mirror of
https://github.com/ig-labs/Defender-mpengine-Fuzzing
synced 2026-06-08 14:47:25 +00:00
p0w1
146 lines
3.9 KiB
C
Executable File
146 lines
3.9 KiB
C
Executable File
#ifndef __ENGINEBOOT_H
|
|
#define __ENGINEBOOT_H
|
|
#pragma once
|
|
#pragma pack(push, 1)
|
|
typedef unsigned long long ulong;
|
|
|
|
#define BOOTENGINE_PARAMS_VERSION 0xA400
|
|
|
|
enum {
|
|
BOOT_CACHEENABLED = 1 << 0,
|
|
BOOT_NOFILECHANGES = 1 << 3,
|
|
BOOT_ENABLECALLISTO = 1 << 6,
|
|
BOOT_REALTIMESIGS = 1 << 8,
|
|
BOOT_DISABLENOTIFICATION = 1 << 9,
|
|
BOOT_CLOUDBHEAVIORBLOCK = 1 << 10,
|
|
BOOT_ENABLELOGGING = 1 << 12,
|
|
BOOT_ENABLEBETA = 1 << 16,
|
|
BOOT_ENABLEIEV = 1 << 17,
|
|
BOOT_ENABLEMANAGED = 1 << 19,
|
|
};
|
|
|
|
enum {
|
|
BOOT_ATTR_NORMAL = 1 << 0,
|
|
BOOT_ATTR_ISXBAC = 1 << 2,
|
|
};
|
|
|
|
enum {
|
|
ENGINE_UNPACK = 1 << 1,
|
|
ENGINE_HEURISTICS = 1 << 3,
|
|
ENGINE_DISABLETHROTTLING = 1 << 11,
|
|
ENGINE_PARANOID = 1 << 12,
|
|
ENGINE_DISABLEANTISPYWARE = 1 << 15,
|
|
ENGINE_DISABLEANTIVIRUS = 1 << 16,
|
|
ENGINE_DISABLENETWORKDRIVES = 1 << 20,
|
|
};
|
|
|
|
typedef struct _ENGINE_INFO {
|
|
DWORD field_0;
|
|
DWORD field_4; // Possibly Signature UNIX time?
|
|
DWORD field_8;
|
|
DWORD field_C;
|
|
} ENGINE_INFO, *PENGINE_INFO;
|
|
|
|
|
|
typedef struct _ENGINE_CONFIG {
|
|
ULONG64 EngineFlags;
|
|
PWCHAR Inclusions; // Example, "*.zip"
|
|
PVOID Exceptions;
|
|
PWCHAR UnknownString2;
|
|
PWCHAR QuarantineLocation;
|
|
DWORD field_14;
|
|
DWORD field_18;
|
|
DWORD field_1C;
|
|
DWORD field_20;
|
|
DWORD field_24;
|
|
DWORD field_28;
|
|
ULONG64 field_2C; // Setting this seems to cause packer to be reported.
|
|
ULONG64 field_30;
|
|
ULONG64 field_34;
|
|
PCHAR UnknownAnsiString1;
|
|
PCHAR UnknownAnsiString2;
|
|
} ENGINE_CONFIG, *PENGINE_CONFIG;
|
|
|
|
typedef struct _ENGINE_CONTEXT {
|
|
DWORD field_0;
|
|
} ENGINE_CONTEXT, *PENGINE_CONTEXT;
|
|
|
|
/*
|
|
BootParams.ClientVersion = BOOTENGINE_PARAMS_VERSION; 0xA400
|
|
BootParams.SignatureLocation = wchar_t L"C:\\tmp";;
|
|
BootParams.Attributes = BOOT_ATTR_NORMAL;
|
|
BootParams.ProductName = ProductName;
|
|
EngineConfig.QuarantineLocation = QurantineLocation;
|
|
EngineConfig.Inclusions = Inclusions;
|
|
EngineConfig.EngineFlags = 1 << 1;
|
|
EngineConfig.UnknownAnsiString1 = NULL;
|
|
EngineConfig.UnknownAnsiString2 = NULL;
|
|
BootParams.EngineInfo = &EngineInfo;
|
|
BootParams.EngineConfig = &EngineConfig;*/
|
|
typedef struct _BOOTENGINE_PARAMS {
|
|
ULONG64 ClientVersion;
|
|
PWCHAR SignatureLocation;
|
|
PVOID SpynetSource;
|
|
PENGINE_CONFIG EngineConfig;
|
|
PENGINE_INFO EngineInfo;
|
|
PWCHAR ScanReportLocation;
|
|
DWORD BootFlags;
|
|
PWCHAR LocalCopyDirectory;
|
|
PWCHAR OfflineTargetOS;
|
|
CHAR ProductString[16];
|
|
ULONG64 field_34;
|
|
PVOID GlobalCallback;
|
|
PENGINE_CONTEXT EngineContext;
|
|
ULONG64 AvgCpuLoadFactor;
|
|
CHAR field_44[16];
|
|
PWCHAR SpynetReportingGUID;
|
|
PWCHAR SpynetVersion;
|
|
PWCHAR NISEngineVersion;
|
|
PWCHAR NISSignatureVersion;
|
|
ULONG64 FlightingEnabled;
|
|
DWORD FlightingLevel;
|
|
PVOID DynamicConfig;
|
|
DWORD AutoSampleSubmission;
|
|
DWORD EnableThreatLogging;
|
|
PWCHAR ProductName;
|
|
DWORD PassiveMode;
|
|
DWORD SenseEnabled;
|
|
PWCHAR SenseOrgId;
|
|
DWORD Attributes;
|
|
DWORD BlockAtFirstSeen;
|
|
DWORD PUAProtection;
|
|
DWORD SideBySidePassiveMode;
|
|
ULONG64 a;
|
|
ULONG64 b;
|
|
ULONG64 c;
|
|
ULONG64 d;
|
|
ULONG64 e;
|
|
ULONG64 f;
|
|
ULONG64 g;
|
|
ULONG64 h;
|
|
ULONG64 i;
|
|
ULONG64 j;
|
|
ULONG64 k;
|
|
ULONG64 l;
|
|
ULONG64 m;
|
|
ULONG64 n;
|
|
ULONG64 o;
|
|
ULONG64 p;
|
|
ULONG64 q;
|
|
ULONG64 r;
|
|
ULONG64 s;
|
|
ULONG64 t;
|
|
ULONG64 u;
|
|
ULONG64 v;
|
|
ULONG64 w;
|
|
ULONG64 x;
|
|
ULONG64 y;
|
|
ULONG64 z;
|
|
|
|
|
|
|
|
} BOOTENGINE_PARAMS, *PBOOTENGINE_PARAMS;
|
|
|
|
#pragma pack(pop)
|
|
#endif // __ENGINEBOOT_H
|