diff options
Diffstat (limited to 'include/win_funcs.h')
| -rw-r--r-- | include/win_funcs.h | 401 |
1 files changed, 401 insertions, 0 deletions
diff --git a/include/win_funcs.h b/include/win_funcs.h new file mode 100644 index 0000000..9ea4510 --- /dev/null +++ b/include/win_funcs.h @@ -0,0 +1,401 @@ +#pragma once + +#include "types.h" + +typedef u32 (*PTHREAD_START_ROUTINE)(void* lpThreadParameter); +typedef PTHREAD_START_ROUTINE LPTHREAD_START_ROUTINE; + +#define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters + +// +// Exception record definition. +// + +typedef struct _EXCEPTION_RECORD { + u32 ExceptionCode; + u32 ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + void* ExceptionAddress; + u32 NumberParameters; + u64* ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; + } EXCEPTION_RECORD; + +typedef EXCEPTION_RECORD *PEXCEPTION_RECORD; + +typedef struct _EXCEPTION_DEBUG_INFO { + EXCEPTION_RECORD ExceptionRecord; + u32 dwFirstChance; +} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; + +typedef struct _CREATE_THREAD_DEBUG_INFO { + void* hThread; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; +} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; + +typedef struct _CREATE_PROCESS_DEBUG_INFO { + void* hFile; + void* hProcess; + void* hThread; + void* lpBaseOfImage; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; + void* lpImageName; + u16 fUnicode; +} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; + +typedef struct _EXIT_THREAD_DEBUG_INFO { + u32 dwExitCode; +} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; + +typedef struct _EXIT_PROCESS_DEBUG_INFO { + u32 dwExitCode; +} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; + +typedef struct _LOAD_DLL_DEBUG_INFO { + void* hFile; + void* lpBaseOfDll; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpImageName; + u16 fUnicode; +} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; + +typedef struct _UNLOAD_DLL_DEBUG_INFO { + void* lpBaseOfDll; +} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; + +typedef struct _OUTPUT_DEBUG_STRING_INFO { + char* lpDebugStringData; + u16 fUnicode; + u16 nDebugStringLength; +} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; + +typedef struct _RIP_INFO { + u32 dwError; + u32 dwType; +} RIP_INFO, *LPRIP_INFO; + +typedef struct _DEBUG_EVENT { + u32 dwDebugEventCode; + u32 dwProcessId; + u32 dwThreadId; + union { + EXCEPTION_DEBUG_INFO Exception; + CREATE_THREAD_DEBUG_INFO CreateThread; + CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; + EXIT_THREAD_DEBUG_INFO ExitThread; + EXIT_PROCESS_DEBUG_INFO ExitProcess; + LOAD_DLL_DEBUG_INFO LoadDll; + UNLOAD_DLL_DEBUG_INFO UnloadDll; + OUTPUT_DEBUG_STRING_INFO DebugString; + RIP_INFO RipInfo; + } u; +} DEBUG_EVENT, *LPDEBUG_EVENT; + + +typedef struct _CONSOLE_READCONSOLE_CONTROL { + u32 nLength; + u32 nInitialChars; + u32 dwCtrlWakeupMask; + u32 dwControlKeyState; +} CONSOLE_READCONSOLE_CONTROL, *PCONSOLE_READCONSOLE_CONTROL; + +typedef struct _STARTUPINFOA { + u32 cb; + i8* lpReserved; + i8* lpDesktop; + i8* lpTitle; + u32 dwX; + u32 dwY; + u32 dwXSize; + u32 dwYSize; + u32 dwXCountChars; + u32 dwYCountChars; + u32 dwFillAttribute; + u32 dwFlags; + u16 wShowWindow; + u16 cbReserved2; + u8* lpReserved2; + void* hStdInput; + void* hStdOutput; + void* hStdError; +} STARTUPINFOA, *LPSTARTUPINFOA; + +typedef struct _SECURITY_ATTRIBUTES { + u32 nLength; + void* lpSecurityDescriptor; + i32 bInheritHandle; +} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; + +typedef struct _PROCESS_INFORMATION { + void* hProcess; + void* hThread; + u32 dwProcessId; + u32 dwThreadId; +} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; + +typedef struct _OVERLAPPED { + u32* Internal; + u32* InternalHigh; + union { + struct { + u32 Offset; + u32 OffsetHigh; + } DUMMYSTRUCTNAME; + void* Pointer; + } DUMMYUNIONNAME; + + void* hEvent; +} OVERLAPPED, *LPOVERLAPPED; + +// +// Define 128-bit 16-byte aligned xmm register type. +// + +typedef struct __declspec(align(16)) _M128A { + u64 Low; + i64 High; +} M128A, *PM128A; + +// +// Format of data for (F)XSAVE/(F)XRSTOR instruction +// + +typedef struct __declspec(align(16)) _XSAVE_FORMAT { + u16 ControlWord; + u16 StatusWord; + u8 TagWord; + u8 Reserved1; + u16 ErrorOpcode; + u32 ErrorOffset; + u16 ErrorSelector; + u16 Reserved2; + u32 DataOffset; + u16 DataSelector; + u16 Reserved3; + u32 MxCsr; + u32 MxCsr_Mask; + M128A FloatRegisters[8]; + +#if defined(_WIN64) + + M128A XmmRegisters[16]; + u8 Reserved4[96]; + +#else + + M128A XmmRegisters[8]; + BYTE Reserved4[224]; + +#endif + +} XSAVE_FORMAT, *PXSAVE_FORMAT; +typedef XSAVE_FORMAT XMM_SAVE_AREA32, *PXMM_SAVE_AREA32; + +// +// Context Frame +// +// This frame has a several purposes: 1) it is used as an argument to +// NtContinue, 2) it is used to constuct a call frame for APC delivery, +// and 3) it is used in the user level thread creation routines. +// +// +// The flags field within this record controls the contents of a CONTEXT +// record. +// +// If the context record is used as an input parameter, then for each +// portion of the context record controlled by a flag whose value is +// set, it is assumed that that portion of the context record contains +// valid context. If the context record is being used to modify a threads +// context, then only that portion of the threads context is modified. +// +// If the context record is used as an output parameter to capture the +// context of a thread, then only those portions of the thread's context +// corresponding to set flags will be returned. +// +// CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags. +// +// CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15. +// +// CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs. +// +// CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15. +// +// CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7. +// + +typedef struct __declspec(align(16)) _CONTEXT { + + // + // Register parameter home addresses. + // + // N.B. These fields are for convience - they could be used to extend the + // context record in the future. + // + + u64 P1Home; + u64 P2Home; + u64 P3Home; + u64 P4Home; + u64 P5Home; + u64 P6Home; + + // + // Control flags. + // + + u32 ContextFlags; + u32 MxCsr; + + // + // Segment Registers and processor flags. + // + + u16 SegCs; + u16 SegDs; + u16 SegEs; + u16 SegFs; + u16 SegGs; + u16 SegSs; + u32 EFlags; + + // + // Debug registers + // + + u64 Dr0; + u64 Dr1; + u64 Dr2; + u64 Dr3; + u64 Dr6; + u64 Dr7; + + // + // Integer registers. + // + + u64 Rax; + u64 Rcx; + u64 Rdx; + u64 Rbx; + u64 Rsp; + u64 Rbp; + u64 Rsi; + u64 Rdi; + u64 R8; + u64 R9; + u64 R10; + u64 R11; + u64 R12; + u64 R13; + u64 R14; + u64 R15; + + // + // Program counter. + // + + u64 Rip; + + // + // Floating point state. + // + + union { + XMM_SAVE_AREA32 FltSave; + struct { + M128A Header[2]; + M128A Legacy[8]; + M128A Xmm0; + M128A Xmm1; + M128A Xmm2; + M128A Xmm3; + M128A Xmm4; + M128A Xmm5; + M128A Xmm6; + M128A Xmm7; + M128A Xmm8; + M128A Xmm9; + M128A Xmm10; + M128A Xmm11; + M128A Xmm12; + M128A Xmm13; + M128A Xmm14; + M128A Xmm15; + }; + }; + + // + // Vector registers. + // + + M128A VectorRegister[26]; + u64 VectorControl; + + // + // Special debug control registers. + // + + u64 DebugControl; + u64 LastBranchToRip; + u64 LastBranchFromRip; + u64 LastExceptionToRip; + u64 LastExceptionFromRip; +} CONTEXT, *PCONTEXT; +typedef PCONTEXT LPCONTEXT; + +// ======================= +// ====== Funcs PFN ====== +// ======================= +typedef void*(*PFN_VirtualAlloc)(void*, u64, u32, u32); +typedef i32(*PFN_VirtualFree)(void*, size_t, u32); + +typedef i32(*PFN_CreateProcessA)(const i8*, i8*, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, i32, u32, void*, const i8*, LPSTARTUPINFOA, LPPROCESS_INFORMATION); +typedef void*(*PFN_OpenProcess)(u32, i32, u32); +typedef i32(*PFN_TerminateProcess)(void*, u32); + +typedef void*(*PFN_OpenThread)(u32, i32, u32); +typedef i32(*PFN_GetThreadContext)(void*, LPCONTEXT); +typedef i32(*PFN_SetThreadContext)(void*, const CONTEXT*); + +typedef void*(*PFN_CreateFileA)(const i8*, u32, u32, LPSECURITY_ATTRIBUTES, u32, u32, void*); +typedef i32(*PFN_ReadFile)(void*, void*, u32, u32*, LPOVERLAPPED); +typedef u32(*PFN_SetFilePointer)(void*, i32, i32*, u32); +typedef i32(*PFN_WriteFile)(void*, const void*, u32, u32*, LPOVERLAPPED); +typedef void*(*PFN_GetStdHandle)(u32); +typedef u32(*PFN_GetLastError)(void); + +typedef i32(*PFN_SetConsoleMode)(void*, u32); +typedef i32(*PFN_ReadConsoleA)(void*, void*, u32, u32*, PCONSOLE_READCONSOLE_CONTROL); +typedef i32(*PFN_WriteConsoleA)(void*, const void*, u32, u32*, void*); + +typedef i32(*PFN_ReadProcessMemory)(void*, const void*, void*, size_t, size_t*); +typedef i32(*PFN_OutputDebugStringA)(const char*); +typedef i32(*PFN_ContinueDebugEvent)(u32, u32, u32); +typedef i32(*PFN_WaitForDebugEventEx)(LPDEBUG_EVENT, u32); + + +typedef i32(*PFN_CompareStringA)(u32, u32, const i8*, i32, const i8*, i32); +typedef i32(*PFN_WideCharToMultiByte)(u32, u32, const u16*, i32, i8*, i32, i8*, i32*); +typedef u32(*PFN_GetFinalPathNameByHandleA)(void*, i8*, u32, u32); + +typedef i32(*PFN_CloseHandle)(void*); + +typedef i32(*PFN_memset)(void*, void*, size_t, char); +typedef i32(*PFN_memcpy)(void*, void*, size_t); + +// ========================== +// ====== Funcs extern ====== +// ========================== +#define KERNEL32(name) \ + extern PFN_##name name; +#define KERNEL_BASE(name) \ + extern PFN_##name name; + +#include "funcs.h" + +#undef KERNEL_BASE +#undef KERNEL32 |