#pragma once #include #include "ntdefs.h" #define CSR_MAKE_API_NUMBER( DllIndex, ApiIndex ) \ (CSR_API_NUMBER)(((DllIndex) << 16) | (ApiIndex)) #define CSRSRV_SERVERDLL_INDEX 0 #define CSRSRV_FIRST_API_NUMBER 0 #define BASESRV_SERVERDLL_INDEX 1 #define BASESRV_FIRST_API_NUMBER 0 #define CONSRV_SERVERDLL_INDEX 2 #define CONSRV_FIRST_API_NUMBER 512 #define USERSRV_SERVERDLL_INDEX 3 #define USERSRV_FIRST_API_NUMBER 1024 typedef enum _BASESRV_API_NUMBER { BasepCreateProcess = BASESRV_FIRST_API_NUMBER, BasepCreateThread, BasepGetTempFile, BasepExitProcess, BasepDebugProcess, BasepCheckVDM, BasepUpdateVDMEntry, BasepGetNextVDMCommand, BasepExitVDM, BasepIsFirstVDM, BasepGetVDMExitCode, BasepSetReenterCount, BasepSetProcessShutdownParam, BasepGetProcessShutdownParam, BasepNlsSetUserInfo, BasepNlsSetMultipleUserInfo, BasepNlsCreateSection, BasepSetVDMCurDirs, BasepGetVDMCurDirs, BasepBatNotification, BasepRegisterWowExec, BasepSoundSentryNotification, BasepRefreshIniFileMapping, BasepDefineDosDevice, BasepSetTermsrvAppInstallMode, BasepNlsUpdateCacheCount, BasepSetTermsrvClientTimeZone, BasepSxsCreateActivationContext, BasepDebugProcessStop, BasepRegisterThread, BasepNlsGetUserInfo, } BASESRV_API_NUMBER, * PBASESRV_API_NUMBER; typedef struct { BYTE byte0; // +00 BYTE byte1; // +01 BYTE byte2; // +02 BYTE byte3; // +02 ULONG64 DUMMY; // +08 ULONG_PTR ManifestAddress; // +10 ULONG64 ManifestSize; // +18 HANDLE SectionHandle; // +20 ULONG64 Offset; // +28 ULONG_PTR Size; // +30 } BASE_SXS_STREAM; // 0x38 typedef struct { ULONG Flags; // +00 // direct set, value = 0x40 ULONG ProcessParameterFlags; // +04 // direct set, value = 0x4001 HANDLE FileHandle; // +08 // we can get this value UNICODE_STRING SxsWin32ExePath; // +10 // UNICODE_STRING, we can build! UNICODE_STRING SxsNtExePath; // +20 // UNICODE_STRING, we can build! BYTE Field30[0x10]; // +30 // blank, ignore BASE_SXS_STREAM PolicyStream; // +40 // !!! UNICODE_STRING AssemblyName; // +78 // blank, ignore UNICODE_STRING FileName3; // +88 // UNICODE_STRING, we can build! BYTE Field98[0x10]; // +98 // blank, ignore UNICODE_STRING FileName4; // +a8 // UNICODE_STRING, we can build! BYTE OtherFileds[0x110]; // +b8 // blank, ignore } BASE_SXS_CREATEPROCESS_MSG; // 0x1C8 typedef struct { HANDLE ProcessHandle; // +00 // can get HANDLE ThreadHandle; // +08 // can get CLIENT_ID ClientId; // +10 // can get, PID, TID ULONG CreationFlags; // +20 // direct set, must be zero ULONG VdmBinaryType; // +24 // direct set, must be zero ULONG VdmTask; // +28 // ignore //ULONG_PTR VdmTask; // modified value HANDLE hVDM; // +30 // ignore BASE_SXS_CREATEPROCESS_MSG Sxs; // +38 // deep, need analyze, (for BASE_API_MSG, start with 0x78) ULONG64 PebAddressNative; // +200 // can get ULONG_PTR PebAddressWow64; // +208 // direct set, must be zero (Win64 limit) USHORT ProcessorArchitecture; // +210 // direct set, must be 9 (AMD64 limit) } BASE_CREATEPROCESS_MSG; //////////////////////////////////////////////////////////////////////////////////////////////////// #ifndef CSHORT #define CSHORT short #endif typedef struct _CSR_CAPTURE_HEADER { ULONG Length; PVOID RelatedCaptureBuffer; // real: PCSR_CAPTURE_HEADER ULONG CountMessagePointers; PCHAR FreeSpace; ULONG_PTR MessagePointerOffsets[1]; // Offsets within CSR_API_MSG of pointers } CSR_CAPTURE_HEADER, * PCSR_CAPTURE_HEADER; typedef ULONG CSR_API_NUMBER; //////////////////////////////////////////////////////////////////////////////////////////////////// typedef struct _PORT_MESSAGE_HEADER { union { struct { CSHORT DataLength; CSHORT TotalLength; } s1; ULONG Length; } u1; union { struct { CSHORT Type; CSHORT DataInfoOffset; } s2; ULONG ZeroInit; } u2; union { CLIENT_ID ClientId; double DoNotUseThisField; }; ULONG MessageId; union { SIZE_T ClientViewSize; ULONG CallbackId; }; } PORT_MESSAGE_HEADER, * PPORT_MESSAGE_HEADER; typedef struct _PORT_MESSAGE { PORT_MESSAGE_HEADER Header; // 0x00 PCSR_CAPTURE_HEADER CaptureBuffer; // 0x28 CSR_API_NUMBER ApiNumber; // 0x30 ULONG ReturnValue; // 0x34 ULONG64 Reserved; // 0x38 } PORT_MESSAGE, * PPORT_MESSAGE; typedef struct { PORT_MESSAGE PortHeader; BASE_CREATEPROCESS_MSG CreateProcessMSG; // 0x40 } BASE_API_MSG, *PBASE_API_MSG; typedef struct _CSR_CAPTURE_BUFFER { ULONG Size; struct _CSR_CAPTURE_BUFFER* PreviousCaptureBuffer; ULONG PointerCount; PVOID BufferEnd; ULONG_PTR PointerOffsetsArray[ANYSIZE_ARRAY]; } CSR_CAPTURE_BUFFER, * PCSR_CAPTURE_BUFFER;