mirror of
https://github.com/phra/PEzor
synced 2026-06-08 16:45:36 +00:00
phra
272 lines
9.2 KiB
C
Executable File
272 lines
9.2 KiB
C
Executable File
/*************************************************************************************
|
|
* Author: Jeff Tang <jtang@cylance.com>
|
|
* Copyright (c) 2017 Cylance Inc. All rights reserved. *
|
|
* *
|
|
* Redistribution and use in source and binary forms, with or without modification, *
|
|
* are permitted provided that the following conditions are met: *
|
|
* *
|
|
* 1. Redistributions of source code must retain the above copyright notice, this *
|
|
* list of conditions and the following disclaimer. *
|
|
* *
|
|
* 2. Redistributions in binary form must reproduce the above copyright notice, *
|
|
* this list of conditions and the following disclaimer in the documentation and/or *
|
|
* other materials provided with the distribution. *
|
|
* *
|
|
* 3. Neither the name of the copyright holder nor the names of its contributors *
|
|
* may be used to endorse or promote products derived from this software without *
|
|
* specific prior written permission. *
|
|
* *
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND *
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED *
|
|
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE *
|
|
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR *
|
|
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES *
|
|
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; *
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON *
|
|
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT *
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS *
|
|
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *
|
|
* *
|
|
*************************************************************************************/
|
|
|
|
#pragma once
|
|
#ifndef _APISETMAP_H_
|
|
#define _APISETMAP_H_
|
|
|
|
#define WIN32_LEAN_AND_MEAN
|
|
#include <windows.h>
|
|
#include <subauth.h>
|
|
//#include <winternl.h>
|
|
|
|
typedef struct __LDR_DATA_TABLE_ENTRY
|
|
{
|
|
//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
ULONG Flags;
|
|
SHORT LoadCount;
|
|
SHORT TlsIndex;
|
|
LIST_ENTRY HashTableEntry;
|
|
ULONG TimeDateStamp;
|
|
} __LDR_DATA_TABLE_ENTRY, *__PLDR_DATA_TABLE_ENTRY;
|
|
|
|
// WinDbg> dt -v ntdll!_PEB_LDR_DATA
|
|
typedef struct __PEB_LDR_DATA //, 7 elements, 0x28 bytes
|
|
{
|
|
DWORD dwLength;
|
|
DWORD dwInitialized;
|
|
LPVOID lpSsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
LPVOID lpEntryInProgress;
|
|
} __PEB_LDR_DATA, * __PPEB_LDR_DATA;
|
|
|
|
// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
|
|
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
|
|
{
|
|
struct _PEB_FREE_BLOCK * pNext;
|
|
DWORD dwSize;
|
|
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;
|
|
|
|
// struct _PEB is defined in Winternl.h but it is incomplete
|
|
// WinDbg> dt -v ntdll!_PEB
|
|
typedef struct __PEB // 65 elements, 0x210 bytes
|
|
{
|
|
BYTE bInheritedAddressSpace;
|
|
BYTE bReadImageFileExecOptions;
|
|
BYTE bBeingDebugged;
|
|
BYTE bSpareBool;
|
|
LPVOID lpMutant;
|
|
LPVOID lpImageBaseAddress;
|
|
__PPEB_LDR_DATA pLdr;
|
|
LPVOID lpProcessParameters;
|
|
LPVOID lpSubSystemData;
|
|
LPVOID lpProcessHeap;
|
|
PRTL_CRITICAL_SECTION pFastPebLock;
|
|
LPVOID lpFastPebLockRoutine;
|
|
LPVOID lpFastPebUnlockRoutine;
|
|
DWORD dwEnvironmentUpdateCount;
|
|
LPVOID lpKernelCallbackTable;
|
|
DWORD dwSystemReserved;
|
|
DWORD dwAtlThunkSListPtr32;
|
|
LPVOID lpApiSetMap; // used to be PPEB_FREE_BLOCK pFreeList;
|
|
DWORD dwTlsExpansionCounter;
|
|
LPVOID lpTlsBitmap;
|
|
DWORD dwTlsBitmapBits[2];
|
|
LPVOID lpReadOnlySharedMemoryBase;
|
|
LPVOID lpReadOnlySharedMemoryHeap;
|
|
LPVOID lpReadOnlyStaticServerData;
|
|
LPVOID lpAnsiCodePageData;
|
|
LPVOID lpOemCodePageData;
|
|
LPVOID lpUnicodeCaseTableData;
|
|
DWORD dwNumberOfProcessors;
|
|
DWORD dwNtGlobalFlag;
|
|
LARGE_INTEGER liCriticalSectionTimeout;
|
|
DWORD dwHeapSegmentReserve;
|
|
DWORD dwHeapSegmentCommit;
|
|
DWORD dwHeapDeCommitTotalFreeThreshold;
|
|
DWORD dwHeapDeCommitFreeBlockThreshold;
|
|
DWORD dwNumberOfHeaps;
|
|
DWORD dwMaximumNumberOfHeaps;
|
|
LPVOID lpProcessHeaps;
|
|
LPVOID lpGdiSharedHandleTable;
|
|
LPVOID lpProcessStarterHelper;
|
|
DWORD dwGdiDCAttributeList;
|
|
LPVOID lpLoaderLock;
|
|
DWORD dwOSMajorVersion;
|
|
DWORD dwOSMinorVersion;
|
|
WORD wOSBuildNumber;
|
|
WORD wOSCSDVersion;
|
|
DWORD dwOSPlatformId;
|
|
DWORD dwImageSubsystem;
|
|
DWORD dwImageSubsystemMajorVersion;
|
|
DWORD dwImageSubsystemMinorVersion;
|
|
DWORD dwImageProcessAffinityMask;
|
|
DWORD dwGdiHandleBuffer[34];
|
|
LPVOID lpPostProcessInitRoutine;
|
|
LPVOID lpTlsExpansionBitmap;
|
|
DWORD dwTlsExpansionBitmapBits[32];
|
|
DWORD dwSessionId;
|
|
ULARGE_INTEGER liAppCompatFlags;
|
|
ULARGE_INTEGER liAppCompatFlagsUser;
|
|
LPVOID lppShimData;
|
|
LPVOID lpAppCompatInfo;
|
|
UNICODE_STRING usCSDVersion;
|
|
LPVOID lpActivationContextData;
|
|
LPVOID lpProcessAssemblyStorageMap;
|
|
LPVOID lpSystemDefaultActivationContextData;
|
|
LPVOID lpSystemAssemblyStorageMap;
|
|
DWORD dwMinimumStackCommit;
|
|
} __PEB, * __PPEB;
|
|
|
|
typedef struct
|
|
{
|
|
WORD offset:12;
|
|
WORD type:4;
|
|
} IMAGE_RELOC, *PIMAGE_RELOC;
|
|
|
|
#define DEREF( name )*(UINT_PTR *)(name)
|
|
#define DEREF_64( name )*(DWORD64 *)(name)
|
|
#define DEREF_32( name )*(DWORD *)(name)
|
|
#define DEREF_16( name )*(WORD *)(name)
|
|
#define DEREF_8( name )*(BYTE *)(name)
|
|
|
|
__PPEB GetProcessEnvironmentBlock();
|
|
__PLDR_DATA_TABLE_ENTRY GetInMemoryOrderModuleList();
|
|
|
|
// Win 10
|
|
typedef struct _API_SET_VALUE_ENTRY_V6
|
|
{
|
|
ULONG Flags;
|
|
ULONG NameOffset;
|
|
ULONG NameLength;
|
|
ULONG ValueOffset;
|
|
ULONG ValueLength;
|
|
} API_SET_VALUE_ENTRY_V6, *PAPI_SET_VALUE_ENTRY_V6;
|
|
|
|
typedef struct _API_SET_NAMESPACE_HASH_ENTRY_V6
|
|
{
|
|
ULONG Hash;
|
|
ULONG Index;
|
|
} API_SET_NAMESPACE_HASH_ENTRY_V6, *PAPI_SET_NAMESPACE_HASH_ENTRY_V6;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ENTRY_V6
|
|
{
|
|
ULONG Flags;
|
|
ULONG NameOffset;
|
|
ULONG Size;
|
|
ULONG NameLength;
|
|
ULONG DataOffset;
|
|
ULONG Count;
|
|
} API_SET_NAMESPACE_ENTRY_V6, *PAPI_SET_NAMESPACE_ENTRY_V6;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ARRAY_V6
|
|
{
|
|
ULONG Version;
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
ULONG Count;
|
|
ULONG DataOffset;
|
|
ULONG HashOffset;
|
|
ULONG Multiplier;
|
|
API_SET_NAMESPACE_ENTRY_V6 Array[ANYSIZE_ARRAY];
|
|
} API_SET_NAMESPACE_ARRAY_V6, *PAPI_SET_NAMESPACE_ARRAY_V6;
|
|
|
|
// Windows 8.1
|
|
typedef struct _API_SET_VALUE_ENTRY_V4
|
|
{
|
|
ULONG Flags;
|
|
ULONG NameOffset;
|
|
ULONG NameLength;
|
|
ULONG ValueOffset;
|
|
ULONG ValueLength;
|
|
} API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4;
|
|
|
|
typedef struct _API_SET_VALUE_ARRAY_V4
|
|
{
|
|
ULONG Flags;
|
|
ULONG Count;
|
|
API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY];
|
|
} API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ENTRY_V4
|
|
{
|
|
ULONG Flags;
|
|
ULONG NameOffset;
|
|
ULONG NameLength;
|
|
ULONG AliasOffset;
|
|
ULONG AliasLength;
|
|
ULONG DataOffset;
|
|
} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ARRAY_V4
|
|
{
|
|
ULONG Version;
|
|
ULONG Size;
|
|
ULONG Flags;
|
|
ULONG Count;
|
|
API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY];
|
|
} API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4;
|
|
|
|
// Windows 7/8
|
|
typedef struct _API_SET_VALUE_ENTRY_V2
|
|
{
|
|
ULONG NameOffset;
|
|
ULONG NameLength;
|
|
ULONG ValueOffset;
|
|
ULONG ValueLength;
|
|
} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;
|
|
|
|
typedef struct _API_SET_VALUE_ARRAY_V2
|
|
{
|
|
ULONG Count;
|
|
API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
|
|
} API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ENTRY_V2
|
|
{
|
|
ULONG NameOffset;
|
|
ULONG NameLength;
|
|
ULONG DataOffset;
|
|
} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;
|
|
|
|
typedef struct _API_SET_NAMESPACE_ARRAY_V2
|
|
{
|
|
ULONG Version;
|
|
ULONG Count;
|
|
API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY];
|
|
} API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2;
|
|
|
|
PWCHAR GetRedirectedName(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize);
|
|
PWCHAR GetRedirectedName_V6(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize);
|
|
PWCHAR GetRedirectedName_V4(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize);
|
|
PWCHAR GetRedirectedName_V2(const PWSTR wszImportingModule, const PWSTR wszVirtualModule, SIZE_T* stSize);
|
|
|
|
#endif // _APISETMAP_H_
|