mirror of
https://github.com/zodiacon/WindowsInternals
synced 2026-08-09 13:18:09 +00:00
Pavel Yosifovich
80 lines
2.3 KiB
C++
80 lines
2.3 KiB
C++
// apiSetMap.cpp : Defines the entry point for the console application.
|
|
//
|
|
|
|
#include "stdafx.h"
|
|
|
|
void PrintHeader() {
|
|
printf("ApiSetMap - list API Set mappings - version 1.0\n");
|
|
printf("(c) Alex Ionescu, Pavel Yosifovich, and Contributors\n");
|
|
printf("http://www.alex-ionescu.com\n\n");
|
|
}
|
|
|
|
|
|
int main() {
|
|
PrintHeader();
|
|
|
|
auto peb = NtCurrentTeb()->ProcessEnvironmentBlock;
|
|
auto apiSetMap = static_cast<PAPI_SET_NAMESPACE>(peb->Reserved9[0]);
|
|
auto apiSetMapAsNumber = reinterpret_cast<ULONG_PTR>(apiSetMap);
|
|
|
|
auto nsEntry = reinterpret_cast<PAPI_SET_NAMESPACE_ENTRY>((apiSetMap->EntryOffset + apiSetMapAsNumber));
|
|
|
|
UNICODE_STRING nameString, valueString;
|
|
|
|
for (ULONG i = 0; i < apiSetMap->Count; i++) {
|
|
auto isSealed = (nsEntry->Flags & API_SET_SCHEMA_ENTRY_FLAGS_SEALED) != 0;
|
|
|
|
//
|
|
// Build a UNICODE_STRING for this contract
|
|
//
|
|
nameString.MaximumLength = static_cast<USHORT>(nsEntry->NameLength);
|
|
nameString.Length = static_cast<USHORT>(nsEntry->NameLength);
|
|
nameString.Buffer = reinterpret_cast<PWCHAR>(apiSetMapAsNumber + nsEntry->NameOffset);
|
|
printf("%56wZ.dll -> %s{", &nameString, (isSealed ? "s" : "" ));
|
|
|
|
//
|
|
// Iterate the values (i.e.: the hosts for this set)
|
|
//
|
|
auto valueEntry = reinterpret_cast<PAPI_SET_VALUE_ENTRY>(apiSetMapAsNumber + nsEntry->ValueOffset);
|
|
for (ULONG j = 0; j < nsEntry->ValueCount; j++) {
|
|
//
|
|
// Build a UNICODE_STRING for this host
|
|
//
|
|
valueString.Buffer = reinterpret_cast<PWCHAR>(apiSetMapAsNumber + valueEntry->ValueOffset);
|
|
valueString.MaximumLength = static_cast<USHORT>(valueEntry->ValueLength);
|
|
valueString.Length = static_cast<USHORT>(valueEntry->ValueLength);
|
|
printf("%wZ", &valueString);
|
|
|
|
//
|
|
// If there's more than one, add a comma
|
|
//
|
|
if ((j + 1) != nsEntry->ValueCount) {
|
|
printf(", ");
|
|
}
|
|
|
|
//
|
|
// If there's an alias...
|
|
//
|
|
if (valueEntry->NameLength != 0) {
|
|
//
|
|
// Build a UNICODE_STRING for it
|
|
//
|
|
nameString.MaximumLength = static_cast<USHORT>(valueEntry->NameLength);
|
|
nameString.Length = static_cast<USHORT>(valueEntry->NameLength);
|
|
nameString.Buffer = reinterpret_cast<PWCHAR>(apiSetMapAsNumber + valueEntry->NameOffset);
|
|
printf(" [%wZ]", &nameString);
|
|
}
|
|
|
|
valueEntry++;
|
|
}
|
|
//
|
|
// Next contract
|
|
//
|
|
printf("}\n");
|
|
nsEntry++;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|