Load functions by hand

7 files changed, 452 insertions, 15 deletions

diff --git a/include/cvinfo.h b/include/cvinfo.h
index efbf706..0f55ead 100644
--- a/include/cvinfo.h
+++ b/include/cvinfo.h
@@ -1173,7 +1173,7 @@ typedef struct TYPTYPE {
     unsigned char   data[CV_ZEROLEN];
 } TYPTYPE;          // general types record
 
-__INLINE char *NextType ( _In_ char * pType) {
+__INLINE char *NextType ( char * pType) {
     return (pType + ((TYPTYPE *)pType)->len + sizeof(unsigned short));
 }
 
@@ -4389,7 +4389,7 @@ typedef struct POGOINFO {
     unsigned short  rectyp;             // S_POGODATA
 
     unsigned long   invocations;        // Number of times function was called
-    __int64         dynCount;           // Dynamic instruction count
+    i64             dynCount;           // Dynamic instruction count
     unsigned long   numInstrs;          // Static instruction count
     unsigned long   staInstLive;        // Final static instruction count (post inlining)
 } POGOINFO;
@@ -4568,7 +4568,7 @@ typedef struct PDBMAP {
 // V7 line number data types
 //
 
-enum DEBUG_S_SUBSECTION_TYPE {
+enum DEBUG_S_SUBSECTION_TYPE : i64 {
     DEBUG_S_IGNORE = 0x80000000,    // if this bit is set in a subsection type then ignore the subsection contents
 
     DEBUG_S_SYMBOLS = 0xf1,
diff --git a/include/events.h b/include/events.h
index 65131c6..1055f84 100644
--- a/include/events.h
+++ b/include/events.h
@@ -1,19 +1,19 @@
 #pragma once
 
-extern void handle_create_process();
+extern void handle_create_process(void);
 
-extern void handle_create_thread();
+extern void handle_create_thread(void);
 
-extern void handle_exception();
+extern void handle_exception(void);
 
-extern void handle_exit_process();
+extern void handle_exit_process(void);
 
-extern void handle_exit_thread();
+extern void handle_exit_thread(void);
 
-extern void handle_load_dll();
+extern void handle_load_dll(void);
 
-extern void handle_unload_dll();
+extern void handle_unload_dll(void);
 
-extern void handle_output_debug_string();
+extern void handle_output_debug_string(void);
 
-extern void handle_rip();
+extern void handle_rip(void);
diff --git a/include/funcs.h b/include/funcs.h
new file mode 100644
index 0000000..7661539
--- /dev/null
+++ b/include/funcs.h
@@ -0,0 +1,35 @@
+KERNEL_BASE(VirtualAlloc)
+KERNEL_BASE(VirtualFree)
+
+KERNEL32(CreateProcessA)
+KERNEL32(OpenProcess)
+KERNEL32(TerminateProcess)
+
+KERNEL32(OpenThread)
+KERNEL32(GetThreadContext)
+KERNEL32(SetThreadContext)
+
+KERNEL32(CreateFileA)
+KERNEL32(ReadFile)
+KERNEL32(WriteFile)
+KERNEL32(SetFilePointer)
+KERNEL32(GetStdHandle)
+KERNEL32(GetLastError)
+
+KERNEL32(SetConsoleMode)
+KERNEL32(ReadConsoleA)
+KERNEL32(WriteConsoleA)
+
+KERNEL32(ReadProcessMemory)
+KERNEL32(OutputDebugStringA)
+KERNEL32(ContinueDebugEvent)
+KERNEL32(WaitForDebugEventEx)
+
+KERNEL32(WideCharToMultiByte)
+KERNEL32(GetFinalPathNameByHandleA)
+KERNEL32(CompareStringA)
+
+KERNEL32(CloseHandle)
+
+KERNEL32(memset)
+KERNEL32(memcpy)
diff --git a/include/hashmap.h b/include/hashmap.h
index 88490e7..7053419 100644
--- a/include/hashmap.h
+++ b/include/hashmap.h
@@ -17,7 +17,7 @@ struct hashmap {
     struct element* arr;
 };
 
-extern struct hashmap create_unordered_flat();
+extern struct hashmap create_unordered_flat(void);
 
 extern struct element* insert_elem(struct hashmap* map, u32 start, u32 end, u64 name);
 
diff --git a/include/module.h b/include/module.h
index 89a2d8c..f61437e 100644
--- a/include/module.h
+++ b/include/module.h
@@ -141,7 +141,7 @@ struct module {
 extern struct module modules[64U];
 extern u64 modules_list;
 
-extern u8 add_module();
+extern u8 add_module(void);
 
 extern void remove_module(u8 index);
 
diff --git a/include/utils.h b/include/utils.h
index d93d2bb..24083cf 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -5,9 +5,10 @@
 #if defined (_DEBUG)
 #define assert(x) if (!(x)) __debugbreak();
 #else
-#define assert(x) (x)
+#define assert(x) ((void)((x) ? 1 : 0))
 #endif
 
+#define NULL    0
 #define TRUE    1
 #define FALSE   0
 
diff --git a/include/win_funcs.h b/include/win_funcs.h
new file mode 100644
index 0000000..9ea4510
--- /dev/null
+++ b/include/win_funcs.h
@@ -0,0 +1,401 @@
+#pragma once
+
+#include "types.h"
+
+typedef u32 (*PTHREAD_START_ROUTINE)(void* lpThreadParameter);
+typedef PTHREAD_START_ROUTINE LPTHREAD_START_ROUTINE;
+
+#define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters
+
+//
+// Exception record definition.
+//
+
+typedef struct _EXCEPTION_RECORD {
+    u32     ExceptionCode;
+    u32     ExceptionFlags;
+    struct _EXCEPTION_RECORD *ExceptionRecord;
+    void*   ExceptionAddress;
+    u32     NumberParameters;
+    u64*    ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
+    } EXCEPTION_RECORD;
+
+typedef EXCEPTION_RECORD *PEXCEPTION_RECORD;
+
+typedef struct _EXCEPTION_DEBUG_INFO {
+    EXCEPTION_RECORD ExceptionRecord;
+    u32 dwFirstChance;
+} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO;
+
+typedef struct _CREATE_THREAD_DEBUG_INFO {
+    void* hThread;
+    void* lpThreadLocalBase;
+    LPTHREAD_START_ROUTINE lpStartAddress;
+} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO;
+
+typedef struct _CREATE_PROCESS_DEBUG_INFO {
+    void* hFile;
+    void* hProcess;
+    void* hThread;
+    void* lpBaseOfImage;
+    u32   dwDebugInfoFileOffset;
+    u32   nDebugInfoSize;
+    void* lpThreadLocalBase;
+    LPTHREAD_START_ROUTINE lpStartAddress;
+    void* lpImageName;
+    u16   fUnicode;
+} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO;
+
+typedef struct _EXIT_THREAD_DEBUG_INFO {
+    u32 dwExitCode;
+} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO;
+
+typedef struct _EXIT_PROCESS_DEBUG_INFO {
+    u32 dwExitCode;
+} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO;
+
+typedef struct _LOAD_DLL_DEBUG_INFO {
+    void* hFile;
+    void* lpBaseOfDll;
+    u32 dwDebugInfoFileOffset;
+    u32 nDebugInfoSize;
+    void* lpImageName;
+    u16 fUnicode;
+} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO;
+
+typedef struct _UNLOAD_DLL_DEBUG_INFO {
+    void* lpBaseOfDll;
+} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO;
+
+typedef struct _OUTPUT_DEBUG_STRING_INFO {
+    char* lpDebugStringData;
+    u16 fUnicode;
+    u16 nDebugStringLength;
+} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO;
+
+typedef struct _RIP_INFO {
+    u32 dwError;
+    u32 dwType;
+} RIP_INFO, *LPRIP_INFO;
+
+typedef struct _DEBUG_EVENT {
+    u32 dwDebugEventCode;
+    u32 dwProcessId;
+    u32 dwThreadId;
+    union {
+        EXCEPTION_DEBUG_INFO Exception;
+        CREATE_THREAD_DEBUG_INFO CreateThread;
+        CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
+        EXIT_THREAD_DEBUG_INFO ExitThread;
+        EXIT_PROCESS_DEBUG_INFO ExitProcess;
+        LOAD_DLL_DEBUG_INFO LoadDll;
+        UNLOAD_DLL_DEBUG_INFO UnloadDll;
+        OUTPUT_DEBUG_STRING_INFO DebugString;
+        RIP_INFO RipInfo;
+    } u;
+} DEBUG_EVENT, *LPDEBUG_EVENT;
+
+
+typedef struct _CONSOLE_READCONSOLE_CONTROL {
+    u32 nLength;
+    u32 nInitialChars;
+    u32 dwCtrlWakeupMask;
+    u32 dwControlKeyState;
+} CONSOLE_READCONSOLE_CONTROL, *PCONSOLE_READCONSOLE_CONTROL;
+
+typedef struct _STARTUPINFOA {
+    u32   cb;
+    i8*   lpReserved;
+    i8*   lpDesktop;
+    i8*   lpTitle;
+    u32   dwX;
+    u32   dwY;
+    u32   dwXSize;
+    u32   dwYSize;
+    u32   dwXCountChars;
+    u32   dwYCountChars;
+    u32   dwFillAttribute;
+    u32   dwFlags;
+    u16   wShowWindow;
+    u16   cbReserved2;
+    u8*   lpReserved2;
+    void* hStdInput;
+    void* hStdOutput;
+    void* hStdError;
+} STARTUPINFOA, *LPSTARTUPINFOA;
+
+typedef struct _SECURITY_ATTRIBUTES {
+    u32 nLength;
+    void* lpSecurityDescriptor;
+    i32 bInheritHandle;
+} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;
+
+typedef struct _PROCESS_INFORMATION {
+    void* hProcess;
+    void* hThread;
+    u32 dwProcessId;
+    u32 dwThreadId;
+} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
+
+typedef struct _OVERLAPPED {
+    u32* Internal;
+    u32* InternalHigh;
+    union {
+        struct {
+            u32 Offset;
+            u32 OffsetHigh;
+        } DUMMYSTRUCTNAME;
+        void* Pointer;
+    } DUMMYUNIONNAME;
+
+    void*  hEvent;
+} OVERLAPPED, *LPOVERLAPPED;
+
+//
+// Define 128-bit 16-byte aligned xmm register type.
+//
+
+typedef struct __declspec(align(16)) _M128A {
+    u64 Low;
+    i64 High;
+} M128A, *PM128A;
+
+//
+// Format of data for (F)XSAVE/(F)XRSTOR instruction
+//
+
+typedef struct __declspec(align(16)) _XSAVE_FORMAT {
+    u16   ControlWord;
+    u16   StatusWord;
+    u8    TagWord;
+    u8    Reserved1;
+    u16   ErrorOpcode;
+    u32   ErrorOffset;
+    u16   ErrorSelector;
+    u16   Reserved2;
+    u32   DataOffset;
+    u16   DataSelector;
+    u16   Reserved3;
+    u32   MxCsr;
+    u32   MxCsr_Mask;
+    M128A FloatRegisters[8];
+
+#if defined(_WIN64)
+
+    M128A XmmRegisters[16];
+    u8    Reserved4[96];
+
+#else
+
+    M128A XmmRegisters[8];
+    BYTE  Reserved4[224];
+
+#endif
+
+} XSAVE_FORMAT, *PXSAVE_FORMAT;
+typedef XSAVE_FORMAT XMM_SAVE_AREA32, *PXMM_SAVE_AREA32;
+
+//
+// Context Frame
+//
+//  This frame has a several purposes: 1) it is used as an argument to
+//  NtContinue, 2) it is used to constuct a call frame for APC delivery,
+//  and 3) it is used in the user level thread creation routines.
+//
+//
+// The flags field within this record controls the contents of a CONTEXT
+// record.
+//
+// If the context record is used as an input parameter, then for each
+// portion of the context record controlled by a flag whose value is
+// set, it is assumed that that portion of the context record contains
+// valid context. If the context record is being used to modify a threads
+// context, then only that portion of the threads context is modified.
+//
+// If the context record is used as an output parameter to capture the
+// context of a thread, then only those portions of the thread's context
+// corresponding to set flags will be returned.
+//
+// CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags.
+//
+// CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15.
+//
+// CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs.
+//
+// CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15.
+//
+// CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7.
+//
+
+typedef struct __declspec(align(16)) _CONTEXT {
+
+    //
+    // Register parameter home addresses.
+    //
+    // N.B. These fields are for convience - they could be used to extend the
+    //      context record in the future.
+    //
+
+    u64 P1Home;
+    u64 P2Home;
+    u64 P3Home;
+    u64 P4Home;
+    u64 P5Home;
+    u64 P6Home;
+
+    //
+    // Control flags.
+    //
+
+    u32 ContextFlags;
+    u32 MxCsr;
+
+    //
+    // Segment Registers and processor flags.
+    //
+
+    u16   SegCs;
+    u16   SegDs;
+    u16   SegEs;
+    u16   SegFs;
+    u16   SegGs;
+    u16   SegSs;
+    u32 EFlags;
+
+    //
+    // Debug registers
+    //
+
+    u64 Dr0;
+    u64 Dr1;
+    u64 Dr2;
+    u64 Dr3;
+    u64 Dr6;
+    u64 Dr7;
+
+    //
+    // Integer registers.
+    //
+
+    u64 Rax;
+    u64 Rcx;
+    u64 Rdx;
+    u64 Rbx;
+    u64 Rsp;
+    u64 Rbp;
+    u64 Rsi;
+    u64 Rdi;
+    u64 R8;
+    u64 R9;
+    u64 R10;
+    u64 R11;
+    u64 R12;
+    u64 R13;
+    u64 R14;
+    u64 R15;
+
+    //
+    // Program counter.
+    //
+
+    u64 Rip;
+
+    //
+    // Floating point state.
+    //
+
+    union {
+        XMM_SAVE_AREA32 FltSave;
+        struct {
+            M128A Header[2];
+            M128A Legacy[8];
+            M128A Xmm0;
+            M128A Xmm1;
+            M128A Xmm2;
+            M128A Xmm3;
+            M128A Xmm4;
+            M128A Xmm5;
+            M128A Xmm6;
+            M128A Xmm7;
+            M128A Xmm8;
+            M128A Xmm9;
+            M128A Xmm10;
+            M128A Xmm11;
+            M128A Xmm12;
+            M128A Xmm13;
+            M128A Xmm14;
+            M128A Xmm15;
+        };
+    };
+
+    //
+    // Vector registers.
+    //
+
+    M128A VectorRegister[26];
+    u64 VectorControl;
+
+    //
+    // Special debug control registers.
+    //
+
+    u64 DebugControl;
+    u64 LastBranchToRip;
+    u64 LastBranchFromRip;
+    u64 LastExceptionToRip;
+    u64 LastExceptionFromRip;
+} CONTEXT, *PCONTEXT;
+typedef PCONTEXT LPCONTEXT;
+
+// =======================
+// ====== Funcs PFN ======
+// =======================
+typedef void*(*PFN_VirtualAlloc)(void*, u64, u32, u32);
+typedef i32(*PFN_VirtualFree)(void*, size_t, u32);
+
+typedef i32(*PFN_CreateProcessA)(const i8*, i8*, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, i32, u32, void*, const i8*, LPSTARTUPINFOA, LPPROCESS_INFORMATION);
+typedef void*(*PFN_OpenProcess)(u32, i32, u32);
+typedef i32(*PFN_TerminateProcess)(void*, u32);
+
+typedef void*(*PFN_OpenThread)(u32, i32, u32);
+typedef i32(*PFN_GetThreadContext)(void*, LPCONTEXT);
+typedef i32(*PFN_SetThreadContext)(void*, const CONTEXT*);
+
+typedef void*(*PFN_CreateFileA)(const i8*, u32, u32, LPSECURITY_ATTRIBUTES, u32, u32, void*);
+typedef i32(*PFN_ReadFile)(void*, void*, u32, u32*, LPOVERLAPPED);
+typedef u32(*PFN_SetFilePointer)(void*, i32, i32*, u32);
+typedef i32(*PFN_WriteFile)(void*, const void*, u32, u32*, LPOVERLAPPED);
+typedef void*(*PFN_GetStdHandle)(u32);
+typedef u32(*PFN_GetLastError)(void);
+
+typedef i32(*PFN_SetConsoleMode)(void*, u32);
+typedef i32(*PFN_ReadConsoleA)(void*, void*, u32, u32*, PCONSOLE_READCONSOLE_CONTROL);
+typedef i32(*PFN_WriteConsoleA)(void*, const void*, u32, u32*, void*);
+
+typedef i32(*PFN_ReadProcessMemory)(void*, const void*, void*, size_t, size_t*);
+typedef i32(*PFN_OutputDebugStringA)(const char*);
+typedef i32(*PFN_ContinueDebugEvent)(u32, u32, u32);
+typedef i32(*PFN_WaitForDebugEventEx)(LPDEBUG_EVENT, u32);
+
+
+typedef i32(*PFN_CompareStringA)(u32, u32, const i8*, i32, const i8*, i32);
+typedef i32(*PFN_WideCharToMultiByte)(u32, u32, const u16*, i32, i8*, i32, i8*, i32*);
+typedef u32(*PFN_GetFinalPathNameByHandleA)(void*, i8*, u32, u32);
+
+typedef i32(*PFN_CloseHandle)(void*);
+
+typedef i32(*PFN_memset)(void*, void*, size_t, char);
+typedef i32(*PFN_memcpy)(void*, void*, size_t);
+
+// ==========================
+// ====== Funcs extern ======
+// ==========================
+#define KERNEL32(name)      \
+    extern PFN_##name name;
+#define KERNEL_BASE(name)   \
+    extern PFN_##name name;
+
+#include "funcs.h"
+
+#undef KERNEL_BASE
+#undef KERNEL32