admin/vxunderground-VX-API
1
0
Fork 0
mirror of https://github.com/vxunderground/VX-API synced 2026-06-06 16:54:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
59db771f970e70638461afb4bf8a2da895540c3c
vxunderground-VX-API/VX-API/MalwareDataTypes.h
T
vxunderground 34ffa701dc Initial push 
N/A
2022-06-14 18:00:16 -05:00

705 lines
22 KiB
C
Raw Blame History

#pragma once
#include "MalwareHeader.h"
#define ERROR_FAILURE_RETURN 0
#define PROCESSOR_FEATURE_MAX 64
#pragma region Application Specific Enums
typedef enum MALWARE_PRIVILEGE_VARIANTS {
MW_SEDEBUG_PRIVILEGE,
MW_SEBACKUP_PRIVILEGE
} MalwarePrivilegeVariants;
typedef enum STRING_HASH_VARIANTS {
SH_DJB2,
SH_FNVV1A,
SH_J1AAT_32,
SH_LL,
SH_ROTR_32,
SH_SDBM,
SH_FAST,
SH_UHA1
} StringHashVariants;
typedef enum OS_IDENTIFICATION_FROM_PEB {
OSMAJORVERSION,
OSMINORVERSION,
OSBUILDNUMBER,
OSPLATFORMID
}OsIdentificationVariants;
#pragma endregion
#pragma region NT String Structures
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING;
typedef struct _STRING {
USHORT Length;
USHORT MaximumLength;
PCHAR Buffer;
} ANSI_STRING, * PANSI_STRING;
typedef struct _RTL_DRIVE_LETTER_CURDIR {
WORD Flags;
WORD Length;
ULONG TimeStamp;
ANSI_STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, * PRTL_DRIVE_LETTER_CURDIR;
typedef struct _CURDIR {
UNICODE_STRING DosPath;
PVOID Handle;
}CURDIR, * PCURDIR;
#pragma endregion
#pragma region PEB Sub-Structures
typedef struct _RTL_USER_PROCESS_PARAMETERS {
ULONG MaximumLength;
ULONG Length;
ULONG Flags;
ULONG DebugFlags;
PVOID ConsoleHandle;
ULONG ConsoleFlags;
PVOID StandardInput;
PVOID StandardOutput;
PVOID StandardError;
CURDIR CurrentDirectory;
UNICODE_STRING DllPath;
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
PVOID Environment;
ULONG StartingX;
ULONG StartingY;
ULONG CountX;
ULONG CountY;
ULONG CountCharsX;
ULONG CountCharsY;
ULONG FillAttribute;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopInfo;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
ULONG EnvironmentSize;
}RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
SHORT LoadCount;
SHORT TlsIndex;
LIST_ENTRY HashTableEntry;
ULONG TimeDateStamp;
} LDR_MODULE, * PLDR_MODULE;
typedef struct _PEB_LDR_DATA {
ULONG Length;
ULONG Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, * PPEB_LDR_DATA;
#pragma endregion
#pragma region PEB
typedef struct _PEB {
BOOLEAN InheritedAddressSpace;
BOOLEAN ReadImageFileExecOptions;
BOOLEAN BeingDebugged;
BOOLEAN Spare;
HANDLE Mutant;
PVOID ImageBase;
PPEB_LDR_DATA LoaderData;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID SubSystemData;
PVOID ProcessHeap;
PVOID FastPebLock;
PVOID FastPebLockRoutine;
PVOID FastPebUnlockRoutine;
ULONG EnvironmentUpdateCount;
PVOID* KernelCallbackTable;
PVOID EventLogSection;
PVOID EventLog;
PVOID FreeList;
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[0x2];
PVOID ReadOnlySharedMemoryBase;
PVOID ReadOnlySharedMemoryHeap;
PVOID* ReadOnlyStaticServerData;
PVOID AnsiCodePageData;
PVOID OemCodePageData;
PVOID UnicodeCaseTableData;
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
BYTE Spare2[0x4];
LARGE_INTEGER CriticalSectionTimeout;
ULONG HeapSegmentReserve;
ULONG HeapSegmentCommit;
ULONG HeapDeCommitTotalFreeThreshold;
ULONG HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
PVOID** ProcessHeaps;
PVOID GdiSharedHandleTable;
PVOID ProcessStarterHelper;
PVOID GdiDCAttributeList;
PVOID LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
ULONG OSBuildNumber;
ULONG OSPlatformId;
ULONG ImageSubSystem;
ULONG ImageSubSystemMajorVersion;
ULONG ImageSubSystemMinorVersion;
ULONG GdiHandleBuffer[0x22];
ULONG PostProcessInitRoutine;
ULONG TlsExpansionBitmap;
BYTE TlsExpansionBitmapBits[0x80];
ULONG SessionId;
} PEB, * PPEB;
#pragma endregion
#pragma region TEB Sub-Structures
typedef struct __CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
}CLIENT_ID, * PCLIENT_ID;
typedef PVOID PACTIVATION_CONTEXT;
typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME {
struct __RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous;
PACTIVATION_CONTEXT ActivationContext;
ULONG Flags;
} RTL_ACTIVATION_CONTEXT_STACK_FRAME, * PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
typedef struct _ACTIVATION_CONTEXT_STACK {
PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
LIST_ENTRY FrameListCache;
ULONG Flags;
ULONG NextCookieSequenceNumber;
ULONG StackId;
} ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK;
typedef struct _GDI_TEB_BATCH {
ULONG Offset;
ULONG HDC;
ULONG Buffer[310];
} GDI_TEB_BATCH, * PGDI_TEB_BATCH;
typedef struct _TEB_ACTIVE_FRAME_CONTEXT {
ULONG Flags;
PCHAR FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, * PTEB_ACTIVE_FRAME_CONTEXT;
typedef struct _TEB_ACTIVE_FRAME {
ULONG Flags;
struct _TEB_ACTIVE_FRAME* Previous;
PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, * PTEB_ACTIVE_FRAME;
#pragma endregion
#pragma region TEB
typedef struct _TEB
{
NT_TIB NtTib;
PVOID EnvironmentPointer;
CLIENT_ID ClientId;
PVOID ActiveRpcHandle;
PVOID ThreadLocalStoragePointer;
PPEB ProcessEnvironmentBlock;
ULONG LastErrorValue;
ULONG CountOfOwnedCriticalSections;
PVOID CsrClientThread;
PVOID Win32ThreadInfo;
ULONG User32Reserved[26];
ULONG UserReserved[5];
PVOID WOW32Reserved;
LCID CurrentLocale;
ULONG FpSoftwareStatusRegister;
PVOID SystemReserved1[54];
LONG ExceptionCode;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
PACTIVATION_CONTEXT_STACK* ActivationContextStackPointer;
UCHAR SpareBytes1[0x30 - 3 * sizeof(PVOID)];
ULONG TxFsContext;
#elif (NTDDI_VERSION >= NTDDI_WS03)
PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
UCHAR SpareBytes1[0x34 - 3 * sizeof(PVOID)];
#else
ACTIVATION_CONTEXT_STACK ActivationContextStack;
UCHAR SpareBytes1[24];
#endif
GDI_TEB_BATCH GdiTebBatch;
CLIENT_ID RealClientId;
PVOID GdiCachedProcessHandle;
ULONG GdiClientPID;
ULONG GdiClientTID;
PVOID GdiThreadLocalInfo;
PSIZE_T Win32ClientInfo[62];
PVOID glDispatchTable[233];
PSIZE_T glReserved1[29];
PVOID glReserved2;
PVOID glSectionInfo;
PVOID glSection;
PVOID glTable;
PVOID glCurrentRC;
PVOID glContext;
NTSTATUS LastStatusValue;
UNICODE_STRING StaticUnicodeString;
WCHAR StaticUnicodeBuffer[261];
PVOID DeallocationStack;
PVOID TlsSlots[64];
LIST_ENTRY TlsLinks;
PVOID Vdm;
PVOID ReservedForNtRpc;
PVOID DbgSsReserved[2];
#if (NTDDI_VERSION >= NTDDI_WS03)
ULONG HardErrorMode;
#else
ULONG HardErrorsAreDisabled;
#endif
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
PVOID Instrumentation[13 - sizeof(GUID) / sizeof(PVOID)];
GUID ActivityId;
PVOID SubProcessTag;
PVOID EtwLocalData;
PVOID EtwTraceData;
#elif (NTDDI_VERSION >= NTDDI_WS03)
PVOID Instrumentation[14];
PVOID SubProcessTag;
PVOID EtwLocalData;
#else
PVOID Instrumentation[16];
#endif
PVOID WinSockData;
ULONG GdiBatchCount;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
BOOLEAN SpareBool0;
BOOLEAN SpareBool1;
BOOLEAN SpareBool2;
#else
BOOLEAN InDbgPrint;
BOOLEAN FreeStackOnTermination;
BOOLEAN HasFiberData;
#endif
UCHAR IdealProcessor;
#if (NTDDI_VERSION >= NTDDI_WS03)
ULONG GuaranteedStackBytes;
#else
ULONG Spare3;
#endif
PVOID ReservedForPerf;
PVOID ReservedForOle;
ULONG WaitingOnLoaderLock;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
PVOID SavedPriorityState;
ULONG_PTR SoftPatchPtr1;
ULONG_PTR ThreadPoolData;
#elif (NTDDI_VERSION >= NTDDI_WS03)
ULONG_PTR SparePointer1;
ULONG_PTR SoftPatchPtr1;
ULONG_PTR SoftPatchPtr2;
#else
Wx86ThreadState Wx86Thread;
#endif
PVOID* TlsExpansionSlots;
#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
PVOID DeallocationBStore;
PVOID BStoreLimit;
#endif
ULONG ImpersonationLocale;
ULONG IsImpersonating;
PVOID NlsCache;
PVOID pShimData;
ULONG HeapVirtualAffinity;
HANDLE CurrentTransactionHandle;
PTEB_ACTIVE_FRAME ActiveFrame;
#if (NTDDI_VERSION >= NTDDI_WS03)
PVOID FlsData;
#endif
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
PVOID PreferredLangauges;
PVOID UserPrefLanguages;
PVOID MergedPrefLanguages;
ULONG MuiImpersonation;
union
{
struct
{
USHORT SpareCrossTebFlags : 16;
};
USHORT CrossTebFlags;
};
union
{
struct
{
USHORT DbgSafeThunkCall : 1;
USHORT DbgInDebugPrint : 1;
USHORT DbgHasFiberData : 1;
USHORT DbgSkipThreadAttach : 1;
USHORT DbgWerInShipAssertCode : 1;
USHORT DbgIssuedInitialBp : 1;
USHORT DbgClonedThread : 1;
USHORT SpareSameTebBits : 9;
};
USHORT SameTebFlags;
};
PVOID TxnScopeEntercallback;
PVOID TxnScopeExitCAllback;
PVOID TxnScopeContext;
ULONG LockCount;
ULONG ProcessRundown;
ULONG64 LastSwitchTime;
ULONG64 TotalSwitchOutTime;
LARGE_INTEGER WaitReasonBitMap;
#else
BOOLEAN SafeThunkCall;
BOOLEAN BooleanSpare[3];
#endif
} TEB, * PTEB;
#pragma endregion
#pragma region KUserSharedData Sub-Structures
typedef struct _KSYSTEM_TIME
{
ULONG LowPart;
LONG High1Time;
LONG High2Time;
} KSYSTEM_TIME, * PKSYSTEM_TIME;
typedef enum _NT_PRODUCT_TYPE
{
NtProductWinNt = 1,
NtProductLanManNt = 2,
NtProductServer = 3
} NT_PRODUCT_TYPE;
typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
{
StandardDesign = 0,
NEC98x86 = 1,
EndAlternatives = 2
} ALTERNATIVE_ARCHITECTURE_TYPE;
#pragma endregion
#pragma region KUserSharedData
typedef struct _KUSER_SHARED_DATA {
ULONG TickCountLowDeprecated;
ULONG TickCountMultiplier;
KSYSTEM_TIME InterruptTime;
KSYSTEM_TIME SystemTime;
KSYSTEM_TIME TimeZoneBias;
USHORT ImageNumberLow;
USHORT ImageNumberHigh;
WCHAR NtSystemRoot[260];
ULONG MaxStackTraceDepth;
ULONG CryptoExponent;
ULONG TimeZoneId;
ULONG LargePageMinimum;
ULONG AitSamplingValue;
ULONG AppCompatFlag;
ULONGLONG RNGSeedVersion;
ULONG GlobalValidationRunlevel;
LONG TimeZoneBiasStamp;
ULONG NtBuildNumber;
NT_PRODUCT_TYPE NtProductType;
BOOLEAN ProductTypeIsValid;
BOOLEAN Reserved0[1];
USHORT NativeProcessorArchitecture;
ULONG NtMajorVersion;
ULONG NtMinorVersion;
BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
ULONG Reserved1;
ULONG Reserved3;
ULONG TimeSlip;
ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
ULONG BootId;
LARGE_INTEGER SystemExpirationDate;
ULONG SuiteMask;
BOOLEAN KdDebuggerEnabled;
union {
UCHAR MitigationPolicies;
struct {
UCHAR NXSupportPolicy : 2;
UCHAR SEHValidationPolicy : 2;
UCHAR CurDirDevicesSkippedForDlls : 2;
UCHAR Reserved : 2;
};
};
USHORT CyclesPerYield;
ULONG ActiveConsoleId;
ULONG DismountCount;
ULONG ComPlusPackage;
ULONG LastSystemRITEventTickCount;
ULONG NumberOfPhysicalPages;
BOOLEAN SafeBootMode;
UCHAR VirtualizationFlags;
UCHAR Reserved12[2];
union {
ULONG SharedDataFlags;
struct {
ULONG DbgErrorPortPresent : 1;
ULONG DbgElevationEnabled : 1;
ULONG DbgVirtEnabled : 1;
ULONG DbgInstallerDetectEnabled : 1;
ULONG DbgLkgEnabled : 1;
ULONG DbgDynProcessorEnabled : 1;
ULONG DbgConsoleBrokerEnabled : 1;
ULONG DbgSecureBootEnabled : 1;
ULONG DbgMultiSessionSku : 1;
ULONG DbgMultiUsersInSessionSku : 1;
ULONG DbgStateSeparationEnabled : 1;
ULONG SpareBits : 21;
} DUMMYSTRUCTNAME2;
} DUMMYUNIONNAME2;
ULONG DataFlagsPad[1];
ULONGLONG TestRetInstruction;
LONGLONG QpcFrequency;
ULONG SystemCall;
ULONG Reserved2;
ULONGLONG SystemCallPad[2];
union {
KSYSTEM_TIME TickCount;
ULONG64 TickCountQuad;
struct {
ULONG ReservedTickCountOverlay[3];
ULONG TickCountPad[1];
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME3;
ULONG Cookie;
ULONG CookiePad[1];
LONGLONG ConsoleSessionForegroundProcessId;
ULONGLONG TimeUpdateLock;
ULONGLONG BaselineSystemTimeQpc;
ULONGLONG BaselineInterruptTimeQpc;
ULONGLONG QpcSystemTimeIncrement;
ULONGLONG QpcInterruptTimeIncrement;
UCHAR QpcSystemTimeIncrementShift;
UCHAR QpcInterruptTimeIncrementShift;
USHORT UnparkedProcessorCount;
ULONG EnclaveFeatureMask[4];
ULONG TelemetryCoverageRound;
USHORT UserModeGlobalLogger[16];
ULONG ImageFileExecutionOptions;
ULONG LangGenerationCount;
ULONGLONG Reserved4;
ULONGLONG InterruptTimeBias;
ULONGLONG QpcBias;
ULONG ActiveProcessorCount;
UCHAR ActiveGroupCount;
UCHAR Reserved9;
union {
USHORT QpcData;
struct {
UCHAR QpcBypassEnabled;
UCHAR QpcShift;
};
};
LARGE_INTEGER TimeZoneBiasEffectiveStart;
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
XSTATE_CONFIGURATION XState;
KSYSTEM_TIME FeatureConfigurationChangeStamp;
ULONG Spare;
} KUSER_SHARED_DATA, * PKUSER_SHARED_DATA;
#pragma endregion
#pragma region Volume Shadow Copy Service Data
CONST IID IID_IVssCoordinator = { 0xda9f41d4, 0x1a5d, 0x41d0, {0xa6, 0x14, 0x6d, 0xfd, 0x78, 0xdf, 0x5d, 0x05} };
CONST IID CLSID_CVssCoordinator = { 0xe579ab5f, 0x1cc4, 0x44b4, {0xbe, 0xd9, 0xde, 0x09, 0x91, 0xff, 0x06, 0x23} };
typedef GUID VSS_ID;
typedef WCHAR* VSS_PWSZ;
typedef LONGLONG VSS_TIMESTAMP;
typedef enum _VSS_SNAPSHOT_STATE{
VSS_SS_UNKNOWN = 0,
VSS_SS_PREPARING = (VSS_SS_UNKNOWN + 1),
VSS_SS_PROCESSING_PREPARE = (VSS_SS_PREPARING + 1),
VSS_SS_PREPARED = (VSS_SS_PROCESSING_PREPARE + 1),
VSS_SS_PROCESSING_PRECOMMIT = (VSS_SS_PREPARED + 1),
VSS_SS_PRECOMMITTED = (VSS_SS_PROCESSING_PRECOMMIT + 1),
VSS_SS_PROCESSING_COMMIT = (VSS_SS_PRECOMMITTED + 1),
VSS_SS_COMMITTED = (VSS_SS_PROCESSING_COMMIT + 1),
VSS_SS_PROCESSING_POSTCOMMIT = (VSS_SS_COMMITTED + 1),
VSS_SS_PROCESSING_PREFINALCOMMIT = (VSS_SS_PROCESSING_POSTCOMMIT + 1),
VSS_SS_PREFINALCOMMITTED = (VSS_SS_PROCESSING_PREFINALCOMMIT + 1),
VSS_SS_PROCESSING_POSTFINALCOMMIT = (VSS_SS_PREFINALCOMMITTED + 1),
VSS_SS_CREATED = (VSS_SS_PROCESSING_POSTFINALCOMMIT + 1),
VSS_SS_ABORTED = (VSS_SS_CREATED + 1),
VSS_SS_DELETED = (VSS_SS_ABORTED + 1),
VSS_SS_POSTCOMMITTED = (VSS_SS_DELETED + 1),
VSS_SS_COUNT = (VSS_SS_POSTCOMMITTED + 1)
} VSS_SNAPSHOT_STATE;
typedef enum _VSS_OBJECT_TYPE{
VSS_OBJECT_UNKNOWN = 0,
VSS_OBJECT_NONE = (VSS_OBJECT_UNKNOWN + 1),
VSS_OBJECT_SNAPSHOT_SET = (VSS_OBJECT_NONE + 1),
VSS_OBJECT_SNAPSHOT = (VSS_OBJECT_SNAPSHOT_SET + 1),
VSS_OBJECT_PROVIDER = (VSS_OBJECT_SNAPSHOT + 1),
VSS_OBJECT_TYPE_COUNT = (VSS_OBJECT_PROVIDER + 1)
} VSS_OBJECT_TYPE;
typedef enum _VSS_PROVIDER_TYPE{
VSS_PROV_UNKNOWN = 0,
VSS_PROV_SYSTEM = 1,
VSS_PROV_SOFTWARE = 2,
VSS_PROV_HARDWARE = 3,
VSS_PROV_FILESHARE = 4
} VSS_PROVIDER_TYPE;
typedef struct _VSS_SNAPSHOT_PROP{
VSS_ID m_SnapshotId;
VSS_ID m_SnapshotSetId;
LONG m_lSnapshotsCount;
VSS_PWSZ m_pwszSnapshotDeviceObject;
VSS_PWSZ m_pwszOriginalVolumeName;
VSS_PWSZ m_pwszOriginatingMachine;
VSS_PWSZ m_pwszServiceMachine;
VSS_PWSZ m_pwszExposedName;
VSS_PWSZ m_pwszExposedPath;
VSS_ID m_ProviderId;
LONG m_lSnapshotAttributes;
VSS_TIMESTAMP m_tsCreationTimestamp;
VSS_SNAPSHOT_STATE m_eStatus;
} VSS_SNAPSHOT_PROP;
typedef struct _VSS_PROVIDER_PROP{
VSS_ID m_ProviderId;
VSS_PWSZ m_pwszProviderName;
VSS_PROVIDER_TYPE m_eProviderType;
VSS_PWSZ m_pwszProviderVersion;
VSS_ID m_ProviderVersionId;
CLSID m_ClassId;
} VSS_PROVIDER_PROP;
typedef union __MIDL___MIDL_itf_vss_0000_0000_0001{
VSS_SNAPSHOT_PROP Snap;
VSS_PROVIDER_PROP Prov;
} VSS_OBJECT_UNION;
typedef struct _VSS_OBJECT_PROP{
VSS_OBJECT_TYPE Type;
VSS_OBJECT_UNION Obj;
} VSS_OBJECT_PROP;
struct __declspec(uuid("AE1C7110-2F60-11d3-8A39-00C04F72D8E3"))
IVssEnumObject : public IUnknown{
#pragma warning( push )
#pragma warning( disable : 28285)
virtual HRESULT __stdcall Next(ULONG, __RPC__out_ecount_part(celt, *pceltFetched) VSS_OBJECT_PROP*, ULONG*) = 0;
#pragma warning( pop )
virtual HRESULT __stdcall Skip(ULONG) = 0;
virtual HRESULT __stdcall Reset(VOID) = 0;
virtual HRESULT __stdcall Clone(IVssEnumObject**) = 0;
};
struct __declspec(uuid("507C37B4-CF5B-4e95-B0AF-14EB9767467E"))
IVssAsync : public IUnknown{
virtual HRESULT __stdcall Cancel(VOID) = 0;
virtual HRESULT __stdcall Wait(DWORD dwMilliseconds = 0xffffffff) = 0;
virtual HRESULT __stdcall QueryStatus(HRESULT*, INT*) = 0;
};
struct __declspec(uuid("{da9f41d4-1a5d-41d0-a614-6dfd78df5d05}"))
IVssCoordinator: public IUnknown{
virtual HRESULT __stdcall SetContext(LONG) = 0;
virtual HRESULT __stdcall StartSnapshotSet(LPGUID) = 0;
virtual HRESULT __stdcall AddToSnapshotSet(PWCHAR, GUID, LPGUID) = 0;
virtual HRESULT __stdcall DoSnapshotSet(IDispatch*, IVssAsync**) = 0;
virtual HRESULT __stdcall GetSnapshotProperties(GUID, VSS_SNAPSHOT_PROP*) = 0;
virtual HRESULT __stdcall ExposeSnapshot(GUID, PWCHAR, LONG, PWCHAR, PWCHAR*) = 0;
virtual HRESULT __stdcall ImportSnapshots(PUSHORT, IVssAsync**) = 0;
virtual HRESULT __stdcall Query(GUID, VSS_OBJECT_TYPE, VSS_OBJECT_TYPE, IVssEnumObject**) = 0;
virtual HRESULT __stdcall DeleteSnapshots(GUID, VSS_OBJECT_TYPE, INT, PLONG, LPGUID) = 0;
virtual HRESULT __stdcall BreakSnapshotSet(GUID) = 0;
virtual HRESULT __stdcall RevertToSnapshot(GUID, INT) = 0;
virtual HRESULT __stdcall QueryRevertStatus(PWCHAR, IVssAsync**) = 0;
virtual HRESULT __stdcall IsVolumeSupported(GUID, PWCHAR, PINT) = 0;
virtual HRESULT __stdcall IsVolumeSnapshotted(GUID, PWCHAR, PINT, PLONG) = 0;
virtual HRESULT __stdcall SetWriterInstance(LONG, LPGUID) = 0;
};
#pragma endregion
#pragma region Function Definitions
typedef PVOID(NTAPI* RTLALLOCATEHEAP)(PVOID, ULONG, SIZE_T);
RTLALLOCATEHEAP pfnRtlAllocateHeap;
typedef BOOL(NTAPI* RTLFREEHEAP)(PVOID, ULONG, PVOID);
RTLFREEHEAP pfnFreeHeap;
typedef NTSTATUS(NTAPI* LDRLOADDLL) (PWCHAR, DWORD, PUNICODE_STRING, PHANDLE);
LDRLOADDLL pfnLdrLoadDll;
typedef NTSTATUS(NTAPI* NTCLOSE)(HANDLE);
NTCLOSE pfnNtClose;
#pragma endregion
#pragma region Forwarded Function Hashes
#define RTLALLOCATEHEAP_DJB2 0xc0b381da
#define RTLFREEHEAP_DJB2 0x70ba71d7
#define LDRLOADDLL_DJB2 0x0307db23
#define NTCLOSE_DJB2 0x8b8e133d
#define RTLALLOCATEHEAP_FNVV1A 0xb3f819f8
#define RTLFREEHEAP_FNVV1A 0x7c76ecf5
#define LDRLOADDLL_FNVV1A 0x7b566b5f
#define NTCLOSE_FNVV1A 0x6b372c05
#define RTLALLOCATEHEAP_JOAAT32 0xeaa4c060
#define RTLFREEHEAP_JOAAT32 0x9fda562a
#define LDRLOADDLL_JOAAT32 0x26c4b1f1
#define NTCLOSE_JOAAT32 0xb1d7c572
#define RTLALLOCATEHEAP_LL 0x000005d5
#define RTLFREEHEAP_LL 0x00000432
#define LDRLOADDLL_LL 0x000003be
#define NTCLOSE_LL 0x000002b8
#define RTLALLOCATEHEAP_ROTR32 0x8e17053d
#define RTLFREEHEAP_ROTR32 0xc839b3b6
#define LDRLOADDLL_ROTR32 0xcc4c8b22
#define NTCLOSE_ROTR32 0x7b3f64a4
#define RTLALLOCATEHEAP_SDBM 0x572d53d3
#define RTLFREEHEAP_SDBM 0x10de9522
#define LDRLOADDLL_SDBM 0xf6cfc604
#define NTCLOSE_SDBM 0xec097f52
#define RTLALLOCATEHEAP_FAST 0x93ec7afa
#define RTLFREEHEAP_FAST 0x5c50da17
#define LDRLOADDLL_FAST 0xdab31bd6
#define NTCLOSE_FAST 0x8e3595f5
#define RTLALLOCATEHEAP_UGH1 0x07d597a0
#define RTLFREEHEAP_UGH1 0x2710ab50
#define LDRLOADDLL_UGH1 0x7352adac
#define NTCLOSE_UGH1 0x058a36c5
#pragma endregion
Reference in New Issue View Git Blame Copy Permalink