__(self):
|
||||
return "<{0} Id={self.Id} Opcode={self.Opcode} Version={self.Version} Level={self.Level}>".format(type(self).__name__, self=self)
|
||||
@@ -0,0 +1,6 @@
|
||||
_OLD_EVENT_HEADER_EXTENDED_DATA_ITEM = _EVENT_HEADER_EXTENDED_DATA_ITEM
|
||||
class _EVENT_HEADER_EXTENDED_DATA_ITEM(_OLD_EVENT_HEADER_EXTENDED_DATA_ITEM):
|
||||
@property
|
||||
def data(self):
|
||||
bdata = (ctypes.c_char * self.DataSize).from_address(self.DataPtr)
|
||||
return bdata[:]
|
||||
@@ -0,0 +1,3 @@
|
||||
_OLD_EVENT_RECORD = _EVENT_RECORD
|
||||
class _EVENT_RECORD(_OLD_EVENT_RECORD):
|
||||
pass
|
||||
@@ -45,6 +45,7 @@ class _GUID(INITIAL_GUID):
|
||||
datas.append(int(part_iid[4][i * 2:(i + 1) * 2], 16))
|
||||
return cls.from_raw(*datas, strid=iid)
|
||||
|
||||
|
||||
@classmethod
|
||||
def from_raw(cls, Data1, Data2, Data3, Data41, Data42, Data43, Data44, Data45, Data46, Data47, Data48, **kwargs):
|
||||
return cls(Data1, Data2, Data3, (BYTE*8)(Data41, Data42, Data43, Data44, Data45, Data46, Data47, Data48), **kwargs)
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
class _OBJECT_ATTRIBUTES(_OBJECT_ATTRIBUTES):
|
||||
@classmethod
|
||||
def from_string(cls, path, attributes=OBJ_CASE_INSENSITIVE): # Directly on constructor ?
|
||||
self = cls()
|
||||
self.Length = ctypes.sizeof(self)
|
||||
self.RootDirectory = 0
|
||||
self.ObjectName = ctypes.pointer(LSA_UNICODE_STRING.from_string(path))
|
||||
self.Attributes = attributes
|
||||
self.SecurityDescriptor = 0
|
||||
self.SecurityQualityOfService = 0
|
||||
return self
|
||||
|
||||
def __repr__(self):
|
||||
if not self.ObjectName:
|
||||
return super(_OBJECT_ATTRIBUTES, self).__repr__()
|
||||
return """<{0} ObjectName="{1}">""".format(type(self).__name__, self.ObjectName[0].str)
|
||||
@@ -0,0 +1,5 @@
|
||||
old_SYMBOL_INFO = _SYMBOL_INFO
|
||||
class _SYMBOL_INFO(old_SYMBOL_INFO):
|
||||
@property
|
||||
def tag(self):
|
||||
return SymTagEnum.mapper[self.Tag]
|
||||
@@ -66,20 +66,29 @@ class StructureParsedFile(ParsedFile):
|
||||
self.add_exports(enum.name)
|
||||
self.add_exports(*enum.typedef)
|
||||
for struct in structs:
|
||||
self.asser_struct_not_already_in_import(struct)
|
||||
if any(x in self.imports for x in [struct.name] + struct.typedef.keys()):
|
||||
print("Export <{0}> defined after first use".format(struct.name))
|
||||
raise ValueError("LOL")
|
||||
self.compute_imports_exports_for_struct(struct)
|
||||
|
||||
|
||||
def compute_imports_exports_for_struct(self, struct):
|
||||
self.asser_struct_not_already_in_import(struct)
|
||||
if any(x in self.imports for x in [struct.name] + struct.typedef.keys()):
|
||||
print("Export <{0}> defined after first use".format(struct.name))
|
||||
raise ValueError("LOL")
|
||||
if struct.name is not None: # Anonymous structs
|
||||
self.add_exports(struct.name)
|
||||
self.add_exports(*struct.typedef)
|
||||
for field_type, field_name, nb_rep in struct.fields:
|
||||
if field_type.name not in self.exports:
|
||||
self.add_imports(field_type.name)
|
||||
self.imports_by_struct[field_type.name] = struct.name
|
||||
try:
|
||||
int(nb_rep)
|
||||
except:
|
||||
self.add_imports(nb_rep)
|
||||
self.add_exports(*struct.typedef)
|
||||
for field_type, field_name, nb_rep in struct.fields:
|
||||
if field_name is None:
|
||||
# Anon sub-struct/union
|
||||
self.compute_imports_exports_for_struct(field_type)
|
||||
continue
|
||||
if field_type.name not in self.exports:
|
||||
self.add_imports(field_type.name)
|
||||
self.imports_by_struct[field_type.name] = struct.name
|
||||
try:
|
||||
int(nb_rep)
|
||||
except:
|
||||
self.add_imports(nb_rep)
|
||||
|
||||
def asser_struct_not_already_in_import(self, struct):
|
||||
for sname in [struct.name] + struct.typedef.keys():
|
||||
|
||||
@@ -30,9 +30,7 @@ class WinStructParser(Parser):
|
||||
# Not a name. Anon union/struct ?
|
||||
subdef_type = self.next_token() # union / struct
|
||||
if type(self.peek()) == OpenBracketToken:
|
||||
print("<{0}> ANON START WITH <{1}>".format(self._yolo, self.peek()))
|
||||
sub = self.parse_winstruct(anonymous=True, anon_type=subdef_type)
|
||||
print("Anon is <{0}>".format(sub))
|
||||
return (sub, NameToken(None), 1)
|
||||
else:
|
||||
# struct _MYNAME_ -> no anon juste the name of the struct.
|
||||
@@ -137,9 +135,8 @@ class WinStructParser(Parser):
|
||||
# Anonymous structure def: check if we are ina typedef
|
||||
if not is_typedef and not anonymous:
|
||||
raise ValueError("Anonymous structure/union not in a typedef")
|
||||
struct_name = "anon"
|
||||
struct_name = None
|
||||
self.assert_token_type(OpenBracketToken)
|
||||
self._yolo = struct_name
|
||||
|
||||
result = WinDefType(struct_name, self.pack)
|
||||
while type(self.peek()) != CloseBracketToken:
|
||||
@@ -148,6 +145,10 @@ class WinStructParser(Parser):
|
||||
self.assert_token_type(CloseBracketToken)
|
||||
if is_typedef:
|
||||
self.parse_typedef(result)
|
||||
elif anonymous:
|
||||
if type(self.peek()) == NameToken:
|
||||
result.add_typedef(self.assert_token_type(NameToken).value)
|
||||
self.assert_token_type(SemiColonToken)
|
||||
else:
|
||||
self.assert_token_type(SemiColonToken)
|
||||
return result
|
||||
|
||||
@@ -83,11 +83,17 @@ class WinStruct(object):
|
||||
continue
|
||||
i += 1
|
||||
# Should begin by "_ANON_" to trigger <generate_anonymous_union>
|
||||
if type.typedef:
|
||||
assert len(type.typedef) == 1, "Anonymous structure should have only one name"
|
||||
field_name = list(type.typedef)[0]
|
||||
type.typedef = {} # Remove typedef so that there is no use of it when genering the code for this anon-struct
|
||||
else:
|
||||
field_name = "anon_{0:02}".format(i)
|
||||
type.name = "_ANON_{0}_SUB_{1}_{2}".format(self.name, type.ctypes_type, i).upper()
|
||||
code.append(type.generate_ctypes()) # Generate class for the code
|
||||
# Replace the type name + field name in fields list
|
||||
|
||||
new_fields.append((WinStructType(type.name), "anon_{0:02}".format(i), nb))
|
||||
new_fields.append((WinStructType(type.name), field_name, nb))
|
||||
self.fields = new_fields
|
||||
return "\n".join(code)
|
||||
|
||||
@@ -157,11 +163,7 @@ class WinStruct(object):
|
||||
|
||||
if self.is_self_referencing():
|
||||
print("{0} is self referencing".format(self.name))
|
||||
return self.generate_selfref_ctypes_class() + "\n"
|
||||
|
||||
|
||||
import pdb;pdb.set_trace()
|
||||
print("LOL")
|
||||
return anon_code + self.generate_selfref_ctypes_class() + "\n"
|
||||
|
||||
ctypes_class = self.generate_ctypes_class()
|
||||
ctypes_typedef = self.generate_typedef_ctypes()
|
||||
|
||||
+682
-376
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
+1913
-1692
File diff suppressed because it is too large
Load Diff
+787
-567
File diff suppressed because it is too large
Load Diff
+4616
-3114
File diff suppressed because one or more lines are too long
@@ -1,3 +1,3 @@
|
||||
from .apiproxy import is_implemented, get_target, resolve
|
||||
from .error import WinproxyError
|
||||
from .error import WinproxyError, ExportNotFound
|
||||
from .apis import * # Import all functions
|
||||
@@ -2,6 +2,7 @@ import ctypes
|
||||
import functools
|
||||
|
||||
import windows.generated_def as gdef
|
||||
from .error import ExportNotFound
|
||||
|
||||
# Utils
|
||||
def is_implemented(apiproxy):
|
||||
@@ -25,14 +26,6 @@ def resolve(apiproxy):
|
||||
return ctypes.cast(func, gdef.PVOID).value
|
||||
|
||||
|
||||
# ApiProxy stuff
|
||||
class ExportNotFound(RuntimeError):
|
||||
def __init__(self, func_name, api_name):
|
||||
self.func_name = func_name
|
||||
self.api_name = api_name
|
||||
super(ExportNotFound, self).__init__("Function {0} not found into {1}".format(func_name, api_name))
|
||||
|
||||
|
||||
class NeededParameterType(object):
|
||||
_inst = None
|
||||
|
||||
|
||||
@@ -14,4 +14,6 @@ from shlwapi import *
|
||||
from user32 import *
|
||||
from version import *
|
||||
from wevtapi import *
|
||||
from wintrust import *
|
||||
from wintrust import *
|
||||
from tdh import *
|
||||
from dnsapi import *
|
||||
@@ -2,7 +2,7 @@ import ctypes
|
||||
import windows.generated_def as gdef
|
||||
|
||||
from ..apiproxy import ApiProxy, NeededParameter
|
||||
from ..error import fail_on_zero, succeed_on_zero, result_is_error_code
|
||||
from ..error import fail_on_zero, succeed_on_zero, result_is_error_code, result_is_handle
|
||||
|
||||
class Advapi32Proxy(ApiProxy):
|
||||
APIDLL = "advapi32"
|
||||
@@ -95,6 +95,16 @@ def AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges=False, NewState=Need
|
||||
BufferLength = ctypes.sizeof(NewState)
|
||||
return AdjustTokenPrivileges.ctypes_function(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength)
|
||||
|
||||
# Access check
|
||||
|
||||
@Advapi32Proxy()
|
||||
def MapGenericMask(AccessMask, GenericMapping):
|
||||
return MapGenericMask.ctypes_function(AccessMask, GenericMapping)
|
||||
|
||||
@Advapi32Proxy()
|
||||
def AccessCheck(pSecurityDescriptor, ClientToken, DesiredAccess, GenericMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess, AccessStatus):
|
||||
return AccessCheck.ctypes_function(pSecurityDescriptor, ClientToken, DesiredAccess, GenericMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess, AccessStatus)
|
||||
|
||||
# Sid
|
||||
|
||||
@Advapi32Proxy()
|
||||
@@ -355,3 +365,81 @@ def CryptAcquireContextW(phProv, pszContainer, pszProvider, dwProvType, dwFlags)
|
||||
def CryptReleaseContext(hProv, dwFlags):
|
||||
return CryptReleaseContext.ctypes_function(hProv, dwFlags)
|
||||
|
||||
|
||||
## Event Tracing
|
||||
|
||||
@Advapi32Proxy(error_check=succeed_on_zero)
|
||||
def EnumerateTraceGuidsEx(TraceQueryInfoClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength):
|
||||
if isinstance(InBuffer, gdef.GUID):
|
||||
# GUID is not convertible to a pointer directly
|
||||
# But we want to use it as an array for this function
|
||||
# Test/Assert on InBufferSize?
|
||||
InBuffer = ctypes.cast(ctypes.pointer(InBuffer), gdef.PVOID) # Caller keep a ref
|
||||
return EnumerateTraceGuidsEx.ctypes_function(TraceQueryInfoClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def QueryAllTracesA(PropertyArray, PropertyArrayCount, SessionCount):
|
||||
return QueryAllTracesA.ctypes_function(PropertyArray, PropertyArrayCount, SessionCount)
|
||||
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def QueryAllTracesW(PropertyArray, PropertyArrayCount, SessionCount):
|
||||
return QueryAllTracesW.ctypes_function(PropertyArray, PropertyArrayCount, SessionCount)
|
||||
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_handle)
|
||||
def OpenTraceA(Logfile):
|
||||
return OpenTraceA.ctypes_function(Logfile)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_handle)
|
||||
def OpenTraceW(Logfile):
|
||||
return OpenTraceW.ctypes_function(Logfile)
|
||||
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def StartTraceA(TraceHandle, InstanceName, Properties):
|
||||
return StartTraceA.ctypes_function(TraceHandle, InstanceName, Properties)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def StartTraceW(TraceHandle, InstanceName, Properties):
|
||||
return StartTraceW.ctypes_function(TraceHandle, InstanceName, Properties)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def StopTraceA(TraceHandle, InstanceName, Properties):
|
||||
return StopTraceA.ctypes_function(TraceHandle, InstanceName, Properties)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def StopTraceW(TraceHandle, InstanceName, Properties):
|
||||
return StopTraceW.ctypes_function(TraceHandle, InstanceName, Properties)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def ControlTraceA(TraceHandle, InstanceName, Properties, ControlCode):
|
||||
return ControlTraceA.ctypes_function(TraceHandle, InstanceName, Properties, ControlCode)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def ControlTraceW(TraceHandle, InstanceName, Properties, ControlCode):
|
||||
return ControlTraceW.ctypes_function(TraceHandle, InstanceName, Properties, ControlCode)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def ProcessTrace(HandleArray, HandleCount, StartTime, EndTime):
|
||||
return ProcessTrace.ctypes_function(HandleArray, HandleCount, StartTime, EndTime)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def EnableTrace(Enable, EnableFlag, EnableLevel, ControlGuid, SessionHandle):
|
||||
return EnableTrace.ctypes_function(Enable, EnableFlag, EnableLevel, ControlGuid, SessionHandle)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def EnableTraceEx(ProviderId, SourceId, TraceHandle, IsEnabled, Level, MatchAnyKeyword, MatchAllKeyword, EnableProperty, EnableFilterDesc):
|
||||
return EnableTraceEx.ctypes_function(ProviderId, SourceId, TraceHandle, IsEnabled, Level, MatchAnyKeyword, MatchAllKeyword, EnableProperty, EnableFilterDesc)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def EnableTraceEx2(TraceHandle, ProviderId, ControlCode, Level, MatchAnyKeyword, MatchAllKeyword, Timeout, EnableParameters):
|
||||
return EnableTraceEx2.ctypes_function(TraceHandle, ProviderId, ControlCode, Level, MatchAnyKeyword, MatchAllKeyword, Timeout, EnableParameters)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def TraceQueryInformation(SessionHandle, InformationClass, TraceInformation, InformationLength, ReturnLength):
|
||||
return TraceQueryInformation.ctypes_function(SessionHandle, InformationClass, TraceInformation, InformationLength, ReturnLength)
|
||||
|
||||
@Advapi32Proxy(error_check=result_is_error_code)
|
||||
def TraceSetInformation(SessionHandle, InformationClass, TraceInformation, InformationLength):
|
||||
return TraceSetInformation.ctypes_function(SessionHandle, InformationClass, TraceInformation, InformationLength)
|
||||
|
||||
@@ -8,6 +8,15 @@ class DbgHelpProxy(ApiProxy):
|
||||
APIDLL = "dbghelp"
|
||||
default_error_check = staticmethod(fail_on_zero)
|
||||
|
||||
# We keep the simple definition where callback UserContext are PVOID
|
||||
# Be we want to be able to pass arbitrary python object (list/dict)
|
||||
# So ctypes magic to make the py_object->pvoid transformation
|
||||
# !! this code loose a ref to obj.
|
||||
# Should still work as our calling-caller method keep a ref
|
||||
def transform_pyobject_to_pvoid(obj):
|
||||
if obj is None or isinstance(obj, (int, long)):
|
||||
return obj
|
||||
return ctypes.POINTER(gdef.PVOID)(ctypes.py_object(obj))[0]
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymInitialize(hProcess, UserSearchPath, fInvadeProcess):
|
||||
@@ -27,4 +36,63 @@ def SymFromAddr(hProcess, Address, Displacement, Symbol):
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymGetModuleInfo64(hProcess, dwAddr, ModuleInfo):
|
||||
return SymGetModuleInfo64.ctypes_function(hProcess, dwAddr, ModuleInfo)
|
||||
return SymGetModuleInfo64.ctypes_function(hProcess, dwAddr, ModuleInfo)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymFromName(hProcess, Name, Symbol):
|
||||
return SymFromName.ctypes_function(hProcess, Name, Symbol)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymLoadModuleEx(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags):
|
||||
return SymLoadModuleEx.ctypes_function(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymSetOptions(SymOptions):
|
||||
return SymSetOptions.ctypes_function(SymOptions)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymGetTypeInfo(hProcess, ModBase, TypeId, GetType, pInfo):
|
||||
return SymGetTypeInfo.ctypes_function(hProcess, ModBase, TypeId, GetType, pInfo)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymEnumSymbols(hProcess, BaseOfDll, Mask, EnumSymbolsCallback, UserContext):
|
||||
if UserContext is not None and not isinstance(UserContext, (int, long)):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymEnumSymbols.ctypes_function(hProcess, BaseOfDll, Mask, EnumSymbolsCallback, UserContext)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymEnumSymbolsEx(hProcess, BaseOfDll, Mask, EnumSymbolsCallback, UserContext, Options):
|
||||
if UserContext is not None and not isinstance(UserContext, (int, long)):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymEnumSymbolsEx.ctypes_function(hProcess, BaseOfDll, Mask, EnumSymbolsCallback, UserContext, Options)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymEnumTypes(hProcess, BaseOfDll, EnumSymbolsCallback, UserContext):
|
||||
if UserContext is not None and not isinstance(UserContext, (int, long)):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymEnumTypes.ctypes_function(hProcess, BaseOfDll, EnumSymbolsCallback, UserContext)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymEnumTypesByName(hProcess, BaseOfDll, mask, EnumSymbolsCallback, UserContext):
|
||||
if UserContext is not None and not isinstance(UserContext, (int, long)):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymEnumTypesByName.ctypes_function(hProcess, BaseOfDll, mask, EnumSymbolsCallback, UserContext)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymEnumerateModules64(hProcess, EnumModulesCallback, UserContext):
|
||||
if UserContext is not None and not isinstance(UserContext, (int, long)):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymEnumerateModules64.ctypes_function(hProcess, EnumModulesCallback, UserContext)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymGetTypeFromName(hProcess, BaseOfDll, Name, Symbol):
|
||||
return SymGetTypeFromName.ctypes_function(hProcess, BaseOfDll, Name, Symbol)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymSearch(hProcess, BaseOfDll, Index, SymTag, Mask, Address, EnumSymbolsCallback, UserContext, Options):
|
||||
UserContext = transform_pyobject_to_pvoid(UserContext)
|
||||
return SymSearch.ctypes_function(hProcess, BaseOfDll, Index, SymTag, Mask, Address, EnumSymbolsCallback, UserContext, Options)
|
||||
|
||||
@DbgHelpProxy()
|
||||
def SymSearchW(hProcess, BaseOfDll, Index, SymTag, Mask, Address, EnumSymbolsCallback, UserContext, Options):
|
||||
return SymSearchW.ctypes_function(hProcess, BaseOfDll, Index, SymTag, Mask, Address, EnumSymbolsCallback, UserContext, Options)
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
import ctypes
|
||||
import windows.generated_def as gdef
|
||||
|
||||
from ..apiproxy import ApiProxy, NeededParameter
|
||||
from ..error import fail_on_zero, result_is_error_code
|
||||
|
||||
class DNSapiProxy(ApiProxy):
|
||||
APIDLL = "dnsapi"
|
||||
default_error_check = staticmethod(fail_on_zero)
|
||||
|
||||
|
||||
@DNSapiProxy()
|
||||
def DnsGetCacheDataTable(DnsEntries):
|
||||
return DnsGetCacheDataTable.ctypes_function(DnsEntries)
|
||||
|
||||
|
||||
@DNSapiProxy(error_check=result_is_error_code)
|
||||
def DnsQuery_A(pszName, wType, Options, pExtra, ppQueryResults, pReserved):
|
||||
return DnsQuery_A.ctypes_function(pszName, wType, Options, pExtra, ppQueryResults, pReserved)
|
||||
|
||||
|
||||
@DNSapiProxy(error_check=result_is_error_code)
|
||||
def DnsQuery_W(pszName, wType, Options, pExtra, ppQueryResults, pReserved):
|
||||
return DnsQuery_W.ctypes_function(pszName, wType, Options, pExtra, ppQueryResults, pReserved)
|
||||
|
||||
@DNSapiProxy()
|
||||
def DnsFree(pData, FreeType):
|
||||
return DnsFree.ctypes_function(pData, FreeType)
|
||||
@@ -427,11 +427,15 @@ def DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lp
|
||||
# Wow64
|
||||
|
||||
@Kernel32Proxy()
|
||||
def Wow64DisableWow64FsRedirection(OldValue):
|
||||
def Wow64DisableWow64FsRedirection(OldValue=None):
|
||||
if OldValue is None:
|
||||
OldValue = gdef.PVOID()
|
||||
return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
|
||||
|
||||
@Kernel32Proxy()
|
||||
def Wow64RevertWow64FsRedirection(OldValue):
|
||||
def Wow64RevertWow64FsRedirection(OldValue=None):
|
||||
if OldValue is None:
|
||||
OldValue = gdef.PVOID()
|
||||
return Wow64RevertWow64FsRedirection.ctypes_function(OldValue)
|
||||
|
||||
@Kernel32Proxy()
|
||||
@@ -711,6 +715,10 @@ def ConnectNamedPipe(hNamedPipe, lpOverlapped):
|
||||
def SetNamedPipeHandleState(hNamedPipe, lpMode, lpMaxCollectionCount, lpCollectDataTimeout):
|
||||
return SetNamedPipeHandleState.ctypes_function(hNamedPipe, lpMode, lpMaxCollectionCount, lpCollectDataTimeout)
|
||||
|
||||
@Kernel32Proxy()
|
||||
def CreatePipe(hReadPipe, hWritePipe, lpPipeAttributes, nSize):
|
||||
return CreatePipe.ctypes_function(hReadPipe, hWritePipe, lpPipeAttributes, nSize)
|
||||
|
||||
# Firmware
|
||||
|
||||
@Kernel32Proxy()
|
||||
@@ -729,4 +737,22 @@ def GetFirmwareEnvironmentVariableExA(lpName, lpGuid, pBuffer, nSize, pdwAttribu
|
||||
def GetFirmwareEnvironmentVariableExW(lpName, lpGuid, pBuffer, nSize, pdwAttribubutes):
|
||||
return GetFirmwareEnvironmentVariableExW.ctypes_function(lpName, lpGuid, pBuffer, nSize, pdwAttribubutes)
|
||||
|
||||
#####
|
||||
#####
|
||||
|
||||
# Time
|
||||
|
||||
@Kernel32Proxy(error_check=fail_on_zero)
|
||||
def FileTimeToSystemTime(lpFileTime, lpSystemTime):
|
||||
return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime)
|
||||
|
||||
@Kernel32Proxy(error_check=fail_on_zero)
|
||||
def SystemTimeToFileTime(lpSystemTime, lpFileTime):
|
||||
return SystemTimeToFileTime.ctypes_function(lpSystemTime, lpFileTime)
|
||||
|
||||
@Kernel32Proxy(error_check=None)
|
||||
def GetSystemTime(lpSystemTime):
|
||||
return GetSystemTime.ctypes_function(lpSystemTime)
|
||||
|
||||
@Kernel32Proxy(error_check=None)
|
||||
def GetSystemTimeAsFileTime(lpSystemTimeAsFileTime):
|
||||
return GetSystemTimeAsFileTime.ctypes_function(lpSystemTimeAsFileTime)
|
||||
|
||||
@@ -35,6 +35,11 @@ def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumb
|
||||
def NtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength):
|
||||
return NtCreateFile.ctypes_function(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength)
|
||||
|
||||
@NtdllProxy()
|
||||
def NtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions):
|
||||
return NtOpenFile.ctypes_function(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions)
|
||||
|
||||
|
||||
@NtdllProxy()
|
||||
def NtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass):
|
||||
return NtSetInformationFile.ctypes_function(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass)
|
||||
@@ -195,8 +200,8 @@ def NtQueryDirectoryObject(DirectoryHandle, Buffer, Length, ReturnSingleEntry, R
|
||||
|
||||
|
||||
@NtdllProxy()
|
||||
def NtQuerySymbolicLinkObject(LinkHandle, LinkTarget, ReturnedLength):
|
||||
return NtQuerySymbolicLinkObject.ctypes_function(LinkHandle, LinkTarget, ReturnedLength)
|
||||
def NtCreateSymbolicLinkObject(pHandle, DesiredAccess, ObjectAttributes, DestinationName):
|
||||
return NtCreateSymbolicLinkObject.ctypes_function(pHandle, DesiredAccess, ObjectAttributes, DestinationName)
|
||||
|
||||
|
||||
@NtdllProxy()
|
||||
@@ -204,6 +209,11 @@ def NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes):
|
||||
return NtOpenSymbolicLinkObject.ctypes_function(LinkHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
|
||||
@NtdllProxy()
|
||||
def NtQuerySymbolicLinkObject(LinkHandle, LinkTarget, ReturnedLength):
|
||||
return NtQuerySymbolicLinkObject.ctypes_function(LinkHandle, LinkTarget, ReturnedLength)
|
||||
|
||||
|
||||
# Event
|
||||
|
||||
@NtdllProxy()
|
||||
@@ -358,6 +368,9 @@ def NtQueryLicenseValue(Name, Type, Buffer, Length=None, DataLength=NeededParame
|
||||
Length = len(buffer)
|
||||
return NtQueryLicenseValue.ctypes_function(Name, Type, Buffer, Length, DataLength)
|
||||
|
||||
@NtdllProxy()
|
||||
def NtQueryKey(KeyHandle, KeyInformationClass, KeyInformation, Length, ResultLength):
|
||||
return NtQueryKey.ctypes_function(KeyHandle, KeyInformationClass, KeyInformation, Length, ResultLength)
|
||||
|
||||
# Other
|
||||
|
||||
@@ -373,6 +386,12 @@ def NtEnumerateSystemEnvironmentValuesEx(InformationClass, Buffer, BufferLength)
|
||||
return NtEnumerateSystemEnvironmentValuesEx.ctypes_function(InformationClass, Buffer, BufferLength)
|
||||
|
||||
|
||||
# Pipe
|
||||
@NtdllProxy()
|
||||
def NtCreateNamedPipeFile(NamedPipeFileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, CreateDisposition, CreateOptions, WriteModeMessage, ReadModeMessage, NonBlocking, MaxInstances, InBufferSize, OutBufferSize, DefaultTimeOut):
|
||||
return NtCreateNamedPipeFile.ctypes_function(NamedPipeFileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, CreateDisposition, CreateOptions, WriteModeMessage, ReadModeMessage, NonBlocking, MaxInstances, InBufferSize, OutBufferSize, DefaultTimeOut)
|
||||
|
||||
|
||||
#########
|
||||
|
||||
|
||||
|
||||
@@ -32,10 +32,18 @@ def CoCreateInstanceEx(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResul
|
||||
return CoCreateInstanceEx.ctypes_function(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResults)
|
||||
|
||||
|
||||
@Ole32Proxy()
|
||||
def CoGetClassObject(rclsid, dwClsContext, pvReserved, riid, ppv):
|
||||
return CoGetClassObject.ctypes_function(rclsid, dwClsContext, pvReserved, riid, ppv)
|
||||
|
||||
@Ole32Proxy()
|
||||
def CoGetInterceptor(iidIntercepted, punkOuter, iid, ppv):
|
||||
return CoGetInterceptor.ctypes_function(iidIntercepted, punkOuter, iid, ppv)
|
||||
|
||||
@Ole32Proxy()
|
||||
def CLSIDFromProgID(lpszProgID, lpclsid):
|
||||
return CLSIDFromProgID.ctypes_function(lpszProgID, lpclsid)
|
||||
return CLSIDFromProgID.ctypes_function(lpszProgID, lpclsid)
|
||||
|
||||
@Ole32Proxy()
|
||||
def CoTaskMemFree(pv):
|
||||
return CoTaskMemFree.ctypes_function(pv)
|
||||
@@ -0,0 +1,16 @@
|
||||
import ctypes
|
||||
import windows.generated_def as gdef
|
||||
|
||||
from ..apiproxy import ApiProxy, NeededParameter
|
||||
from ..error import result_is_error_code
|
||||
|
||||
# TDH: Trace Data Helper
|
||||
# https://docs.microsoft.com/en-us/windows/desktop/etw/retrieving-event-data-using-tdh
|
||||
|
||||
class TdhProxy(ApiProxy):
|
||||
APIDLL = "tdh"
|
||||
default_error_check = staticmethod(result_is_error_code)
|
||||
|
||||
@TdhProxy()
|
||||
def TdhEnumerateProviders(pBuffer, pBufferSize):
|
||||
return TdhEnumerateProviders.ctypes_function(pBuffer, pBufferSize)
|
||||
@@ -19,7 +19,7 @@ def GetFileVersionInfoA(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededPar
|
||||
def GetFileVersionInfoW(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededParameter):
|
||||
if dwLen is None and lpData is not None:
|
||||
dwLen = len(lpData)
|
||||
return GetFileVersionInfoA.ctypes_function(lptstrFilename, dwHandle, dwLen, lpData)
|
||||
return GetFileVersionInfoW.ctypes_function(lptstrFilename, dwHandle, dwLen, lpData)
|
||||
|
||||
@VersionProxy()
|
||||
def GetFileVersionInfoSizeA(lptstrFilename, lpdwHandle=None):
|
||||
|
||||
@@ -3,6 +3,15 @@ import ctypes
|
||||
import windows.generated_def as gdef
|
||||
from windows.generated_def.ntstatus import NtStatusException
|
||||
|
||||
|
||||
# ApiProxy stuff
|
||||
class ExportNotFound(RuntimeError):
|
||||
def __init__(self, func_name, api_name):
|
||||
self.func_name = func_name
|
||||
self.api_name = api_name
|
||||
super(ExportNotFound, self).__init__("Function {0} not found into {1}".format(func_name, api_name))
|
||||
|
||||
|
||||
# PFW Winproxy Exception type
|
||||
class WinproxyError(WindowsError):
|
||||
def __new__(cls, func_name, error_code=None):
|
||||
|
||||
Reference in New Issue
Block a user