#pragma once #include typedef struct { PVOID Fixup; // 0 PVOID OG_retaddr; // 8 PVOID rbx; // 16 PVOID rdi; // 24 PVOID BTIT_ss; // 32 PVOID BTIT_retaddr; // 40 PVOID Gadget_ss; // 48 PVOID RUTS_ss; // 56 PVOID RUTS_retaddr; // 64 PVOID ssn; // 72 PVOID trampoline; // 80 PVOID rsi; // 88 PVOID r12; // 96 PVOID r13; // 104 PVOID r14; // 112 PVOID r15; // 120 } PRM, * PPRM; /* God Bless Vulcan Raven*/ typedef struct { LPCWSTR dllPath; ULONG offset; ULONG totalStackSize; BOOL requiresLoadLibrary; BOOL setsFramePointer; PVOID returnAddress; BOOL pushRbp; ULONG countOfCodes; BOOL pushRbpIndex; } StackFrame, * PStackFrame; typedef enum _UNWIND_OP_CODES { UWOP_PUSH_NONVOL = 0, /* info == register number */ UWOP_ALLOC_LARGE, /* no info, alloc size in next 2 slots */ UWOP_ALLOC_SMALL, /* info == size of allocation / 8 - 1 */ UWOP_SET_FPREG, /* no info, FP = RSP + UNWIND_INFO.FPRegOffset*16 */ UWOP_SAVE_NONVOL, /* info == register number, offset in next slot */ UWOP_SAVE_NONVOL_FAR, /* info == register number, offset in next 2 slots */ UWOP_SAVE_XMM128 = 8, /* info == XMM reg number, offset in next slot */ UWOP_SAVE_XMM128_FAR, /* info == XMM reg number, offset in next 2 slots */ UWOP_PUSH_MACHFRAME /* info == 0: no error-code, 1: error-code */ } UNWIND_CODE_OPS; typedef union _UNWIND_CODE { struct { BYTE CodeOffset; BYTE UnwindOp : 4; BYTE OpInfo : 4; }; USHORT FrameOffset; } UNWIND_CODE, * PUNWIND_CODE; typedef struct _UNWIND_INFO { BYTE Version : 3; BYTE Flags : 5; BYTE SizeOfProlog; BYTE CountOfCodes; BYTE FrameRegister : 4; BYTE FrameOffset : 4; UNWIND_CODE UnwindCode[1]; /* UNWIND_CODE MoreUnwindCode[((CountOfCodes + 1) & ~1) - 1]; * union { * OPTIONAL ULONG ExceptionHandler; * OPTIONAL ULONG FunctionEntry; * }; * OPTIONAL ULONG ExceptionData[]; */ } UNWIND_INFO, * PUNWIND_INFO;