#pragma once #include "types.h" typedef u32 (*PTHREAD_START_ROUTINE)(void* lpThreadParameter); typedef PTHREAD_START_ROUTINE LPTHREAD_START_ROUTINE; #define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters // // Exception record definition. // typedef struct _EXCEPTION_RECORD { u32 ExceptionCode; u32 ExceptionFlags; struct _EXCEPTION_RECORD *ExceptionRecord; void* ExceptionAddress; u32 NumberParameters; u64* ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } EXCEPTION_RECORD; typedef EXCEPTION_RECORD *PEXCEPTION_RECORD; typedef struct _EXCEPTION_DEBUG_INFO { EXCEPTION_RECORD ExceptionRecord; u32 dwFirstChance; } EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; typedef struct _CREATE_THREAD_DEBUG_INFO { void* hThread; void* lpThreadLocalBase; LPTHREAD_START_ROUTINE lpStartAddress; } CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; typedef struct _CREATE_PROCESS_DEBUG_INFO { void* hFile; void* hProcess; void* hThread; void* lpBaseOfImage; u32 dwDebugInfoFileOffset; u32 nDebugInfoSize; void* lpThreadLocalBase; LPTHREAD_START_ROUTINE lpStartAddress; void* lpImageName; u16 fUnicode; } CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; typedef struct _EXIT_THREAD_DEBUG_INFO { u32 dwExitCode; } EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; typedef struct _EXIT_PROCESS_DEBUG_INFO { u32 dwExitCode; } EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; typedef struct _LOAD_DLL_DEBUG_INFO { void* hFile; void* lpBaseOfDll; u32 dwDebugInfoFileOffset; u32 nDebugInfoSize; void* lpImageName; u16 fUnicode; } LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; typedef struct _UNLOAD_DLL_DEBUG_INFO { void* lpBaseOfDll; } UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; typedef struct _OUTPUT_DEBUG_STRING_INFO { char* lpDebugStringData; u16 fUnicode; u16 nDebugStringLength; } OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; typedef struct _RIP_INFO { u32 dwError; u32 dwType; } RIP_INFO, *LPRIP_INFO; typedef struct _DEBUG_EVENT { u32 dwDebugEventCode; u32 dwProcessId; u32 dwThreadId; union { EXCEPTION_DEBUG_INFO Exception; CREATE_THREAD_DEBUG_INFO CreateThread; CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; EXIT_THREAD_DEBUG_INFO ExitThread; EXIT_PROCESS_DEBUG_INFO ExitProcess; LOAD_DLL_DEBUG_INFO LoadDll; UNLOAD_DLL_DEBUG_INFO UnloadDll; OUTPUT_DEBUG_STRING_INFO DebugString; RIP_INFO RipInfo; } u; } DEBUG_EVENT, *LPDEBUG_EVENT; typedef struct _CONSOLE_READCONSOLE_CONTROL { u32 nLength; u32 nInitialChars; u32 dwCtrlWakeupMask; u32 dwControlKeyState; } CONSOLE_READCONSOLE_CONTROL, *PCONSOLE_READCONSOLE_CONTROL; typedef struct _STARTUPINFOA { u32 cb; i8* lpReserved; i8* lpDesktop; i8* lpTitle; u32 dwX; u32 dwY; u32 dwXSize; u32 dwYSize; u32 dwXCountChars; u32 dwYCountChars; u32 dwFillAttribute; u32 dwFlags; u16 wShowWindow; u16 cbReserved2; u8* lpReserved2; void* hStdInput; void* hStdOutput; void* hStdError; } STARTUPINFOA, *LPSTARTUPINFOA; typedef struct _SECURITY_ATTRIBUTES { u32 nLength; void* lpSecurityDescriptor; i32 bInheritHandle; } SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; typedef struct _PROCESS_INFORMATION { void* hProcess; void* hThread; u32 dwProcessId; u32 dwThreadId; } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; typedef struct _OVERLAPPED { u32* Internal; u32* InternalHigh; union { struct { u32 Offset; u32 OffsetHigh; } DUMMYSTRUCTNAME; void* Pointer; } DUMMYUNIONNAME; void* hEvent; } OVERLAPPED, *LPOVERLAPPED; // // Define 128-bit 16-byte aligned xmm register type. // typedef struct __declspec(align(16)) _M128A { u64 Low; i64 High; } M128A, *PM128A; // // Format of data for (F)XSAVE/(F)XRSTOR instruction // typedef struct __declspec(align(16)) _XSAVE_FORMAT { u16 ControlWord; u16 StatusWord; u8 TagWord; u8 Reserved1; u16 ErrorOpcode; u32 ErrorOffset; u16 ErrorSelector; u16 Reserved2; u32 DataOffset; u16 DataSelector; u16 Reserved3; u32 MxCsr; u32 MxCsr_Mask; M128A FloatRegisters[8]; #if defined(_WIN64) M128A XmmRegisters[16]; u8 Reserved4[96]; #else M128A XmmRegisters[8]; BYTE Reserved4[224]; #endif } XSAVE_FORMAT, *PXSAVE_FORMAT; typedef XSAVE_FORMAT XMM_SAVE_AREA32, *PXMM_SAVE_AREA32; // // Context Frame // // This frame has a several purposes: 1) it is used as an argument to // NtContinue, 2) it is used to constuct a call frame for APC delivery, // and 3) it is used in the user level thread creation routines. // // // The flags field within this record controls the contents of a CONTEXT // record. // // If the context record is used as an input parameter, then for each // portion of the context record controlled by a flag whose value is // set, it is assumed that that portion of the context record contains // valid context. If the context record is being used to modify a threads // context, then only that portion of the threads context is modified. // // If the context record is used as an output parameter to capture the // context of a thread, then only those portions of the thread's context // corresponding to set flags will be returned. // // CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags. // // CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15. // // CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs. // // CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15. // // CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7. // typedef struct __declspec(align(16)) _CONTEXT { // // Register parameter home addresses. // // N.B. These fields are for convience - they could be used to extend the // context record in the future. // u64 P1Home; u64 P2Home; u64 P3Home; u64 P4Home; u64 P5Home; u64 P6Home; // // Control flags. // u32 ContextFlags; u32 MxCsr; // // Segment Registers and processor flags. // u16 SegCs; u16 SegDs; u16 SegEs; u16 SegFs; u16 SegGs; u16 SegSs; u32 EFlags; // // Debug registers // u64 Dr0; u64 Dr1; u64 Dr2; u64 Dr3; u64 Dr6; u64 Dr7; // // Integer registers. // u64 Rax; u64 Rcx; u64 Rdx; u64 Rbx; u64 Rsp; u64 Rbp; u64 Rsi; u64 Rdi; u64 R8; u64 R9; u64 R10; u64 R11; u64 R12; u64 R13; u64 R14; u64 R15; // // Program counter. // u64 Rip; // // Floating point state. // union { XMM_SAVE_AREA32 FltSave; struct { M128A Header[2]; M128A Legacy[8]; M128A Xmm0; M128A Xmm1; M128A Xmm2; M128A Xmm3; M128A Xmm4; M128A Xmm5; M128A Xmm6; M128A Xmm7; M128A Xmm8; M128A Xmm9; M128A Xmm10; M128A Xmm11; M128A Xmm12; M128A Xmm13; M128A Xmm14; M128A Xmm15; }; }; // // Vector registers. // M128A VectorRegister[26]; u64 VectorControl; // // Special debug control registers. // u64 DebugControl; u64 LastBranchToRip; u64 LastBranchFromRip; u64 LastExceptionToRip; u64 LastExceptionFromRip; } CONTEXT, *PCONTEXT; typedef PCONTEXT LPCONTEXT; // ======================= // ====== Funcs PFN ====== // ======================= typedef void*(*PFN_VirtualAlloc)(void*, u64, u32, u32); typedef i32(*PFN_VirtualFree)(void*, size_t, u32); typedef i32(*PFN_CreateProcessA)(const i8*, i8*, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, i32, u32, void*, const i8*, LPSTARTUPINFOA, LPPROCESS_INFORMATION); typedef void*(*PFN_OpenProcess)(u32, i32, u32); typedef i32(*PFN_TerminateProcess)(void*, u32); typedef void*(*PFN_OpenThread)(u32, i32, u32); typedef i32(*PFN_GetThreadContext)(void*, LPCONTEXT); typedef i32(*PFN_SetThreadContext)(void*, const CONTEXT*); typedef void*(*PFN_CreateFileA)(const i8*, u32, u32, LPSECURITY_ATTRIBUTES, u32, u32, void*); typedef i32(*PFN_ReadFile)(void*, void*, u32, u32*, LPOVERLAPPED); typedef u32(*PFN_SetFilePointer)(void*, i32, i32*, u32); typedef i32(*PFN_WriteFile)(void*, const void*, u32, u32*, LPOVERLAPPED); typedef void*(*PFN_GetStdHandle)(u32); typedef u32(*PFN_GetLastError)(void); typedef i32(*PFN_SetConsoleMode)(void*, u32); typedef i32(*PFN_ReadConsoleA)(void*, void*, u32, u32*, PCONSOLE_READCONSOLE_CONTROL); typedef i32(*PFN_WriteConsoleA)(void*, const void*, u32, u32*, void*); typedef i32(*PFN_ReadProcessMemory)(void*, const void*, void*, size_t, size_t*); typedef i32(*PFN_OutputDebugStringA)(const char*); typedef i32(*PFN_ContinueDebugEvent)(u32, u32, u32); typedef i32(*PFN_WaitForDebugEventEx)(LPDEBUG_EVENT, u32); typedef i32(*PFN_CompareStringA)(u32, u32, const i8*, i32, const i8*, i32); typedef i32(*PFN_WideCharToMultiByte)(u32, u32, const u16*, i32, i8*, i32, i8*, i32*); typedef u32(*PFN_GetFinalPathNameByHandleA)(void*, i8*, u32, u32); typedef i32(*PFN_CloseHandle)(void*); typedef i32(*PFN_memset)(void*, void*, size_t, char); typedef i32(*PFN_memcpy)(void*, void*, size_t); // ========================== // ====== Funcs extern ====== // ========================== #define KERNEL32(name) \ extern PFN_##name name; #define KERNEL_BASE(name) \ extern PFN_##name name; #include "funcs.h" #undef KERNEL_BASE #undef KERNEL32